@ljwei-stak/dsh-model-route-bot 0.64.0 → 0.66.0

package/packages/orchestration/src/bot-routing-service.mjs

@@ -17,16 +17,18 @@
 import { botRoutingCandidates, candidateMachineGrant, withMachineFact } from './bot-routing-candidates.mjs'
 import { routeBot } from './bot-routing.mjs'
 import { normalizeBotRouting, workerBinding } from './bot-routing-mode.mjs'
-import { dispatchRoutedTask, pinnedMachineRefusal, workerGrantFact, routedEffectClass } from './bot-routing-dispatch.mjs'
+import { assertPlanAccepted, dispatchRoutedTask, pinnedMachineRefusal, workerGrantFact, routedEffectClass } from './bot-routing-dispatch.mjs'
+import { canonicalTaskJson, taskRef } from './task-contract.mjs'
 import { createHash } from 'node:crypto'
 const fail = code => { const error = new Error(code); error.code = code; throw error }
+const submittedPlanId = (originBotId, requestKey) => `route_${createHash('sha256').update(`${originBotId}:${requestKey}`).digest('hex').slice(0, 48)}`
 
 /**
  * @param {{
  *   bots: () => Array<object>,
  *   settingsFor: (botId: string) => object | null,
  *   machineHealth?: (machineId: string) => { online?: boolean } | null,
- *   priceFor?: (route: object) => number | null,
+ *   priceFor?: (route: object, botId: string) => number | null,
  *   qualityFor?: (botId: string) => number | null,
  *   loadFor?: (botId: string) => number | null,
  *   busyFor?: (botId: string) => boolean,
@@ -36,9 +38,10 @@ const fail = code => { const error = new Error(code); error.code = code; throw e
  *   subjectFor?: (botId: string) => unknown,
  *   bindWorker?: (binding: object) => Promise<unknown> | unknown,
  *   newTaskId?: () => string,
+ *   readSubmittedPlan?: (originBotId: string, planId: string) => object | Promise<object>,
  * }} source
  */
-export function createBotRoutingService({ bots, settingsFor, machineHealth, priceFor, qualityFor, loadFor, busyFor, routing, mainBotIds = [], submitPlan = null, subjectFor = null, bindWorker = null, newTaskId = null, executionBackendFor = null, settle = null, deliver = null, onAccepted = null }) {
+export function createBotRoutingService({ bots, settingsFor, machineHealth, priceFor, qualityFor, loadFor, busyFor, routing, mainBotIds = [], submitPlan = null, subjectFor = null, bindWorker = null, newTaskId = null, readSubmittedPlan = null, executionBackendFor = null, settle = null, deliver = null, onAccepted = null }) {
   if (typeof bots !== 'function') fail('BOT_ROUTING_REQUIRES_BOTS')
   if (typeof settingsFor !== 'function') fail('BOT_ROUTING_REQUIRES_SETTINGS')
 
@@ -81,7 +84,7 @@ export function createBotRoutingService({ bots, settingsFor, machineHealth, pric
         quality: candidate.quality,
         busy: candidate.busy,
       }))
-      return { enabled: settings.enabled, preset: settings.preset, autoGrant: settings.autoGrant, candidates: rows }
+      return { enabled: settings.enabled, preset: settings.preset, autoGrant: settings.autoGrant, requesterBotId: readMainBotIds()[0] ?? null, candidates: rows }
     },
 
     /**
@@ -132,6 +135,27 @@ export function createBotRoutingService({ bots, settingsFor, machineHealth, pric
       }
     },
 
+    /** Owner-only observation: no candidate reads, grant changes, runner or routing switch needed. */
+    async submissionStatus(payload, context = {}) {
+      if (context?.kind !== 'owner') fail('REMOTE_OWNER_REQUIRED')
+      const value = JSON.parse(canonicalTaskJson(payload))
+      if (!value || Array.isArray(value) || Object.keys(value).some(key => !['requestKey', 'requesterBotId'].includes(key))) fail('INVALID_TASK_REQUEST')
+      const requestKey = taskRef(value.requestKey), originBotId = taskRef(value.requesterBotId)
+      if (typeof readSubmittedPlan !== 'function') fail('BOT_ROUTING_STATUS_UNAVAILABLE')
+      const planId = submittedPlanId(originBotId, requestKey)
+      let plan
+      try { plan = await readSubmittedPlan(originBotId, planId) }
+      catch (error) {
+        if (error?.code !== 'TASK_PLAN_NOT_FOUND') throw error
+        // This is a point-in-time read. An original request may still commit later.
+        return { found: false, planId, originBotId, planState: null, packages: [] }
+      }
+      if (plan?.planId !== planId || plan?.ownerBotId !== originBotId) fail('BOT_ROUTING_SUBMISSION_IDENTITY_MISMATCH')
+      const accepted = assertPlanAccepted(plan)
+      return { found: true, accepted: true, planId, originBotId, planState: accepted.state,
+        packages: accepted.packages.map(({ id, targetBotId, taskId, attemptId, operationId, state }) => ({ id, targetBotId, taskId, attemptId, operationId, state })) }
+    },
+
     /**
      * Dispatch for real. The Host injects plan submission and the subject directory; without them
      * this refuses, because a dispatch that cannot create a task must not look like one.
@@ -153,6 +177,7 @@ export function createBotRoutingService({ bots, settingsFor, machineHealth, pric
       if (!subjectFor(originBotId)) fail('ROUTING_SUBJECT_UNKNOWN')
       if (!owner && !readMainBotIds().includes(requesterBotId)) fail(`BOT_ROUTING_DISPATCH_DENIED:${requesterBotId}`)
       if (!owner && (typeof context.sessionId !== 'string' || context.sessionId === '')) fail('BOT_ROUTING_SESSION_REQUIRED')
+      if (payload.requestKey !== undefined && payload.requestKey !== '') taskRef(payload.requestKey)
       const needs = routingNeeds(payload)
       const decision = service.decide({ ...payload, needs, requesterBotId })
       if (!decision.chosen) fail(`BOT_ROUTING_NO_ELIGIBLE:${decision.rejected.map(row => row.reason).join(',') || 'none'}`)
@@ -184,7 +209,7 @@ export function createBotRoutingService({ bots, settingsFor, machineHealth, pric
         settle: typeof settle === 'function' ? report => settle(report, context) : null,
         deliver: typeof deliver === 'function' ? report => deliver(report, context) : null,
         newTaskId: typeof payload.requestKey === 'string' && payload.requestKey !== ''
-          ? () => `route_${createHash('sha256').update(`${originBotId}:${payload.requestKey}`).digest('hex').slice(0, 48)}`
+          ? () => submittedPlanId(originBotId, payload.requestKey)
           : typeof newTaskId === 'function' ? newTaskId : undefined,
       })
       if (typeof onAccepted === 'function') await onAccepted(report, context)

package/packages/orchestration/src/bot-routing.mjs

@@ -16,7 +16,7 @@
 export const BOT_ROUTING_PRESETS = Object.freeze(['economy', 'balanced', 'quality'])
 
 const fail = code => { const error = new Error(code); error.code = code; throw error }
-const finite = value => (typeof value === 'number' && Number.isFinite(value) ? value : null)
+const finite = (value, max = Infinity) => (typeof value === 'number' && Number.isFinite(value) && value >= 0 && value <= max ? value : null)
 const list = value => (Array.isArray(value) ? value : [])
 
 /** Hard requirements a Bot must satisfy before it is even scored. */
@@ -53,7 +53,7 @@ export const botRejection = (candidate, task = {}) => rejection(candidate, task)
 /** Lower is better. Unknown cost sorts after known cost but is never silently free. */
 function score(candidate, preset, maxPrice) {
   const price = finite(candidate.pricePerMTokUsd)
-  const quality = finite(candidate.quality)
+  const quality = finite(candidate.quality, 1)
   const load = finite(candidate.load) ?? 0
   // Cost is normalised against the most expensive eligible Bot, so one very expensive route
   // cannot swamp quality evidence: what matters is the ratio within this decision, not dollars.
@@ -91,9 +91,11 @@ export function routeBot({ task = {}, candidates = [], preset = 'balanced', limi
   const scored = []
   for (const candidate of eligible) {
     scored.push({ botId: candidate.botId, score: score(candidate, preset, maxPrice), model: candidate.model,
-      pricePerMTokUsd: finite(candidate.pricePerMTokUsd), quality: finite(candidate.quality) })
+      pricePerMTokUsd: finite(candidate.pricePerMTokUsd), quality: finite(candidate.quality, 1) })
   }
-  scored.sort((left, right) => left.score - right.score || String(left.botId).localeCompare(String(right.botId)))
+  scored.sort((left, right) => left.score - right.score
+    || Number(left.pricePerMTokUsd === null) - Number(right.pricePerMTokUsd === null)
+    || String(left.botId).localeCompare(String(right.botId)))
   const ranked = scored.slice(0, Math.max(1, limit))
   return {
     preset,

package/packages/orchestration/src/product-composition.mjs

@@ -27,6 +27,7 @@ import { openBotSettings } from './bot-settings.mjs'
 import { openFundingAccounts } from './funding-accounts.mjs'
 import { createModelAccounting } from './model-accounting.mjs'
 import { createTaskService } from './task-service.mjs'
+import { inspectProductTask, projectProductTask } from './task-product.mjs'
 import { createDesktopActions } from './desktop-actions.mjs'
 import { registerTaskTools } from './task-tools.mjs'
 import { createMrReadBackend } from './mr-read-backend.mjs'
@@ -63,6 +64,9 @@ const validPolicy = value => Boolean(value) && ['run', 'check', 'filterRoutes'].
 // instead of silently dropping every managed task.
 const TASK_RUNNER_TTL_MS = 10_000
 const TASK_RUNNER_CLAIM_MS = 12_000
+// Frequent enough that a stopped runner is rebuilt inside one lease period,
+// rare enough that a healthy Host only reads one row every five seconds.
+const TASK_RUNNER_WATCHDOG_MS = 5_000
 const TASK_TTL_MS = 120_000
 const TASK_BACKEND_LIMIT = 64
 const TASK_READ_LIMIT = 512
@@ -93,6 +97,17 @@ export function compileProductGrant(bot, { routes, hydrated }) {
     modelRoutes: hydrated && provider && model && routes.has(key) ? [{ provider, model }] : [] }
 }
 
+/**
+ * An action that is only meaningful for a signed-in person says so at its own
+ * entry. The authorization seam decides who may call, but a route that forgets to
+ * declare its caller class inherits whatever the seam defaults to, and a later
+ * change there would hand a non-owner somebody's console.
+ */
+const ownerOnly = fn => (payload, context) => {
+  if (context?.kind !== 'owner') throw Object.assign(new Error('OWNER_ONLY'), { code: 'OWNER_ONLY' })
+  return fn(payload, context)
+}
+
 /** Subscription usage is not API spend; missing token evidence stays unknown. */
 export function projectModelCallAmount(receipt, resolution = null) {
   if (resolution) return resolution.costUsd
@@ -343,19 +358,22 @@ export function startBotProduct(ctx, options = {}) {
       if (!taskService) throw new Error('TASK_SERVICE_UNAVAILABLE')
       return taskService.submitPlan(subject, request, caller)
     },
+    readSubmittedPlan: (originBotId, planId) => {
+      if (!journal) throw Object.assign(new Error('BOT_ROUTING_STATUS_UNAVAILABLE'), { code: 'BOT_ROUTING_STATUS_UNAVAILABLE' })
+      // Authenticated owner observation reads durable identities even if the Bot was paused.
+      return journal.getPlan(originBotId, planId)
+    },
     bindWorker: (binding, context) => commitWorkerBinding(binding, context),
     executionBackendFor: effect => effect === 'read' ? 'bot-turn-read' : 'bot-turn-write',
     onAccepted: report => turnBackends?.watchPlan(report),
     busyFor: botId => product?.rt.live?.get(product.rt.chatOf(botId))?.turn !== undefined,
-    priceFor: route => {
-      for (const bot of product?.lifecycle.committedBots() ?? []) {
-        const settings = routingSettingsFor(bot.id)
-        if (settings?.model?.provider === route.provider && settings.model.model === route.model) {
-          const price = settings.funding?.pricing
-          if (typeof price?.input === 'number' && typeof price.output === 'number') return (price.input + price.output) / 2
-        }
-      }
-      return null
+    priceFor: (route, botId) => {
+      // Funding prices belong to the Bot binding, even when another Bot uses the same model.
+      const settings = routingSettingsFor(botId)
+      if (settings?.model?.provider !== route.provider || settings.model.model !== route.model) return null
+      const price = settings.funding?.pricing
+      if (!Number.isFinite(price?.input) || price.input < 0 || !Number.isFinite(price?.output) || price.output < 0) return null
+      return (price.input + price.output) / 2
     },
   })
   ctx.provide('botRouting', botRouting)
@@ -384,7 +402,7 @@ export function startBotProduct(ctx, options = {}) {
 
   const grants = new Map()
   let machines, product, releaseMachineSecrets, funding, botSettings, fundingAccounts, modelAccounting, routingSettings, turnBackends, routineExecution, machineHeartbeat
-  let journal, taskService, taskBackends, releaseTaskTools, cliSessionFactory, remoteCliBackend, sharedAdmission
+  let journal, taskService, taskBackends, releaseTaskTools, cliSessionFactory, remoteCliBackend, sharedAdmission, taskRunnerWatchdog
   const committedBots = new Map()
   let ownerCatalogStamp=''
   let routes = new Set(), hydrated = false, refreshing = false, lastRefresh = 0, timer = null
@@ -623,7 +641,7 @@ export function startBotProduct(ctx, options = {}) {
           if (typeof factory !== 'function') throw new TypeError('TASK_CLI_SESSION_FACTORY_REQUIRED')
           cliSessionFactory = factory
         }
-        journal = funding.store.openTaskJournal()
+        journal = funding.store.openTaskJournal({leaseClock:'db'})
         const modelBackends = createTaskBackends({ ctx, mr, authority, directory, store: funding.store,
           machineId, workspaceId, workspace: managedWorkspace, runtimeRoot: join(managedRoot, 'cli-runtime'),
           bindingFor: botId => botSettings.get(botId, { publishChange: false }),
@@ -648,6 +666,13 @@ export function startBotProduct(ctx, options = {}) {
             return privateCall&&['private','handoff'].includes(plan.origin.kind)&&product?.lifecycle.committedMainBotIds().includes(id)?product.lifecycle.committedBots().map(bot=>bot.id):[id]
           },
           runnerTtlMs: TASK_RUNNER_TTL_MS, taskTtlMs: TASK_TTL_MS,
+          // Lease expiry reads the ledger's clock, not this process's: a Host
+          // whose wall clock drifted must not be able to declare its own live
+          // lease expired and let a second runner take the same tasks.
+          leaseClock: 'db',
+          // The deployment refuses a writer that cannot prove a stop, so a new
+          // backend cannot be added without also teaching it how to say so.
+          requireStopProof: true,
           // The committed binding's maxConcurrentTasks is the per-Bot limit; an
           // unconfigured Bot keeps the conservative single-task default.
           concurrencyFor: botId => {
@@ -665,6 +690,19 @@ export function startBotProduct(ctx, options = {}) {
             await new Promise(resolve => { const pending = setTimeout(resolve, 250); pending.unref() })
           }
         }
+        // A runner that stops (a lease lost to a clock jump, a journal write that
+        // never settled) must come back on its own, or the Host keeps accepting
+        // work nobody will claim. The watchdog reports what it did instead of
+        // hiding a permanent stop behind a quiet 5-second tick.
+        taskRunnerWatchdog = setInterval(() => {
+          try {
+            const state = taskService.state()
+            if (state.closed || state.running) return
+            const outcome = taskService.restart({ reason: state.stopReason ?? 'TASK_RUNNER_WATCHDOG' })
+            if (!outcome.accepted) ctx.logger?.('task-runner-restart-deferred', { code: outcome.code, reason: state.stopReason })
+          } catch (error) { ctx.logger?.('task-runner-watchdog-failed', { code: error?.code ?? 'TASK_RUNNER_WATCHDOG_FAILED' }) }
+        }, TASK_RUNNER_WATCHDOG_MS)
+        taskRunnerWatchdog.unref?.()
         releaseTaskTools = registerTaskTools(ctx, defineTool, { service: taskService, directory })
       }
       const machineActions=Object.fromEntries(['pair','bind','probe','revoke','reconcile'].map(name=>[`machine.${name}`,(payload,context)=>machines[name](payload,context)]))
@@ -729,22 +767,10 @@ export function startBotProduct(ctx, options = {}) {
           // same single authority; a section without a runner stays blocked.
           ...(taskService ? { tasks: async ({ runtime, signal }) => {
             signal?.throwIfAborted(); await runtime.load()
-            const items = []
-            for (const bot of Object.values(runtime.state?.bots ?? {})) {
-              for (const task of journal.list(bot.id)) {
-                if (items.length >= TASK_READ_LIMIT) break
-                items.push({ botId: task.ownerBotId, taskId: task.taskId, state: task.state, backend: task.input.backend,
-                  ...(task.planId?{planId:task.planId,logicalPackageId:task.logicalPackageId}:{}),
-                  location: task.input.target.location, machineId: task.input.target.machineId, workspaceId: task.input.target.workspaceId,
-                  createdAt: task.createdAt, updatedAt: task.updatedAt, deadlineAt: task.deadlineAt,
-                  attemptNumber: task.attemptNumber, operationId: task.operationId, attempts: task.attempts.length,
-                  legacyRunIds: task.legacyRunIds, result: task.result ? { code: task.result.code ?? task.result.summary?.code ?? null,
-                    ...(task.executionRef?.kind==='remote-operation'?{remote:{status:['succeeded','failed','cancelled','admitted','running','cancel_pending','unknown'].includes(task.result.summary?.status)?task.result.summary.status:'unknown',stopConfirmed:task.result.summary?.stopConfirmed===true,possiblyApplied:task.result.summary?.possiblyApplied!==false,...(/^[a-f0-9]{64}$/.test(task.result.summary?.sha256??'')?{sha256:task.result.summary.sha256}:{}),...(Number.isSafeInteger(task.result.summary?.bytes)?{bytes:task.result.summary.bytes}:{}),...(Number.isSafeInteger(task.result.summary?.exitCode)?{exitCode:task.result.summary.exitCode}:{}),...(task.result.summary?.notStarted===true?{notStarted:true}:{})}}:{}) } : null,
-                  reconciliation: task.reconciliation ? { at: task.reconciliation.at, outcome: task.reconciliation.outcome } : null })
-              }
-            }
+            const loaded = journal.productList(Object.values(runtime.state?.bots ?? {}).map(bot => bot.id), { limit: TASK_READ_LIMIT })
+            const items = loaded.items.map(projectProductTask)
             const plans=Object.values(runtime.state?.bots??{}).flatMap(bot=>journal.listPlans(bot.id))
-            return { status: 'available', items, plans, backends: taskBackends.catalog() }
+            return { status: 'available', items, total: loaded.total, truncated: loaded.truncated, plans, backends: taskBackends.catalog() }
           } } : {}),
           // N07: the usage projection reads the durable source receipts and the
           // funding totals from the single authority; an unknown amount stays
@@ -837,6 +863,7 @@ export function startBotProduct(ctx, options = {}) {
           // action. Registering it here is what makes the routing card work at runtime; the owner
           // RPC methods are a second door onto the same service.
           'botRoutingInspect': async () => ({ ...botRouting.inspect(), settingsRevision: routingSettings.get().revision }),
+          'botRouting.status': (payload, context) => botRouting.submissionStatus(payload, context),
           'botRouting.save': async (payload, context) => {
             const saved = routingSettings.save(payload, context)
             return { ...botRouting.inspect(), settingsRevision: saved.revision }
@@ -873,15 +900,20 @@ export function startBotProduct(ctx, options = {}) {
           // N09: owner task management runs on the owning Bot's own subject, so
           // the Bot's committed grant authorizes every cancel/retry/reconcile.
           ...(taskService ? {
+            // Task management is the person's own console, not a Bot surface. Every
+            // action here names its caller class instead of inheriting the default,
+            // so a change at the authorization seam cannot quietly hand a non-owner
+            // the ability to cancel, retry or reconcile somebody's work.
+            'task.inspect': ownerOnly(payload => inspectProductTask({ service: taskService, journal, subject: taskOwner(payload), taskId: payload?.taskId })),
             // Bot routing turns a preview into a real package: the decision names the Bot, the
             // worker binding is committed first, and only then is the plan submitted. A failure in
             // either step leaves no half-dispatched task behind.
             'botRouting.dispatch': (payload, context) => botRouting.dispatch(payload, context),
-            'task.plan.submit': payload => taskService.submitPlan(taskOwner(payload),{requestKey:payload?.requestKey,plan:payload?.plan},{owner:true}),
-            'task.plan.cancel': payload => taskService.cancelPlan(taskOwner(payload),{planId:payload?.planId}),
-            'task.cancel': payload => taskService.cancel(taskOwner(payload), { taskId: payload?.taskId }),
-            'task.retry': payload => taskService.retry(taskOwner(payload), { taskId: payload?.taskId, requestKey: payload?.requestKey }),
-            'task.reconcile': payload => taskService.reconcile(taskOwner(payload), { taskId: payload?.taskId, requestKey: payload?.requestKey }),
+            'task.plan.submit': ownerOnly(payload => taskService.submitPlan(taskOwner(payload),{requestKey:payload?.requestKey,plan:payload?.plan},{owner:true})),
+            'task.plan.cancel': ownerOnly(payload => taskService.cancelPlan(taskOwner(payload),{planId:payload?.planId})),
+            'task.cancel': ownerOnly(payload => taskService.cancel(taskOwner(payload), { taskId: payload?.taskId })),
+            'task.retry': ownerOnly(payload => taskService.retry(taskOwner(payload), { taskId: payload?.taskId, requestKey: payload?.requestKey })),
+            'task.reconcile': ownerOnly(payload => taskService.reconcile(taskOwner(payload), { taskId: payload?.taskId, requestKey: payload?.requestKey })),
           } : {}),
           // An unconfirmed receipt fail-closes its Bot until an owner resolves it:
           // attest the vendor-confirmed amount or waive it, with a required note.
@@ -912,6 +944,7 @@ export function startBotProduct(ctx, options = {}) {
       await routineExecution?.close?.()
       await machines?.closeDesktopSessions?.()
       for(const cleanup of [()=>product?.dispose(),()=>releaseMachineSecrets?.(),()=>releaseTaskTools?.(),()=>machines?.close(),()=>botSettings?.close(),()=>fundingAccounts?.close(),()=>modelAccounting?.close(),()=>routingSettings?.close()])try{cleanup()}catch{}
+      if(taskRunnerWatchdog)clearInterval(taskRunnerWatchdog)
       if(taskService)await taskService.close().catch(()=>{})
       else journal?.close()
       turnBackends?.close()
@@ -942,6 +975,7 @@ export function startBotProduct(ctx, options = {}) {
         await routineExecution?.close?.()
         await machines?.closeDesktopSessions?.()
         for(const cleanup of [()=>product?.dispose(),()=>releaseMachineSecrets?.(),()=>releaseTaskTools?.(),()=>machines?.close(),()=>botSettings?.close(),()=>fundingAccounts?.close(),()=>modelAccounting?.close(),()=>routingSettings?.close()])try{cleanup()}catch{}
+        if(taskRunnerWatchdog)clearInterval(taskRunnerWatchdog)
         if(taskService)await taskService.close().catch(()=>{})
         else journal?.close()
         turnBackends?.close()

package/packages/orchestration/src/sqlite-router-state.mjs

@@ -54,7 +54,31 @@ export async function openSqliteRouterState({Database,file,legacyFile,now=Date.n
     }
     try{const result=work();db.exec('COMMIT');return result}catch(e){db.exec('ROLLBACK');throw e}
   }
-  const write=(value,revision,fundingEpoch=epoch)=>{
+  // Rewrite only what changed. Every submit used to delete all rows and insert
+  // them again: with MAX_RUNS at 200 and synchronous=FULL that is 200 fsyncs of
+  // unchanged data on the hot path, which is also how a long write lock turns
+  // into a SQLITE_BUSY for the other Host.
+  const writeRuns=(runs,budgetReservations)=>{
+    const before=new Map(db.prepare('SELECT id,payload FROM router_runs').all().map(row=>[row.id,row.payload]))
+    const after=new Map(runs.map(run=>[run.id,serialize(run)]))
+    for(const [id,payload] of after)if(before.get(id)!==payload)db.prepare('INSERT INTO router_runs VALUES(?,?) ON CONFLICT(id) DO UPDATE SET payload=excluded.payload').run(id,payload)
+    for(const id of before.keys())if(!after.has(id))db.prepare('DELETE FROM router_runs WHERE id=?').run(id)
+    const heldBefore=new Map(db.prepare('SELECT id,payload FROM router_holds').all().map(row=>[row.id,row.payload]))
+    const heldAfter=new Map(Object.entries(budgetReservations).map(([id,hold])=>[id,serialize(hold)]))
+    for(const [id,payload] of heldAfter){
+      const existing=heldBefore.get(id)
+      if(existing===payload)continue
+      if(existing===undefined)db.prepare('INSERT INTO router_holds VALUES(?,?,?)').run(id,budgetReservations[id].runId,payload)
+      else db.prepare('UPDATE router_holds SET payload=? WHERE id=?').run(payload,id)
+    }
+    for(const id of heldBefore.keys())if(!heldAfter.has(id))db.prepare('DELETE FROM router_holds WHERE id=?').run(id)
+  }
+  const writeFull=(runs,budgetReservations)=>{
+    db.prepare('DELETE FROM router_holds').run();db.prepare('DELETE FROM router_runs').run()
+    for(const run of runs)db.prepare('INSERT INTO router_runs VALUES(?,?)').run(run.id,serialize(run))
+    for(const [id,hold] of Object.entries(budgetReservations))db.prepare('INSERT INTO router_holds VALUES(?,?,?)').run(id,hold.runId,serialize(hold))
+  }
+  const write=(value,revision,fundingEpoch=epoch,{fullWrite=false}={})=>{
     // Capture each run before MAX_RUNS retention folds it into the global archive.
     // These are projections, never a second monetary writer.
     funding.project(value,fundingEpoch)
@@ -62,9 +86,8 @@ export async function openSqliteRouterState({Database,file,legacyFile,now=Date.n
     const serialized=serialize(state)
     if(new Set(runs.map(run=>run.id)).size!==runs.length)fail('ROUTER_DUPLICATE_RUN_ID')
     if(Object.entries(budgetReservations).some(([id,hold])=>id!==hold.runId||!runs.some(run=>run.id===hold.runId)))fail('ROUTER_ORPHAN_RESERVATION')
-    db.prepare('DELETE FROM router_holds').run();db.prepare('DELETE FROM router_runs').run()
-    for(const run of runs)db.prepare('INSERT INTO router_runs VALUES(?,?)').run(run.id,serialize(run))
-    for(const [id,hold] of Object.entries(budgetReservations))db.prepare('INSERT INTO router_holds VALUES(?,?,?)').run(id,hold.runId,serialize(hold))
+    if(fullWrite)writeFull(runs,budgetReservations)
+    else writeRuns(runs,budgetReservations)
     db.prepare('INSERT INTO router_meta VALUES(1,2,?,?) ON CONFLICT(singleton) DO UPDATE SET revision=excluded.revision,payload=excluded.payload').run(revision,serialize(meta))
     db.prepare('INSERT INTO router_commits VALUES(?,?,?)').run(revision,now(),hash(serialized))
   }
@@ -136,7 +159,9 @@ export async function openSqliteRouterState({Database,file,legacyFile,now=Date.n
     funding.identity({id:receipt.runId,modelCall:{botId:receipt.botId,...(receipt.fundingScopeId?{fundingScopeId:receipt.fundingScopeId}:{}),...(receipt.fundingProjectId?{fundingProjectId:receipt.fundingProjectId}:{})}},epoch)
     db.prepare('INSERT INTO router_model_calls VALUES(?,?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET payload=excluded.payload').run(receipt.id,receipt.botId,receipt.taskId,receipt.runId,identity,serialize(receipt))
   }
-  const update=(change,{retrySafe=false,modelReceipt}={})=>{
+  // `fullWrite` is the diagnostic escape hatch: it forces the old delete-and-insert
+  // path, which the incremental writer is compared against in tests.
+  const update=(change,{retrySafe=false,modelReceipt,fullWrite=false}={})=>{
     const admission=currentTaskAdmission()
     if(modelReceipt)modelReceipt=normalizeModelReceipt(modelReceipt)
     const next=chain.then(async()=>{
@@ -151,7 +176,7 @@ export async function openSqliteRouterState({Database,file,legacyFile,now=Date.n
             if(modelReceipt&&result?.accepted!==false)applyReceipt(modelReceipt)
             const publish=prepareTaskAdmission(admission,db,candidate,result)
             if(publish)atomicStep('task-linked-before-money')
-            write(candidate,row.revision+1)
+            write(candidate,row.revision+1,undefined,{fullWrite})
             if(publish)atomicStep('money-written-before-commit')
             return publish
           })
@@ -195,9 +220,9 @@ export async function openSqliteRouterState({Database,file,legacyFile,now=Date.n
   }
   const activeAuthority=()=>{if(closed)fail('ROUTER_STORE_CLOSED');const m=migration();if(m?.phase!=='active'||m.id!==epoch)fail('ROUTER_AUTHORITY_INACTIVE')}
   return Object.freeze({...createRouterStateAPI({file,read,update,now}),kind:'sqlite-router-state',legacyFile,rollback,modelCalls,
-    openTaskJournal(){
+    openTaskJournal({leaseClock='app',writeDeadlineMs=10_000}={}){
       activeAuthority()
-      const journal=openTaskJournal(Database,file,{database:db,financialEpoch:()=>{activeAuthority();return epoch},onClose:()=>journals.delete(journal)})
+      const journal=openTaskJournal(Database,file,{database:db,leaseClock,writeDeadlineMs,financialEpoch:()=>{activeAuthority();return epoch},onClose:()=>journals.delete(journal)})
       journals.add(journal);return journal
     },
     async modelCall(botId,id){await chain;await checkMarker();const row=db.prepare('SELECT payload FROM router_model_calls WHERE bot_id=? AND id=?').get(botId,id);return row?JSON.parse(row.payload):null},

package/packages/orchestration/src/stop-proof.mjs

@@ -0,0 +1,37 @@
+/**
+ * Which task backends owe a stop proof, and which evidence each accepts.
+ *
+ * One truth for two readers: the journal decides whether a terminal attempt may
+ * keep a terminal state (`needsStopProof`), and the service refuses to register
+ * a side-effecting backend that nobody taught to prove itself. Keeping the list
+ * in one module is what stops a new backend from silently landing in the second
+ * set — the failure that turns a failed write into a silently repeated one.
+ *
+ * `remote-command` is on the list because a container command with a side effect
+ * is exactly what must not be retried on a guess; it was missing while its
+ * driver already produced `container-supervisor` evidence, which the journal did
+ * not accept either. Both halves are fixed here.
+ */
+
+const EVIDENCE = Object.freeze({
+  'codex-read': Object.freeze(['native-tree', 'cli-no-dispatch']),
+  'bot-turn-read': Object.freeze(['bot-turn-ended', 'bot-turn-not-sent']),
+  'bot-turn-write': Object.freeze(['bot-turn-ended', 'bot-turn-not-sent']),
+  'remote-write': Object.freeze(['agent-stop-receipt', 'agent-write-completed', 'remote-dispatch-not-sent']),
+  'remote-command': Object.freeze(['container-supervisor', 'remote-dispatch-not-sent']),
+})
+
+const IDS = Object.freeze(Object.keys(EVIDENCE))
+
+/** A frozen set so a caller cannot widen the requirement at run time. */
+export const STOP_PROOF_BACKENDS = Object.freeze(new Set(IDS))
+
+/** True when this backend id must present a stop proof before a terminal state stands. */
+export const requiresStopProof = (backend) => STOP_PROOF_BACKENDS.has(backend)
+
+/** The evidence strings this backend may cite, or null when it owes no proof. */
+export const stopProofEvidence = (backend) => EVIDENCE[backend] ?? null
+
+/** True for backends whose effects can land outside this process. */
+export const hasExternalEffect = (backend) =>
+  backend?.effect === 'workspace-write' || (backend?.location === 'remote' && backend?.effect !== 'read')

package/packages/orchestration/src/task-contract.mjs

@@ -48,10 +48,20 @@ export function parseTaskSubmit(value) {
   return {requestKey:v.requestKey,backend:v.backend,input:JSON.parse(canonicalTaskJson(v.input))}
 }
 
-const PLAN_KEYS = ['schemaVersion','taskId','origin','planRevision','packages']
+const PLAN_KEYS = ['schemaVersion','taskId','origin','initiator','planRevision','packages']
 const ORIGIN_KEYS = ['kind','botId','sessionId']
 const PACKAGE_KEYS = ['id','targetBotId','objective','dependsOn','acceptance','effectClass','execution']
-const ORIGIN_KINDS = new Set(['private','group'])
+// Where a plan came from. `handoff` is emitted by buildHandoff(bot-handoff.mjs)
+// and was missing here, so every Bot-to-Bot handoff died at the contract.
+const ORIGIN_KINDS = new Set(['private','group','handoff'])
+/**
+ * What started a run, as distinct from whose authority it carries. `origin` says
+ * which conversation a plan came from; this says whether anybody was there when
+ * it ran. A schedule or a delegation asserts a person's authority while nobody is
+ * watching, and the actor column alone can never tell those apart.
+ */
+export const INITIATOR_KINDS = new Set(['person','bot','routine','handoff','responsibility','memory'])
+const INITIATOR_KEYS = ['kind','id','origin']
 const EFFECT_CLASSES = new Set(['read','workspace-write'])
 const PLAN_PACKAGE_LIMIT = 32
 const PLAN_TEXT_LIMIT = 4_000
@@ -152,8 +162,10 @@ export function parseTaskPlan(value) {
     if (!Array.isArray(item.dependsOn) || item.dependsOn.length > PLAN_DEPENDENCY_LIMIT) throw new PolicyError('INVALID_TASK_PLAN')
     for (const dependency of item.dependsOn) taskRef(dependency)
   }
+  const initiator = planInitiator(plan)
   return { schemaVersion: 1, taskId: plan.taskId,
     origin: { kind: origin.kind, botId: origin.botId, sessionId: origin.sessionId ?? null },
+    initiator,
     planRevision: plan.planRevision,
     packages: plan.packages.map(item => ({ id: item.id, targetBotId: item.targetBotId, objective: item.objective,
       dependsOn: [...item.dependsOn], acceptance: [...item.acceptance], effectClass: item.effectClass,...(item.execution===undefined?{}:{execution:{backend:item.execution.backend,input:['bot-turn-read','bot-turn-write'].includes(item.execution.backend)?{task:item.execution.input.task,...(item.execution.input.machineId===undefined?{}:{machineId:item.execution.input.machineId}),...(item.execution.input.rootId===undefined?{}:{rootId:item.execution.input.rootId})}:item.execution.backend==='remote-write'?parseRemoteTaskWrite(item.execution.input):parseRemoteTaskCommand(item.execution.input)}}) })) }
@@ -207,6 +219,34 @@ export function validateTaskPlan(plan, { knownBots = null } = {}) {
   if (order.length !== plan.packages.length) throw new PolicyError('TASK_PLAN_CYCLE')
   return Object.freeze({ order: Object.freeze(order) })
 }
+/** Validate an explicit initiator: six kinds, an id where the kind needs one. */
+export function parseInitiator(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new PolicyError('INVALID_INITIATOR')
+  if (Object.keys(value).some((key) => !INITIATOR_KEYS.includes(key))) throw new PolicyError('INVALID_INITIATOR')
+  if (!INITIATOR_KINDS.has(value.kind)) throw new PolicyError('INVALID_INITIATOR')
+  if (value.kind === 'person') {
+    if (value.id !== undefined) throw new PolicyError('INVALID_INITIATOR')
+    return {kind: 'person'}
+  }
+  taskRef(value.id)
+  if (value.origin !== undefined) taskRef(value.origin)
+  // `origin` is the root of the chain, never the previous hop: a hop that names
+  // its sender as the origin makes a deep chain unattributable.
+  return {kind: value.kind, id: value.id, ...(value.origin ? {origin: value.origin} : {})}
+}
+
+/**
+ * The initiator a plan implies when it does not carry one. A person's own
+ * conversation is the only kind a plan can be assumed to have; a delegation
+ * knows its sender, so it names the origin Bot rather than a person.
+ */
+export function planInitiator(plan) {
+  if (plan?.initiator) return parseInitiator(plan.initiator)
+  const origin = plan?.origin
+  if (origin?.kind === 'handoff') return {kind: 'handoff', id: taskRef(origin.botId), origin: taskRef(origin.botId)}
+  return {kind: 'person'}
+}
+
 export function parseTaskReference(value) {
   const v = closed(value,['taskId'])
   return {taskId:taskRef(v.taskId)}