@memberjunction/task-graph 6.1.0-edge.2 → 6.1.0-edge.4

package/dist/TaskGraphDispatcher.js

@@ -18,15 +18,44 @@
  *
  * @module @memberjunction/task-graph
  */
-import { ComputeEligibleTasks, ComputeParentRollup, ComputeTasksToBlock, IsGraphStalled, ResolveExclusiveGroups, ComputeSkipCascade, LayoutGraphNodes, ApplyOutputMapping, BuildMappedInput, ResolveMappedInput, LoadAgentRunTree, SumAgentRunTreeCost, WalkAgentRunTree, } from '@memberjunction/ai-core-plus';
+import { ComputeEligibleTasks, ComputeParentRollup, ComputeTasksToBlock, IsGraphStalled, ResolveExclusiveGroups, ComputeSkipCascade, ConfirmSkipSeeds, LayoutGraphNodes, ApplyOutputMapping, BuildMappedInput, ResolveMappedInput, LoadAgentRunTree, SumAgentRunTreeCost, WalkAgentRunTree, } from '@memberjunction/ai-core-plus';
 import { LogError, LogStatus, RunView } from '@memberjunction/core';
 import { ShutdownRegistry, UUIDsEqual } from '@memberjunction/global';
-import { TaskClaimStore } from './TaskClaimStore.js';
+import { TaskClaimStore, TERMINAL_PARENT_STATUSES, TERMINAL_PARENT_STATUS_SQL } from './TaskClaimStore.js';
+import { BuildConditionContext, DecideGate, IsBrokenGuard, ParseConditionOutput, } from './condition-gate.js';
+import { HumanTaskSQL, IsHumanTask } from './task-predicates.js';
+import { IsSettlementExpired, IsSubmittingRunReady, SelectUnsettledGraphIDs, SweepCutoff, UNSETTLED_SWEEP_WINDOW_HOURS, UNSETTLED_STARTUP_WINDOW_HOURS, } from './settlement-rescue.js';
 import { DispatcherConditionEvaluator } from './DispatcherConditionEvaluator.js';
+import { DecideClaimGate, OverrideVerdictFor, ParseTaskGraphDebugState, } from './debug-state.js';
 import { RunForEachLoop, RunWhileLoop } from './TaskLoopExecutor.js';
+import { RegisterTaskGraphKick } from './task-graph-kick.js';
 import { NotificationEngine } from '@memberjunction/notifications';
 /** Metadata-seeded notification type for human tasks (metadata/notifications/.task-assignment-type.json). */
 const HUMAN_TASK_NOTIFICATION_TYPE = 'Task Assignment';
+/**
+ * Statuses a graph parent has stopped moving from.
+ *
+ * Shared by the guarded terminal write and the unsettled-graph sweep, so "terminal" means exactly
+ * one thing in both — the two disagreeing is how a graph becomes invisible to the machinery that is
+ * supposed to rescue it.
+ */
+const TERMINAL_TASK_STATUSES = new Set(TERMINAL_PARENT_STATUSES);
+/**
+ * How long `Stop()` waits for in-flight tasks and timer passes before giving up and saying so.
+ *
+ * Generous, because the alternative to waiting is a dispatcher that writes after its host believes
+ * it has shut down — settling graphs onto a connection somebody else now owns.
+ */
+const STOP_DRAIN_TIMEOUT_MS = 30_000;
+/**
+ * How many consecutive failing passes a graph gets before this instance stops re-queueing it.
+ *
+ * Not a giving-up threshold so much as a stop-shouting one: past this the graph has failed to settle
+ * on every attempt for minutes, so something is wrong that another identical attempt will not fix,
+ * and continuing costs a full graph load per poll forever. It is reported and left to the startup
+ * sweep, which is the wider net.
+ */
+const MAX_SETTLEMENT_RETRY_PASSES = 20;
 /**
  * Written to a human task's `ClaimedBy` once its assignee has been told it is ready.
  *
@@ -47,7 +76,7 @@ function asRunQueryProvider(provider) {
     const candidate = provider;
     return typeof candidate.RunQuery === 'function' ? candidate : undefined;
 }
-import { IsReinvokeCapReached, MAX_REINVOKE_DEPTH, ParseTaskGraphParentMetadata } from './TaskGraphService.js';
+import { IsReinvokeCapReached, MAX_REINVOKE_DEPTH, ParseTaskGraphParentMetadata, TASK_TYPE_NAME } from './TaskGraphService.js';
 import { DEFAULT_DISPATCHER_CONFIG, } from './types.js';
 /**
  * Renders a loop's bindings as template values.
@@ -132,16 +161,9 @@ function deepMergePayload(base, incoming) {
     }
     return out;
 }
-/**
- * Statuses at which an origin's outgoing conditions may be decided.
- *
- * `Skipped` is included: a branch that was not taken IS settled, and a condition on an edge leaving
- * it should resolve rather than hang the graph forever.
- */
-const TERMINAL_FOR_CONDITIONS = new Set([
-    'Complete', 'Failed', 'Cancelled', 'Skipped',
-]);
 export class TaskGraphDispatcher {
+    /** Minimum interval between `NodeProgress` frames for one task. */
+    static { this.NODE_PROGRESS_MIN_INTERVAL_MS = 1_000; }
     constructor(providerFactory, agentRunner, contextUser, config, 
     /**
      * Optional. Absent means a host that cannot post messages or start agent turns — a worker,
@@ -171,24 +193,90 @@ export class TaskGraphDispatcher {
         this.observer = observer;
         this.actionRunner = actionRunner;
         this.promptRunner = promptRunner;
+        /**
+         * Edges already reported as unevaluable, so the report is once per transition and not once per
+         * poll. Per-instance and in-memory by design: a restart re-reports, which is the right amount of
+         * noise for a condition that is still broken after a restart.
+         */
+        this.reportedUnevaluableConditions = new Set();
+        /** Resolved once it EXISTS; null while it does not, so a fresh install is not cached blind. */
+        this.cachedWorkflowTaskTypeID = null;
+        /**
+         * Graphs this instance is still trying to settle, with how many passes it has spent trying.
+         *
+         * **The sweep's window is on `__mj_UpdatedAt`, and a failing pass writes nothing** — the terminal
+         * write returns rowcount 0 because the row is already terminal, the layout pass touches only
+         * children, a refused CAS writes nothing at all. So a graph that fails to settle stops advancing
+         * its own timestamp and, after 24h of futile retries, ages out of the steady-state window while
+         * the process is up. The doc comment claimed the bound was "on abandonment, not age"; for this
+         * case it was on age, and R2-2's deferral made the case ordinary rather than exotic.
+         *
+         * In memory rather than a touch column because the alternative is a write on every failed
+         * attempt — more load exactly when something is already wrong — and because a restart is covered
+         * by the wide startup sweep, which is the durable backstop this leans on.
+         */
+        this.retryingSettlement = new Map();
+        /**
+         * Graphs whose settled-branch ANNOUNCEMENTS have already been made by this process.
+         *
+         * Re-entry is the point of the rescue, but only the parts that failed should repeat. Layout and
+         * the `GraphSettled` frame are idempotent facts about a finished graph, so a graph stuck in
+         * retry was re-persisting geometry and re-emitting the same frame every poll — for the whole
+         * 24h window, for as long as it kept failing.
+         */
+        this.announcedSettlements = new Set();
+        /** Graphs already reported as settled-but-undeliverable by this instance. */
+        this.reportedUndeliverable = new Set();
+        /** Live claim heartbeats by task ID, so the drain can silence the ones it gives up waiting for. */
+        this.heartbeats = new Map();
+        /** Latched once the drain has given up waiting, so a late arrival does not re-register. */
+        this.heartbeatsPurged = false;
         this.running = false;
         this.pollTimer = null;
         this.reconcileTimer = null;
+        this.unregisterKick = null;
         /** Tasks this instance is currently executing — bounds concurrency and drives heartbeats. */
         this.inFlight = new Set();
         /** Guards against a slow poll overlapping the next tick. */
         this.polling = false;
         /**
-         * The poll pass currently running, so `Stop` can wait for it.
+         * Timer-driven passes currently running — poll and reconcile alike.
          *
-         * `clearInterval` cannot cancel a tick that has already fired, and a pass is a long sequence of
-         * awaits (provider, rollup, claim query) — so without this, `Stop` returns while a pass is still
-         * mid-flight and about to claim. Its tasks then land in `inFlight` AFTER the drain loop already
-         * saw an empty set, which is precisely the state the drain exists to prevent.
+         * A counter rather than a boolean because the two timers overlap by design, and `Stop()` has to
+         * wait for BOTH. Neither pass is held by anything else: they are launched `void`-ed from
+         * `setInterval`, so without this they are unobservable from the outside and a stopped dispatcher
+         * keeps writing.
          */
-        this.pollPass = null;
+        this.activePasses = 0;
         /** Graph → owning user, from the parent's durable metadata. Ownership never changes, so this never goes stale. */
         this.ownerByParentID = new Map();
+        /** Monotonic pass counter for `PassCompleted` frames, so a viewer can order and gap-detect ticks. */
+        this.passCounter = 0;
+        /**
+         * Debug state per graph, cached for ONE pass. `pollOnce` clears it at entry, so within a pass
+         * the claim filter and the propagation loop read the same state (loading it twice could see a
+         * pause land between them and gate half a pass), and across passes a control verb written by any
+         * instance is picked up within one poll interval.
+         */
+        this.debugStateByGraph = new Map();
+        /**
+         * The pause state last announced per graph, so `GraphPaused`/`GraphResumed` are emitted on the
+         * TRANSITION rather than every pass — the verbs write durable state, not events, and it is this
+         * instance's job to notice the change and say so exactly once.
+         */
+        this.announcedPaused = new Map();
+        /**
+         * The verdict last emitted per gating edge. `GateDecision` frames announce CHANGES: edges are
+         * re-resolved every pass, and an unconditional emission would repeat every few seconds for as
+         * long as the graph lives — the frame-topic version of the log flood
+         * `logUnevaluableConditionOnce` exists to prevent.
+         *
+         * Nested by graph so a settled run's entries go in one delete. Flat per-edge maps in a process
+         * that runs for weeks are a slow leak with no upper bound but the table's size.
+         */
+        this.emittedGateVerdicts = new Map();
+        /** Last `NodeProgress` emission per task, for rate limiting chatty runners. Nested by graph. */
+        this.nodeProgressLastEmit = new Map();
         /** Name shown in the shutdown drain log. */
         this.ShutdownName = 'TaskGraphDispatcher';
         this.config = { ...DEFAULT_DISPATCHER_CONFIG, ...config };
@@ -212,6 +300,37 @@ export class TaskGraphDispatcher {
             LogError(`[TaskGraphDispatcher] Observer threw on ${frame.Kind} (ignored): ${e instanceof Error ? e.message : String(e)}`);
         }
     }
+    /**
+     * A progress sink for one task's runner, rate-limited into `NodeProgress` frames.
+     *
+     * Rate-limited HERE rather than asking every runner to be polite, for the same reason `emit`
+     * swallows observer throws in one place: a chatty runner (an agent streaming token-level
+     * updates) must not be able to flood the topic, and the limit belongs to the announcement, not
+     * the work. A 100% report always passes — the terminal update is the one a viewer must not lose.
+     */
+    nodeProgressEmitter(graphID, ownerUserID, taskID, taskName) {
+        return (message, percent) => {
+            const now = Date.now();
+            let perTask = this.nodeProgressLastEmit.get(graphID);
+            if (!perTask) {
+                perTask = new Map();
+                this.nodeProgressLastEmit.set(graphID, perTask);
+            }
+            const last = perTask.get(taskID) ?? 0;
+            if (percent !== 100 && now - last < TaskGraphDispatcher.NODE_PROGRESS_MIN_INTERVAL_MS)
+                return;
+            perTask.set(taskID, now);
+            this.emit({
+                Kind: 'NodeProgress',
+                ParentTaskID: graphID,
+                OwnerUserID: ownerUserID,
+                TaskID: taskID,
+                TaskName: taskName,
+                ProgressMessage: message,
+                ProgressPercent: percent,
+            });
+        };
+    }
     /**
      * Who a graph belongs to, memoized for the process's lifetime.
      *
@@ -230,18 +349,106 @@ export class TaskGraphDispatcher {
         const cached = this.ownerByParentID.get(parentTaskID);
         if (cached !== undefined)
             return cached;
-        let owner = null;
         try {
             const parent = await provider.GetEntityObject('MJ: Tasks', this.contextUser);
-            if (await parent.Load(parentTaskID)) {
-                owner = this.readParentMetadata(parent).submittedByUserID ?? null;
+            if (!(await parent.Load(parentTaskID))) {
+                // NOT CACHED (C1). A failed load is not an answer, and caching it as one is
+                // permanent for the life of the process: the delivery filter fails closed on a null
+                // owner, so every frame for this graph reaches nobody until a restart. One
+                // transient blip, and a viewer watches a workflow that never appears to move.
+                LogError(`[TaskGraphDispatcher] Could not load graph ${parentTaskID} to resolve its owner; frames for it are unaddressed this pass.`);
+                return null;
             }
+            const owner = this.readParentMetadata(parent).submittedByUserID ?? null;
+            // A successfully-read graph with no owner IS an answer — a scheduled or remote-triggered
+            // graph legitimately has none — so that one caches.
+            this.ownerByParentID.set(parentTaskID, owner);
+            return owner;
         }
         catch (e) {
             LogError(`[TaskGraphDispatcher] Could not resolve owner for graph ${parentTaskID}: ${e instanceof Error ? e.message : String(e)}`);
+            return null;
         }
-        this.ownerByParentID.set(parentTaskID, owner);
-        return owner;
+    }
+    /**
+     * A graph's debug state, cached for the current pass.
+     *
+     * Read fresh (BypassCache) because the state is written by direct `JSON_MODIFY` statements that
+     * fire no cache invalidation — the same reason every row read in this class bypasses the cache.
+     */
+    async readDebugState(provider, parentTaskID) {
+        const cached = this.debugStateByGraph.get(parentTaskID);
+        if (cached !== undefined)
+            return cached;
+        await this.primeDebugStates(provider, [parentTaskID]);
+        return this.debugStateByGraph.get(parentTaskID) ?? {};
+    }
+    /**
+     * Reads the debug bag for a set of graphs in ONE query, priming the per-pass cache.
+     *
+     * Batched because both loops in a pass — propagation and claiming — walk every active graph, so
+     * a per-graph read made observability cost scale with the number of live workflows on a path
+     * that is meant to be flat. One `ID IN (…)` per pass costs the same whether a server is running
+     * one workflow or fifty.
+     *
+     * Already-cached graphs are skipped, so calling this from both loops is free the second time.
+     */
+    async primeDebugStates(provider, parentTaskIDs) {
+        const missing = parentTaskIDs.filter((id) => !this.debugStateByGraph.has(id));
+        if (missing.length === 0)
+            return;
+        try {
+            const idList = missing.map((id) => `'${id}'`).join(',');
+            const rows = await RunView.FromMetadataProvider(provider).RunView({
+                EntityName: 'MJ: Tasks',
+                ExtraFilter: `ID IN (${idList})`,
+                Fields: ['ID', 'InputPayload'],
+                ResultType: 'simple',
+                // The bag is written by direct JSON_MODIFY statements, which fire no cache
+                // invalidation — a cached read here would gate on state a verb already changed.
+                BypassCache: true,
+            }, this.contextUser);
+            const byID = new Map((rows.Success ? rows.Results ?? [] : []).map((r) => [r.ID, r.InputPayload]));
+            for (const id of missing) {
+                this.debugStateByGraph.set(id, ParseTaskGraphDebugState(byID.get(id) ?? null));
+            }
+        }
+        catch (e) {
+            // "Not being debugged" is the safe reading of "could not read": gating real work on a
+            // transient read failure would turn a database hiccup into a paused workflow. Cached as
+            // empty for this pass only, so the next pass tries again.
+            LogError(`[TaskGraphDispatcher] Could not read debug state for ${missing.length} graph(s): ${e instanceof Error ? e.message : String(e)}`);
+            for (const id of missing)
+                this.debugStateByGraph.set(id, {});
+        }
+    }
+    /**
+     * Announces a graph's pause-state TRANSITION, once, whichever instance notices first in its own
+     * frame stream.
+     *
+     * Per-instance dedup rather than a CAS: frames are advisory commentary, and a viewer receiving
+     * the transition from two instances is a duplicate line, not a duplicate execution — the price
+     * of a cross-instance guard here would be a write on every pass for a purely cosmetic guarantee.
+     */
+    async announcePauseTransition(provider, parentTaskID, debug) {
+        const paused = debug.paused === true;
+        const previous = this.announcedPaused.get(parentTaskID);
+        if (previous === paused)
+            return;
+        this.announcedPaused.set(parentTaskID, paused);
+        // First sighting of an unpaused graph needs no announcement — "running" is the default a
+        // viewer already assumes; only a transition is information.
+        if (previous === undefined && !paused)
+            return;
+        this.emit({
+            Kind: paused ? 'GraphPaused' : 'GraphResumed',
+            ParentTaskID: parentTaskID,
+            OwnerUserID: await this.resolveOwner(provider, parentTaskID),
+            TaskID: debug.pausedAtTaskID ?? undefined,
+            Reason: paused
+                ? (debug.pausedReason === 'breakpoint' ? 'breakpoint' : 'paused by user')
+                : 'resumed',
+        });
     }
     /**
      * Begins dispatching.
@@ -260,11 +467,72 @@ export class TaskGraphDispatcher {
         ShutdownRegistry.Instance.Register(this);
         LogStatus(`[TaskGraphDispatcher] Starting as instance '${this.config.InstanceID}'.`);
         await this.Reconcile();
-        this.pollTimer = setInterval(() => { this.pollPass = this.pollOnce(); }, this.config.PollIntervalSeconds * 1000);
-        this.reconcileTimer = setInterval(() => { void this.Reconcile(); }, this.config.ReconciliationIntervalSeconds * 1000);
+        // One wide pass over graphs that reached terminal without settling, mirroring what claim
+        // reconciliation above already does for tasks. The realistic producer of a >24h-stale
+        // unsettled graph is this process having been DOWN — an outage, a long deploy — which the
+        // steady-state window cannot see and which would otherwise leave those runs parked forever.
+        // Counted as a pass (R2-13). It settles graphs, delivers continuations and can start fresh
+        // reinvoke turns, and it runs AFTER this instance registers for shutdown — so a `Stop()`
+        // landing during it used to return immediately while the sweep carried on doing all of that
+        // against a host that believed the dispatcher had stopped.
+        this.activePasses++;
+        try {
+            await this.sweepUnsettledGraphs(UNSETTLED_STARTUP_WINDOW_HOURS);
+        }
+        finally {
+            this.activePasses--;
+        }
+        // A `Stop()` LANDING DURING THE BOOT AWAITS MUST NOT BE UNDONE HERE (R3-4).
+        //
+        // Everything above this line is awaited — reconciliation and the counted startup sweep,
+        // which R2-13's own fix makes `Stop()` wait out. So a host that shuts down during boot
+        // drains correctly, logs "Stopped.", and returns with both timer fields null — and then
+        // this continuation ran anyway and installed both timers on the stopped instance.
+        //
+        // `pollOnce` was inert (its own `running` guard), but `Reconcile` had no such guard: it
+        // minted a provider and ran `ReleaseExpiredClaims` — a real UPDATE returning tasks to
+        // Pending — every two minutes forever, against a pool the host may have torn down. Nothing
+        // would ever call `Stop()` again, since `ShutdownRegistry.ShutdownAll` clears its items
+        // after one pass, and the intervals pinned the event loop so the process could not exit.
+        if (!this.running) {
+            LogStatus(`[TaskGraphDispatcher] Stopped during startup; not installing timers.`);
+            return;
+        }
+        this.pollTimer = setInterval(() => { void this.pollOnce(); }, this.config.PollIntervalSeconds * 1000);
+        this.unregisterKick = RegisterTaskGraphKick(() => { this.Kick(); });
+        // Do not wait a full interval for work that already exists (or is about to be submitted).
+        this.Kick();
+        this.reconcileTimer = setInterval(
+        // Guarded HERE rather than inside `Reconcile` (R3-4). The defect is a stopped
+        // instance's TIMER executing `ReleaseExpiredClaims` — a real UPDATE — forever; the
+        // public method itself stays callable, because reconciling on demand before starting is
+        // a legitimate use (IT74's crash-recovery check does exactly that) and a guard there
+        // would silently no-op it, which is the class of failure this whole effort is about.
+        () => { if (this.running)
+            void this.Reconcile(); }, this.config.ReconciliationIntervalSeconds * 1000);
+        // Belt and suspenders: `Stop()` remains the real teardown, but an un-`unref`'d interval
+        // keeps the event loop alive on its own, so a leaked instance can prevent process exit.
+        this.pollTimer.unref?.();
+        this.reconcileTimer.unref?.();
     }
     /**
-     * Stops accepting new work and waits for in-flight tasks to finish.
+     * Stops accepting new work and waits for everything already started to finish.
+     *
+     * **"Everything" includes the timer passes, and that is the fix.** This waited only on
+     * `inFlight` — the task executions — while a poll pass is a `void`-ed promise nothing held. So
+     * `Stop()` returned while a pass was mid-flight, and that pass went on to settle graphs, emit
+     * lifecycle frames and CLAIM NEW TASKS afterwards. Three consequences, all of them quiet:
+     *
+     *  - a `GraphSettled` frame arrived after every subscriber had gone, so the settlement was
+     *    invisible to exactly the viewer watching for it;
+     *  - a process shutting down claimed work it was about to abandon, leaving claims to expire —
+     *    the orphaned-claim state reconciliation exists to clean up, manufactured by the shutdown;
+     *  - the host reused the connection the moment `Stop()` resolved, and the still-running pass's
+     *    statements collided with it (`Requests can only be made in the LoggedIn state`).
+     *
+     * A pass is bookkeeping for work that already happened, so it is DRAINED rather than cancelled:
+     * abandoning one halfway is the crash window the unsettled sweep exists to rescue, and choosing
+     * to open it on every clean shutdown would be perverse.
      *
      * Deliberately does NOT release claims on the way out: an abandoned claim expires on its own,
      * and releasing eagerly would hand a still-running task to another instance mid-execution.
@@ -272,6 +540,8 @@ export class TaskGraphDispatcher {
      */
     async Stop() {
         this.running = false;
+        this.unregisterKick?.();
+        this.unregisterKick = null;
         if (this.pollTimer) {
             clearInterval(this.pollTimer);
             this.pollTimer = null;
@@ -280,20 +550,35 @@ export class TaskGraphDispatcher {
             clearInterval(this.reconcileTimer);
             this.reconcileTimer = null;
         }
-        // Drain the poll pass BEFORE the task drain below, not after: a pass still running has not
-        // necessarily claimed anything yet, so `inFlight` can be empty while work is moments from
-        // starting. Clearing `running` above stops that pass claiming anything further; this waits
-        // for it to notice. Its own failures are already logged inside `pollOnce`.
-        if (this.pollPass) {
-            await this.pollPass.catch(() => undefined);
-            this.pollPass = null;
-        }
-        const deadline = Date.now() + 30_000;
-        while (this.inFlight.size > 0 && Date.now() < deadline) {
-            await new Promise((r) => setTimeout(r, 250));
+        // Short poll interval: a pass is usually milliseconds from done, and the old 250ms granularity
+        // was most of the cost of stopping a dispatcher that had nothing left to do.
+        const deadline = Date.now() + STOP_DRAIN_TIMEOUT_MS;
+        while ((this.activePasses > 0 || this.inFlight.size > 0) && Date.now() < deadline) {
+            await new Promise((r) => setTimeout(r, 25));
         }
         if (this.inFlight.size > 0) {
-            LogError(`[TaskGraphDispatcher] Stopped with ${this.inFlight.size} task(s) still in flight; their claims will expire.`);
+            // The promise in this message was FALSE while the process lived (R2-13): each in-flight
+            // task heartbeats its own claim on its own timer, so an over-drain task renewed its lease
+            // indefinitely and the claim never expired — reconciliation could not reclaim the work,
+            // and the host's shutdown was waiting on something that had stopped being reclaimable.
+            // Stopping the heartbeats makes the sentence true. The task itself keeps running; its
+            // completion write is guarded on still owning the claim, so if another instance reclaims
+            // the task in the meantime, the abandoned executor's result is refused rather than raced.
+            // Latched, because the purge RACES the registration it is purging (C5). A task stalled
+            // in its two pre-heartbeat awaits — creating a provider, loading the row — registers
+            // AFTER this line and would renew its claim for the rest of the process's life, which is
+            // exactly the state the drain timeout means to end, under exactly the database duress
+            // that causes drain timeouts in the first place.
+            this.heartbeatsPurged = true;
+            for (const stop of this.heartbeats.values())
+                clearInterval(stop);
+            this.heartbeats.clear();
+            LogError(`[TaskGraphDispatcher] Stopped with ${this.inFlight.size} task(s) still in flight; their claims will now expire.`);
+        }
+        if (this.activePasses > 0) {
+            // Loud, because from here on this instance writes to a database the host believes it has
+            // finished with — the precise shape that produced connection-state errors downstream.
+            LogError(`[TaskGraphDispatcher] Stopped with ${this.activePasses} pass(es) still running; their writes may land after shutdown.`);
         }
         LogStatus(`[TaskGraphDispatcher] Stopped.`);
     }
@@ -309,6 +594,51 @@ export class TaskGraphDispatcher {
      * that shape indicates tampering or a bug and Record Changes already carries the audit trail.
      */
     async Reconcile() {
+        this.activePasses++;
+        try {
+            await this.reconcileOnce();
+        }
+        finally {
+            this.activePasses--;
+        }
+    }
+    /**
+     * Announces expired claims the sweep just released, so a viewer watching the graph sees "the
+     * step's worker vanished and the engine requeued it" as it happens.
+     *
+     * Best-effort by contract: the release already succeeded and is the durable truth; a frame that
+     * cannot be addressed (row unloadable, no parent) is dropped, never retried.
+     */
+    async announceReclaims(provider, released) {
+        if (!this.observer || released.length === 0)
+            return;
+        try {
+            const idList = released.map((r) => `'${r.TaskID}'`).join(',');
+            const rows = await RunView.FromMetadataProvider(provider).RunView({
+                EntityName: 'MJ: Tasks',
+                ExtraFilter: `ID IN (${idList})`,
+                Fields: ['ID', 'ParentID', 'Name'],
+                ResultType: 'simple',
+                BypassCache: true,
+            }, this.contextUser);
+            for (const row of (rows.Success ? rows.Results : []) ?? []) {
+                const graphID = row.ParentID ?? row.ID;
+                this.emit({
+                    Kind: 'ClaimChanged',
+                    ParentTaskID: graphID,
+                    OwnerUserID: await this.resolveOwner(provider, graphID),
+                    TaskID: row.ID,
+                    TaskName: row.Name,
+                    ClaimEvent: 'reclaimed',
+                });
+            }
+        }
+        catch (e) {
+            LogError(`[TaskGraphDispatcher] Could not announce reclaimed task(s) (ignored): ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    /** The reconciliation body. Wrapped by {@link Reconcile} so `Stop()` can drain it. */
+    async reconcileOnce() {
         let provider = null;
         try {
             provider = await this.providerFactory.CreateProvider();
@@ -318,11 +648,21 @@ export class TaskGraphDispatcher {
                 LogStatus(`[TaskGraphDispatcher] Reconciliation: ${released.length} expired claim(s) released, ` +
                     `${orphaned.length} orphaned task(s) reported.`);
             }
+            await this.announceReclaims(provider, released);
         }
         catch (e) {
             LogError(`[TaskGraphDispatcher] Reconciliation failed: ${e instanceof Error ? e.message : String(e)}`);
         }
     }
+    /**
+     * Run a pass now instead of waiting for the next poll tick.
+     *
+     * Submit calls this (via {@link KickTaskGraphDispatchers}) so a just-written graph is claimed
+     * in milliseconds rather than up to {@link TaskGraphDispatcherConfig.PollIntervalSeconds}.
+     */
+    Kick() {
+        void this.pollOnce();
+    }
     /**
      * One dispatch pass: find claimable work, claim what fits under the concurrency cap, execute.
      *
@@ -332,10 +672,11 @@ export class TaskGraphDispatcher {
     async pollOnce() {
         if (!this.running || this.polling)
             return;
-        const capacity = this.config.MaxConcurrentTasks - this.inFlight.size;
-        if (capacity <= 0)
-            return;
         this.polling = true;
+        this.activePasses++;
+        // One pass, one read of each graph's debug state — see `readDebugState`.
+        this.debugStateByGraph.clear();
+        const passNumber = ++this.passCounter;
         try {
             const provider = await this.providerFactory.CreateProvider();
             // `running` is re-read after every await from here on. The entry check above only proves
@@ -346,15 +687,35 @@ export class TaskGraphDispatcher {
             // then sit claimed until their lease expires.
             if (!this.running)
                 return;
-            // Settle graphs before picking new work, so a failure earlier in this pass stops its
-            // branch immediately rather than after another wave has already launched.
+            // SETTLEMENT IS NOT GATED ON CAPACITY (R2-11).
+            //
+            // This used to return at `capacity <= 0` before reaching the rollup, so a handful of
+            // wedged long-running tasks froze EVERYTHING for the whole instance: no settlement, no
+            // skip or block propagation, no human-task settlement, no continuation delivery — for
+            // graphs that had nothing to do with the tasks holding the slots. A per-task hang is an
+            // accepted limitation; "one hung task stops every workflow on this host" is not, and the
+            // two were the same line of code.
+            //
+            // Only CLAIMING consumes capacity, because only claiming starts work.
             await this.propagateAndRollup(provider);
+            const capacity = this.config.MaxConcurrentTasks - this.inFlight.size;
+            if (capacity <= 0)
+                return;
+            // The rollup above can take seconds, and `Stop()` may have been called during it. Claiming
+            // now would start work the process has already decided to abandon — the claim then sits
+            // until its TTL expires and another instance reclaims it. Settling first and checking
+            // here is the right order: bookkeeping for finished work always completes, new work never
+            // starts after the decision to stop.
             if (!this.running)
                 return;
-            const candidates = await this.findClaimableTasks(provider, capacity);
+            const { tasks: candidates, stats } = await this.findClaimableTasks(provider, capacity);
+            const claimedByGraph = new Map();
             for (const task of candidates) {
-                // Re-checked per iteration, not just before the loop: claiming is itself awaited, so
-                // a multi-task wave can straddle a Stop.
+                // Re-checked EVERY iteration, not once before the loop (R2-13). Claiming is itself
+                // awaited, so a multi-task wave can straddle a `Stop`; and `findClaimableTasks` loads
+                // and resolves every active graph, so the scan before this loop can run for seconds.
+                // Unchecked, a shutting-down process takes ownership of work it is about to abandon,
+                // manufacturing the orphaned claims reconciliation exists to clean up.
                 if (!this.running)
                     break;
                 if (this.inFlight.size >= this.config.MaxConcurrentTasks)
@@ -363,16 +724,34 @@ export class TaskGraphDispatcher {
                     // Another instance won the race, or the task is no longer Pending. Normal.
                     continue;
                 }
+                const graphID = task.ParentID ?? task.ID;
+                claimedByGraph.set(graphID, (claimedByGraph.get(graphID) ?? 0) + 1);
                 this.inFlight.add(task.ID);
                 // Intentionally not awaited — the poll loop must keep dispatching while this runs.
                 void this.executeClaimed(task.ID).finally(() => this.inFlight.delete(task.ID));
             }
+            // The engine's heartbeat, per watched graph: what was ready, what was held, what this
+            // instance took. A stuck run is a strip of these ticking with nothing moving, which is
+            // the honest visual of a stall — and the reason this frame exists.
+            for (const [graphID, s] of stats) {
+                this.emit({
+                    Kind: 'PassCompleted',
+                    ParentTaskID: graphID,
+                    OwnerUserID: await this.resolveOwner(provider, graphID),
+                    PassNumber: passNumber,
+                    EligibleCount: s.eligible,
+                    HeldCount: s.held,
+                    ClaimedCount: claimedByGraph.get(graphID) ?? 0,
+                    InstanceInFlightCount: this.inFlight.size,
+                });
+            }
         }
         catch (e) {
             LogError(`[TaskGraphDispatcher] Poll failed: ${e instanceof Error ? e.message : String(e)}`);
         }
         finally {
             this.polling = false;
+            this.activePasses--;
         }
     }
     /**
@@ -390,19 +769,44 @@ export class TaskGraphDispatcher {
                 LogError(`[TaskGraphDispatcher] Claimed task ${taskID} could not be loaded.`);
                 return;
             }
+            // Emitted after the claim is held, not before: a frame saying "started" for work another
+            // instance actually took would be a lie a viewer cannot detect.
+            const graphID = task.ParentID ?? taskID;
+            const ownerUserID = await this.resolveOwner(provider, graphID);
             heartbeat = setInterval(() => {
                 void this.claims.Heartbeat(provider, taskID, this.contextUser).then((ok) => {
                     if (!ok) {
                         // Lost ownership — reconciliation reclaimed it, or a human intervened.
                         LogError(`[TaskGraphDispatcher] Lost claim on task ${taskID} while executing; another instance may take it over.`);
+                        // Announced so a viewer sees "this step's worker lost its lease" the moment
+                        // it happens instead of discovering it in a forensic query later — the R2-1
+                        // wedge class, made visible.
+                        this.emit({
+                            Kind: 'ClaimChanged', ParentTaskID: graphID, OwnerUserID: ownerUserID,
+                            TaskID: taskID, TaskName: task.Name,
+                            ClaimEvent: 'heartbeat-lost', ClaimedBy: this.config.InstanceID,
+                        });
                     }
                 });
             }, this.config.HeartbeatIntervalSeconds * 1000);
-            // Emitted after the claim is held, not before: a frame saying "started" for work another
-            // instance actually took would be a lie a viewer cannot detect.
-            const graphID = task.ParentID ?? taskID;
-            const ownerUserID = await this.resolveOwner(provider, graphID);
+            // Registered so `Stop()` can reach it — unless the drain has already given up, in which
+            // case this task arrived too late to be waited for and must not renew its lease (C5).
+            // Its completion write stays guarded, so if another instance reclaims the task in the
+            // meantime this executor's result is refused rather than raced.
+            if (this.heartbeatsPurged || !this.running) {
+                clearInterval(heartbeat);
+                heartbeat = null;
+            }
+            else {
+                this.heartbeats.set(taskID, heartbeat);
+            }
             this.emit({ Kind: 'TaskStarted', ParentTaskID: graphID, OwnerUserID: ownerUserID, TaskID: taskID, TaskName: task.Name, Status: 'In Progress' });
+            this.emit({
+                Kind: 'ClaimChanged', ParentTaskID: graphID, OwnerUserID: ownerUserID,
+                TaskID: taskID, TaskName: task.Name,
+                ClaimEvent: 'claimed', ClaimedBy: this.config.InstanceID,
+                ClaimExpiresAt: new Date(Date.now() + this.config.ClaimTTLSeconds * 1000).toISOString(),
+            });
             const dependencyOutputs = await this.loadDependencyOutputs(provider, taskID);
             let inputPayload = null;
             if (task.InputPayload) {
@@ -413,13 +817,18 @@ export class TaskGraphDispatcher {
                     LogError(`[TaskGraphDispatcher] Task ${taskID} has malformed InputPayload: ${e}`);
                 }
             }
-            const result = await this.runTaskBody(task, provider, inputPayload, dependencyOutputs);
-            // A prompt can end the workflow early and say why. Honour it before recording the
-            // outcome, so the remaining tasks are already Skipped by the time the rollup runs and
-            // the graph settles Complete rather than looking abandoned with work left Pending.
-            if (result.ChatMessage) {
-                await this.endGraphEarly(provider, task, result.ChatMessage);
-            }
+            const onProgress = this.nodeProgressEmitter(graphID, ownerUserID, taskID, task.Name);
+            const result = await this.runTaskBody(task, provider, inputPayload, dependencyOutputs, onProgress);
+            // ONLY THE CONFIRMED OWNER MUTATES THE GRAPH (R2-10).
+            //
+            // The early-finish skips used to run BEFORE this, so a lapsed claim produced the worst
+            // possible pair: the siblings were terminally Skipped and satisfying dependents, while
+            // the completion was refused and the task re-ran on another instance — where it might
+            // not end early at all. The graph would then be missing steps nobody decided to skip.
+            //
+            // Recording first costs a poll: the skips now land after the completion, so a rollup
+            // that lands in between sees work still Pending and settles one pass later. That is a
+            // delay; the other order was a wrong graph.
             const recorded = await this.claims.CompleteClaimed(provider, taskID, {
                 Status: result.Success ? 'Complete' : 'Failed',
                 OutputPayload: result.Output != null ? JSON.stringify(result.Output) : null,
@@ -445,6 +854,13 @@ export class TaskGraphDispatcher {
                     Status: result.Success ? 'Complete' : 'Failed',
                     ErrorMessage: result.Success ? undefined : (result.ErrorMessage ?? undefined),
                 });
+                // A prompt can end the workflow early and say why — honoured only now that this
+                // instance is the confirmed owner of the outcome. The remaining tasks are Skipped
+                // here so the graph settles Complete rather than looking abandoned with work left
+                // Pending; a rollup that lands between the two simply settles one pass later.
+                if (result.ChatMessage) {
+                    await this.endGraphEarly(provider, task, result.ChatMessage);
+                }
             }
         }
         catch (e) {
@@ -458,6 +874,7 @@ export class TaskGraphDispatcher {
         finally {
             if (heartbeat)
                 clearInterval(heartbeat);
+            this.heartbeats.delete(taskID);
         }
     }
     /**
@@ -466,8 +883,11 @@ export class TaskGraphDispatcher {
      * All four decisions — what is eligible, what must block, what the parent status is, whether the
      * graph is wedged — are delegated to the pure algorithms, unchanged from Phase 1.
      */
-    async propagateAndRollup(provider) {
-        for (const parentID of await this.findActiveGraphIDs(provider)) {
+    async propagateAndRollup(provider, graphIDs) {
+        const graphs = graphIDs ?? await this.findActiveGraphIDs(provider);
+        // One read for every graph this pass touches, rather than one per graph — see primeDebugStates.
+        await this.primeDebugStates(provider, graphs);
+        for (const parentID of graphs) {
             // Human steps settle BEFORE the graph state is read, so an answer given since the last
             // poll is already reflected when eligibility and rollup are computed. Doing it after
             // would delay every dependent branch by a full poll interval for no reason — and on a
@@ -475,8 +895,11 @@ export class TaskGraphDispatcher {
             // between "answered and moving" and "answered and apparently still stuck".
             await this.expireOverdueRequests(provider, parentID);
             await this.settleAnsweredHumanTasks(provider, parentID);
-            await this.reopenCancelledHumanTasks(provider, parentID);
-            const graph = await this.loadGraphState(provider, parentID);
+            await this.reconcileWaitingHumanTasks(provider, parentID);
+            // Edge overrides apply to propagation exactly as they apply to claiming — a branch the
+            // operator answered 'false' must cascade its skips here, not merely stop being claimed.
+            const debug = await this.readDebugState(provider, parentID);
+            const graph = await this.loadGraphState(provider, parentID, debug);
             if (graph.nodes.length === 0)
                 continue;
             // SKIPS FIRST — before blocking, before eligibility. A task whose gating predecessors
@@ -490,17 +913,22 @@ export class TaskGraphDispatcher {
             // route" and "something upstream broke". A reader cannot tell those apart, so every
             // conditional workflow looked half-failed and people went hunting for bugs that did not
             // exist. `Blocked` is now reserved for FAILURE-driven unsatisfiability.
-            const skipSeeds = new Set([...graph.skipSeedTaskIDs, ...graph.unreachableTaskIDs]);
-            const toSkip = new Set([
-                ...skipSeeds,
-                ...ComputeSkipCascade(graph.nodes, graph.edges, [...skipSeeds]),
-            ]);
+            // Computed once in `loadGraphState` so the claim filter sees the same set this pass is
+            // about to write — see R2-14 there.
+            const toSkip = graph.cascadeSkipTaskIDs;
+            const skippedByRoute = [];
             for (const taskID of toSkip) {
                 const entity = graph.entityById.get(taskID);
                 if (!entity || entity.Status !== 'Pending')
                     continue;
-                entity.Status = 'Skipped';
-                if (await entity.Save()) {
+                // The in-memory check above is a cheap pre-filter; the guard that matters is IN the
+                // statement (R3-1's audit item). This snapshot was loaded at the top of the pass and
+                // a task can be claimed and started before its skip write lands — R2-14 closed that
+                // window for the claim filter, and this closes it for the write itself.
+                const skipTypeID = await this.workflowTaskTypeID(provider);
+                if (skipTypeID && await this.claims.TrySkipPending(provider, taskID, skipTypeID, this.contextUser)) {
+                    entity.Status = 'Skipped';
+                    skippedByRoute.push(taskID);
                     LogStatus(`[TaskGraphDispatcher] Skipped '${entity.Name}' (${taskID}) — another branch was taken.`);
                     // Announced separately from TaskBlocked because it means something different to
                     // a viewer: nothing went wrong, this route simply was not the one chosen.
@@ -519,6 +947,11 @@ export class TaskGraphDispatcher {
                         node.status = 'Skipped';
                 }
             }
+            // A human step reached by a route the workflow did not take has the same zombie request
+            // as one skipped by an early finish (R2-10): notified, `Requested` forever, and invisible
+            // to the settle and expiry sweeps because they filter on Pending tasks and this one is
+            // not Pending any more. Same treatment, different reason.
+            await this.withdrawOpenRequests(provider, skippedByRoute, 'The workflow took a different route, so this step is no longer needed.');
             // Only failure-driven unsatisfiability reaches here now; not-taken branches were skipped
             // above. A task already Skipped is left alone rather than overwritten — the two passes
             // must not fight over the same row.
@@ -543,10 +976,14 @@ export class TaskGraphDispatcher {
                     });
                 }
             }
-            if (IsGraphStalled(graph.nodes, graph.edges)) {
+            // Holds are passed in, or the detector reports a held graph as healthy: a held target's
+            // gating edge is still live and its origin Complete, so ComputeEligibleTasks counts it
+            // as eligible and "something is eligible" reads as "not stalled". A graph waiting
+            // forever on a broken condition then produced no diagnostics at all.
+            if (IsGraphStalled(graph.nodes, graph.edges, graph.holdTaskIDs)) {
                 LogError(`[TaskGraphDispatcher] Graph ${parentID} is stalled: pending work with no satisfiable path.`);
             }
-            const fresh = await this.loadGraphState(provider, parentID);
+            const fresh = await this.loadGraphState(provider, parentID, debug);
             // ComputeParentRollup treats an empty child set as Complete-and-terminal, which is right
             // for a graph that genuinely has no children and catastrophic for one whose reload came
             // back empty transiently — it would mark live work finished and fire its continuation.
@@ -568,40 +1005,127 @@ export class TaskGraphDispatcher {
             // Taken from the earliest child rather than from the clock, because that is when work
             // genuinely began — a graph can sit Pending for a long time between submission (already
             // recorded as CreatedAt) and a dispatcher picking up its first task.
+            // Column-scoped for the same reason the terminal write is: a full-row save here would
+            // carry this instance's `InputPayload` snapshot and could erase a continuation marker
+            // another instance had just claimed. Guarded on `StartedAt IS NULL`, so calling it on
+            // every pass is free.
             const earliestChildStart = this.earliestStart(fresh.entityById);
-            const startedAtChanged = parent.StartedAt == null && earliestChildStart != null;
-            if (startedAtChanged)
+            if (parent.StartedAt == null && earliestChildStart != null) {
+                await this.claims.TryStampParentStart(provider, parentID, earliestChildStart, this.contextUser);
                 parent.StartedAt = earliestChildStart;
-            if (startedAtChanged || parent.Status !== rollup.status || parent.PercentComplete !== rollup.percentComplete) {
+            }
+            // THE TERMINAL WRITE IS GUARDED AND COLUMN-SCOPED, not a full-row save.
+            //
+            // `GenerateSaveSQL` sends every updateable column on every save, so a full-row save
+            // carries the whole in-memory snapshot — including `InputPayload`, where the continuation
+            // marker lives. Two instances both compute the terminal rollup; if one claims the marker
+            // and the other then saves its pre-marker snapshot, the marker is ERASED and the
+            // settlement delivers twice. For `reinvoke` that is a second billed agent turn.
+            //
+            // Guarding on "not already terminal" also makes the write idempotent across the
+            // re-entrant settle path below, and replaces an unchecked `Save()` whose failure left the
+            // graph active — re-emitting frames and recomputing cost every poll, forever.
+            if (rollup.outcome === 'settled') {
+                const settled = await this.claims.TrySettleParent(provider, parentID, rollup.status, rollup.percentComplete, this.contextUser);
+                if (!settled && !TERMINAL_TASK_STATUSES.has(parent.Status)) {
+                    // Neither "already terminal" nor a successful write: the statement failed. Leave
+                    // the graph active so the next pass retries rather than settling on a status the
+                    // database never accepted. Re-queued explicitly, because a failed write is
+                    // exactly the case where the row's own timestamp does not advance.
+                    LogError(`[TaskGraphDispatcher] Could not write terminal status for graph ${parentID}; leaving it active to retry.`);
+                    this.keepRetryingSettlement(parentID);
+                    continue;
+                }
                 parent.Status = rollup.status;
-                parent.PercentComplete = rollup.percentComplete;
-                if (rollup.isTerminal)
-                    parent.CompletedAt = new Date();
-                await parent.Save();
-            }
-            if (rollup.isTerminal) {
-                // Geometry is settled once, here, so every viewer of this run agrees on it.
-                await this.persistComputedLayout(fresh);
-                // Emitted before the continuation is delivered, and outside its once-only guard: a
-                // viewer watching the run should learn it finished whether or not this instance is
-                // the one that wins the delivery CAS.
-                this.emit({
-                    Kind: 'GraphSettled',
-                    ParentTaskID: parentID,
-                    OwnerUserID: await this.resolveOwner(provider, parentID),
-                    Status: rollup.status,
-                    CompletedCount: fresh.nodes.filter((n) => n.status === 'Complete').length,
-                    TotalCount: fresh.nodes.length,
-                });
-                await this.rollUpCostToSubmittingRun(provider, parent);
+            }
+            else if (parent.Status !== rollup.status || parent.PercentComplete !== rollup.percentComplete) {
+                // Guarded and column-scoped for the same reason the terminal write is — and the race
+                // here needs no exotic timing. This instance may have computed a non-terminal rollup
+                // from a snapshot taken before another instance settled the graph; a full-row save
+                // would then REVERT the status and erase the continuation marker with it, and the
+                // next pass would settle and deliver a second time. See TryUpdateParentProgress.
+                await this.claims.TryUpdateParentProgress(provider, parentID, rollup.status, rollup.percentComplete, this.contextUser);
+            }
+            if (rollup.outcome === 'settled') {
+                // ANNOUNCE ONCE PER PROCESS, RETRY THE REST (R2-12). Layout and the frame are
+                // idempotent facts about a finished graph; the cost, lifecycle and delivery writes
+                // below are the ones re-entry exists to retry. Without this split, a graph that keeps
+                // failing to settle re-persisted geometry and re-emitted the same frame every poll
+                // for the whole rescue window.
+                if (!this.announcedSettlements.has(parentID)) {
+                    // Geometry is settled once, here, so every viewer of this run agrees on it.
+                    await this.persistComputedLayout(fresh);
+                    // Emitted before the continuation is delivered, and outside its once-only guard: a
+                    // viewer watching the run should learn it finished whether or not this instance is
+                    // the one that wins the delivery CAS.
+                    this.emit({
+                        Kind: 'GraphSettled',
+                        ParentTaskID: parentID,
+                        OwnerUserID: await this.resolveOwner(provider, parentID),
+                        Status: rollup.status,
+                        CompletedCount: fresh.nodes.filter((n) => n.status === 'Complete').length,
+                        TotalCount: fresh.nodes.length,
+                    });
+                    this.announcedSettlements.add(parentID);
+                }
+                // READ-ONLY GATE, before any write to the submitting run's half (R2-2).
+                //
+                // A graph can settle before the run that submitted it has parked at all. `BaseAgent`
+                // sets `Paused` in `finalizeAgentRun`, AFTER the graph is durable and dispatchable —
+                // so a fast graph finishes first, and both writes below then land wrong: the
+                // lifecycle write silently returns (its guard is `Status === 'Paused'`), and the cost
+                // write is overwritten moments later by finalize's own full-row save, which carries
+                // the in-memory nulls it had before the dispatcher wrote anything.
+                //
+                // Deferring the whole half — rather than doing the parts that happen to work — is
+                // what keeps the marker honest: nothing below claims it, so the graph stays
+                // terminal-and-undelivered and the rescue sweep brings it back next pass, by which
+                // time finalize has parked the run and both writes land.
+                const readiness = await this.submittingRunReadiness(provider, parent);
+                if (readiness.Verdict === 'defer') {
+                    this.keepRetryingSettlement(parentID);
+                    continue;
+                }
+                // A settled graph will not produce another verdict, claim or progress report, so the
+                // per-graph observability caches for it are dead weight from here. Unbounded, they
+                // are a slow leak in a process that runs for weeks — one that grows with every
+                // workflow the server has ever seen rather than with anything live. (A deferred
+                // settlement below repopulates them naturally on the retry pass.)
+                this.forgetGraphObservability(parentID);
+                // R3-8: the rollup gets a verdict, and a TRANSIENT failure defers exactly as a
+                // failed lifecycle write does. Continuing past one would settle the run and claim
+                // the marker, which permanently excludes the graph from the rescue sweep — making
+                // the rollup's own "retrying on a later settlement" log a promise it could not keep.
+                // Permanent refusals (truncated tree, graph not in the tree) proceed as before:
+                // those do not clear on their own, and deferring on them would stall forever.
+                if (await this.rollUpCostToSubmittingRun(provider, parent) === 'failed-transient') {
+                    this.keepRetryingSettlement(parentID);
+                    continue;
+                }
                 // Deliberately AFTER the rollup and OUTSIDE its refusal paths. The rollup declines
                 // to write a number it cannot stand behind — a truncated tree, an unreachable graph
                 // — and every one of those returns early. If the run's lifecycle were settled in
                 // there, a refused rollup would strand the run parked forever, which is a far worse
                 // failure than a missing cost figure. Cost and lifecycle are separate concerns with
                 // separate failure modes, so they get separate writes.
-                await this.settleSubmittingRun(provider, parent, rollup.status);
-                await this.deliverContinuation(provider, parent, fresh);
+                if (await this.settleSubmittingRun(provider, parent, rollup.status) === 'defer') {
+                    // The lifecycle write did not land. Delivering now would claim the marker and
+                    // make this the LAST pass to look at the graph — leaving the run Paused forever,
+                    // which is the exact permanence R2-2 removes. Leave the marker unset and retry.
+                    this.keepRetryingSettlement(parentID);
+                    continue;
+                }
+                if (await this.deliverContinuation(provider, parent, fresh, readiness.SubmitterCancelled)) {
+                    // Delivered, expired, or lost the CAS to a peer — every one of those means this
+                    // graph is somebody's finished business and needs nothing further from here.
+                    this.retryingSettlement.delete(parentID);
+                    this.announcedSettlements.delete(parentID);
+                }
+                else {
+                    // This instance cannot deliver. Stay quiet about it — the frame is already out —
+                    // and leave the graph for a capable peer via the sweep.
+                    this.keepRetryingSettlement(parentID);
+                }
             }
         }
     }
@@ -647,13 +1171,15 @@ export class TaskGraphDispatcher {
     async rollUpCostToSubmittingRun(provider, parent) {
         const meta = ParseTaskGraphParentMetadata(parent.InputPayload);
         if (!meta.submittedByAgentRunID)
-            return;
+            return 'landed';
         const runID = meta.submittedByAgentRunID;
         try {
             const runQuery = asRunQueryProvider(provider);
             if (!runQuery) {
+                // Permanent for this host: a provider that cannot run queries will not grow the
+                // ability on the next pass, so deferring would stall the graph forever.
                 LogError(`[TaskGraphDispatcher] Cannot roll up cost for run ${runID}: provider cannot run queries.`);
-                return;
+                return 'refused-permanent';
             }
             const tree = await LoadAgentRunTree(runID, runQuery, this.contextUser);
             // Each of these means the sum would be a LOWER BOUND, and the column's whole contract is
@@ -667,41 +1193,49 @@ export class TaskGraphDispatcher {
             // absent, and `?? TotalCost` cannot save a reader from a non-null wrong number. So a
             // refusal CLEARS it, restoring the fallback's honest meaning: not settled.
             if (tree.ErrorMessage || !tree.Root) {
-                await this.clearStaleRollup(provider, runID, tree.ErrorMessage ?? 'the run tree came back empty');
-                return;
+                // TRANSIENT — nothing cleared (R2-15), and now nothing delivered either (R3-8).
+                //
+                // R2-15 stopped this path erasing a correct total. What it did not stop was the pass
+                // CONTINUING: settlement flipped the run terminal and delivery claimed the marker,
+                // which permanently excludes the graph from the rescue sweep — so this function's
+                // own promise of "retrying on a later settlement" was structurally impossible to
+                // keep. One transient DB error, no interleaving, and a multi-graph run kept a wrong
+                // non-null authoritative total forever while a first-graph run stayed null.
+                LogError(`[TaskGraphDispatcher] Could not load the run tree for ${runID} to roll up graph ` +
+                    `${parent.ID}: ${tree.ErrorMessage ?? 'the run tree came back empty'}. Leaving any ` +
+                    `existing rollup alone and deferring settlement so a later pass can retry.`);
+                return 'failed-transient';
             }
             if (tree.Truncated) {
+                // PERMANENT: the tree is genuinely too deep, and it will be just as deep next pass.
                 await this.clearStaleRollup(provider, runID, `the run tree hit the depth cap, so any total would silently under-report ` +
                     `(graph ${parent.ID} still carries its own costs)`);
-                return;
+                return 'refused-permanent';
             }
             // The graph that just settled must appear in the tree. If it does not, the tree stopped
             // at the run — the submitting step never recorded its parentTaskID — and the sum is
             // merely the run's own spend wearing the name of a rollup. That is precisely the silent
             // under-count this rewrite exists to remove, so it is reported rather than written.
             if (!this.treeContainsGraph(tree.Root, parent.ID)) {
+                // PERMANENT: a missing parentTaskID link is a fact about how the graph was
+                // submitted, not a condition that clears on its own.
                 await this.clearStaleRollup(provider, runID, `graph ${parent.ID} is not reachable from it, so the tree cannot see the work. ` +
                     `Did the submitting step record parentTaskID?`);
-                return;
+                return 'refused-permanent';
             }
             const totals = SumAgentRunTreeCost(tree.Root);
-            const submitting = await provider.GetEntityObject('MJ: AI Agent Runs', this.contextUser);
-            if (!(await submitting.Load(runID))) {
-                LogError(`[TaskGraphDispatcher] Could not load run ${runID} to record graph cost against it.`);
-                return;
-            }
             // Assignment, never accumulation. The tree already contains the run's own spend as its
             // ROOT node, and it reads own-cost everywhere, so recomputing from scratch on every
             // settlement lands on the same answer — which is what makes this safe to call again when
             // a second graph settles, or when the terminal check is re-evaluated after a HITL wait.
-            submitting.TotalCostRollup = totals.Cost;
-            submitting.TotalTokensUsedRollup = totals.Tokens;
-            submitting.TotalPromptTokensUsedRollup = totals.PromptTokens;
-            submitting.TotalCompletionTokensUsedRollup = totals.CompletionTokens;
-            if (!(await submitting.Save())) {
-                LogError(`[TaskGraphDispatcher] Could not record graph cost against run ${runID}: ` +
-                    `${submitting.LatestResult?.CompleteMessage ?? 'unknown error'}`);
-                return;
+            //
+            // COLUMN-SCOPED (C4). A full-row save here carried a whole snapshot of the run, and two
+            // instances entering the settled branch for one graph is by design — so a peer's rollup,
+            // loaded before this instance settled the run, would write `Paused` back over
+            // `Completed` along with everything else it had read.
+            if (!(await this.claims.TrySetRunCostRollup(provider, runID, totals, this.contextUser))) {
+                LogError(`[TaskGraphDispatcher] Could not record graph cost against run ${runID}.`);
+                return 'failed-transient';
             }
             LogStatus(`[TaskGraphDispatcher] Credited graph ${parent.ID} to run ${runID}: ` +
                 `${tree.Rows.length} node(s), ${totals.Tokens} token(s), cost ${totals.Cost}.`);
@@ -710,8 +1244,13 @@ export class TaskGraphDispatcher {
             // A failed rollup must never fail the graph. The work finished; only the accounting for
             // it is missing, and a graph marked Failed because its cost could not be summed would be
             // a far worse lie than a cost of null.
+            // A throw is transient by default: nothing here proves the condition will persist, and
+            // the cost of being wrong in this direction is one deferred pass rather than a
+            // permanently wrong authoritative total.
             LogError(`[TaskGraphDispatcher] Cost rollup failed for graph ${parent.ID}: ${e instanceof Error ? e.message : String(e)}`);
+            return 'failed-transient';
         }
+        return 'landed';
     }
     /**
      * Clears a rollup that can no longer be trusted, and says why.
@@ -783,25 +1322,70 @@ export class TaskGraphDispatcher {
             return;
         try {
             LogStatus(`[TaskGraphDispatcher] '${task.Name}' ended the workflow early: ${message}`);
+            // DECLARE BEFORE MUTATING (R3-1).
+            //
+            // The early finish is decided by one task's result and known to nothing else: skip seeds
+            // come from durable condition and exclusive-group state, so no claim filter anywhere —
+            // including this instance's own, since `executeClaimed` is not awaited and the poll loop
+            // runs concurrently — can tell the remaining steps are about to be skipped. Stamping it
+            // first is what lets `loadGraphState` fold them into the filter, which closes the window
+            // for every instance instead of narrowing it for one.
+            const typeID = await this.workflowTaskTypeID(provider);
+            if (typeID)
+                await this.claims.TryDeclareEarlyFinish(provider, task.ParentID, typeID, this.contextUser);
+            const skipped = [];
+            const claimedMeanwhile = [];
             for (const sibling of await this.loadChildTasks(provider, task.ParentID)) {
-                if (sibling.ID === task.ID || sibling.Status !== 'Pending')
+                if (UUIDsEqual(sibling.ID, task.ID) || sibling.Status !== 'Pending')
+                    continue;
+                // GUARDED, not a full-row save against the snapshot above. A sibling claimed between
+                // that load and this write is mid-execution; overwriting it to `Skipped` discards a
+                // running step's outcome while its side effects have already fired. Rowcount is the
+                // verdict — see TaskClaimStore.TrySkipPending.
+                if (!typeID || !(await this.claims.TrySkipPending(provider, sibling.ID, typeID, this.contextUser))) {
+                    claimedMeanwhile.push(sibling.Name);
                     continue;
-                sibling.Status = 'Skipped';
-                if (await sibling.Save()) {
-                    this.emit({
-                        Kind: 'TaskSkipped',
-                        ParentTaskID: task.ParentID,
-                        OwnerUserID: await this.resolveOwner(provider, task.ParentID),
-                        TaskID: sibling.ID,
-                        TaskName: sibling.Name,
-                        Status: 'Skipped',
-                    });
                 }
+                skipped.push(sibling.ID);
+                this.emit({
+                    Kind: 'TaskSkipped',
+                    ParentTaskID: task.ParentID,
+                    OwnerUserID: await this.resolveOwner(provider, task.ParentID),
+                    TaskID: sibling.ID,
+                    TaskName: sibling.Name,
+                    Status: 'Skipped',
+                });
             }
-            const parent = await provider.GetEntityObject('MJ: Tasks', this.contextUser);
-            if (await parent.Load(task.ParentID)) {
-                parent.OutputPayload = JSON.stringify({ message });
-                await parent.Save();
+            if (claimedMeanwhile.length > 0) {
+                // Reported rather than forced. Those steps were already running when the workflow
+                // decided to stop; their results are real and are allowed to land. The graph settles
+                // once they finish, which is a pass later than it would have and correct.
+                LogStatus(`[TaskGraphDispatcher] Early finish left ${claimedMeanwhile.length} step(s) running ` +
+                    `(${claimedMeanwhile.join(', ')}) — they were claimed before the skip and their outcomes stand.`);
+            }
+            // WITHDRAW WHAT WE JUST SKIPPED (R2-10).
+            //
+            // A skipped human step leaves its `MJ: AI Agent Requests` row `Requested` forever:
+            // un-answerable, because answering settles nothing once the task is terminal, and
+            // immortal, because the human settle and expiry sweeps both filter on `Status='Pending'`
+            // tasks and this one no longer is. The person keeps seeing "a workflow is waiting on
+            // you" for a workflow that finished without them. `Cancel` has always done this; the
+            // early-finish path skipped exactly the same rows and did not.
+            await this.withdrawOpenRequests(provider, skipped, 'The workflow finished before this step was needed.');
+            // Column-scoped, because skipping the siblings above just made this graph fully
+            // terminal — so another instance can settle it and claim the marker before this line
+            // runs. A full-row save from the snapshot we loaded first would undo both. See
+            // TaskClaimStore.TrySetParentOutput.
+            if (typeID) {
+                await this.claims.TrySetParentOutput(provider, task.ParentID, JSON.stringify({ message }), typeID, this.contextUser);
+            }
+            else {
+                // Surfaced rather than dropped (R2-10). The graph still ends early — the siblings
+                // are already Skipped — but the reason it ended goes nowhere, and a workflow that
+                // stopped for a stated reason with no stated reason recorded is exactly the kind of
+                // silence this round exists to remove.
+                LogError(`[TaskGraphDispatcher] Could not resolve the workflow task type, so the early-finish ` +
+                    `reason for graph ${task.ParentID} was not recorded: ${message}`);
             }
         }
         catch (e) {
@@ -849,17 +1433,9 @@ export class TaskGraphDispatcher {
      * as a recovery path; they are ordinary sequencing, and treating them as recovery would let a
      * graph sail past a failure it never anticipated.
      */
-    async computeHandledFailures(provider, parentTaskID, nodes, edges) {
+    computeHandledFailures(failureSemantics, nodes, edges) {
         const handled = new Set();
-        // Cheap exit before touching the database: with no failures there is nothing to handle, and
-        // this runs on every poll for every active graph.
-        if (!nodes.some((n) => n.status === 'Failed'))
-            return handled;
-        const parent = await provider.GetEntityObject('MJ: Tasks', this.contextUser);
-        if (!(await parent.Load(parentTaskID)))
-            return handled;
-        const meta = ParseTaskGraphParentMetadata(parent.InputPayload);
-        if (meta.failureSemantics !== 'edges')
+        if (failureSemantics !== 'edges')
             return handled;
         for (const node of nodes) {
             if (node.status !== 'Failed')
@@ -893,28 +1469,77 @@ export class TaskGraphDispatcher {
      * user-visible noise and, for `reinvoke`, an unbounded agent-run loop. Given one of the two has
      * to be chosen, the quiet failure is the safe one.
      *
-     * The marker is written with a compare-and-swap read-back, so two instances reconciling the same
-     * completed graph produce one winner rather than two.
+     * The marker is claimed with a real compare-and-swap (one guarded UPDATE, rowcount as verdict),
+     * so two instances reconciling the same completed graph produce one winner rather than two.
      */
-    async deliverContinuation(provider, parent, graph) {
+    async deliverContinuation(provider, parent, graph, submitterCancelled) {
         const meta = this.readParentMetadata(parent);
         if (meta.continuationDeliveredAt)
-            return;
-        // At the cap, downgrade rather than refuse: the results still reach the user, the chain just
+            return true;
+        // Nobody is waiting: the run that submitted this graph was cancelled. Claim the marker so
+        // nothing re-offers the graph, and record WHY nothing was announced — "we chose not to" and
+        // "we found it too late" are different facts about a settlement, and a reader afterwards
+        // should be able to tell them apart.
+        if (submitterCancelled) {
+            if (await this.claimContinuation(provider, parent.ID, 'cancelled')) {
+                LogStatus(`[TaskGraphDispatcher] Graph ${parent.ID} settled, but the run that submitted it was ` +
+                    `cancelled — no message posted and no reinvoke started.`);
+            }
+            return true;
+        }
+        // At the cap, DOWNGRADE rather than refuse: the results still reach the user, the chain just
         // stops growing. Refusing outright would lose the outcome of work that actually completed.
-        const mode = IsReinvokeCapReached(meta) ? 'message' : meta.continuation;
+        //
+        // But a downgrade only applies to something that was going to be delivered (C2). Mapping the
+        // cap straight onto `'message'` also promoted `continuation: 'none'` — a graph that asked
+        // for silence — into a message nobody requested. Latent today because `Submit` refuses to
+        // create a graph past the cap, and exactly the kind of latent that stops being latent the
+        // moment a producer bypasses that check.
+        const mode = meta.continuation !== 'none' && IsReinvokeCapReached(meta) ? 'message' : meta.continuation;
         if (mode !== 'none' && IsReinvokeCapReached(meta) && meta.continuation === 'reinvoke') {
             LogStatus(`[TaskGraphDispatcher] Graph ${parent.ID} hit the reinvoke cap (${MAX_REINVOKE_DEPTH}); ` +
                 `delivering results as a message instead of starting another turn.`);
         }
-        if (!(await this.claimContinuation(provider, parent.ID, meta)))
-            return;
+        // A SETTLEMENT NOBODY IS WAITING FOR STILL SETTLES — it just does not get announced.
+        //
+        // Run settlement and cost rollup are status corrections and are always safe to apply late; a
+        // run left `Paused` forever is strictly worse than a stale notification skipped. A stale
+        // NOTIFICATION is not: posting a day-old "your workflow finished" into a live conversation,
+        // or worse starting a fresh billed agent turn for it, is the outcome the age-out exists to
+        // avoid. So an aged-out settlement claims the marker as `expired` and logs, which both
+        // records what happened and stops any later pass delivering it. Second rung on the ladder
+        // the reinvoke cap already established.
+        const expired = IsSettlementExpired(parent.CompletedAt, new Date());
+        // ONLY AN INSTANCE THAT CAN DELIVER MAY CLAIM THE RIGHT TO (R2-6).
+        //
+        // The claim ran before the deliverer check, so an instance constructed WITHOUT one — a
+        // worker tier, an integration bundle, a second dev session — could observe the settlement
+        // first, win the CAS, mark the graph `delivered`, and discard the message or reinvoke a
+        // capable peer would have made moments later. Permanently, decided by poll timing.
+        //
+        // Declining leaves the marker unset, so the rescue sweep keeps offering the graph until an
+        // instance that can deliver takes it. Run settlement and cost rollup have already happened
+        // above and are not held up by this — what is deferred is the announcement, which is the only
+        // part this instance genuinely cannot do.
+        //
+        // `expired` is exempt: recording "too old to deliver" requires no deliverer, and a graph past
+        // its window has nothing left for a capable peer to do.
+        if (!expired && mode !== 'none' && !this.continuationDeliverer) {
+            this.reportUndeliverableOnce(parent.ID);
+            return false;
+        }
+        if (!(await this.claimContinuation(provider, parent.ID, expired ? 'expired' : 'delivered')))
+            return true;
+        if (expired) {
+            LogStatus(`[TaskGraphDispatcher] Graph ${parent.ID} settled after its delivery window ` +
+                `(${UNSETTLED_SWEEP_WINDOW_HOURS}h); the run and its cost were corrected, but the ` +
+                `continuation was NOT delivered. Marked expired.`);
+            return true;
+        }
         if (mode === 'none')
-            return;
+            return true;
         const summary = this.buildContinuationSummary(parent, graph);
         LogStatus(`[TaskGraphDispatcher] Graph ${parent.ID} finished — ${summary}`);
-        if (!this.continuationDeliverer)
-            return;
         const params = {
             ParentTaskID: parent.ID,
             WorkflowName: parent.Name,
@@ -951,6 +1576,12 @@ export class TaskGraphDispatcher {
             // on the marker: a missed notification visible in the record beats one repeated forever.
             LogError(`[TaskGraphDispatcher] Continuation delivery failed for ${parent.ID}: ${e instanceof Error ? e.message : String(e)}`);
         }
+        // C1: the function is declared `Promise<boolean>` and fell off the end here, so EVERY
+        // successfully delivered graph resolved `undefined` — read as "not resolved" by the caller,
+        // which then re-queued it and paid another full settle pass (run-tree cost query included)
+        // and polluted R2-6's retry accounting. No double delivery, because the CAS holds; just a
+        // wasted pass per settlement and a retry counter measuring the wrong thing.
+        return true;
     }
     /** Reads the parent's durable continuation metadata through the shared parser. */
     readParentMetadata(parent) {
@@ -962,19 +1593,26 @@ export class TaskGraphDispatcher {
      * `MJ: Tasks` stays user-writable (D20), so a plain "read, decide, write" is not enough — the
      * read-back is what makes a lost race observable instead of producing a duplicate delivery.
      */
-    async claimContinuation(provider, parentID, meta) {
-        const row = await provider.GetEntityObject('MJ: Tasks', this.contextUser);
-        if (!(await row.Load(parentID)))
-            return false;
-        const current = this.readParentMetadata(row);
-        if (current.continuationDeliveredAt)
-            return false; // a peer got there first
-        row.InputPayload = JSON.stringify({ ...meta, continuationDeliveredAt: new Date().toISOString() });
-        if (!(await row.Save())) {
-            LogError(`[TaskGraphDispatcher] Could not mark continuation delivered for ${parentID}; skipping to avoid a duplicate.`);
+    /**
+     * True when this graph finished so long ago that announcing it would surprise rather than inform.
+     *
+     * Measured from the parent's completion, not from when we noticed: the point is how stale the
+     * NEWS is to whoever would receive it.
+     */
+    async claimContinuation(provider, parentID, deliveredAs = 'delivered') {
+        // ONE GUARDED STATEMENT — see TaskClaimStore.TryClaimContinuation.
+        //
+        // This was Load → check the marker → `Save()`: an unconditional last-write-wins UPDATE that
+        // two dispatchers could both pass. The comments here and at the call site called it a
+        // compare-and-swap read-back; it was read-check-write, and for `continuation: 'reinvoke'`
+        // losing that race means two fresh agent turns billed for one settlement, each able to
+        // submit further graphs.
+        // The type discriminator is part of the guard, not a caller-side filter — see
+        // TryClaimContinuation. Nothing to claim if the type does not exist: no graph was submitted.
+        const typeID = await this.workflowTaskTypeID(provider);
+        if (!typeID)
             return false;
-        }
-        return true;
+        return this.claims.TryClaimContinuation(provider, parentID, deliveredAs, typeID, this.contextUser);
     }
     /** One line describing how the graph ended, for the completion log and message delivery. */
     buildContinuationSummary(parent, graph) {
@@ -1016,11 +1654,11 @@ export class TaskGraphDispatcher {
             // Nothing will change on a retry. Mark it so the loop stops, and leave the task Pending
             // and visible — a person can still see it in the Tasks UI, which is the fallback the
             // notification was only ever an accelerant for.
-            await this.markHumanTaskNotified(task);
+            await this.markHumanTaskNotified(task, provider);
             return;
         }
         if (!task.UserID) {
-            await this.markHumanTaskNotified(task);
+            await this.markHumanTaskNotified(task, provider);
             return;
         }
         try {
@@ -1036,7 +1674,7 @@ export class TaskGraphDispatcher {
         catch (e) {
             LogError(`[TaskGraphDispatcher] Could not notify ${task.UserID} about task ${task.ID}: ${e instanceof Error ? e.message : String(e)}`);
         }
-        await this.markHumanTaskNotified(task);
+        await this.markHumanTaskNotified(task, provider);
         // Emitted once, alongside the marker, so a viewer sees the graph stop on a person rather
         // than appearing to stall for no reason.
         this.emit({
@@ -1060,8 +1698,88 @@ export class TaskGraphDispatcher {
      * invalidate. Left cached, a completed task keeps reading as `In Progress` and the graph never
      * rolls up: submitted work simply never settles.
      */
-    async findActiveGraphIDs(provider) {
+    /**
+     * Settles graphs that reached terminal without completing their post-settlement sequence.
+     *
+     * Runs the ordinary propagation path, which is safe to re-enter by construction: the terminal
+     * write is guarded on not-already-terminal, the cost rollup assigns rather than accumulates, run
+     * settlement is guarded on `Paused`, and delivery is guarded by the continuation CAS. A revisit
+     * therefore corrects whatever is missing and does nothing where nothing is.
+     *
+     * @param windowHours how far back to look — wide once at startup, narrow in steady state
+     */
+    async sweepUnsettledGraphs(windowHours) {
+        try {
+            const provider = await this.providerFactory.CreateProvider();
+            const ids = await this.findActiveGraphIDs(provider, windowHours);
+            if (ids.length === 0)
+                return;
+            LogStatus(`[TaskGraphDispatcher] Startup sweep: reviewing ${ids.length} graph(s), including any that reached terminal without settling.`);
+            await this.propagateAndRollup(provider, ids);
+        }
+        catch (e) {
+            LogError(`[TaskGraphDispatcher] Unsettled-graph sweep failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    /**
+     * The `AI Workflow` task type, resolved once per process.
+     *
+     * `MJ: Tasks` is a GENERAL-PURPOSE entity — conversations and user to-dos live there too — so an
+     * unscoped sweep treats every root task hierarchy as a workflow: rolling up and overwriting the
+     * status of somebody's to-do list, raising agent requests against plain tasks, and (once the
+     * continuation CAS exists) injecting marker keys into a user's own `InputPayload`.
+     *
+     * `Submit` has always stamped this type on the parent and every child (`ensureTaskType`, which
+     * runs before the persist transaction), so the discriminator D3 called for already exists on
+     * every dispatcher-owned row. Verified against the live database: every parent graph carries it.
+     *
+     * Null when the type row does not exist yet — no graph has ever been submitted — in which case
+     * there is nothing for the dispatcher to find and the sweep returns empty rather than unscoped.
+     *
+     * **A miss is never cached**, and that is not a micro-optimisation. `TaskGraphService.Submit`
+     * creates the row on first use, so on a fresh install the ordinary sequence is: dispatcher
+     * starts, looks, finds nothing — then somebody submits the first workflow. Caching that first
+     * `null` would blind this process to every graph until it was restarted, with each poll reporting
+     * a clean, empty sweep. The row is created once and never removed, so the retry costs one
+     * `MaxRows: 1` lookup per poll for exactly as long as there is genuinely nothing to dispatch.
+     */
+    async workflowTaskTypeID(provider) {
+        if (this.cachedWorkflowTaskTypeID)
+            return this.cachedWorkflowTaskTypeID;
+        const result = await RunView.FromMetadataProvider(provider).RunView({
+            EntityName: 'MJ: Task Types',
+            ExtraFilter: `Name='${TASK_TYPE_NAME}'`,
+            Fields: ['ID'],
+            // Ordered, and reading two (R2-7). An unordered `MaxRows: 1` against two rows sharing
+            // the name lets this instance bind a different ID than `Submit` did — after which
+            // every graph the other stamped is invisible to all three sweep arms here.
+            OrderBy: '__mj_CreatedAt ASC, ID ASC',
+            ResultType: 'simple',
+            MaxRows: 2,
+        }, this.contextUser);
+        if (!result.Success) {
+            // A failed lookup is not "no such type" — saying so would silently skip a poll cycle's
+            // worth of real work. Report it, and let the next cycle ask again.
+            LogError(`[TaskGraphDispatcher] Could not resolve the '${TASK_TYPE_NAME}' task type: ${result.ErrorMessage}`);
+            return null;
+        }
+        const rows = result.Results ?? [];
+        if (rows.length > 1) {
+            LogError(`[TaskGraphDispatcher] More than one '${TASK_TYPE_NAME}' task type exists. Binding the ` +
+                `oldest (${rows[0].ID}); any graph stamped with the other is invisible to this sweep and ` +
+                `will never settle. Merge them.`);
+        }
+        this.cachedWorkflowTaskTypeID = rows[0]?.ID ?? null;
+        return this.cachedWorkflowTaskTypeID;
+    }
+    async findActiveGraphIDs(provider, windowHours = UNSETTLED_SWEEP_WINDOW_HOURS) {
         const rv = RunView.FromMetadataProvider(provider);
+        // EVERY arm is scoped to workflow graphs. Unscoped, the dispatcher rewrites tasks that are
+        // none of its business — see workflowTaskTypeID.
+        const typeID = await this.workflowTaskTypeID(provider);
+        if (!typeID)
+            return [];
+        const ofWorkflowType = `TypeID='${typeID}'`;
         // TWO queries, because "has work left to do" and "needs attention" are not the same set.
         //
         // Selecting only graphs with non-terminal CHILDREN looks right and is subtly fatal: the
@@ -1073,23 +1791,50 @@ export class TaskGraphDispatcher {
         //
         // The second query closes it: a parent that is itself non-terminal still needs looking at,
         // whatever its children are doing.
-        const [withPendingWork, unsettledParents] = await rv.RunViews([
+        // THREE queries. The third rescues a graph that reached terminal without settling.
+        //
+        // The post-settlement sequence — cost rollup, run settlement, continuation delivery — runs
+        // AFTER the parent's terminal write, and a terminal parent with all-terminal children
+        // matches neither query above. So a process that died in that window left the submitting
+        // agent run `Paused` FOREVER: no rollup, no notification, and nothing that would ever look
+        // again. The metadata's own doc comment promised "the next sweep retries"; that sweep did
+        // not exist.
+        //
+        // Bounded rather than unbounded, because the marker lives in `InputPayload` JSON and cannot
+        // be filtered in SQL: the window is what keeps this a targeted rescue instead of a re-parse
+        // of every graph ever run. `__mj_UpdatedAt` advances on each settle attempt, so a graph
+        // being actively retried stays in the window — the bound is on ABANDONMENT, not on age.
+        const cutoff = SweepCutoff(new Date(), windowHours);
+        const [withPendingWork, unsettledParents, terminalRecent] = await rv.RunViews([
             {
                 EntityName: 'MJ: Tasks',
-                ExtraFilter: `ParentID IS NOT NULL AND Status IN ('Pending','In Progress')`,
+                ExtraFilter: `${ofWorkflowType} AND ParentID IS NOT NULL AND Status IN ('Pending','In Progress')`,
                 Fields: ['ParentID'],
                 ResultType: 'simple',
                 BypassCache: true,
             },
             {
                 EntityName: 'MJ: Tasks',
-                ExtraFilter: `ParentID IS NULL AND Status IN ('Pending','In Progress')`,
+                ExtraFilter: `${ofWorkflowType} AND ParentID IS NULL AND Status IN ('Pending','In Progress')`,
                 Fields: ['ID'],
                 ResultType: 'simple',
                 BypassCache: true,
             },
+            {
+                EntityName: 'MJ: Tasks',
+                ExtraFilter: `${ofWorkflowType} AND ParentID IS NULL AND Status IN (${TERMINAL_PARENT_STATUS_SQL}) ` +
+                    `AND __mj_UpdatedAt >= '${cutoff}'`,
+                Fields: ['ID', 'InputPayload'],
+                ResultType: 'simple',
+                BypassCache: true,
+            },
         ], this.contextUser);
         const ids = new Set();
+        // Graphs this instance is mid-retry on, whatever the window says (R2-12). A failing pass
+        // writes nothing, so their `__mj_UpdatedAt` has stopped advancing and the third arm below
+        // will eventually stop finding them — which would turn a retry into a silent abandonment.
+        for (const id of this.retryingSettlement.keys())
+            ids.add(id);
         for (const r of (withPendingWork?.Results ?? [])) {
             if (r.ParentID)
                 ids.add(r.ParentID);
@@ -1100,6 +1845,11 @@ export class TaskGraphDispatcher {
             if (r.ID)
                 ids.add(r.ID);
         }
+        // The marker is JSON, so the filter is in TypeScript rather than in SQL — see
+        // SelectUnsettledGraphIDs, which owns that decision and is tested directly.
+        for (const id of SelectUnsettledGraphIDs((terminalRecent?.Results ?? []))) {
+            ids.add(id);
+        }
         return [...ids];
     }
     /**
@@ -1111,10 +1861,16 @@ export class TaskGraphDispatcher {
      */
     async findClaimableTasks(provider, limit) {
         const claimable = [];
-        for (const parentID of await this.findActiveGraphIDs(provider)) {
+        const stats = new Map();
+        const activeGraphs = await this.findActiveGraphIDs(provider);
+        // Usually a no-op — propagateAndRollup primed these earlier in the same pass.
+        await this.primeDebugStates(provider, activeGraphs);
+        for (const parentID of activeGraphs) {
             if (claimable.length >= limit)
                 break;
-            const graph = await this.loadGraphState(provider, parentID);
+            const debug = await this.readDebugState(provider, parentID);
+            await this.announcePauseTransition(provider, parentID, debug);
+            const graph = await this.loadGraphState(provider, parentID, debug);
             // HOLD is what makes "a broken condition stalls visibly" true rather than merely stated.
             // An undecided exclusive group keeps all its edges, and a kept edge on a Complete origin
             // is a SATISFIED prerequisite — so without this filter every branch of the fork would be
@@ -1134,9 +1890,71 @@ export class TaskGraphDispatcher {
             // window before it was marked.
             const eligible = ComputeEligibleTasks(graph.nodes, graph.edges, graph.handledFailureIDs)
                 .filter((n) => !graph.holdTaskIDs.has(n.id) &&
+                // CONFIRMED seeds, not raw ones (P1). Holding a decided loser out of claiming
+                // closes a real race — the loser could be claimed between eligibility and the
+                // skip write — and that role is unchanged. What changed is which targets count
+                // as decided: a task another live route still reaches was never a loser, so it
+                // must stay claimable and run when its own prerequisites are met.
                 !graph.skipSeedTaskIDs.has(n.id) &&
-                !graph.unreachableTaskIDs.has(n.id));
+                !graph.unreachableTaskIDs.has(n.id) &&
+                // ...and everything the cascade is about to reach (R2-14). A descendant of a
+                // seed is eligible for the moments between its ancestor's skip landing and its
+                // own, because Skipped satisfies prerequisites — a window another instance can
+                // and does claim inside.
+                !graph.cascadeSkipTaskIDs.has(n.id));
+            stats.set(parentID, { eligible: eligible.length, held: graph.holdTaskIDs.size });
+            // THE DEBUG GATE — pause, single-step, breakpoints — decided by the pure function, with
+            // the CAS writes staying here. Every control is a gate on CLAIMING: a claimed task can
+            // never be interrupted mid-flight anyway, so "paused" means nothing new starts while
+            // in-flight work finishes and its completions land. That is also why the gate sits
+            // BEFORE the runner checks and the human notification below: pausing a graph must not
+            // keep notifying assignees — a notification is starting something.
+            const gate = DecideClaimGate(debug, eligible.map((n) => n.id));
+            if (gate.mode === 'closed')
+                continue;
+            let allowedTaskIDs = null;
+            if (gate.mode === 'breakpoint') {
+                const typeID = await this.workflowTaskTypeID(provider);
+                // The pause is a CAS so two instances arriving at the same breakpoint in the same
+                // interval produce one announcement — the loser simply sees a paused graph next pass.
+                if (typeID && await this.claims.TryPauseAtBreakpoint(provider, parentID, gate.taskID, typeID, this.contextUser)) {
+                    const owner = await this.resolveOwner(provider, parentID);
+                    const name = graph.entityById.get(gate.taskID)?.Name;
+                    LogStatus(`[TaskGraphDispatcher] Graph ${parentID} paused at breakpoint on '${name}' (${gate.taskID}).`);
+                    this.emit({ Kind: 'BreakpointHit', ParentTaskID: parentID, OwnerUserID: owner, TaskID: gate.taskID, TaskName: name });
+                    this.emit({ Kind: 'GraphPaused', ParentTaskID: parentID, OwnerUserID: owner, TaskID: gate.taskID, Reason: 'breakpoint' });
+                    this.announcedPaused.set(parentID, true);
+                }
+                continue;
+            }
+            if (gate.mode === 'step') {
+                allowedTaskIDs = new Set(gate.taskIDs);
+                // THE ALLOWANCE IS CONSUMED ONLY IF SOMETHING WILL ACTUALLY MOVE.
+                //
+                // "Eligible" is a graph-shape answer; whether this host can run the step is a
+                // separate one, decided below by the runner checks. Consuming first meant a step
+                // onto a node this instance has no runner for — or one already in flight — spent
+                // the allowance and released nothing, leaving the operator pressing a button that
+                // did nothing and no reason anywhere. Deciding first costs one pre-pass over a set
+                // that is at most the frontier.
+                const releasable = eligible.filter((n) => {
+                    const entity = graph.entityById.get(n.id);
+                    return entity ? allowedTaskIDs.has(n.id) && this.canActOn(entity) : false;
+                });
+                if (releasable.length === 0) {
+                    await this.reportStepReleasedNothing(provider, parentID, gate.taskIDs, graph);
+                    continue;
+                }
+                const typeID = await this.workflowTaskTypeID(provider);
+                // Consuming the allowance is the race: exactly one instance clears the marker and
+                // releases work; the loser waits for the next allowance. A lost consume is normal.
+                if (!typeID || !(await this.claims.TryConsumeStepMarker(provider, parentID, typeID, this.contextUser))) {
+                    continue;
+                }
+            }
             for (const node of eligible) {
+                if (allowedTaskIDs && !allowedTaskIDs.has(node.id))
+                    continue;
                 const entity = graph.entityById.get(node.id);
                 if (!entity)
                     continue;
@@ -1165,6 +1983,17 @@ export class TaskGraphDispatcher {
                         continue;
                 }
                 else if (!entity.AgentID) {
+                    // No runner column at all — a person completes this one. Asked through the same
+                    // predicate the human settle/expiry sweeps use, so a task that gets NOTIFIED here
+                    // is a task those sweeps can later see; the two disagreeing is how a human task
+                    // ends up asked and then never settled.
+                    if (!IsHumanTask(entity)) {
+                        // Neither a runner nor a person: nothing can ever move this. Loud, because
+                        // the alternative is a graph that waits forever on nobody.
+                        LogError(`[TaskGraphDispatcher] Task '${entity.Name}' (${entity.ID}) has no runner ` +
+                            `assignment and is not a human step — nothing can execute it. The graph will stall.`);
+                        continue;
+                    }
                     await this.notifyHumanTaskReady(entity, provider);
                     continue;
                 }
@@ -1174,8 +2003,82 @@ export class TaskGraphDispatcher {
                 if (claimable.length >= limit)
                     break;
             }
+            if (debug.skipBreakpointTaskID) {
+                const skip = debug.skipBreakpointTaskID;
+                const claimedThisPass = claimable.some((t) => UUIDsEqual(t.ID, skip));
+                const stillEligible = eligible.some((n) => UUIDsEqual(n.id, skip));
+                if (claimedThisPass || !stillEligible) {
+                    await this.clearSkipBreakpoint(provider, parentID);
+                }
+            }
         }
-        return claimable;
+        return { tasks: claimable, stats };
+    }
+    async clearSkipBreakpoint(provider, parentTaskID) {
+        const typeID = await this.workflowTaskTypeID(provider);
+        if (!typeID)
+            return;
+        await this.claims.TryWriteDebugFields(provider, parentTaskID, [TaskClaimStore.DebugField('$.debug.skipBreakpointTaskID', { Kind: 'null' })], typeID, this.contextUser);
+    }
+    /**
+     * Drops the per-graph frame-dedup state for a graph that has settled.
+     *
+     * `ownerByParentID` is deliberately NOT purged here: it is the delivery key for the
+     * `GraphSettled` frame emitted moments earlier and for any rescue-sweep pass that revisits the
+     * graph, it is one small string per graph, and ownership never changes — the cost of keeping it
+     * is bounded and the cost of losing it is a re-query on a path that is meant to be cheap.
+     */
+    forgetGraphObservability(parentTaskID) {
+        this.emittedGateVerdicts.delete(parentTaskID);
+        this.nodeProgressLastEmit.delete(parentTaskID);
+        this.announcedPaused.delete(parentTaskID);
+        this.debugStateByGraph.delete(parentTaskID);
+    }
+    /**
+     * Whether THIS host can act on a task right now — the runner-availability question, asked
+     * without acting on it.
+     *
+     * Mirrors the checks in the claim loop so a step allowance is spent only when something will
+     * actually move. A human step counts as actionable: stepping onto one legitimately produces a
+     * notification rather than a claim.
+     */
+    canActOn(entity) {
+        if (this.inFlight.has(entity.ID))
+            return false;
+        if (entity.ActionID)
+            return !!this.actionRunner;
+        if (entity.PromptID)
+            return !!this.promptRunner;
+        if (entity.AgentID)
+            return true;
+        return IsHumanTask(entity);
+    }
+    /**
+     * Says why a step press released nothing, instead of leaving the allowance spent and the
+     * console silent.
+     *
+     * The allowance is deliberately NOT consumed on this path — the operator's intent stands, and
+     * the step will release as soon as the named work becomes actionable (a runner arrives, an
+     * in-flight task finishes). Announced once per pass rather than logged only, because the person
+     * waiting is looking at the console, not the server log.
+     */
+    async reportStepReleasedNothing(provider, parentTaskID, requestedTaskIDs, graph) {
+        const names = requestedTaskIDs
+            .map((id) => graph.entityById.get(id)?.Name)
+            .filter((n) => !!n);
+        const subject = names.length > 0 ? `"${names.join('", "')}"` : 'the next step';
+        const reason = `Step is still waiting: ${subject} cannot start on this server yet — it is already ` +
+            `running, or no runner for that step type is loaded here. The step will release as ` +
+            `soon as it can; nothing was lost.`;
+        LogStatus(`[TaskGraphDispatcher] Step on graph ${parentTaskID} released nothing: ${reason}`);
+        this.emit({
+            Kind: 'StepRefused',
+            ParentTaskID: parentTaskID,
+            OwnerUserID: await this.resolveOwner(provider, parentTaskID),
+            TaskID: requestedTaskIDs[0],
+            TaskName: names[0],
+            Reason: reason,
+        });
     }
     /**
      * Marks a human task as notified, so the request is raised exactly once.
@@ -1184,11 +2087,16 @@ export class TaskGraphDispatcher {
      * notification: the task stays visible in the inbox either way, whereas a notification storm is
      * not self-correcting.
      */
-    async markHumanTaskNotified(task) {
-        task.ClaimedBy = HUMAN_TASK_NOTIFIED_MARKER;
-        if (!(await task.Save())) {
-            LogError(`[TaskGraphDispatcher] Could not mark task ${task.ID} as notified; it may notify again.`);
+    async markHumanTaskNotified(task, provider) {
+        // Guarded, not a full-row save against a snapshot (R3-5). This row was loaded at the top of
+        // the pass; a full-row write could revert a status it has reached since, and two instances
+        // could both stamp it after both having seen it absent. The predicate makes it once-only.
+        if (await this.claims.TryMarkHumanNotified(provider, task.ID, HUMAN_TASK_NOTIFIED_MARKER, this.contextUser)) {
+            task.ClaimedBy = HUMAN_TASK_NOTIFIED_MARKER;
+            return;
         }
+        // Rowcount 0 is ordinary: another instance marked it, or the task is no longer Pending.
+        // Either way this instance has nothing left to do about the notification.
     }
     /**
      * Raises the `MJ: AI Agent Requests` row a person answers to release this step.
@@ -1205,9 +2113,13 @@ export class TaskGraphDispatcher {
      */
     async raiseHumanRequest(task, provider) {
         try {
-            const existing = await this.findOpenRequest(provider, task.ID);
-            if (existing)
-                return 'raised'; // already waiting on someone
+            const existing = await this.findOpenRequests(provider, task.ID);
+            if (existing.length > 0) {
+                // Somebody IS waiting on this task — but "somebody" may be two rows, so collapse
+                // before returning. Free: the rows are already in hand.
+                await this.withdrawDuplicateRequests(provider, task.ID, existing, existing[0].ID);
+                return 'raised';
+            }
             const request = await provider.GetEntityObject('MJ: AI Agent Requests', this.contextUser);
             request.NewRecord();
             request.OriginatingTaskID = task.ID;
@@ -1240,7 +2152,24 @@ export class TaskGraphDispatcher {
             if (expiresInHours && expiresInHours > 0) {
                 request.ExpiresAt = new Date(Date.now() + expiresInHours * 60 * 60 * 1000);
             }
-            if (!(await request.Save())) {
+            if (await request.Save()) {
+                // INSERT-THEN-RESELECT (R3-5). The check above is read-then-write in a system whose
+                // every other cross-instance write is a CAS, and there is no unique index behind it —
+                // so two overlapping instances both read "none open", both insert, and both ping the
+                // assignee. When one is answered, `settleAnsweredHumanTasks` settles from the single
+                // latest terminal request and NOTHING ever touches the other: the withdrawal paths
+                // fire only on skips and cancels, and both human sweeps scope to `Pending` tasks,
+                // which the settled task no longer is. The duplicate becomes a durable, unanswerable,
+                // immortal inbox item — the zombie class R2-10 removed from the skip paths.
+                //
+                // Checking harder is what created the window, so the resolution is to let both
+                // inserts happen and then agree on a winner: the oldest open row. A loser withdraws
+                // its own row and returns `raised` — somebody IS waiting on this task, which is what
+                // the caller needs to know.
+                await this.withdrawDuplicateRequests(provider, task.ID, await this.findOpenRequests(provider, task.ID), request.ID);
+                return 'raised';
+            }
+            {
                 LogError(`[TaskGraphDispatcher] Could not raise a request for task ${task.ID}: ` +
                     `${request.LatestResult?.CompleteMessage ?? 'unknown error'}`);
                 // A failed SAVE may be transient (deadlock, contention), so this one earns a retry.
@@ -1281,15 +2210,25 @@ export class TaskGraphDispatcher {
             return null;
         }
     }
-    /** The still-open request for a task, if one exists. */
-    async findOpenRequest(provider, taskID) {
+    /**
+     * Every still-open request for a task, oldest first.
+     *
+     * Plural, and ordered, for one reason each. Ordered, because the oldest row is the one every
+     * instance must agree is "the" request — it is the one the assignee most likely already saw,
+     * and the one `withdrawDuplicateRequests` keeps; unordered, two instances could each decide a
+     * different duplicate was the keeper and withdraw each other's. Plural, because a caller that
+     * only ever sees the first cannot notice there are two, which is how the duplicate below
+     * survived: every reader of this took `[0]` and moved on.
+     */
+    async findOpenRequests(provider, taskID) {
         const result = await RunView.FromMetadataProvider(provider).RunView({
             EntityName: 'MJ: AI Agent Requests',
             ExtraFilter: `OriginatingTaskID='${taskID}' AND Status='Requested'`,
+            OrderBy: '__mj_CreatedAt ASC, ID ASC',
             ResultType: 'entity_object',
             BypassCache: true,
         }, this.contextUser);
-        return (result.Success ? result.Results?.[0] : null) ?? null;
+        return (result.Success ? result.Results : null) ?? [];
     }
     /**
      * Settles a human task from the request a person answered.
@@ -1306,7 +2245,7 @@ export class TaskGraphDispatcher {
     async settleAnsweredHumanTasks(provider, graphID) {
         const waiting = await RunView.FromMetadataProvider(provider).RunView({
             EntityName: 'MJ: Tasks',
-            ExtraFilter: `ParentID='${graphID}' AND StepType='Human' AND Status='Pending'`,
+            ExtraFilter: `ParentID='${graphID}' AND ${HumanTaskSQL()} AND Status='Pending'`,
             ResultType: 'entity_object',
             BypassCache: true,
         }, this.contextUser);
@@ -1336,11 +2275,27 @@ export class TaskGraphDispatcher {
             if (!(await task.Save())) {
                 LogError(`[TaskGraphDispatcher] Could not settle human task ${task.ID}: ` +
                     `${task.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+                continue;
             }
+            // WITHDRAW EVERY OTHER OPEN ASK FOR THIS STEP (R3-5).
+            //
+            // The step is terminal now, so both human sweeps — which scope to `Pending` tasks — will
+            // never look at it again, and any request still `Requested` is un-answerable and
+            // immortal: the assignee keeps seeing "a workflow is waiting on you" for a step that is
+            // finished. Duplicates only arose from the raise race fixed above, but this also
+            // retroactively cleans the ones already minted, which the raise-side fix cannot reach.
+            await this.withdrawOpenRequests(provider, [task.ID], 'This step has been settled; the request is no longer open.');
         }
     }
     /**
-     * Re-opens a human step whose request was CANCELLED.
+     * Reconciles the requests behind human steps that are waiting on somebody.
+     *
+     * Two things can be wrong with a waiting step, and both are silent. It can have NO open request
+     * — the cancel case below — or it can have MORE than one, which the raise cannot fix because it
+     * never runs again for a notified task. Both are corrected here, on the only sweep that visits
+     * these tasks every pass.
+     *
+     * **Re-opening a human step whose request was CANCELLED.**
      *
      * `answeredRequestFor` deliberately excludes `Canceled`, because cancelling withdraws the ASK
      * rather than deciding the step — the task is supposed to keep waiting "for whatever replaces
@@ -1353,7 +2308,7 @@ export class TaskGraphDispatcher {
      * and raises a fresh request, which is exactly the replacement the design assumed. Bounded by
      * human action: it takes another person cancelling again to come back here.
      */
-    async reopenCancelledHumanTasks(provider, graphID) {
+    async reconcileWaitingHumanTasks(provider, graphID) {
         const waiting = await RunView.FromMetadataProvider(provider).RunView({
             EntityName: 'MJ: Tasks',
             // `StepType` is NULLABLE, and rows predating the column exist (4 in the reference
@@ -1364,7 +2319,7 @@ export class TaskGraphDispatcher {
             // this to tasks the dispatcher raised a request for, so the widening cannot pull in
             // unrelated work.
             ExtraFilter: `ParentID='${graphID}' AND Status='Pending' ` +
-                `AND (StepType='Human' OR (StepType IS NULL AND UserID IS NOT NULL)) ` +
+                `AND ${HumanTaskSQL()} ` +
                 `AND ClaimedBy='${HUMAN_TASK_NOTIFIED_MARKER}'`,
             ResultType: 'entity_object',
             BypassCache: true,
@@ -1375,8 +2330,13 @@ export class TaskGraphDispatcher {
             // Only when there is nothing live AND nothing terminal. A task with an open request is
             // simply waiting; one with a terminal request is settled on the next pass by
             // settleAnsweredHumanTasks, and re-raising either would ask the same question twice.
-            if (await this.findOpenRequest(provider, task.ID))
+            const open = await this.findOpenRequests(provider, task.ID);
+            if (open.length > 0) {
+                // Waiting, correctly — but on however many asks happen to exist. Collapse them here
+                // or nothing ever will: the raise is behind the notified marker for good.
+                await this.withdrawDuplicateRequests(provider, task.ID, open, open[0].ID);
                 continue;
+            }
             if (await this.answeredRequestFor(provider, task.ID))
                 continue;
             LogStatus(`[TaskGraphDispatcher] The request for '${task.Name}' was cancelled and nothing ` +
@@ -1414,7 +2374,7 @@ export class TaskGraphDispatcher {
         const humanTasks = await RunView.FromMetadataProvider(provider).RunView({
             EntityName: 'MJ: Tasks',
             Fields: ['ID'],
-            ExtraFilter: `ParentID='${graphID}' AND StepType='Human' AND Status='Pending'`,
+            ExtraFilter: `ParentID='${graphID}' AND ${HumanTaskSQL()} AND Status='Pending'`,
             ResultType: 'simple',
         }, this.contextUser);
         const ids = (humanTasks.Results ?? []).map((r) => `'${r.ID}'`);
@@ -1450,7 +2410,7 @@ export class TaskGraphDispatcher {
         }
     }
     /** Loads a graph's children and edges in the shapes both the algorithms and mutation need. */
-    async loadGraphState(provider, parentTaskID) {
+    async loadGraphState(provider, parentTaskID, debug) {
         const rv = RunView.FromMetadataProvider(provider);
         // BypassCache throughout: task status is written by the claim protocol's direct SQL, which
         // fires no cache invalidation. See findActiveGraphIDs.
@@ -1459,7 +2419,8 @@ export class TaskGraphDispatcher {
         if (children.length === 0) {
             return {
                 nodes: [], edges: [], entityById: new Map(),
-                unreachableTaskIDs: new Set(), skipSeedTaskIDs: new Set(), holdTaskIDs: new Set(),
+                unreachableTaskIDs: new Set(), cascadeSkipTaskIDs: new Set(),
+                skipSeedTaskIDs: new Set(), holdTaskIDs: new Set(),
                 handledFailureIDs: new Set(),
             };
         }
@@ -1467,6 +2428,19 @@ export class TaskGraphDispatcher {
         const depsResult = await rv.RunView({ EntityName: 'MJ: Task Dependencies', ExtraFilter: `TaskID IN (${idList})`, ResultType: 'entity_object', BypassCache: true }, this.contextUser);
         const deps = (depsResult.Success ? depsResult.Results : []) ?? [];
         const entityById = new Map(children.map((c) => [c.ID, c]));
+        // Read ONCE, and only when it can change an answer (R2-4). Both consumers below — which
+        // origin statuses may decide an exclusive group, and which failures count as handled — are
+        // no-ops unless something has actually failed, and this runs on every poll for every active
+        // graph, so the parent load stays behind the same cheap exit `computeHandledFailures` used.
+        // One parent read serves both questions this pass asks of the metadata bag.
+        const parentMeta = await this.readParentMetadataFor(provider, parentTaskID);
+        const failureSemantics = parentMeta.failureSemantics;
+        // The invocation's own parameters, carried on the parent so a condition evaluated by any
+        // instance sees what the walker saw (R3-3).
+        const invocation = {
+            Data: parentMeta.invocation?.data,
+            Context: parentMeta.invocation?.context,
+        };
         // Conditional edges are resolved HERE, before eligibility runs, by dropping edges whose
         // condition does not hold. Expressing it as edge removal rather than as a second rule inside
         // the eligibility algorithm is what keeps one definition of "ready": a task with no live
@@ -1491,6 +2465,12 @@ export class TaskGraphDispatcher {
         // only ResolveExclusiveGroups can decide.
         const exclusive = deps.filter((d) => !!d.ExclusiveGroup);
         const ordinary = deps.filter((d) => !d.ExclusiveGroup);
+        // Named once and consumed twice — by the resolution below and by the `GateDecision` frame
+        // emission further down. Two copies of this rule is how the console starts narrating
+        // decisions the engine no longer makes.
+        const decidingStatuses = failureSemantics === 'edges'
+            ? new Set(['Complete', 'Failed'])
+            : new Set(['Complete']);
         const resolution = ResolveExclusiveGroups(exclusive.map((d) => ({
             id: d.ID,
             taskId: d.TaskID,
@@ -1499,19 +2479,46 @@ export class TaskGraphDispatcher {
             originStatus: (entityById.get(d.DependsOnTaskID)?.Status ?? 'Pending'),
             priority: d.Priority ?? 0,
             sequence: d.Sequence ?? 0,
-            conditionOutcome: this.evaluateExclusiveCondition(d, entityById),
+            conditionOutcome: this.evaluateExclusiveCondition(d, entityById, invocation, debug),
         })), 
-        // A flow's failure handling is its outgoing edges, so a Failed origin still decides its
-        // group. For a loop-agent graph the set is Complete-only and nothing changes.
-        new Set(['Complete', 'Failed']));
+        // WHICH STATUSES MAY DECIDE — the graph's own failure dialect, not a constant.
+        //
+        // Under `'edges'`, a flow's failure handling IS its outgoing edges, so a Failed origin
+        // decides its group and the drawn recovery path runs. Under `'block'` — the spec's
+        // DEFAULT — a failure is terminal for everything downstream, and letting it decide was
+        // silently catastrophic: the losers were removed and seeded, `ComputeSkipCascade`
+        // confirmed them `Skipped`, `Skipped` satisfies dependents, and because the removed
+        // loser edges also sever `ComputeTasksToBlock`'s forward walk, a join fed by an
+        // independent healthy route EXECUTED downstream of an unhandled failure. The parent
+        // still rolled up Failed, so the verdict looked right while the side effects had fired.
+        //
+        // The old comment claimed a loop-agent graph saw Complete-only. It did not; the same
+        // hardcoded set was passed for every graph.
+        decidingStatuses);
         const loserEdgeIDs = new Set(resolution.loserEdgeIDs);
+        // Targets of an edge whose condition could not be evaluated (P2). Neither eligible nor
+        // skipped: the edge stays live so the target is not mistaken for unreachable, and the target
+        // joins the hold set so nothing claims it.
+        const heldByCondition = new Set();
+        // Decisions collected for `GateDecision` frames — announced after the state is assembled,
+        // change-only, so a viewer learns WHY a branch ran (or is held) the moment it is decided.
+        const gateDecisions = [];
         for (const d of ordinary) {
             if (d.Condition?.trim()) {
-                const outcome = this.evaluateEdgeCondition(d, entityById);
-                if (outcome === 'drop') {
+                const decision = this.evaluateEdgeCondition(d, entityById, failureSemantics, invocation, debug);
+                if (decision.decided) {
+                    gateDecisions.push({
+                        edge: d,
+                        verdict: decision.outcome === 'keep' ? 'satisfied' : decision.outcome === 'drop' ? 'notTaken' : 'held',
+                        reason: decision.reason,
+                    });
+                }
+                if (decision.outcome === 'drop') {
                     droppedInto.add(d.TaskID);
                     continue;
                 }
+                if (decision.outcome === 'hold')
+                    heldByCondition.add(d.TaskID);
             }
             stillReachable.add(d.TaskID);
             liveEdges.push({
@@ -1535,17 +2542,105 @@ export class TaskGraphDispatcher {
         // Only unreachable when EVERY route in was cut. A node still holding a live edge is simply
         // waiting on it, and a node reached by an alternate branch is genuinely reachable.
         const unreachableTaskIDs = new Set([...droppedInto].filter((id) => !stillReachable.has(id)));
+        // EXCLUSIVE LOSERS GET THE SAME TEST — they did not, and that is P1.
+        //
+        // A loser's target was seeded and written `Skipped` unconditionally, with no "does another
+        // live route reach it?" check. The shape that breaks: `A →(cond)→ Review → Publish` and
+        // `A →(else)→ Publish`. With the condition true, the losing edge `A→Publish` skipped
+        // **Publish** while Review was still running; Review completed, Publish was already
+        // terminal, and `Skipped` satisfies dependents — so the graph settled Complete with the
+        // publish step never executed. No error and no stall.
+        //
+        // Confirmed against `liveEdges`, which by this point has both losers and definitely-false
+        // edges removed, so "a live gating edge still points here" is exactly the surviving-route
+        // question. A genuine loser has none and is still skipped.
+        const confirmedSkipSeeds = new Set(ConfirmSkipSeeds([...resolution.skipSeedTaskIDs], liveEdges));
+        // Exclusive edges get verdicts too, once their origin can decide them: a loser is a branch
+        // not taken, a member of an undecided group is held, a surviving edge is satisfied. Same
+        // vocabulary as ordinary edges so a viewer never needs to know which dialect an edge was.
+        //
+        // GATED ON THE SAME `terminalDecides` SET THE RESOLUTION USED — not on
+        // `TERMINAL_FOR_CONDITIONS`. Since R2-4 a `Failed` origin decides its group only under
+        // `failureSemantics: 'edges'`; announcing from the wider set would tell a viewer the fork
+        // resolved while under `'block'` the engine deliberately left it undecided and let the
+        // ordinary block cascade own everything downstream. A console that narrates decisions the
+        // engine did not make is worse than one that stays quiet.
+        const exclusiveHolds = new Set(resolution.holdTaskIDs);
+        for (const d of exclusive) {
+            const originStatus = entityById.get(d.DependsOnTaskID)?.Status ?? 'Pending';
+            if (!decidingStatuses.has(originStatus) && !OverrideVerdictFor(debug ?? {}, d.ID))
+                continue;
+            gateDecisions.push({
+                edge: d,
+                verdict: loserEdgeIDs.has(d.ID)
+                    ? 'notTaken'
+                    : exclusiveHolds.has(d.TaskID) ? 'held' : 'satisfied',
+                reason: exclusiveHolds.has(d.TaskID)
+                    ? 'this fork is undecided — a path in its group cannot be answered yet'
+                    : undefined,
+            });
+        }
+        this.emitGateDecisions(provider, parentTaskID, gateDecisions, entityById);
         const nodes = children.map((c) => ({ id: c.ID, status: c.Status }));
+        // THE CASCADE IS COMPUTED HERE, NOT ONLY AT SKIP TIME (R2-14).
+        //
+        // The claim filter covered seeds, holds and unreachable targets but not the cascade's
+        // DESCENDANTS, and the skip writes are sequential per-entity saves. Between a seed's
+        // `Skipped` landing and its descendants', another instance's fresh load sees
+        // Skipped-satisfies-prerequisites and finds those descendants eligible — so it claims and
+        // executes a branch that was never taken, irreversibly if the step has side effects.
+        //
+        // The set is already needed by the propagation pass, so computing it once here costs
+        // nothing and closes the window by construction: nothing that is about to be skipped is
+        // claimable, whichever instance is looking.
+        const allSkipSeeds = [...confirmedSkipSeeds, ...unreachableTaskIDs];
+        const cascadeSkipTaskIDs = new Set([
+            ...allSkipSeeds,
+            ...ComputeSkipCascade(nodes, liveEdges, allSkipSeeds),
+        ]);
+        // A DECLARED EARLY FINISH MAKES EVERY REMAINING STEP UNCLAIMABLE (R3-1).
+        //
+        // The declaration is durable, so this holds for every instance rather than only the one that
+        // decided it — which is the whole point. Folded into the same set the claim filter already
+        // consults, so nothing about to be skipped can be claimed and started in the window between
+        // the decision and the skip writes.
+        if (parentMeta.earlyFinishedAt) {
+            for (const node of nodes) {
+                if (node.status === 'Pending')
+                    cascadeSkipTaskIDs.add(node.id);
+            }
+        }
         return {
             nodes,
             edges: liveEdges,
             entityById,
             unreachableTaskIDs,
-            skipSeedTaskIDs: new Set(resolution.skipSeedTaskIDs),
-            holdTaskIDs: new Set(resolution.holdTaskIDs),
-            handledFailureIDs: await this.computeHandledFailures(provider, parentTaskID, nodes, liveEdges),
+            cascadeSkipTaskIDs,
+            skipSeedTaskIDs: confirmedSkipSeeds,
+            // Exclusive holds and ordinary-condition holds are the same state and share one set:
+            // "we cannot tell yet, so nothing may claim this."
+            holdTaskIDs: new Set([...resolution.holdTaskIDs, ...heldByCondition]),
+            handledFailureIDs: this.computeHandledFailures(failureSemantics, nodes, liveEdges),
         };
     }
+    /**
+     * Reports an unevaluable condition ONCE per edge, not once per poll.
+     *
+     * Eligibility is recomputed every cycle, so an unqualified LogError here would repeat every few
+     * seconds for as long as the graph is held — which buries the one line that matters under
+     * thousands of copies of itself. Keyed by edge id plus the failure text, so a condition that
+     * starts failing differently is reported again.
+     */
+    logUnevaluableConditionOnce(dep, errorMessage) {
+        const key = `${dep.ID}:${errorMessage ?? ''}`;
+        if (this.reportedUnevaluableConditions.has(key))
+            return;
+        this.reportedUnevaluableConditions.add(key);
+        LogError(`[TaskGraphDispatcher] Dependency ${dep.ID} has an unevaluable condition ` +
+            `(${errorMessage}); condition text: ${JSON.stringify(dep.Condition)}. ` +
+            `Task ${dep.TaskID} is HELD — it will not run and will not be skipped until the ` +
+            `condition can be evaluated. The graph reports as stalled while this holds.`);
+    }
     /**
      * Decides whether a conditional dependency edge is live.
      *
@@ -1553,38 +2648,55 @@ export class TaskGraphDispatcher {
      * only information a runtime graph has to branch on. Returns `'drop'` only on a definite false;
      * an unevaluable condition keeps the edge for the reason stated at the call site.
      */
-    evaluateEdgeCondition(dep, entityById) {
+    evaluateEdgeCondition(dep, entityById, failureSemantics, invocation, debug) {
+        // An operator's override answers the edge BEFORE the condition is consulted — an override
+        // exists precisely because the condition cannot be answered (or answered wrongly), so
+        // evaluating first would re-produce the hold the override exists to end.
+        const override = OverrideVerdictFor(debug ?? {}, dep.ID);
+        if (override) {
+            return {
+                outcome: override === 'true' ? 'keep' : 'drop',
+                reason: `answered '${override}' by an operator override`,
+                decided: true,
+            };
+        }
         const upstream = entityById.get(dep.DependsOnTaskID);
         if (!upstream)
-            return 'keep';
-        // TERMINALITY GUARD — fixes a latent bug, not a hypothetical one.
-        //
-        // Without it, every conditional edge is evaluated on every poll cycle, including while its
-        // origin is still Pending. A condition like `succeeded` is then a DEFINITE FALSE, the edge
-        // is dropped, and the target is Blocked at wave one — permanently, before the origin ever
-        // ran. That kills any conditioned linear chain, which is the most common flow shape there
-        // is.
+            return { outcome: 'keep', decided: false };
+        // The DECISION lives in `condition-gate`; what stays here is the loading and the logging.
         //
-        // A non-terminal origin is UNDECIDED, and 'keep' is the safe reading of undecided: the
-        // prerequisite gate already prevents the target starting early, so keeping the edge costs
-        // nothing and dropping it is irreversible.
-        if (!TERMINAL_FOR_CONDITIONS.has(upstream.Status))
-            return 'keep';
-        let output = null;
-        if (upstream.OutputPayload) {
-            try {
-                output = JSON.parse(upstream.OutputPayload);
-            }
-            catch { /* a malformed payload is not grounds to drop a prerequisite */ }
-        }
-        const result = this.conditionEvaluator.Evaluate(dep.Condition, this.buildConditionContext(upstream, output));
-        if (!result.Success) {
-            LogError(`[TaskGraphDispatcher] Dependency ${dep.ID} has an unevaluable condition ` +
-                `(${result.ErrorMessage}); keeping the edge so the graph stalls visibly rather than ` +
-                `running ${dep.TaskID} out of order.`);
-            return 'keep';
-        }
-        return result.Value ? 'keep' : 'drop';
+        // `DecideGate` takes the evaluation as a thunk rather than a value, and that is the fix, not
+        // a style: the terminality guard has to stop the evaluation happening at all. Evaluating
+        // `succeeded` against a still-Pending origin does not fail — it returns a confident, wrong
+        // `false`, the edge is dropped, and the target is Blocked at wave one before the origin ever
+        // ran. That killed every conditioned linear chain, with no error anywhere.
+        let unevaluableError;
+        let evaluated = false;
+        const outcome = DecideGate(upstream.Status, failureSemantics, () => {
+            evaluated = true;
+            const result = this.conditionEvaluator.Evaluate(dep.Condition, BuildConditionContext(upstream, ParseConditionOutput(upstream.OutputPayload), invocation));
+            if (!result.Success)
+                unevaluableError = result.ErrorMessage;
+            return result;
+        });
+        // Reported here rather than inside the decision, so the pure part stays pure and a held edge
+        // is still loud once — see logUnevaluableConditionOnce.
+        if (outcome === 'hold')
+            this.logUnevaluableConditionOnce(dep, unevaluableError);
+        return {
+            outcome,
+            reason: outcome === 'hold'
+                ? (unevaluableError ?? 'the condition cannot be answered yet')
+                : undefined,
+            // A verdict was rendered only when the gate was genuinely ASKED. Terminality alone is
+            // not enough since R3-2: a Failed origin under 'block' (and a Cancelled origin under
+            // either dialect) returns 'keep' WITHOUT evaluating, so the block cascade owns the
+            // target — announcing that as "satisfied" would tell a viewer a gate opened that
+            // DecideGate deliberately never asked. `evaluated` is set by the thunk itself, so this
+            // cannot drift from the gate's own rules; a Skipped origin's unevaluated drop is still
+            // a verdict a viewer needs (the branch was not taken).
+            decided: evaluated || (upstream.Status === 'Skipped' && outcome === 'drop'),
+        };
     }
     /**
      * An exclusive edge's condition as a three-way outcome.
@@ -1593,55 +2705,70 @@ export class TaskGraphDispatcher {
      * the branch, the second holds the whole group. The generic keep/drop path cannot express that
      * difference, which is why exclusive edges take this route instead.
      */
-    evaluateExclusiveCondition(dep, entityById) {
+    evaluateExclusiveCondition(dep, entityById, invocation, debug) {
+        // Same override-first rule as ordinary edges — see evaluateEdgeCondition.
+        const override = OverrideVerdictFor(debug ?? {}, dep.ID);
+        if (override)
+            return override === 'true' ? 'satisfied' : 'unsatisfied';
         if (!dep.Condition?.trim())
             return 'satisfied';
         const upstream = entityById.get(dep.DependsOnTaskID);
         if (!upstream)
             return 'unevaluable';
-        let output = null;
-        if (upstream.OutputPayload) {
-            try {
-                output = JSON.parse(upstream.OutputPayload);
-            }
-            catch { /* malformed payload */ }
-        }
-        const result = this.conditionEvaluator.Evaluate(dep.Condition, this.buildConditionContext(upstream, output));
+        const result = this.conditionEvaluator.Evaluate(dep.Condition, 
+        // The invocation envelope rides the EXCLUSIVE dialect too. R3-3 threaded it into the
+        // ordinary path; a flow's XOR branch reading `data.userApproval` is the same documented
+        // condition on a different edge kind, and `BuildConditionContext`'s defaulted parameter
+        // made omitting it here silently evaluate those roots against nothing.
+        BuildConditionContext(upstream, ParseConditionOutput(upstream.OutputPayload), invocation));
+        // SAME CLASSIFICATION AS THE ORDINARY DIALECT (R2-3). The null-safe envelope already makes
+        // one level of absence read as false here, but a deeper absent chain still throws — and
+        // calling that 'unevaluable' would hold the whole group forever on a terminal origin, while
+        // `DecideGate` would have dropped the identical condition. Two dialects, one question.
         if (!result.Success)
-            return 'unevaluable';
+            return IsBrokenGuard(result.ErrorMessage) ? 'unevaluable' : 'unsatisfied';
         return result.Value ? 'satisfied' : 'unsatisfied';
     }
     /**
-     * Everything an edge condition can see — the SUPERSET of both dialects.
+     * Announces gate verdicts that CHANGED since this instance last looked.
      *
-     * A flow condition is written against `payload` / `stepResult` / `flowContext` / `data` /
-     * `context`; the dispatcher's own conditions are written against `status` / `succeeded` /
-     * `failed` / `output` / `errorMessage`. Compiling flows onto this engine without the flow
-     * dialect would make every `payload.x` condition evaluate against nothing — silently, since an
-     * undefined property is simply falsy. Both dialects are readable here so a condition means the
-     * same thing on either engine.
-     *
-     * `payload` is the ORIGIN task's post-step snapshot. There is deliberately no "graph-wide
-     * payload": each task's output is its own, and inventing a merged one would give conditions a
-     * value the flow engine never had.
+     * Fire-and-forget by design: `loadGraphState` is synchronous graph assembly, and the owner
+     * lookup the frame needs is async — so the emission floats behind rather than making state
+     * loading wait on observability. Frames are commentary, never a step of the work.
      */
-    buildConditionContext(upstream, output) {
-        const envelope = (output && typeof output === 'object' ? output : {});
-        const succeeded = upstream.Status === 'Complete';
-        return {
-            // dispatcher dialect — unchanged
-            status: upstream.Status,
-            succeeded,
-            failed: upstream.Status === 'Failed',
-            output,
-            errorMessage: upstream.ErrorMessage ?? null,
-            // flow dialect
-            payload: envelope.payload ?? output,
-            stepResult: { Success: succeeded, step: upstream.Name, result: envelope.result ?? output },
-            flowContext: { currentStepId: upstream.ID, completedSteps: [], executionPath: [], stepCount: 0 },
-            data: envelope.data ?? {},
-            context: envelope.context ?? {},
-        };
+    emitGateDecisions(provider, parentTaskID, decisions, entityById) {
+        if (!this.observer || decisions.length === 0)
+            return;
+        let perEdge = this.emittedGateVerdicts.get(parentTaskID);
+        if (!perEdge) {
+            perEdge = new Map();
+            this.emittedGateVerdicts.set(parentTaskID, perEdge);
+        }
+        const changed = decisions.filter((d) => {
+            const key = `${d.verdict}|${d.reason ?? ''}`;
+            if (perEdge.get(d.edge.ID) === key)
+                return false;
+            perEdge.set(d.edge.ID, key);
+            return true;
+        });
+        if (changed.length === 0)
+            return;
+        void this.resolveOwner(provider, parentTaskID).then((owner) => {
+            for (const d of changed) {
+                this.emit({
+                    Kind: 'GateDecision',
+                    ParentTaskID: parentTaskID,
+                    OwnerUserID: owner,
+                    TaskID: d.edge.TaskID,
+                    TaskName: entityById.get(d.edge.TaskID)?.Name,
+                    EdgeID: d.edge.ID,
+                    DependsOnTaskID: d.edge.DependsOnTaskID,
+                    Verdict: d.verdict,
+                    ConditionText: d.edge.Condition ?? undefined,
+                    Reason: d.reason,
+                });
+            }
+        }).catch(() => { });
     }
     /** Parsed `OutputPayload` of each completed dependency, keyed by that task's ID. */
     async loadDependencyOutputs(provider, taskID) {
@@ -1676,7 +2803,7 @@ export class TaskGraphDispatcher {
      * Every branch is normalized to one shape so the recording path above stays single: an action has
      * no agent run to point at, because its forensics live in `ActionExecutionLog` instead.
      */
-    async runTaskBody(task, provider, inputPayload, dependencyOutputs) {
+    async runTaskBody(task, provider, inputPayload, dependencyOutputs, onProgress) {
         const payload = this.mergedPayload(inputPayload, dependencyOutputs);
         const config = task.ConfigurationObject;
         // A loop's own step type decides how many times its body runs; the body itself is dispatched
@@ -1714,6 +2841,7 @@ export class TaskGraphDispatcher {
                 TemplateParameters: config?.prompt?.templateParameters,
                 Provider: provider,
                 ContextUser: this.contextUser,
+                OnProgress: onProgress,
             });
             // A prompt's response is DEEP-MERGED into the payload rather than replacing it. A prompt
             // answers one question; replacing the payload with its answer would discard everything
@@ -1742,8 +2870,9 @@ export class TaskGraphDispatcher {
                     DependencyOutputs: dependencyOutputs,
                     Provider: provider,
                     ContextUser: this.contextUser,
+                    OnProgress: onProgress,
                 }), AgentRunID: null }
-            : await this.runAgentNode(task, provider, effectiveInput, dependencyOutputs);
+            : await this.runAgentNode(task, provider, effectiveInput, dependencyOutputs, onProgress);
         return {
             ...raw,
             Output: this.applyStepOutputMapping(task, payload, raw.Output, config?.outputMapping),
@@ -2015,7 +3144,7 @@ export class TaskGraphDispatcher {
      * Depth and provenance are read together because they come from the same row: the graph's parent
      * task knows both how many continuation hops led here and which run submitted it.
      */
-    async runAgentNode(task, provider, effectiveInput, dependencyOutputs) {
+    async runAgentNode(task, provider, effectiveInput, dependencyOutputs, onProgress) {
         const context = await this.graphContext(provider, task);
         return this.agentRunner.RunAgentForTask({
             TaskID: task.ID,
@@ -2026,8 +3155,193 @@ export class TaskGraphDispatcher {
             SubmittingAgentRunID: context.SubmittingAgentRunID,
             Provider: provider,
             ContextUser: this.contextUser,
+            OnProgress: onProgress,
         });
     }
+    /**
+     * Leaves exactly one open request standing for a task, withdrawing any others.
+     *
+     * The oldest wins — it is the one whose notification the assignee most likely already saw.
+     *
+     * **Called from every path that reads a task's open requests**, not only from the raise. That is
+     * deliberate and it is the half R3-5 first got wrong: a task is notified exactly once, and
+     * `notifyHumanTaskReady` returns at the marker forever after, so a duplicate minted after that
+     * pass — by an instance that crashed between its insert and its de-dup, or by any build older
+     * than this one — was never looked at again by the only code that could have collapsed it. The
+     * waiting-task sweep is what actually reaches those.
+     *
+     * @param open the task's open requests, oldest first
+     * @param keepIfSole the row this caller is responsible for, named only for the log
+     */
+    async withdrawDuplicateRequests(provider, taskID, open, keepIfSole) {
+        if (open.length <= 1)
+            return;
+        try {
+            LogStatus(`[TaskGraphDispatcher] Task ${taskID} had ${open.length} open requests — keeping the ` +
+                `oldest (${open[0].ID}${UUIDsEqual(open[0].ID, keepIfSole) ? ', this instance\'s' : ''}) and withdrawing the rest.`);
+            for (const duplicate of open.slice(1)) {
+                duplicate.Status = 'Canceled';
+                duplicate.Comments = 'A duplicate request for the same step; the earlier one stands.';
+                if (!(await duplicate.Save())) {
+                    LogError(`[TaskGraphDispatcher] Could not withdraw duplicate request ${duplicate.ID}: ` +
+                        `${duplicate.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+                }
+            }
+        }
+        catch (e) {
+            LogError(`[TaskGraphDispatcher] Could not de-duplicate requests for task ${taskID}: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    /**
+     * Closes the still-open asks raised for tasks that will never be answered.
+     *
+     * `Canceled` rather than `Expired`: nobody ran out of time, the ask was withdrawn — and the two
+     * mean different things downstream, since an expired human step is treated as a FAILURE that a
+     * give-up edge can route around, which would be a lie about a step the workflow decided it no
+     * longer needed.
+     *
+     * Failures are logged and never propagated. The graph's outcome is already decided; refusing to
+     * finish over an inbox row would trade a stale notification for a stalled workflow.
+     */
+    async withdrawOpenRequests(provider, taskIDs, reason) {
+        if (taskIDs.length === 0)
+            return;
+        try {
+            const idList = taskIDs.map((id) => `'${id}'`).join(',');
+            const open = await RunView.FromMetadataProvider(provider).RunView({
+                EntityName: 'MJ: AI Agent Requests',
+                ExtraFilter: `Status='Requested' AND OriginatingTaskID IN (${idList})`,
+                ResultType: 'entity_object',
+                BypassCache: true,
+            }, this.contextUser);
+            if (!open.Success) {
+                LogError(`[TaskGraphDispatcher] Could not read open requests to withdraw: ${open.ErrorMessage}`);
+                return;
+            }
+            for (const request of open.Results ?? []) {
+                request.Status = 'Canceled';
+                request.Comments = reason;
+                if (!(await request.Save())) {
+                    LogError(`[TaskGraphDispatcher] Could not withdraw request ${request.ID}: ` +
+                        `${request.LatestResult?.CompleteMessage ?? 'unknown error'}. It will keep showing ` +
+                        `in someone's inbox for a step that will never run.`);
+                }
+            }
+        }
+        catch (e) {
+            LogError(`[TaskGraphDispatcher] Could not withdraw open requests: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    /**
+     * Says once, per graph, that this instance settled work it cannot announce.
+     *
+     * Once because the sweep re-offers the graph every poll for the rest of its window, and a line
+     * per poll would bury the thing it is trying to report — which is a DEPLOYMENT fact, not a graph
+     * fact: if no instance anywhere carries a deliverer, these settlements never reach anyone.
+     */
+    reportUndeliverableOnce(parentID) {
+        if (this.reportedUndeliverable.has(parentID))
+            return;
+        this.reportedUndeliverable.add(parentID);
+        LogStatus(`[TaskGraphDispatcher] Graph ${parentID} has settled but this instance has no continuation ` +
+            `deliverer, so it is leaving the announcement to a peer that has one. If no instance in ` +
+            `this deployment can deliver, the settlement will never be announced.`);
+    }
+    /**
+     * Keeps a graph in this instance's sweep regardless of what its row timestamp says.
+     *
+     * Bounded, and the bound is about noise rather than surrender: past the cap the graph has failed
+     * on every attempt for minutes, so another identical attempt will not fix it, and continuing
+     * costs a full graph load per poll forever. It is reported once and left to the startup sweep.
+     */
+    keepRetryingSettlement(parentID) {
+        const passes = (this.retryingSettlement.get(parentID) ?? 0) + 1;
+        if (passes > MAX_SETTLEMENT_RETRY_PASSES) {
+            this.retryingSettlement.delete(parentID);
+            LogError(`[TaskGraphDispatcher] Graph ${parentID} has failed to settle on ${MAX_SETTLEMENT_RETRY_PASSES} ` +
+                `consecutive passes; this instance will stop re-queueing it. Its submitting run may be ` +
+                `left Paused. A restart's startup sweep will try again.`);
+            return;
+        }
+        this.retryingSettlement.set(parentID, passes);
+    }
+    /**
+     * A graph's durable metadata bag, for the questions a pass asks of it.
+     *
+     * Defaults on any failure to read it, and the defaults are the safe directions: `'block'` means
+     * a failed step decides nothing, so a graph whose metadata we cannot read stalls visibly instead
+     * of resolving forks on the say-so of a failure; and no early-finish declaration means nothing
+     * is removed from the claim filter on the strength of a read that did not work.
+     */
+    async readParentMetadataFor(provider, parentTaskID) {
+        try {
+            const parent = await provider.GetEntityObject('MJ: Tasks', this.contextUser);
+            if (await parent.Load(parentTaskID))
+                return ParseTaskGraphParentMetadata(parent.InputPayload);
+        }
+        catch { /* fall through to the safe defaults */ }
+        return ParseTaskGraphParentMetadata(null);
+    }
+    /**
+     * Whether the submitting run is in a state where this pass's writes to it will mean anything.
+     *
+     * **Read-only on purpose.** The settled branch's write order — layout, frame, cost, lifecycle,
+     * delivery — is load-bearing and documented at each step; this asks the question those writes
+     * depend on without joining them. What it prevents is a pass that goes through the motions and
+     * then claims the delivery marker, making itself the last pass ever to look at the graph.
+     *
+     * Three answers, and the middle one is the bug:
+     *
+     *  - **no run** — a scheduled or remote-triggered graph has nobody waiting. Proceed.
+     *  - **still `Running`** — `finalizeAgentRun` has not parked it yet. The graph beat its own
+     *    submitter to the finish line, which is ordinary for a fast graph and lasts milliseconds.
+     *    Defer: one poll later the run is parked and everything lands.
+     *  - **anything else** — `Paused` (settle it), or already `Completed`/`Failed`/`Cancelled` for
+     *    its own reasons (leave it; the lifecycle write's own guard declines). Proceed.
+     *
+     * **The deferral is bounded**, because "not parked yet" and "the submitting process died before
+     * it could park" look identical from here. Waiting forever on the second would lose the outcome
+     * of work that actually completed — strictly worse than announcing it late — so past the grace
+     * period this proceeds and says why. The run itself stays `Running`, which is visibly wrong and
+     * belongs to whatever reconciles abandoned runs, not to the graph that finished correctly.
+     */
+    async submittingRunReadiness(provider, parent) {
+        const meta = ParseTaskGraphParentMetadata(parent.InputPayload);
+        if (!meta.submittedByAgentRunID)
+            return { Verdict: 'ready', SubmitterCancelled: false };
+        try {
+            const run = await provider.GetEntityObject('MJ: AI Agent Runs', this.contextUser);
+            if (!(await run.Load(meta.submittedByAgentRunID))) {
+                // Transient, most likely. Deferring costs a poll; proceeding costs the marker.
+                LogError(`[TaskGraphDispatcher] Could not read run ${meta.submittedByAgentRunID} to check whether graph ${parent.ID} may settle it; retrying next pass.`);
+                return { Verdict: 'defer', SubmitterCancelled: false };
+            }
+            // A CANCELLED SUBMITTER HAS NOBODY WAITING (R2-9). Settlement still runs — the graph's
+            // own bookkeeping is owed either way — but announcing it would message a conversation
+            // about a workflow the user stopped, and for `reinvoke` would start a fresh billed turn
+            // for the agent they cancelled.
+            const cancelled = run.Status === 'Cancelled';
+            const settledFor = parent.CompletedAt ? Date.now() - parent.CompletedAt.getTime() : 0;
+            if (!IsSubmittingRunReady(run.Status, settledFor)) {
+                // Still `Running` and inside the grace: `finalizeAgentRun` has not parked it yet.
+                // Defer the whole run-half so nothing claims the marker — see the call site.
+                return { Verdict: 'defer', SubmitterCancelled: cancelled };
+            }
+            if (run.Status === 'Running') {
+                // Ready DESPITE being unparked means the grace has expired: the submitting process
+                // most likely died before it could park. Proceeding loses nothing that is still
+                // recoverable and stops a dead submitter holding a finished workflow's outcome.
+                LogError(`[TaskGraphDispatcher] Run ${run.ID} has been Running for ${Math.round(settledFor / 1000)}s ` +
+                    `since graph ${parent.ID} settled — it never parked, so its submitting process most ` +
+                    `likely died. Settling and delivering the graph anyway; the run needs separate attention.`);
+            }
+            return { Verdict: 'ready', SubmitterCancelled: cancelled };
+        }
+        catch (e) {
+            LogError(`[TaskGraphDispatcher] Could not check the run waiting on graph ${parent.ID}: ${e instanceof Error ? e.message : String(e)}`);
+            return { Verdict: 'defer', SubmitterCancelled: false };
+        }
+    }
     /**
      * Completes the agent run that parked on this graph.
      *
@@ -2053,38 +3367,42 @@ export class TaskGraphDispatcher {
     async settleSubmittingRun(provider, parent, graphStatus) {
         const meta = ParseTaskGraphParentMetadata(parent.InputPayload);
         if (!meta.submittedByAgentRunID)
-            return; // a scheduled or remote-triggered graph has nobody waiting
+            return 'done'; // a scheduled or remote-triggered graph has nobody waiting
         try {
             const run = await provider.GetEntityObject('MJ: AI Agent Runs', this.contextUser);
             if (!(await run.Load(meta.submittedByAgentRunID))) {
                 LogError(`[TaskGraphDispatcher] Could not load run ${meta.submittedByAgentRunID} to settle it against graph ${parent.ID}.`);
-                return;
+                return 'defer';
             }
             if (run.Status !== 'Paused')
-                return;
+                return 'done';
             // The workflow's outcome becomes the run's outcome. A graph that ended any way other than
             // Complete did not do what the run started it to do, and a run reporting success over it
             // would be the same untruth in a different place.
             const succeeded = graphStatus === 'Complete';
-            run.Status = succeeded ? 'Completed' : 'Failed';
-            run.Success = succeeded;
-            run.CompletedAt = new Date();
-            if (!succeeded) {
-                const reason = `The workflow "${parent.Name}" ended ${graphStatus}.`;
-                run.ErrorMessage = run.ErrorMessage ? `${run.ErrorMessage}\n\n${reason}` : reason;
-            }
-            if (!(await run.Save())) {
+            // COLUMN-SCOPED AND GUARDED ON `Paused` (C4), for the same reason every parent write has
+            // been since Round 1: a full-row save carries a stale snapshot of a row another instance
+            // may have moved, and the predicate makes the transition once-only rather than
+            // last-write-wins.
+            const settled = await this.claims.TrySettleRun(provider, run.ID, succeeded, succeeded ? null : `The workflow "${parent.Name}" ended ${graphStatus}.`, this.contextUser);
+            if (!settled) {
                 // Left parked rather than forced. A run stuck at Paused is visibly unfinished, which
                 // is a state someone can investigate; a run flipped to Completed by a write that did
                 // not land would be the same lie this whole change removes.
-                LogError(`[TaskGraphDispatcher] Could not settle run ${run.ID} against graph ${parent.ID}: ` +
-                    `${run.LatestResult?.CompleteMessage ?? 'unknown error'}. It remains Paused.`);
-                return;
+                // Rowcount 0 is either "a peer settled it first" — fine, and the status read above
+                // would have caught the common case — or a write that did not land. Deferring covers
+                // both: a peer's settle makes the next pass's `Paused` check return `done`.
+                LogError(`[TaskGraphDispatcher] Could not settle run ${run.ID} against graph ${parent.ID}; ` +
+                    `it is no longer Paused or the write did not land. Retrying next pass.`);
+                return 'defer';
             }
-            LogStatus(`[TaskGraphDispatcher] Run ${run.ID} settled ${run.Status} — workflow "${parent.Name}" ended ${graphStatus}.`);
+            LogStatus(`[TaskGraphDispatcher] Run ${run.ID} settled ${succeeded ? 'Completed' : 'Failed'} — ` +
+                `workflow "${parent.Name}" ended ${graphStatus}.`);
+            return 'done';
         }
         catch (e) {
             LogError(`[TaskGraphDispatcher] Could not settle the run waiting on graph ${parent.ID}: ${e instanceof Error ? e.message : String(e)}`);
+            return 'defer';
         }
     }
     /**