@mestreyoda/fabrica 0.2.7 → 0.2.11

package/dist/index.js

@@ -87701,7 +87701,7 @@ var require_gaxios = __commonJS({
     var retry_js_1 = require_retry();
     var stream_1 = __require("stream");
     var interceptor_js_1 = require_interceptor();
-    var randomUUID4 = async () => globalThis.crypto?.randomUUID() || (await import("crypto")).randomUUID();
+    var randomUUID6 = async () => globalThis.crypto?.randomUUID() || (await import("crypto")).randomUUID();
     var HTTP_STATUS_NO_CONTENT = 204;
     var Gaxios = class {
       agentCache = /* @__PURE__ */ new Map();
@@ -87974,7 +87974,7 @@ var require_gaxios = __commonJS({
          */
         ["Blob", "File", "FormData"].includes(opts.data?.constructor?.name || "");
         if (opts.multipart?.length) {
-          const boundary = await randomUUID4();
+          const boundary = await randomUUID6();
           preparedHeaders.set("content-type", `multipart/related; boundary=${boundary}`);
           opts.body = stream_1.Readable.from(this.getMultipartRequest(opts.multipart, boundary));
         } else if (shouldDirectlyPassData) {
@@ -110860,18 +110860,6 @@ function mergeConfig(base, overlay, traceOpts) {
   if (base.instance || overlay.instance) {
     merged.instance = { ...base.instance, ...overlay.instance };
   }
-  if (base.providers || overlay.providers) {
-    merged.providers = {
-      github: base.providers?.github || overlay.providers?.github ? {
-        ...base.providers?.github,
-        ...overlay.providers?.github,
-        authProfiles: base.providers?.github?.authProfiles || overlay.providers?.github?.authProfiles ? {
-          ...base.providers?.github?.authProfiles,
-          ...overlay.providers?.github?.authProfiles
-        } : void 0
-      } : void 0
-    };
-  }
   if (traceOpts) {
     const { baseLabel, overlayLabel } = traceOpts;
     const trace2 = {};
@@ -111116,8 +111104,11 @@ function parseLegacyFlatState(worker, role) {
     issueId: worker.issueId,
     sessionKey,
     startTime: worker.startTime,
+    dispatchCycleId: worker.dispatchCycleId ?? null,
+    dispatchRunId: worker.dispatchRunId ?? null,
     previousLabel: worker.previousLabel ?? null,
-    name: worker.name ?? worker.slotName
+    name: worker.name ?? worker.slotName,
+    lastIssueId: worker.lastIssueId ?? null
   };
   return { levels: { [migratedLevel]: [slot] } };
 }
@@ -111133,8 +111124,11 @@ function parseOldSlotState(worker, role) {
       issueId: s2.issueId,
       sessionKey: s2.sessionKey,
       startTime: s2.startTime,
+      dispatchCycleId: s2.dispatchCycleId ?? null,
+      dispatchRunId: s2.dispatchRunId ?? null,
       previousLabel: s2.previousLabel ?? null,
-      name: s2.name ?? s2.slotName
+      name: s2.name ?? s2.slotName,
+      lastIssueId: s2.lastIssueId ?? null
     });
   }
   return { levels };
@@ -111152,8 +111146,11 @@ function parseLevelState(worker, role) {
         issueId: s2.issueId,
         sessionKey: s2.sessionKey,
         startTime: s2.startTime,
+        dispatchCycleId: s2.dispatchCycleId ?? null,
+        dispatchRunId: s2.dispatchRunId ?? null,
         previousLabel: s2.previousLabel ?? null,
-        name: s2.name ?? s2.slotName
+        name: s2.name ?? s2.slotName,
+        lastIssueId: s2.lastIssueId ?? null
       });
     }
   }
@@ -111330,8 +111327,8 @@ import fsSync from "node:fs";
 import path5 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function getCurrentVersion() {
-  if ("0.2.7") {
-    return "0.2.7";
+  if ("0.2.11") {
+    return "0.2.11";
   }
   try {
     const pkgPath = path5.join(THIS_DIR, "..", "..", "package.json");
@@ -112333,6 +112330,7 @@ async function readWorkflowFile(dir) {
   try {
     const content = await fs9.readFile(filePath, "utf-8");
     const parsed = import_yaml2.default.parse(content);
+    rejectPluginOnlyKeys(parsed, filePath);
     if (parsed) validateConfig(parsed);
     return parsed;
   } catch (err) {
@@ -112345,6 +112343,7 @@ async function readLegacyConfigFile(dir) {
   try {
     const content = await fs9.readFile(filePath, "utf-8");
     const parsed = import_yaml2.default.parse(content);
+    rejectPluginOnlyKeys(parsed, filePath);
     if (parsed) validateConfig(parsed);
     return parsed;
   } catch (err) {
@@ -112352,6 +112351,14 @@ async function readLegacyConfigFile(dir) {
     throw new Error(formatConfigReadError(filePath, err, "legacy config.yaml"));
   }
 }
+function rejectPluginOnlyKeys(raw, filePath) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return;
+  const forbidden = PLUGIN_ONLY_KEYS.filter((key) => key in raw);
+  if (forbidden.length === 0) return;
+  throw new Error(
+    `Invalid workflow config at ${filePath}: plugin-only keys are not allowed in workflow.yaml/config.yaml (${forbidden.join(", ")}). Configure them in pluginConfig/openclaw.json instead.`
+  );
+}
 async function readLegacyWorkflowJson(dir) {
   const filePath = path9.join(dir, "workflow.json");
   try {
@@ -112374,7 +112381,7 @@ function formatConfigReadError(filePath, err, kind) {
   const prefix = invalidKinds.has(err?.name ?? "") ? `Invalid ${kind}` : `Failed to read ${kind}`;
   return `${prefix} at ${filePath}: ${message}`;
 }
-var import_yaml2, DEFAULT_MAX_WORKERS_PER_LEVEL;
+var import_yaml2, DEFAULT_MAX_WORKERS_PER_LEVEL, PLUGIN_ONLY_KEYS;
 var init_loader = __esm({
   "lib/config/loader.ts"() {
     "use strict";
@@ -112387,6 +112394,13 @@ var init_loader = __esm({
     init_migrate_layout();
     init_workflow_policy();
     DEFAULT_MAX_WORKERS_PER_LEVEL = 2;
+    PLUGIN_ONLY_KEYS = [
+      "providers",
+      "telegram",
+      "work_heartbeat",
+      "notifications",
+      "projectExecution"
+    ];
   }
 });
 
@@ -112519,9 +112533,9 @@ function resolveNotifyChannel(issueLabels, channels) {
       const channelName = value.slice(colonIdx + 1);
       return channels.find(
         (ch) => ch.channel === channelType && (ch.name === channelName || String(channels.indexOf(ch)) === channelName)
-      ) ?? channels[0];
+      );
     }
-    return channels.find((ch) => ch.channelId === value) ?? channels[0];
+    return channels.find((ch) => ch.channelId === value);
   }
   return channels[0];
 }
@@ -112742,7 +112756,7 @@ function validateWorkflowIntegrity(workflow) {
   }
   return errors;
 }
-var STATE_TYPES, TransitionTargetSchema, StateConfigSchema, WorkflowConfigSchema, ModelEntrySchema, EffortLevelSchema, RoleOverrideSchema, TimeoutConfigSchema, InstanceConfigSchema, GitHubAppProfileSchema, ProvidersConfigSchema, FabricaConfigSchema;
+var STATE_TYPES, TransitionTargetSchema, StateConfigSchema, WorkflowConfigSchema, ModelEntrySchema, EffortLevelSchema, RoleOverrideSchema, TimeoutConfigSchema, InstanceConfigSchema, GitHubAppProfileSchema, ProvidersConfigSchema, FabricaConfigSchema, HeartbeatPluginConfigSchema, TelegramPluginConfigSchema, NotificationPluginConfigSchema, FabricaPluginConfigSchema;
 var init_schema = __esm({
   "lib/config/schema.ts"() {
     "use strict";
@@ -112850,9 +112864,30 @@ var init_schema = __esm({
       roles: external_exports.record(external_exports.string(), RoleOverrideSchema).optional(),
       workflow: WorkflowConfigSchema.partial().optional(),
       timeouts: TimeoutConfigSchema,
-      instance: InstanceConfigSchema,
-      providers: ProvidersConfigSchema
+      instance: InstanceConfigSchema
     });
+    HeartbeatPluginConfigSchema = external_exports.object({
+      enabled: external_exports.boolean().optional(),
+      intervalSeconds: external_exports.number().int().positive().optional(),
+      maxPickupsPerTick: external_exports.number().int().positive().optional()
+    }).optional();
+    TelegramPluginConfigSchema = external_exports.object({
+      bootstrapDmEnabled: external_exports.boolean().optional(),
+      projectsForumChatId: external_exports.string().min(1).optional(),
+      projectsForumAccountId: external_exports.string().min(1).optional(),
+      opsChatId: external_exports.string().min(1).optional()
+    }).optional();
+    NotificationPluginConfigSchema = external_exports.object({
+      workerStart: external_exports.boolean().optional(),
+      workerComplete: external_exports.boolean().optional()
+    }).optional();
+    FabricaPluginConfigSchema = external_exports.object({
+      work_heartbeat: HeartbeatPluginConfigSchema,
+      projectExecution: external_exports.enum(["parallel", "sequential"]).optional(),
+      notifications: NotificationPluginConfigSchema,
+      telegram: TelegramPluginConfigSchema,
+      providers: ProvidersConfigSchema
+    }).passthrough();
   }
 });
 
@@ -115455,7 +115490,7 @@ var receive_exports = {};
 __export(receive_exports, {
   receiveStep: () => receiveStep
 });
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
 var receiveStep;
 var init_receive = __esm({
   "lib/intake/steps/receive.ts"() {
@@ -115466,7 +115501,7 @@ var init_receive = __esm({
       async execute(payload) {
         return {
           ...payload,
-          session_id: payload.session_id || randomUUID2(),
+          session_id: payload.session_id || randomUUID3(),
           timestamp: payload.timestamp || (/* @__PURE__ */ new Date()).toISOString(),
           step: "receive"
         };
@@ -116305,12 +116340,10 @@ function createPluginContext(api) {
   const logger6 = getLogger({ plugin: "fabrica" });
   const rawConfig = api.pluginConfig;
   if (rawConfig && Object.keys(rawConfig).length > 0) {
-    const result = FabricaConfigSchema.safeParse(rawConfig);
+    const result = FabricaPluginConfigSchema.safeParse(rawConfig);
     if (!result.success) {
-      logger6.warn(
-        { errors: result.error.issues.map((i2) => `${i2.path.join(".")}: ${i2.message}`) },
-        "pluginConfig validation failed \u2014 using config as-is, some fields may be ignored"
-      );
+      const issues = result.error.issues.map((i2) => `${i2.path.join(".")}: ${i2.message}`);
+      throw new Error(`pluginConfig validation failed: ${issues.join("; ")}`);
     }
   }
   return {
@@ -116352,7 +116385,9 @@ function emptySlot() {
     active: false,
     issueId: null,
     sessionKey: null,
-    startTime: null
+    startTime: null,
+    dispatchCycleId: null,
+    dispatchRunId: null
   };
 }
 function emptyRoleWorkerState(levelMaxWorkers) {
@@ -116850,6 +116885,8 @@ async function activateWorker(workspaceDir, slugOrChannelId, role, params) {
       issueId: params.issueId,
       sessionKey: params.sessionKey ?? slots[idx].sessionKey,
       startTime: params.startTime ?? (/* @__PURE__ */ new Date()).toISOString(),
+      dispatchCycleId: params.dispatchCycleId ?? null,
+      dispatchRunId: params.dispatchRunId ?? null,
       previousLabel: params.previousLabel ?? null,
       name: params.name ?? slots[idx].name,
       lastIssueId: null
@@ -116887,6 +116924,8 @@ async function deactivateWorker(workspaceDir, slugOrChannelId, role, opts) {
           issueId: null,
           sessionKey: slot.sessionKey,
           startTime: null,
+          dispatchCycleId: slot.dispatchCycleId ?? null,
+          dispatchRunId: slot.dispatchRunId ?? null,
           previousLabel: null,
           name: slot.name,
           lastIssueId: slot.issueId
@@ -116913,6 +116952,37 @@ async function updateIssueRuntime(workspaceDir, slugOrChannelId, issueId, update
   });
   return data;
 }
+async function bindDispatchRunIdBySessionKey(workspaceDir, sessionKey, runId) {
+  const { result } = await withProjectsMutation(workspaceDir, (data) => {
+    for (const [slug, project] of Object.entries(data.projects)) {
+      for (const [role, roleWorker] of Object.entries(project.workers ?? {})) {
+        for (const [level, slots] of Object.entries(roleWorker.levels ?? {})) {
+          for (let slotIndex = 0; slotIndex < slots.length; slotIndex++) {
+            const slot = slots[slotIndex];
+            if (!slot.active || !slot.issueId || slot.sessionKey !== sessionKey) continue;
+            slot.dispatchRunId = runId;
+            project.issueRuntime ??= {};
+            const issueKey = String(slot.issueId);
+            project.issueRuntime[issueKey] = {
+              ...project.issueRuntime[issueKey] ?? {},
+              dispatchRunId: runId,
+              lastSessionKey: sessionKey
+            };
+            return {
+              slug,
+              issueId: Number(slot.issueId),
+              role,
+              level,
+              slotIndex
+            };
+          }
+        }
+      }
+    }
+    return null;
+  });
+  return result;
+}
 async function clearIssueRuntime(workspaceDir, slugOrChannelId, issueId) {
   const { data } = await withProjectsMutation(workspaceDir, (data2) => {
     const slug = resolveProjectSlug(data2, slugOrChannelId);
@@ -116944,23 +117014,18 @@ function findIssueBySessionKey(data, sessionKey) {
           if (slot.sessionKey !== sessionKey) continue;
           const issueId = slot.issueId ?? slot.lastIssueId;
           if (!issueId) continue;
+          const runtime = getIssueRuntime(project, issueId);
+          if (!slot.dispatchCycleId || !runtime?.lastDispatchCycleId || slot.dispatchCycleId !== runtime.lastDispatchCycleId) {
+            continue;
+          }
           return {
             slug,
             issueId: Number(issueId),
-            runtime: getIssueRuntime(project, issueId)
+            runtime
           };
         }
       }
     }
-    for (const [issueId, runtime] of Object.entries(project.issueRuntime ?? {})) {
-      if (runtime.lastSessionKey === sessionKey) {
-        return {
-          slug,
-          issueId: Number(issueId),
-          runtime
-        };
-      }
-    }
   }
   return null;
 }
@@ -117839,7 +117904,7 @@ var GitLabProvider = class {
       return null;
     }
   }
-  async getPrDetails(_issueId) {
+  async getPrDetails(_issueId, _selector) {
     return null;
   }
   async healthCheck() {
@@ -118396,7 +118461,7 @@ Bootstrapped by Fabrica.
       if (!pr?.number || !pr?.url) return null;
       let state;
       if (pr.state === "closed" && pr.mergedAt) {
-        state = pr.reviewDecision === "APPROVED" ? PrState.APPROVED : PrState.MERGED;
+        state = PrState.MERGED;
       } else if (pr.state === "closed") {
         state = PrState.CLOSED;
       } else if (pr.reviewDecision === "APPROVED") {
@@ -118712,7 +118777,7 @@ Bootstrapped by Fabrica.
     if (merged.length > 0) {
       merged.sort((a, b) => new Date(b.mergedAt ?? 0).getTime() - new Date(a.mergedAt ?? 0).getTime());
       const pr = merged[0];
-      const state = pr.reviewDecision === "APPROVED" ? PrState.APPROVED : PrState.MERGED;
+      const state = PrState.MERGED;
       return {
         number: pr.number,
         nodeId: pr.id,
@@ -118747,34 +118812,49 @@ Bootstrapped by Fabrica.
     }
     return { state: PrState.CLOSED, url: null };
   }
-  async getPrDetails(issueId) {
+  async getPrDetails(issueId, selector) {
     try {
-      let prs = await this.findPrsForIssue(
-        issueId,
-        "open",
-        "number,headRefName,url,state,mergedAt"
-      );
       let prState = "open";
-      if (!prs.length) {
-        prs = await this.findPrsForIssue(issueId, "merged", "number,headRefName,url,state,mergedAt");
-        if (prs.length) prState = "merged";
+      let prNumber;
+      let prUrl;
+      let sourceBranch;
+      if (selector?.prNumber) {
+        const status = await this.getPrStatusForNumber(selector.prNumber);
+        if (!status?.number || !status.url || !status.sourceBranch) return null;
+        prNumber = status.number;
+        prUrl = status.url;
+        sourceBranch = status.sourceBranch;
+        prState = status.state === PrState.MERGED ? "merged" : status.state === PrState.CLOSED ? "closed" : "open";
+      } else {
+        let prs = await this.findPrsForIssue(
+          issueId,
+          "open",
+          "number,headRefName,url,state,mergedAt"
+        );
+        if (!prs.length) {
+          prs = await this.findPrsForIssue(issueId, "merged", "number,headRefName,url,state,mergedAt");
+          if (prs.length) prState = "merged";
+        }
+        if (!prs.length) return null;
+        const pr = prs[0];
+        prNumber = pr.number;
+        prUrl = pr.url ?? null;
+        sourceBranch = pr.headRefName;
       }
-      if (!prs.length) return null;
-      const pr = prs[0];
       const raw = await this.gh([
         "api",
-        `repos/:owner/:repo/pulls/${pr.number}`,
+        `repos/:owner/:repo/pulls/${prNumber}`,
         "--jq",
         "{headSha: .head.sha, repositoryId: .head.repo.id, owner: .head.repo.owner.login, repo: .head.repo.name}"
       ]);
       const extra = JSON.parse(raw);
       if (!extra.headSha || !extra.repositoryId || !extra.owner || !extra.repo) return null;
       return {
-        prNumber: pr.number,
+        prNumber,
         headSha: extra.headSha,
         prState,
-        prUrl: pr.url ?? null,
-        sourceBranch: pr.headRefName,
+        prUrl,
+        sourceBranch,
         repositoryId: extra.repositoryId,
         owner: extra.owner,
         repo: extra.repo
@@ -119408,26 +119488,20 @@ function resolveRoute(ctx, explicitChannelId, explicitMessageThreadId) {
     accountId: ctx.agentAccountId
   };
 }
-async function resolveProject(workspaceDir, channelId, opts) {
+async function resolveProjectFromContext(workspaceDir, ctx, explicitChannelId, explicitMessageThreadId) {
+  const route = resolveRoute(ctx, explicitChannelId, explicitMessageThreadId);
   const data = await readProjects(workspaceDir);
-  const project = getProject(data, channelId, opts?.messageThreadId);
+  const project = getProjectByRoute(data, route) ?? getProject(data, route.channelId, route.messageThreadId ?? void 0);
   if (!project) {
     const topicScopedCount = Object.values(data.projects).filter(
-      (candidate) => candidate.channels.some((channel) => String(channel.channelId) === String(channelId) && channel.messageThreadId !== void 0 && channel.messageThreadId !== null)
+      (candidate) => candidate.channels.some((channel) => String(channel.channelId) === String(route.channelId) && channel.messageThreadId !== void 0 && channel.messageThreadId !== null)
     ).length;
-    const threadHint = topicScopedCount > 0 && opts?.messageThreadId == null ? " This Telegram forum group has topic-scoped projects; pass the messageThreadId from the current topic." : "";
+    const threadHint = topicScopedCount > 0 && route.messageThreadId == null ? " This Telegram forum group has topic-scoped projects; pass the messageThreadId from the current topic." : "";
     throw new Error(
-      `No project found for "${opts?.messageThreadId ? routeKey({ channel: "telegram", channelId, messageThreadId: opts.messageThreadId }) : channelId}". Register a new project with project_register, or link this channel to an existing project.${threadHint}`
+      `No project found for "${routeKey(route)}". Register a new project with project_register, or link this channel to an existing project.${threadHint}`
     );
   }
-  return { data, project };
-}
-async function resolveProjectFromContext(workspaceDir, ctx, explicitChannelId, explicitMessageThreadId) {
-  const route = resolveRoute(ctx, explicitChannelId, explicitMessageThreadId);
-  const resolved = await resolveProject(workspaceDir, route.channelId, {
-    messageThreadId: route.messageThreadId ?? void 0
-  });
-  return { ...resolved, route };
+  return { data, project, route };
 }
 async function resolveProvider(project, runCommand, pluginConfig) {
   return createProvider({
@@ -119979,27 +120053,30 @@ async function notify(event, opts) {
     });
     return true;
   }
-  const notifyKey = computeNotifyKey(
-    event.project ?? "global",
-    event.issueId ?? 0,
-    event.type
-  );
-  const isNew = await writeIntent(opts.workspaceDir, notifyKey, event, {
-    channelId: target.channelId,
-    channel: target.channel,
-    accountId: target.accountId,
-    messageThreadId: target.messageThreadId
-  }).catch(() => false);
-  if (!isNew) {
-    await log(opts.workspaceDir, "notify_skip", {
-      eventId,
-      correlationId,
-      eventType: event.type,
-      reason: "duplicate outbox key",
-      key: notifyKey
-    }).catch(() => {
-    });
-    return true;
+  let notifyKey = null;
+  if (!opts.skipOutboxWrite) {
+    notifyKey = computeNotifyKey(
+      event.project ?? "global",
+      event.issueId ?? 0,
+      event.type
+    );
+    const isNew = await writeIntent(opts.workspaceDir, notifyKey, event, {
+      channelId: target.channelId,
+      channel: target.channel,
+      accountId: target.accountId,
+      messageThreadId: target.messageThreadId
+    }).catch(() => false);
+    if (!isNew) {
+      await log(opts.workspaceDir, "notify_skip", {
+        eventId,
+        correlationId,
+        eventType: event.type,
+        reason: "duplicate outbox key",
+        key: notifyKey
+      }).catch(() => {
+      });
+      return true;
+    }
   }
   await log(opts.workspaceDir, "notify", {
     eventId,
@@ -120030,7 +120107,7 @@ async function notify(event, opts) {
       target
     }
   );
-  if (sent) {
+  if (sent && notifyKey) {
     await markDelivered(opts.workspaceDir, notifyKey).catch(() => {
     });
   }
@@ -120864,8 +120941,12 @@ Once the PR shows as mergeable on GitHub, call work_finish again.`
     if (err instanceof Error && (err.message.startsWith("Cannot mark work_finish(done)") || err.message.startsWith("Cannot complete work_finish(done)"))) {
       throw err;
     }
-    logger6.warn({ err }, "PR validation warning; failing open");
-    return { state: PrState.CLOSED, url: null };
+    logger6.warn({ err }, "PR validation warning; failing closed");
+    throw new Error(
+      `Cannot mark work_finish(done) because Fabrica could not verify PR state right now.
+
+Resolve the provider/API error and call work_finish again.`
+    );
   }
 }
 function shouldAutoRecoverToFeedback(summary) {
@@ -120873,58 +120954,19 @@ function shouldAutoRecoverToFeedback(summary) {
   const text = summary.toLowerCase();
   return /retarget/.test(text) || /mismatch de escopo/.test(text) || /mismatch de escopo\/rastreabilidade/.test(text) || /new pr/.test(text) || /novo pr/.test(text) || /não pode satisfazer a issue/.test(text) || /cannot satisfy issue/.test(text);
 }
-async function validateReviewerArtifact(provider, issueId, expectedResult, artifactId, artifactType, selector) {
-  if (!artifactId || !artifactType) {
-    throw new Error(
-      "Reviewer must publish feedback to the PR with review_submit before calling work_finish."
-    );
-  }
-  const comments = await provider.getPrReviewComments(issueId, selector);
-  const match = comments.find(
-    (comment) => matchesReviewArtifact(comment, artifactId, artifactType)
-  );
-  if (!match) {
-    throw new Error(
-      `Review artifact #${artifactId} (${artifactType}) was not found on the PR for issue #${issueId}.`
-    );
-  }
-  if (artifactType === "formal_review") {
-    if (expectedResult === "approve" && match.state !== "APPROVED") {
-      throw new Error(
-        `Review artifact #${artifactId} must be an APPROVED review before reviewer approve can complete issue #${issueId}.`
-      );
-    }
-    if (expectedResult === "reject" && match.state !== "CHANGES_REQUESTED") {
-      throw new Error(
-        `Review artifact #${artifactId} must be a CHANGES_REQUESTED review before reviewer reject can complete issue #${issueId}.`
-      );
-    }
-  }
-}
-async function getCanonicalQaEvidenceValidationForPr(provider, issueId, selector) {
-  const prStatus = await provider.getPrStatus(issueId, selector);
-  return validateCanonicalQaEvidence(prStatus.body);
-}
-function matchesReviewArtifact(comment, artifactId, artifactType) {
-  if (comment.id !== artifactId) return false;
-  if (artifactType === "formal_review") {
-    return comment.state === "APPROVED" || comment.state === "CHANGES_REQUESTED";
-  }
-  return comment.state === "COMMENTED" && !comment.path;
-}
 var INFRA_FAIL_CIRCUIT_BREAKER_THRESHOLD = 2;
 function createWorkFinishTool(ctx) {
   return (toolCtx) => ({
     name: "work_finish",
     label: "Work Finish",
-    description: `Complete a task: Developer done (PR created, goes to review) or blocked. Tester pass/fail/refine/blocked. Reviewer approve/reject/blocked. Architect done/blocked. Handles label transition, state update, issue close/reopen, notifications, and audit logging.`,
+    description: `Complete a task: Developer done (PR created, goes to review) or blocked. Tester pass/fail/fail_infra/refine/blocked. Architect done/blocked. Handles label transition, state update, issue close/reopen, notifications, and audit logging.`,
     parameters: {
       type: "object",
       required: ["channelId", "role", "result"],
       properties: {
-        channelId: { type: "string", description: "Project slug (e.g. 'my-project'). Use the value from the 'Channel:' or 'Project:' line in your task message. Do NOT use a numeric Telegram chat ID." },
+        channelId: { type: "string", description: "Project slug (e.g. 'my-project'). Use the value from the 'Channel:' line in your task message. Do NOT use a numeric Telegram chat ID." },
         role: { type: "string", enum: getAllRoleIds(), description: "Worker role" },
-        result: { type: "string", enum: ["done", "pass", "fail", "fail_infra", "refine", "blocked", "approve", "reject"], description: "Completion result. Use fail_infra (tester only) when the test toolchain is missing or broken \u2014 this keeps the issue in the test queue instead of routing it to the developer." },
+        result: { type: "string", enum: ["done", "pass", "fail", "fail_infra", "refine", "blocked"], description: "Completion result. Use fail_infra (tester only) when the test toolchain is missing or broken \u2014 this keeps the issue in the test queue instead of routing it to the developer." },
         summary: { type: "string", description: "Brief summary" },
         prUrl: { type: "string", description: "PR/MR URL (auto-detected if omitted)" },
         createdTasks: {
@@ -120939,15 +120981,6 @@ function createWorkFinishTool(ctx) {
             }
           },
           description: "Tasks created during this work session (architect creates implementation tasks)."
-        },
-        reviewArtifactId: {
-          type: "number",
-          description: "Artifact ID returned by review_submit. Required for reviewer approve/reject."
-        },
-        reviewArtifactType: {
-          type: "string",
-          enum: ["formal_review", "pr_conversation_comment"],
-          description: "Artifact type returned by review_submit. Required for reviewer approve/reject."
         }
       }
     },
@@ -120957,16 +120990,13 @@ function createWorkFinishTool(ctx) {
       const summary = params.summary;
       const prUrl = params.prUrl;
       const createdTasks = params.createdTasks;
-      const reviewArtifactId = params.reviewArtifactId;
-      const reviewArtifactType = params.reviewArtifactType;
+      const dispatchRunId = typeof params._dispatchRunId === "string" ? params._dispatchRunId : void 0;
       const workspaceDir = requireWorkspaceDir(toolCtx);
-      await recordIssueLifecycleBySessionKey({
-        workspaceDir,
-        sessionKey: toolCtx.sessionKey,
-        stage: "first_worker_activity",
-        details: { source: "work_finish" }
-      }).catch(() => {
-      });
+      if (role === "reviewer") {
+        throw new Error(
+          "Reviewer completion is no longer handled by work_finish. End your response with exactly one plain-text decision line: 'Review result: APPROVE' or 'Review result: REJECT'. Use the project slug from the 'Channel:' line in your task message for any follow-up task_create call."
+        );
+      }
       if (!isValidResult(role, result)) {
         const valid = getCompletionResults(role);
         throw new Error(`${role.toUpperCase()} cannot complete with "${result}". Valid results: ${valid.join(", ")}`);
@@ -120979,6 +121009,41 @@ function createWorkFinishTool(ctx) {
       }
       const { slotIndex, slotLevel, issueId, recovered } = workerSlot;
       const issueRuntime = project.issueRuntime?.[String(issueId)];
+      const currentDispatchRunId = workerSlot.dispatchRunId ?? issueRuntime?.dispatchRunId ?? null;
+      const hasCycleMismatch = Boolean(
+        workerSlot.dispatchCycleId && issueRuntime?.lastDispatchCycleId && workerSlot.dispatchCycleId !== issueRuntime.lastDispatchCycleId
+      );
+      if (!dispatchRunId || !currentDispatchRunId || dispatchRunId !== currentDispatchRunId || hasCycleMismatch) {
+        await log(workspaceDir, "work_finish_rejected", {
+          project: project.name,
+          projectSlug: project.slug,
+          issue: issueId,
+          role,
+          result,
+          reason: "stale_dispatch_cycle",
+          sessionKey: toolCtx.sessionKey ?? null,
+          providedDispatchRunId: dispatchRunId ?? null,
+          currentDispatchRunId,
+          slotDispatchCycleId: workerSlot.dispatchCycleId ?? null,
+          runtimeDispatchCycleId: issueRuntime?.lastDispatchCycleId ?? null
+        });
+        return jsonResult2({
+          success: false,
+          project: project.name,
+          projectSlug: project.slug,
+          issueId,
+          role,
+          result,
+          reason: "stale_dispatch_cycle"
+        });
+      }
+      await recordIssueLifecycleBySessionKey({
+        workspaceDir,
+        sessionKey: toolCtx.sessionKey,
+        stage: "first_worker_activity",
+        details: { source: "work_finish" }
+      }).catch(() => {
+      });
       const prSelector = role === "reviewer" || role === "tester" ? requireCanonicalPrSelector(project, issueId, `${role} completion`) : issueRuntime?.currentPrNumber ? { prNumber: issueRuntime.currentPrNumber } : void 0;
       if (recovered) {
         await log(workspaceDir, "work_finish_recovered_slot", {
@@ -121118,24 +121183,6 @@ function createWorkFinishTool(ctx) {
           boundAt: (/* @__PURE__ */ new Date()).toISOString()
         });
       }
-      if (role === "reviewer" && (result === "approve" || result === "reject")) {
-        await validateReviewerArtifact(provider, issueId, result, reviewArtifactId, reviewArtifactType, prSelector);
-      }
-      if (role === "reviewer" && result === "approve") {
-        const qaEvidence = await getCanonicalQaEvidenceValidationForPr(provider, issueId, prSelector);
-        if (!qaEvidence.valid) {
-          await log(workspaceDir, "work_finish_rejected", {
-            project: project.slug,
-            issue: issueId,
-            reason: "invalid_qa_evidence",
-            role,
-            result,
-            prNumber: issueRuntime?.currentPrNumber ?? null,
-            qaProblems: qaEvidence.problems
-          });
-          throwInvalidQaEvidence(qaEvidence, "reviewer");
-        }
-      }
       const completion = await ctx.observability.withContext({
         sessionKey: toolCtx.sessionKey ?? void 0,
         issueId,
@@ -121230,7 +121277,9 @@ function resolveWorkerSlot(roleWorker, sessionKey) {
           slotIndex: i2,
           slotLevel: level,
           issueId: Number(slot.issueId),
-          recovered: false
+          recovered: false,
+          dispatchCycleId: slot.dispatchCycleId ?? null,
+          dispatchRunId: slot.dispatchRunId ?? null
         };
       }
     }
@@ -121244,7 +121293,9 @@ function resolveWorkerSlot(roleWorker, sessionKey) {
         slotIndex: i2,
         slotLevel: level,
         issueId: Number(slot.lastIssueId),
-        recovered: true
+        recovered: true,
+        dispatchCycleId: slot.dispatchCycleId ?? null,
+        dispatchRunId: slot.dispatchRunId ?? null
       };
     }
   }
@@ -121505,7 +121556,7 @@ Use cases:
 - Orchestrator adds summary comments
 - Cross-referencing related issues or PRs
 
-Blocking reviewer decisions belong in \`review_submit\`, not \`task_comment\`.
+Reviewer worker decisions belong in the review response, not in \`task_comment\`.
 
 Examples:
 - Simple: { issueId: 42, body: "Found an edge case with null inputs" }
@@ -121564,7 +121615,7 @@ Examples:
           sessionKey: toolCtx.sessionKey
         });
         throw new Error(
-          "Reviewer findings must be published to the PR with review_submit. task_comment is reserved for issue-side operational notes from non-reviewer roles."
+          "Reviewer workers must keep findings in the review response and finish with `Review result: APPROVE` or `Review result: REJECT`. task_comment is reserved for issue-side operational notes from non-reviewer roles."
         );
       }
       const { provider, type: providerType } = await resolveProvider(project, ctx.runCommand);
@@ -121576,7 +121627,7 @@ Examples:
           sessionKey: toolCtx.sessionKey ?? null
         });
         throw new Error(
-          "Reviewer feedback must be published on the PR with review_submit. task_comment is not allowed for reviewer findings."
+          "Reviewer worker findings must stay in the review response. task_comment is not allowed for reviewer findings."
         );
       }
       const issue2 = await provider.getIssue(issueId);
@@ -122193,6 +122244,7 @@ import { jsonResult as jsonResult9 } from "openclaw/plugin-sdk";
 
 // lib/dispatch/index.ts
 init_audit();
+import { randomUUID as randomUUID2 } from "node:crypto";
 init_roles();
 init_workflow();
 
@@ -122626,6 +122678,7 @@ function buildTaskMessage(opts) {
   const results = opts.resolvedRole?.completionResults ?? [];
   const availableResults = results.map((r2) => `"${r2}"`).join(", ");
   const isFeedbackCycle = !!opts.prFeedback;
+  const requiresWorkFinish = role !== "reviewer";
   const parts = [
     `${role.toUpperCase()} task for project "${projectName}" \u2014 Issue #${issueId}`,
     ``,
@@ -122690,23 +122743,25 @@ ${issueDescription}` : ""
     `Repo: ${repoDisplay} | Branch: ${baseBranch} | ${issueUrl}`,
     `Project: ${projectName} | Channel: ${channelId}`
   );
-  parts.push(
-    ``,
-    `---`,
-    ``,
-    `## MANDATORY: Task Completion`,
-    ``,
-    `When you finish this task, you MUST invoke the \`work_finish\` **tool** (API tool_use call \u2014 NOT a shell command):`,
-    `- \`role\`: "${role}"`,
-    `- \`channelId\`: "${channelId}"`,
-    `- \`result\`: ${availableResults}`,
-    `- \`summary\`: brief description of what you did`,
-    ``,
-    `\u26A0\uFE0F \`work_finish\` is a Fabrica tool, not a CLI command. Call it as a tool (the same way you use task_create or other tools), not via bash.`,
-    `\u26A0\uFE0F You MUST call work_finish even if you encounter errors or cannot finish.`,
-    `Use "blocked" with a summary explaining why you're stuck.`,
-    `Never end your session without calling work_finish.`
-  );
+  if (requiresWorkFinish) {
+    parts.push(
+      ``,
+      `---`,
+      ``,
+      `## MANDATORY: Task Completion`,
+      ``,
+      `When you finish this task, you MUST invoke the \`work_finish\` **tool** (API tool_use call \u2014 NOT a shell command):`,
+      `- \`role\`: "${role}"`,
+      `- \`channelId\`: "${channelId}" (project slug from the \`Channel:\` line above)`,
+      `- \`result\`: ${availableResults}`,
+      `- \`summary\`: brief description of what you did`,
+      ``,
+      `\u26A0\uFE0F \`work_finish\` is a Fabrica tool, not a CLI command. Call it as a tool (the same way you use task_create or other tools), not via bash.`,
+      `\u26A0\uFE0F You MUST call work_finish even if you encounter errors or cannot finish.`,
+      `Use "blocked" with a summary explaining why you're stuck.`,
+      `Never end your session without calling work_finish.`
+    );
+  }
   return parts.join("\n");
 }
 function buildConflictFixMessage(opts) {
@@ -122725,6 +122780,7 @@ function buildConflictFixMessage(opts) {
   const repoDisplay = sanitizeRepoContext(repo);
   const results = opts.resolvedRole?.completionResults ?? [];
   const availableResults = results.map((r2) => `"${r2}"`).join(", ");
+  const requiresWorkFinish = role !== "reviewer";
   const parts = [
     `${role.toUpperCase()} task for project "${projectName}" \u2014 Issue #${issueId}`,
     ``,
@@ -122738,23 +122794,25 @@ function buildConflictFixMessage(opts) {
     `Repo: ${repoDisplay} | Branch: ${baseBranch} | ${issueUrl}`,
     `Project: ${projectName} | Channel: ${channelId}`
   );
-  parts.push(
-    ``,
-    `---`,
-    ``,
-    `## MANDATORY: Task Completion`,
-    ``,
-    `When you finish this task, you MUST invoke the \`work_finish\` **tool** (API tool_use call \u2014 NOT a shell command):`,
-    `- \`role\`: "${role}"`,
-    `- \`channelId\`: "${channelId}"`,
-    `- \`result\`: ${availableResults}`,
-    `- \`summary\`: brief description of what you did`,
-    ``,
-    `\u26A0\uFE0F \`work_finish\` is a Fabrica tool, not a CLI command. Call it as a tool (the same way you use task_create or other tools), not via bash.`,
-    `\u26A0\uFE0F You MUST call work_finish even if you encounter errors or cannot finish.`,
-    `Use "blocked" with a summary explaining why you're stuck.`,
-    `Never end your session without calling work_finish.`
-  );
+  if (requiresWorkFinish) {
+    parts.push(
+      ``,
+      `---`,
+      ``,
+      `## MANDATORY: Task Completion`,
+      ``,
+      `When you finish this task, you MUST invoke the \`work_finish\` **tool** (API tool_use call \u2014 NOT a shell command):`,
+      `- \`role\`: "${role}"`,
+      `- \`channelId\`: "${channelId}" (project slug from the \`Channel:\` line above)`,
+      `- \`result\`: ${availableResults}`,
+      `- \`summary\`: brief description of what you did`,
+      ``,
+      `\u26A0\uFE0F \`work_finish\` is a Fabrica tool, not a CLI command. Call it as a tool (the same way you use task_create or other tools), not via bash.`,
+      `\u26A0\uFE0F You MUST call work_finish even if you encounter errors or cannot finish.`,
+      `Use "blocked" with a summary explaining why you're stuck.`,
+      `Never end your session without calling work_finish.`
+    );
+  }
   return parts.join("\n");
 }
 function buildAnnouncement(level, role, sessionAction, issueId, issueTitle, issueUrl, resolvedRole, botName) {
@@ -123006,6 +123064,10 @@ function sendToAgent(sessionKey, taskMessage, opts) {
       deliver: false,
       ...opts.extraSystemPrompt ? { extraSystemPrompt: opts.extraSystemPrompt } : {}
     }).then((result) => {
+      if (result?.runId) {
+        bindDispatchRunIdBySessionKey(opts.workspaceDir, sessionKey, result.runId).catch(() => {
+        });
+      }
       log(opts.workspaceDir, "dispatch_agent_sent", {
         step: "sendToAgent",
         sessionKey,
@@ -123229,6 +123291,7 @@ async function dispatchTask(opts) {
     }
   }
   const sessionAction = existingSessionKey ? "send" : "spawn";
+  const dispatchCycleId = randomUUID2();
   const allComments = await provider.listComments(issueId);
   const { workflow } = resolvedConfig;
   const prFeedback = isFeedbackState(workflow, fromLabel) ? await fetchPrFeedback(provider, issueId, prSelector) : void 0;
@@ -123294,12 +123357,16 @@ async function dispatchTask(opts) {
     sessionKey,
     sessionAction,
     fromLabel,
-    name: botName
+    name: botName,
+    dispatchCycleId
   });
   await updateIssueRuntime(workspaceDir, project.slug, String(issueId), {
     dispatchRequestedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    lastDispatchCycleId: dispatchCycleId,
+    dispatchRunId: null,
     agentAcceptedAt: null,
-    firstWorkerActivityAt: null
+    firstWorkerActivityAt: null,
+    lastSessionKey: sessionKey
   }).catch((err) => {
     log(workspaceDir, "dispatch_warning", { step: "record_dispatch_requested", issue: issueId, err: String(err) }).catch(() => {
     });
@@ -123485,6 +123552,8 @@ async function recordWorkerState(workspaceDir, slug, role, slotIndex, opts) {
     level: opts.level,
     sessionKey: opts.sessionKey,
     startTime: (/* @__PURE__ */ new Date()).toISOString(),
+    dispatchCycleId: opts.dispatchCycleId,
+    dispatchRunId: null,
     previousLabel: opts.fromLabel,
     slotIndex,
     name: opts.name
@@ -123810,7 +123879,6 @@ function createReviewSubmitTool(ctx) {
     label: "Review Submit",
     description: `Submit canonical review feedback to the PR linked to an issue.
 
-Use this instead of task_comment for reviewer approvals/rejections.
 It writes the review to the PR itself, preferring a formal PR review and
 falling back to a top-level PR conversation comment when necessary.`,
     parameters: {
@@ -123841,6 +123909,20 @@ falling back to a top-level PR conversation comment when necessary.`,
       const result = params.result;
       const body = params.body;
       const workspaceDir = requireWorkspaceDir(toolCtx);
+      const workerSession = toolCtx.sessionKey ? parseFabricaSessionKey(toolCtx.sessionKey) : null;
+      if (workerSession) {
+        await log(workspaceDir, "review_submit_blocked", {
+          project: workerSession.projectName,
+          role: workerSession.role,
+          issue: issueId,
+          sessionKey: toolCtx.sessionKey,
+          reason: "fabrica_worker_session"
+        }).catch(() => {
+        });
+        throw new Error(
+          workerSession.role === "reviewer" ? "Reviewer workers must finish by ending their response with `Review result: APPROVE` or `Review result: REJECT`. Do not call review_submit." : "Fabrica worker sessions must not call review_submit. Use the role's normal completion contract instead."
+        );
+      }
       await recordIssueLifecycleBySessionKey({
         workspaceDir,
         sessionKey: toolCtx.sessionKey,
@@ -124206,12 +124288,7 @@ async function createProjectForumTopic(ctx, opts) {
       }
     }
   }
-  return {
-    chatId: opts.chatId,
-    topicId: 1,
-    name: opts.name,
-    isFallback: true
-  };
+  throw lastError ?? new Error("Telegram topic creation failed after retry exhaustion");
 }
 
 // lib/telegram/config.ts
@@ -124233,6 +124310,11 @@ function readFabricaTelegramConfig(pluginConfig) {
   };
 }
 
+// lib/intake/lib/artifact-ids.ts
+function buildForumTopicArtifactId(channelId, messageThreadId) {
+  return `telegram:${channelId}:${messageThreadId}`;
+}
+
 // lib/tools/admin/project-register.ts
 async function scaffoldPromptFiles(workspaceDir, projectName) {
   const projectDir = path22.join(workspaceDir, DATA_DIR, "projects", projectName);
@@ -124311,6 +124393,11 @@ async function hasProjectWorkflowOverride(workspaceDir, projectName) {
     return false;
   }
 }
+function normalizeRepoIdentity(value) {
+  const trimmed = value?.trim();
+  if (!trimmed) return null;
+  return trimmed.replace(/\.git$/i, "").toLowerCase();
+}
 function adaptStepRunCommand(runCommand) {
   return async (argv, optionsOrTimeout) => {
     const [cmd, ...args] = argv;
@@ -124352,6 +124439,7 @@ async function registerProject(params) {
     messageThreadId: route.messageThreadId ?? void 0,
     accountId: route.accountId
   });
+  let createdArtifacts = [];
   await acquireLock(workspaceDir);
   try {
     const data = await readProjects(workspaceDir);
@@ -124387,6 +124475,21 @@ async function registerProject(params) {
         `${providerType.toUpperCase()} health check failed for ${repoPath}. Detected provider: ${providerType}. Ensure '${cliName}' CLI is installed, authenticated (${cliName} auth status), and the repo has a ${providerType.toUpperCase()} remote. Install ${cliName} from: ${cliInstallUrl}`
       );
     }
+    let repoRemote;
+    try {
+      repoRemote = await provider.resolveRepositoryRemote() ?? void 0;
+    } catch {
+      repoRemote = void 0;
+    }
+    if (existing) {
+      const sameRepoPath = resolveRepoPath(existing.repo) === repoPath;
+      const sameRepoRemote = normalizeRepoIdentity(existing.repoRemote) != null && normalizeRepoIdentity(existing.repoRemote) === normalizeRepoIdentity(repoRemote);
+      if (!sameRepoPath && !sameRepoRemote) {
+        throw new Error(
+          `Project slug "${slug}" already points to a different repository. Existing repo="${existing.repo}" remote="${existing.repoRemote ?? "unknown"}"; incoming repo="${repoPath}" remote="${repoRemote ?? "unknown"}".`
+        );
+      }
+    }
     await provider.ensureAllStateLabels();
     const workflowOverrideCreated = autonomousProject ? await ensureAutonomousWorkflowOverride(
       workspaceDir,
@@ -124410,12 +124513,6 @@ async function registerProject(params) {
     for (const { name: labelName, color } of OPERATIONAL_LABELS) {
       await provider.ensureLabel(labelName, color);
     }
-    let repoRemote;
-    try {
-      repoRemote = await provider.resolveRepositoryRemote() ?? void 0;
-    } catch {
-      repoRemote = void 0;
-    }
     if (createProjectTopic) {
       if (!runtime || !config2) {
         throw new Error("Runtime and config are required to create a Telegram project topic");
@@ -124436,6 +124533,13 @@ async function registerProject(params) {
         name,
         accountId: telegramConfig.projectsForumAccountId ?? initialRoute.accountId ?? void 0
       });
+      if (createdTopic.isFallback || createdTopic.topicId === 1) {
+        throw new Error("DM bootstrap requires a dedicated Telegram topic; refusing to register against the General topic");
+      }
+      createdArtifacts = [{
+        type: "forum_topic",
+        id: buildForumTopicArtifactId(createdTopic.chatId, createdTopic.topicId)
+      }];
       targetRoute = buildRouteRef({
         channel: "telegram",
         channelId: createdTopic.chatId,
@@ -124524,10 +124628,33 @@ async function registerProject(params) {
       },
       announcement: `${action}. Labels ensured.${promptsNote} Ready for tasks.`
     };
+  } catch (err) {
+    if (createdArtifacts.length > 0) {
+      throw attachArtifactsToError(err, createdArtifacts);
+    }
+    throw err;
   } finally {
     await releaseLock(workspaceDir);
   }
 }
+function attachArtifactsToError(error48, artifacts) {
+  const err = error48 instanceof Error ? error48 : new Error(String(error48));
+  const existing = Array.isArray(err.artifacts) ? err.artifacts : [];
+  const merged = [...existing, ...artifacts].filter((artifact, index, array2) => {
+    if (!artifact || typeof artifact !== "object" || typeof artifact.type !== "string" || typeof artifact.id !== "string") {
+      return false;
+    }
+    const current = `${artifact.type}:${artifact.id}`;
+    return index === array2.findIndex((candidate) => {
+      if (!candidate || typeof candidate !== "object" || typeof candidate.type !== "string" || typeof candidate.id !== "string") {
+        return false;
+      }
+      return current === `${candidate.type}:${candidate.id}`;
+    });
+  });
+  err.artifacts = merged;
+  return err;
+}
 function createProjectRegisterTool(ctx) {
   return (toolCtx) => ({
     name: "project_register",
@@ -124652,6 +124779,11 @@ async function auditHealthFixApplied(workspaceDir, fix, details) {
     });
   }));
 }
+function hasDispatchCycleMismatch(slot, issueRuntime) {
+  return Boolean(
+    slot.dispatchCycleId && issueRuntime?.lastDispatchCycleId && slot.dispatchCycleId !== issueRuntime.lastDispatchCycleId
+  );
+}
 async function fetchIssue(provider, issueId) {
   try {
     return await provider.getIssue(issueId);
@@ -124662,17 +124794,16 @@ async function fetchIssue(provider, issueId) {
 function isIssueClosed(issue2) {
   return issue2.state.toLowerCase() === "closed";
 }
-async function resolveOrphanRevertLabel(provider, issueId, role, defaultQueueLabel, workflow) {
+async function resolveOrphanRevertLabel(provider, project, issueId, role, defaultQueueLabel, workflow) {
   try {
-    const prStatus = await provider.getPrStatus(issueId);
+    const prSelector = getCanonicalPrSelector(project, issueId);
+    const prStatus = await provider.getPrStatus(issueId, prSelector);
     if (prStatus.url && prStatus.state !== PrState.MERGED && prStatus.state !== PrState.CLOSED && prStatus.currentIssueMatch !== false) {
       if (prStatus.state === PrState.CHANGES_REQUESTED || prStatus.state === PrState.HAS_COMMENTS) {
         const queueLabels = getQueueLabels(workflow, role);
         const feedbackLabel = queueLabels.find((l) => isFeedbackState(workflow, l));
         if (feedbackLabel) return feedbackLabel;
       }
-      const rule = getCompletionRule(workflow, role, "done");
-      if (rule) return rule.to;
     }
   } catch {
   }
@@ -124692,7 +124823,8 @@ async function checkWorkerHealth(opts) {
     sessions,
     workflow = DEFAULT_WORKFLOW,
     staleWorkerHours = 2,
-    dispatchConfirmTimeoutMs = DISPATCH_CONFIRMATION_TIMEOUT_MS
+    dispatchConfirmTimeoutMs = DISPATCH_CONFIRMATION_TIMEOUT_MS,
+    healthGracePeriodMs = GRACE_PERIOD_MS
   } = opts;
   const fixes = [];
   if (!hasWorkflowStates(workflow, role)) return fixes;
@@ -124705,7 +124837,7 @@ async function checkWorkerHealth(opts) {
       const sessionKey = slot.sessionKey;
       const slotQueueLabel = slot.previousLabel ?? queueLabel;
       const workerStartTime = slot.startTime ? new Date(slot.startTime).getTime() : null;
-      const withinGracePeriod = workerStartTime !== null && Date.now() - workerStartTime < GRACE_PERIOD_MS;
+      const withinGracePeriod = workerStartTime !== null && Date.now() - workerStartTime < healthGracePeriodMs;
       const issueIdNum = slot.issueId ? Number(slot.issueId) : null;
       let issue2 = null;
       let currentLabel = null;
@@ -124733,6 +124865,23 @@ async function checkWorkerHealth(opts) {
           issueId: slot.issueId ?? void 0
         });
       }
+      if (slot.active && hasDispatchCycleMismatch(slot, issueRuntime)) {
+        await log(workspaceDir, "health_fix_rejected", {
+          type: "dispatch_cycle_mismatch",
+          reason: "stale_dispatch_cycle",
+          project: project.name,
+          projectSlug,
+          role,
+          level,
+          slotIndex,
+          issueId: slot.issueId ?? null,
+          sessionKey,
+          slotDispatchCycleId: slot.dispatchCycleId ?? null,
+          runtimeDispatchCycleId: issueRuntime?.lastDispatchCycleId ?? null
+        }).catch(() => {
+        });
+        continue;
+      }
       if (slot.active && issueIdNum && !issue2) {
         const fix = {
           issue: {
@@ -125013,32 +125162,6 @@ async function checkWorkerHealth(opts) {
           fixes.push(fix);
         }
       }
-      if (slot.active && issueIdNum && issue2 && currentLabel === expectedLabel && autoFix) {
-        try {
-          const prStatus = await provider.getPrStatus(issueIdNum);
-          if (prStatus.url && prStatus.state !== PrState.MERGED && prStatus.state !== PrState.CLOSED && prStatus.state !== PrState.CHANGES_REQUESTED && prStatus.state !== PrState.HAS_COMMENTS && prStatus.currentIssueMatch !== false) {
-            const rule = getCompletionRule(workflow, role, "done");
-            if (rule && rule.to !== expectedLabel) {
-              await resilientLabelTransition(provider, issueIdNum, expectedLabel, rule.to);
-              await deactivateSlot();
-              await log(workspaceDir, "health_transition_to_review", {
-                project: project.name,
-                projectSlug,
-                role,
-                level,
-                issueId: slot.issueId,
-                sessionKey,
-                slotIndex,
-                fromLabel: expectedLabel,
-                toLabel: rule.to,
-                prUrl: prStatus.url
-              }).catch(() => {
-              });
-            }
-          }
-        } catch {
-        }
-      }
       if (!slot.active && issue2 && currentLabel === expectedLabel) {
         const fix = {
           issue: {
@@ -125188,6 +125311,7 @@ async function scanOrphanedLabels(opts) {
         try {
           const revertTarget = await resolveOrphanRevertLabel(
             provider,
+            freshProject,
             issue2.iid,
             role,
             queueLabel,
@@ -125309,6 +125433,7 @@ function createHealthTool(ctx) {
       for (const slug of slugs) {
         const project = data.projects[slug];
         if (!project) continue;
+        const resolvedConfig = await loadConfig(workspaceDir, slug);
         const { provider } = await resolveProvider(project, ctx.runCommand);
         for (const role of Object.keys(project.workers)) {
           const healthFixes = await checkWorkerHealth({
@@ -125318,7 +125443,10 @@ function createHealthTool(ctx) {
             role,
             sessions,
             autoFix: fix,
-            provider
+            provider,
+            workflow: resolvedConfig.workflow,
+            dispatchConfirmTimeoutMs: resolvedConfig.timeouts.dispatchConfirmTimeoutMs,
+            healthGracePeriodMs: resolvedConfig.timeouts.healthGracePeriodMs
           });
           issues.push(...healthFixes.map((f3) => ({ ...f3, project: project.name, role })));
           const orphanFixes = await scanOrphanedLabels({
@@ -125573,6 +125701,11 @@ function createChannelUnlinkTool(_ctx) {
           type: "string",
           description: "Channel ID to remove (e.g., Telegram group ID)"
         },
+        channel: {
+          type: "string",
+          enum: ["telegram", "whatsapp", "discord", "slack"],
+          description: "Channel type. Defaults to 'telegram'."
+        },
         messageThreadId: {
           type: "number",
           description: "Optional Telegram topic ID. When provided, removes only that specific topic route."
@@ -125589,12 +125722,13 @@ function createChannelUnlinkTool(_ctx) {
     },
     async execute(_id, params) {
       const channelId = params.channelId;
+      const channelType = params.channel ?? "telegram";
       const messageThreadId = typeof params.messageThreadId === "number" ? params.messageThreadId : void 0;
       const projectRef = params.project;
       const confirm = params.confirm;
       const workspaceDir = requireWorkspaceDir(toolCtx);
       const targetRoute = buildRouteRef({
-        channel: "telegram",
+        channel: channelType,
         channelId,
         messageThreadId,
         accountId: toolCtx.agentAccountId
@@ -125912,10 +126046,14 @@ var HEARTBEAT_DEFAULTS = {
   intervalSeconds: 60,
   maxPickupsPerTick: 4
 };
+var DEFAULT_TICK_TIMEOUT_MS = 5e4;
 function resolveHeartbeatConfig(pluginConfig) {
   const raw = pluginConfig?.work_heartbeat;
   return { ...HEARTBEAT_DEFAULTS, ...raw };
 }
+function resolveTickTimeoutMs(config2) {
+  return config2?.timeouts?.tickTimeoutMs ?? DEFAULT_TICK_TIMEOUT_MS;
+}
 
 // lib/github/process-events.ts
 init_zod();
@@ -130794,7 +130932,11 @@ async function reviewPass(opts) {
       if (routing !== "human" && routing !== "agent") continue;
       const isManaged = await provider.issueHasReaction(issue2.iid, "eyes");
       if (!isManaged) continue;
-      const status = await provider.getPrStatus(issue2.iid);
+      const projectData = await readProjects(workspaceDir).catch(() => null);
+      const project = projectData ? getProject(projectData, projectName) : null;
+      const issueRuntime = project ? getIssueRuntime(project, issue2.iid) : void 0;
+      const prSelector = project ? getCanonicalPrSelector(project, issue2.iid) : void 0;
+      const status = await provider.getPrStatus(issue2.iid, prSelector);
       if (status.currentIssueMatch === false) continue;
       if (!status.url && status.state === PrState.CLOSED && baseBranch) {
         try {
@@ -130873,14 +131015,12 @@ async function reviewPass(opts) {
           const closedActions = typeof closedTransition === "object" ? closedTransition.actions : void 0;
           const targetState2 = workflow.states[targetKey2];
           if (targetState2) {
-            await resilientLabelTransition(provider, issue2.iid, state.label, targetState2.label);
+            let aborted3 = false;
             if (closedActions) {
               for (const action of closedActions) {
                 switch (action) {
                   case Action.CLOSE_ISSUE:
                     try {
-                      const project = getProject(await readProjects(workspaceDir), projectName);
-                      const issueRuntime = project ? getIssueRuntime(project, issue2.iid) : void 0;
                       if (!project) throw new Error(`Project not found: ${projectName}`);
                       await guardedCloseIssue({
                         workspaceDir,
@@ -130889,10 +131029,12 @@ async function reviewPass(opts) {
                         issueId: issue2.iid,
                         role: "reviewer",
                         provider,
+                        selector: prSelector,
                         issueRuntime,
                         followUpPrRequired: issueRuntime?.followUpPrRequired === true
                       });
                     } catch {
+                      aborted3 = true;
                     }
                     break;
                   case Action.REOPEN_ISSUE:
@@ -130902,8 +131044,13 @@ async function reviewPass(opts) {
                     }
                     break;
                 }
+                if (aborted3) break;
               }
             }
+            if (aborted3) {
+              continue;
+            }
+            await resilientLabelTransition(provider, issue2.iid, state.label, targetState2.label);
             await log(workspaceDir, "review_transition", {
               project: projectName,
               issueId: issue2.iid,
@@ -130948,8 +131095,6 @@ async function reviewPass(opts) {
           switch (action) {
             case Action.MERGE_PR:
               if (status.state === PrState.MERGED) {
-                const project = getProject(await readProjects(workspaceDir), projectName);
-                const issueRuntime = project ? getIssueRuntime(project, issue2.iid) : void 0;
                 if (project && issueRuntime?.currentPrNumber) {
                   await persistMergedArtifact({
                     workspaceDir,
@@ -130963,9 +131108,7 @@ async function reviewPass(opts) {
                 break;
               }
               try {
-                await provider.mergePr(issue2.iid);
-                const project = getProject(await readProjects(workspaceDir), projectName);
-                const issueRuntime = project ? getIssueRuntime(project, issue2.iid) : void 0;
+                await provider.mergePr(issue2.iid, prSelector);
                 if (project && issueRuntime?.currentPrNumber) {
                   await persistMergedArtifact({
                     workspaceDir,
@@ -131010,8 +131153,6 @@ async function reviewPass(opts) {
               break;
             case Action.CLOSE_ISSUE:
               {
-                const project = getProject(await readProjects(workspaceDir), projectName);
-                const issueRuntime = project ? getIssueRuntime(project, issue2.iid) : void 0;
                 if (!project) throw new Error(`Project not found: ${projectName}`);
                 await guardedCloseIssue({
                   workspaceDir,
@@ -131020,6 +131161,7 @@ async function reviewPass(opts) {
                   issueId: issue2.iid,
                   role: "reviewer",
                   provider,
+                  selector: prSelector,
                   issueRuntime,
                   followUpPrRequired: issueRuntime?.followUpPrRequired === true
                 });
@@ -131085,6 +131227,10 @@ async function reviewSkipPass(opts) {
       if (routing !== "skip") continue;
       const isManaged = await provider.issueHasReaction(issue2.iid, "eyes");
       if (!isManaged) continue;
+      const projectData = await readProjects(workspaceDir).catch(() => null);
+      const project = projectData ? getProject(projectData, projectName) : null;
+      const issueRuntime = project ? getIssueRuntime(project, issue2.iid) : void 0;
+      const prSelector = project ? getCanonicalPrSelector(project, issue2.iid) : void 0;
       let aborted2 = false;
       if (actions && effectiveActions && actions.length !== effectiveActions.length) {
         await log(workspaceDir, "illegal_merge_before_test", {
@@ -131100,14 +131246,12 @@ async function reviewSkipPass(opts) {
         for (const action of effectiveActions) {
           switch (action) {
             case Action.MERGE_PR: {
-              const status = await provider.getPrStatus(issue2.iid);
+              const status = await provider.getPrStatus(issue2.iid, prSelector);
               if (status.currentIssueMatch === false) {
                 aborted2 = true;
                 break;
               }
               if (status.state === PrState.MERGED) {
-                const project = getProject(await readProjects(workspaceDir), projectName);
-                const issueRuntime = project ? getIssueRuntime(project, issue2.iid) : void 0;
                 if (project && issueRuntime?.currentPrNumber) {
                   await persistMergedArtifact({
                     workspaceDir,
@@ -131122,9 +131266,7 @@ async function reviewSkipPass(opts) {
               }
               if (!status.url) break;
               try {
-                await provider.mergePr(issue2.iid);
-                const project = getProject(await readProjects(workspaceDir), projectName);
-                const issueRuntime = project ? getIssueRuntime(project, issue2.iid) : void 0;
+                await provider.mergePr(issue2.iid, prSelector);
                 if (project && issueRuntime?.currentPrNumber) {
                   await persistMergedArtifact({
                     workspaceDir,
@@ -131163,8 +131305,6 @@ async function reviewSkipPass(opts) {
               break;
             case Action.CLOSE_ISSUE:
               try {
-                const project = getProject(await readProjects(workspaceDir), projectName);
-                const issueRuntime = project ? getIssueRuntime(project, issue2.iid) : void 0;
                 if (!project) throw new Error(`Project not found: ${projectName}`);
                 await guardedCloseIssue({
                   workspaceDir,
@@ -131173,10 +131313,12 @@ async function reviewSkipPass(opts) {
                   issueId: issue2.iid,
                   role: "reviewer",
                   provider,
+                  selector: prSelector,
                   issueRuntime,
                   followUpPrRequired: issueRuntime?.followUpPrRequired === true
                 });
               } catch {
+                aborted2 = true;
               }
               break;
             case Action.REOPEN_ISSUE:
@@ -131223,19 +131365,21 @@ async function testSkipPass(opts) {
     for (const issue2 of issues) {
       const routing = detectStepRouting(issue2.labels, "test");
       if (routing !== "skip") continue;
+      const projectData = await readProjects(workspaceDir).catch(() => null);
+      const project = projectData ? getProject(projectData, projectName) : null;
+      const issueRuntime = project ? getIssueRuntime(project, issue2.iid) : void 0;
+      const prSelector = project ? getCanonicalPrSelector(project, issue2.iid) : void 0;
       let aborted2 = false;
       if (actions) {
         for (const action of actions) {
           switch (action) {
             case Action.MERGE_PR: {
-              const status = await provider.getPrStatus(issue2.iid);
+              const status = await provider.getPrStatus(issue2.iid, prSelector);
               if (status.currentIssueMatch === false) {
                 aborted2 = true;
                 break;
               }
               if (status.state === PrState.MERGED) {
-                const project = getProject(await readProjects(workspaceDir), projectName);
-                const issueRuntime = project ? getIssueRuntime(project, issue2.iid) : void 0;
                 if (project && issueRuntime?.currentPrNumber) {
                   await persistMergedArtifact({
                     workspaceDir,
@@ -131249,9 +131393,7 @@ async function testSkipPass(opts) {
               }
               if (!status.url) break;
               try {
-                await provider.mergePr(issue2.iid);
-                const project = getProject(await readProjects(workspaceDir), projectName);
-                const issueRuntime = project ? getIssueRuntime(project, issue2.iid) : void 0;
+                await provider.mergePr(issue2.iid, prSelector);
                 if (project && issueRuntime?.currentPrNumber) {
                   await persistMergedArtifact({
                     workspaceDir,
@@ -131291,8 +131433,6 @@ async function testSkipPass(opts) {
               break;
             case Action.CLOSE_ISSUE:
               try {
-                const project = getProject(await readProjects(workspaceDir), projectName);
-                const issueRuntime = project ? getIssueRuntime(project, issue2.iid) : void 0;
                 if (!project) throw new Error(`Project not found: ${projectName}`);
                 await guardedCloseIssue({
                   workspaceDir,
@@ -131301,10 +131441,12 @@ async function testSkipPass(opts) {
                   issueId: issue2.iid,
                   role: "tester",
                   provider,
+                  selector: prSelector,
                   issueRuntime,
                   followUpPrRequired: issueRuntime?.followUpPrRequired === true
                 });
               } catch {
+                aborted2 = true;
               }
               break;
             case Action.REOPEN_ISSUE:
@@ -131401,6 +131543,146 @@ async function holdEscapePass(opts) {
 // lib/services/heartbeat/passes.ts
 init_workflow();
 init_audit();
+init_workflow();
+init_labels();
+
+// lib/services/reviewer-completion.ts
+init_audit();
+init_labels();
+init_workflow();
+
+// lib/services/reviewer-session.ts
+function extractTextContent(content) {
+  if (typeof content === "string") return content;
+  if (!Array.isArray(content)) return "";
+  return content.filter((block) => typeof block === "object" && block != null).filter((block) => block.type === "text" && typeof block.text === "string").map((block) => block.text).join("\n");
+}
+function extractReviewerDecision(text) {
+  const matches2 = Array.from(text.matchAll(/^\s*Review result:\s*(APPROVE|REJECT)\s*$/gim));
+  const latestMatch = matches2.at(-1);
+  if (!latestMatch) return null;
+  return latestMatch[1]?.toUpperCase() === "APPROVE" ? "approve" : "reject";
+}
+function extractReviewerDecisionFromMessages(messages) {
+  const assistantTexts = messages.filter((message) => typeof message === "object" && message != null).filter((message) => message.role === "assistant").map((message) => extractTextContent(message.content)).filter(Boolean).reverse();
+  for (const text of assistantTexts) {
+    const decision = extractReviewerDecision(text);
+    if (decision) return decision;
+  }
+  return null;
+}
+async function parseReviewerSessionResult(runtime, sessionKey) {
+  try {
+    const messagesResult = await runtime.subagent?.getSessionMessages?.({ sessionKey });
+    if (!messagesResult) return null;
+    const messages = Array.isArray(messagesResult) ? messagesResult : Array.isArray(messagesResult?.messages) ? messagesResult.messages : [];
+    return extractReviewerDecisionFromMessages(messages);
+  } catch {
+    return null;
+  }
+}
+
+// lib/services/reviewer-completion.ts
+function resolveReviewerDecisionTransition(workflow, decision) {
+  const activeLabel = getActiveLabel(workflow, "reviewer");
+  const reviewingState = findStateByLabel(workflow, activeLabel);
+  if (!reviewingState?.on) return null;
+  const eventKey = decision === "approve" ? WorkflowEvent.APPROVE : WorkflowEvent.REJECT;
+  const transition2 = reviewingState.on[eventKey];
+  const targetKey = typeof transition2 === "string" ? transition2 : transition2?.target;
+  const targetState = targetKey ? workflow.states[targetKey] : void 0;
+  if (!targetKey || !targetState) return null;
+  return { eventKey, targetKey, targetLabel: targetState.label };
+}
+async function handleReviewerAgentEnd(opts) {
+  const eventDecision = Array.isArray(opts.messages) && opts.messages.length > 0 ? extractReviewerDecisionFromMessages(opts.messages) : null;
+  const decision = eventDecision ?? (opts.runtime ? await parseReviewerSessionResult(opts.runtime, opts.sessionKey) : null);
+  if (!opts.workspaceDir || !opts.runCommand) {
+    return decision;
+  }
+  const parsed = parseFabricaSessionKey(opts.sessionKey);
+  if (!parsed || parsed.role !== "reviewer") {
+    return decision;
+  }
+  const projects = await readProjects(opts.workspaceDir);
+  const projectEntry = Object.entries(projects.projects).find(([, project2]) => project2.name === parsed.projectName);
+  if (!projectEntry) {
+    return decision;
+  }
+  const [projectSlug, project] = projectEntry;
+  const reviewerWorker = project.workers.reviewer;
+  if (!reviewerWorker) {
+    return decision;
+  }
+  let issueId = null;
+  let slotRef = null;
+  for (const [level, slots] of Object.entries(reviewerWorker.levels)) {
+    const slotIndex = slots.findIndex((candidate) => candidate.sessionKey === opts.sessionKey);
+    if (slotIndex >= 0) {
+      const slot = slots[slotIndex];
+      issueId = Number(slot.issueId ?? slot.lastIssueId ?? 0) || null;
+      slotRef = { level, slotIndex, active: slot.active };
+      break;
+    }
+  }
+  if (!issueId) {
+    return decision;
+  }
+  const { workflow } = await loadConfig(opts.workspaceDir, projectSlug);
+  const activeLabel = getActiveLabel(workflow, "reviewer");
+  const revertLabel = getRevertLabel(workflow, "reviewer");
+  const { provider } = await createProvider({
+    repo: project.repo,
+    provider: project.provider,
+    runCommand: opts.runCommand
+  });
+  const issue2 = await provider.getIssue(issueId);
+  const currentLabel = issue2.labels.find((label) => label === activeLabel || label === revertLabel);
+  if (!currentLabel) {
+    return decision;
+  }
+  if (decision) {
+    const transition2 = resolveReviewerDecisionTransition(workflow, decision);
+    if (transition2 && transition2.targetLabel !== currentLabel) {
+      await resilientLabelTransition(provider, issueId, currentLabel, transition2.targetLabel);
+      if (slotRef?.active) {
+        await deactivateWorker(opts.workspaceDir, projectSlug, "reviewer", {
+          level: slotRef.level,
+          slotIndex: slotRef.slotIndex
+        });
+      }
+      await log(opts.workspaceDir, "reviewer_session_transition", {
+        sessionKey: opts.sessionKey,
+        project: parsed.projectName,
+        issueId,
+        result: decision,
+        eventKey: transition2.eventKey,
+        from: currentLabel,
+        to: transition2.targetLabel
+      }).catch(() => {
+      });
+    }
+    return decision;
+  }
+  if (opts.fallbackToQueueOnUndetermined && currentLabel === activeLabel) {
+    await provider.transitionLabel(issueId, activeLabel, revertLabel);
+    if (slotRef?.active) {
+      await deactivateWorker(opts.workspaceDir, projectSlug, "reviewer", {
+        level: slotRef.level,
+        slotIndex: slotRef.slotIndex
+      });
+    }
+    await log(opts.workspaceDir, "reviewer_session_no_result", {
+      sessionKey: opts.sessionKey,
+      project: parsed.projectName,
+      issueId
+    }).catch(() => {
+    });
+  }
+  return null;
+}
+
+// lib/services/heartbeat/passes.ts
 async function fixDualStateLabels(workspaceDir, projectSlug, project, provider, resolvedConfig) {
   const stateLabels = getStateLabels(resolvedConfig.workflow);
   if (stateLabels.length === 0) return 0;
@@ -131448,24 +131730,27 @@ async function performHealthPass(workspaceDir, projectSlug, project, sessions, p
     for (const intent of pendingIntents) {
       if (intent.ts < staleThreshold) {
         try {
-          if (intent.deliveryTarget?.channelId) {
-            await notify(intent.data, {
-              workspaceDir,
-              config: notifyConfig,
-              runtime,
-              runCommand,
-              deliveryTargetOverride: intent.deliveryTarget
-            });
-          } else {
-            await notify(intent.data, {
-              workspaceDir,
-              config: notifyConfig,
-              runtime,
-              runCommand
+          const eventType = typeof intent.data?.type === "string" ? intent.data.type : void 0;
+          const notificationsEnabled = eventType ? notifyConfig[eventType] !== false : true;
+          const hasDeliveryTarget = Boolean(intent.deliveryTarget?.channelId);
+          const sent = intent.deliveryTarget?.channelId ? await notify(intent.data, {
+            workspaceDir,
+            config: notifyConfig,
+            runtime,
+            runCommand,
+            deliveryTargetOverride: intent.deliveryTarget,
+            skipOutboxWrite: true
+          }) : await notify(intent.data, {
+            workspaceDir,
+            config: notifyConfig,
+            runtime,
+            runCommand,
+            skipOutboxWrite: true
+          });
+          if (sent && hasDeliveryTarget && notificationsEnabled) {
+            await markDelivered(workspaceDir, intent.key).catch(() => {
             });
           }
-          await markDelivered(workspaceDir, intent.key).catch(() => {
-          });
         } catch {
         }
       }
@@ -131483,7 +131768,8 @@ async function performHealthPass(workspaceDir, projectSlug, project, sessions, p
       provider,
       staleWorkerHours,
       workflow: resolvedConfig?.workflow,
-      dispatchConfirmTimeoutMs: resolvedConfig?.timeouts?.dispatchConfirmTimeoutMs
+      dispatchConfirmTimeoutMs: resolvedConfig?.timeouts?.dispatchConfirmTimeoutMs,
+      healthGracePeriodMs: resolvedConfig?.timeouts?.healthGracePeriodMs
     });
     fixedCount += healthFixes.filter((f3) => f3.fixed).length;
     const orphanFixes = await scanOrphanedLabels({
@@ -131722,6 +132008,75 @@ async function performHoldEscapePass(workspaceDir, projectSlug, project, provide
     }
   });
 }
+async function performReviewerPollPass(workspaceDir, projectSlug, project, provider, resolvedConfig, runtime) {
+  if (!runtime) return 0;
+  const workflow = resolvedConfig.workflow;
+  let activeLabel;
+  try {
+    activeLabel = getActiveLabel(workflow, "reviewer");
+  } catch {
+    return 0;
+  }
+  const reviewerWorker = project.workers["reviewer"];
+  if (!reviewerWorker) return 0;
+  let transitions = 0;
+  for (const [level, slots] of Object.entries(reviewerWorker.levels)) {
+    for (let slotIndex = 0; slotIndex < slots.length; slotIndex++) {
+      const slot = slots[slotIndex];
+      if (!slot.active || !slot.sessionKey || !slot.issueId) continue;
+      const startTime = slot.startTime ? new Date(slot.startTime).getTime() : 0;
+      if (startTime && Date.now() - startTime < 2 * 6e4) continue;
+      const reviewResult = await handleReviewerAgentEnd({
+        sessionKey: slot.sessionKey,
+        runtime
+      });
+      if (!reviewResult) continue;
+      const transition2 = resolveReviewerDecisionTransition(workflow, reviewResult);
+      if (!transition2) continue;
+      let issue2;
+      try {
+        issue2 = await provider.getIssue(Number(slot.issueId));
+      } catch {
+        continue;
+      }
+      if (!issue2.labels.includes(activeLabel)) {
+        await deactivateWorker(workspaceDir, projectSlug, "reviewer", {
+          level,
+          slotIndex
+        });
+        await log(workspaceDir, "reviewer_poll_slot_released", {
+          sessionKey: slot.sessionKey,
+          project: project.name,
+          projectSlug,
+          issueId: slot.issueId,
+          from: activeLabel,
+          currentLabels: issue2.labels,
+          reason: "issue_already_moved"
+        }).catch(() => {
+        });
+        continue;
+      }
+      await resilientLabelTransition(provider, Number(slot.issueId), activeLabel, transition2.targetLabel);
+      await deactivateWorker(workspaceDir, projectSlug, "reviewer", {
+        level,
+        slotIndex
+      });
+      await log(workspaceDir, "reviewer_poll_transition", {
+        sessionKey: slot.sessionKey,
+        project: project.name,
+        projectSlug,
+        issueId: slot.issueId,
+        result: reviewResult,
+        eventKey: transition2.eventKey,
+        from: activeLabel,
+        to: transition2.targetLabel
+      }).catch(() => {
+      });
+      transitions++;
+    }
+  }
+  return transitions;
+}
 
 // lib/github/pr-event-source.ts
 function buildRunId2(installationId, repositoryId, prNumber, headSha) {
@@ -131828,7 +132183,8 @@ async function runPrDiscoveryPass(params) {
   }
   for (const { issueId } of activeSlots) {
     try {
-      const prDetails = await params.provider.getPrDetails(issueId);
+      const prSelector = getCanonicalPrSelector(params.project, issueId);
+      const prDetails = await params.provider.getPrDetails(issueId, prSelector);
       if (!prDetails) {
         result.skipped++;
         continue;
@@ -131955,52 +132311,6 @@ async function checkGenesisHealth(workspaceDir) {
   }
 }
 
-// lib/observability/health-score.ts
-function computeHealthScore(input) {
-  const signals = [];
-  let totalWeight = 0;
-  let weightedSum = 0;
-  let hasMeaningfulData = false;
-  function addSignal(name, raw, weight, meaningful = true) {
-    if (raw === null) {
-      signals.push({ name, raw, weighted: 0 });
-      return;
-    }
-    if (meaningful) hasMeaningfulData = true;
-    const clamped = Math.max(0, Math.min(1, raw));
-    const weighted = clamped * weight * 100;
-    signals.push({ name, raw, weighted });
-    totalWeight += weight;
-    weightedSum += weighted;
-  }
-  addSignal("completion_rate", input.completionRate, 0.25);
-  const speedRatio = input.avgDispatchToCompletionMinutes !== null && input.avgDispatchToCompletionMinutes > 0 ? Math.min(1, input.baselineMinutes / input.avgDispatchToCompletionMinutes) : null;
-  addSignal("dispatch_speed", speedRatio, 0.2);
-  const errorScore = input.errorRate !== null ? 1 - input.errorRate : null;
-  addSignal("error_rate", errorScore, 0.2);
-  const queueScore = input.maxQueueDepth > 0 ? 1 - Math.min(1, input.queueDepth / input.maxQueueDepth) : 1;
-  addSignal("queue_depth", queueScore, 0.15, false);
-  addSignal("heartbeat_regularity", input.heartbeatRegularity, 0.2);
-  if (!hasMeaningfulData) {
-    return { score: 50, status: "degraded", signals };
-  }
-  const score = totalWeight > 0 ? Math.round(weightedSum / totalWeight) : 50;
-  const status = score > 80 ? "healthy" : score >= 50 ? "degraded" : "unhealthy";
-  return { score, status, signals };
-}
-
-// lib/observability/alerting.ts
-function shouldAlert(score, threshold, state, now2) {
-  if (score < threshold) {
-    if (now2 - state.lastAlertTs < state.cooldownMs) return "skip";
-    return "alert";
-  }
-  if (state.lastAlertScore < threshold && score >= 80) {
-    return "recovered";
-  }
-  return "skip";
-}
-
 // lib/observability/tracer.ts
 init_esm();
 var TRACER_NAME = "fabrica.heartbeat";
@@ -132023,8 +132333,6 @@ async function withTelemetrySpan2(name, fn) {
 
 // lib/services/heartbeat/tick-runner.ts
 var discoveredProjects = /* @__PURE__ */ new Set();
-var _tickCount = 0;
-var _alertState = { lastAlertTs: 0, lastAlertScore: 100, cooldownMs: 18e5 };
 function validateWorkflowIntegrity2(workflow) {
   const errors = [];
   const stateKeys = new Set(Object.keys(workflow.states));
@@ -132119,6 +132427,14 @@ async function tick(opts) {
           }).catch((err) => {
             opts.logger.warn?.(`PR discovery pass failed for ${slug}: ${err.message}`);
           });
+          result.totalReviewTransitions += await performReviewerPollPass(
+            workspaceDir,
+            slug,
+            project,
+            provider,
+            resolvedConfig,
+            runtime
+          );
           result.totalReviewTransitions += await performReviewPass(
             workspaceDir,
             slug,
@@ -132200,35 +132516,6 @@ async function tick(opts) {
     pickups: result.totalPickups,
     skipped: result.totalSkipped
   });
-  _tickCount++;
-  if (_tickCount % 10 === 0) {
-    const healthScore = computeHealthScore({
-      completionRate: slugs.length > 0 ? result.totalPickups / Math.max(1, slugs.length) : null,
-      avgDispatchToCompletionMinutes: null,
-      baselineMinutes: 30,
-      errorRate: slugs.length > 0 ? result.totalHealthFixes / Math.max(1, slugs.length) : null,
-      queueDepth: result.totalSkipped,
-      maxQueueDepth: Math.max(20, slugs.length * 3),
-      heartbeatRegularity: null
-    });
-    await log(workspaceDir, "health_score", {
-      score: healthScore.score,
-      status: healthScore.status,
-      tickCount: _tickCount
-    }).catch(() => {
-    });
-    const decision = shouldAlert(healthScore.score, 60, _alertState, Date.now());
-    if (decision === "alert" || decision === "recovered") {
-      _alertState.lastAlertTs = Date.now();
-      _alertState.lastAlertScore = healthScore.score;
-      await log(workspaceDir, "health_alert", {
-        decision,
-        score: healthScore.score,
-        status: healthScore.status
-      }).catch(() => {
-      });
-    }
-  }
   return result;
 }
 async function checkProjectActive(workspaceDir, slug) {
@@ -132288,7 +132575,6 @@ function registerHeartbeatService(api, pluginCtx) {
     }
   });
 }
-var DEFAULT_TICK_TIMEOUT_MS = 5e4;
 var _ticksTimedOut = 0;
 async function withTickMutex(fn) {
   if (_anyTickRunning) return "busy";
@@ -132312,6 +132598,8 @@ async function runHeartbeatTick(ctx, logger6, mode) {
   let timedOut = false;
   try {
     const workspace = discoverAgents(ctx.config)[0]?.workspace;
+    const resolvedWorkspaceConfig = workspace ? await loadConfig(workspace).catch(() => null) : null;
+    const tickTimeoutMs = resolveTickTimeoutMs(resolvedWorkspaceConfig);
     const lifecycle = workspace ? await getLifecycleService(workspace, logger6) : null;
     const run = () => ctx.observability.withContext(
       { phase: `heartbeat:${mode}` },
@@ -132344,10 +132632,10 @@ async function runHeartbeatTick(ctx, logger6, mode) {
       }
     };
     const HARD_TICK_TIMEOUT_MS = 5 * 6e4;
-    const raceResult = await raceWithTimeout(wrappedTickFn, DEFAULT_TICK_TIMEOUT_MS, () => {
+    const raceResult = await raceWithTimeout(wrappedTickFn, tickTimeoutMs, () => {
       _ticksTimedOut++;
       timedOut = true;
-      logger6.warn(`work_heartbeat ${mode} tick timed out after ${DEFAULT_TICK_TIMEOUT_MS}ms (total timeouts: ${_ticksTimedOut})`);
+      logger6.warn(`work_heartbeat ${mode} tick timed out after ${tickTimeoutMs}ms (total timeouts: ${_ticksTimedOut})`);
       const hardTimeout = setTimeout(() => {
         logger6.error("tick_mutex: hard timeout \u2014 forcing mutex release");
         _tickRunning[mode] = false;
@@ -135758,6 +136046,7 @@ var registerStep = {
     const resolvedName = name ?? fail("Missing project name or repository target for registration");
     const resolvedRepo = repo ?? fail("Missing project name or repository target for registration");
     const resolvedChannelId = channelId ?? fail("Missing channel binding for project registration");
+    const createProjectTopic = payload.metadata.source === "telegram-dm-bootstrap";
     try {
       const programmaticSources = ["telegram-dm-bootstrap", "genesis-trigger-script"];
       const projectWorkflowConfig = programmaticSources.includes(payload.metadata.source ?? "") ? { workflow: { reviewPolicy: "agent" } } : void 0;
@@ -135776,7 +136065,7 @@ var registerStep = {
         pluginConfig: ctx.pluginConfig,
         baseBranch,
         deployBranch: baseBranch,
-        createProjectTopic: payload.metadata.source === "telegram-dm-bootstrap",
+        createProjectTopic,
         projectWorkflowConfig
       });
       if (programmaticSources.includes(payload.metadata.source ?? "") && output.activeWorkflow.reviewPolicy !== "agent") {
@@ -135800,6 +136089,7 @@ var registerStep = {
         metadata: {
           ...payload.metadata,
           project_registered: output.success,
+          project_topic_created: createProjectTopic && output.success && output.messageThreadId != null,
           project_slug: output.projectSlug ?? payload.metadata.project_slug,
           repo_path: resolvedRepo,
           channel_id: output.channelId,
@@ -136341,7 +136631,7 @@ async function runPipeline(initialPayload, ctx) {
       ctx.log(`Step ${step.name} completed in ${stepDuration}ms`);
     } catch (err) {
       ctx.log(`Step ${step.name} FAILED: ${String(err)}`);
-      const failureArtifacts = deriveArtifacts(payload);
+      const failureArtifacts = mergeArtifacts(deriveArtifacts(payload), extractErrorArtifacts(err));
       if (failureArtifacts.length > 0) {
         const cleanupResults = await cleanupArtifacts(failureArtifacts, {
           log: ctx.log,
@@ -136383,6 +136673,12 @@ function deriveArtifacts(payload) {
     const provider = payload.provisioning.provider === "gitlab" ? "gitlab_repo" : "github_repo";
     artifacts.push({ type: provider, id: payload.provisioning.repo_url });
   }
+  if (payload.metadata.project_topic_created === true && payload.metadata.channel_id && payload.metadata.message_thread_id != null) {
+    artifacts.push({
+      type: "forum_topic",
+      id: buildForumTopicArtifactId(payload.metadata.channel_id, payload.metadata.message_thread_id)
+    });
+  }
   if (payload.issues?.length) {
     for (const issue2 of payload.issues) {
       artifacts.push({ type: "github_issue", id: String(issue2.number) });
@@ -136390,6 +136686,31 @@ function deriveArtifacts(payload) {
   }
   return artifacts;
 }
+function extractErrorArtifacts(err) {
+  const artifacts = err?.artifacts;
+  if (!Array.isArray(artifacts)) {
+    return [];
+  }
+  return artifacts.filter(isPipelineArtifact);
+}
+function isPipelineArtifact(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  const artifact = value;
+  return typeof artifact.id === "string" && (artifact.type === "github_repo" || artifact.type === "gitlab_repo" || artifact.type === "forum_topic" || artifact.type === "github_issue");
+}
+function mergeArtifacts(primary, secondary) {
+  const merged = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const artifact of [...primary, ...secondary]) {
+    const key = `${artifact.type}:${artifact.id}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    merged.push(artifact);
+  }
+  return merged;
+}
 
 // lib/tools/admin/genesis.ts
 import { homedir as homedir2 } from "node:os";
@@ -136398,7 +136719,7 @@ import { homedir as homedir2 } from "node:os";
 import { createHash as createHash5, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync as readFileSync3, writeFileSync } from "node:fs";
 import { join as join3 } from "node:path";
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 var GENESIS_TOKEN_VERSION = 1;
 var GENESIS_TOKEN_PREFIX = "g1";
 var GENESIS_TOKEN_SECRET_FILE = ".commit-token-secret";
@@ -136580,7 +136901,7 @@ function normalizeGenesisRequest(params, existingPayload) {
   const dryRun = typeof params.dry_run === "boolean" ? params.dry_run : existingPayload?.dry_run ?? false;
   return {
     phase: phaseCandidate,
-    sessionId: normalizeOptionalString(params.session_id) ?? existingPayload?.session_id ?? randomUUID3(),
+    sessionId: normalizeOptionalString(params.session_id) ?? existingPayload?.session_id ?? randomUUID4(),
     rawIdea: normalizeOptionalString(params.idea) ?? command ?? (existingPayload?.raw_idea ? existingPayload.raw_idea : void 0),
     answers,
     answersJson,
@@ -136941,13 +137262,18 @@ async function handleCommit(params, normalized, ctx) {
       }
     };
     const result = await runPipeline(payload, ctx);
+    const projectRegistered = result.payload.metadata.project_registered === true;
+    const hasRunnableWork = (result.payload.issues?.length ?? 0) > 0 || result.payload.triage?.ready_for_dispatch === true;
+    const programmaticCommitFailedClosed = !dryRun && result.success && !projectRegistered && !hasRunnableWork;
+    const success2 = programmaticCommitFailedClosed ? false : result.success;
+    const error48 = programmaticCommitFailedClosed ? "Programmatic commit produced no registered project and no runnable work" : result.error;
     return jsonResult25({
-      success: result.success,
+      success: success2,
       session_id: result.payload.session_id,
       steps_executed: result.steps_executed,
       steps_skipped: result.steps_skipped,
       duration_ms: result.duration_ms,
-      error: result.error,
+      error: error48,
       spec: result.payload.spec,
       scaffold: result.payload.scaffold,
       qa_contract: result.payload.qa_contract,
@@ -138349,7 +138675,7 @@ init_zod();
 
 // lib/dispatch/telegram-bootstrap-session.ts
 init_constants();
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash6, randomUUID as randomUUID5 } from "node:crypto";
 import fs39 from "node:fs/promises";
 import path41 from "node:path";
 var SESSION_TTL_MS = 10 * 6e4;
@@ -138405,7 +138731,7 @@ async function writeTelegramBootstrapSession(workspaceDir, session) {
   const dir = sessionsDir(workspaceDir);
   await fs39.mkdir(dir, { recursive: true });
   const file2 = sessionPath(workspaceDir, session.conversationId);
-  const tmp = `${file2}.tmp`;
+  const tmp = `${file2}.${randomUUID5()}.tmp`;
   await fs39.writeFile(tmp, JSON.stringify(session, null, 2) + "\n", "utf-8");
   await fs39.rename(tmp, file2);
 }
@@ -138718,6 +139044,54 @@ function logBootstrapWarning(ctx, message) {
     ctx.logger.info(message);
   }
 }
+async function runBootstrapPreflightOrFail(ctx, conversationId, workspaceDir, request, sourceRoute, options) {
+  const telegramConfig = readFabricaTelegramConfig(ctx.pluginConfig);
+  const existingSession = await readTelegramBootstrapSession(workspaceDir, conversationId);
+  const language = options?.language ?? existingSession?.language ?? "pt";
+  if (!telegramConfig.projectsForumChatId) {
+    await upsertTelegramBootstrapSession(workspaceDir, {
+      conversationId,
+      rawIdea: request.rawIdea,
+      projectName: request.projectName ?? void 0,
+      stackHint: request.stackHint ?? void 0,
+      repoUrl: request.repoUrl ?? void 0,
+      repoPath: request.repoPath ?? void 0,
+      sourceRoute,
+      status: "failed",
+      language,
+      error: "missing_projects_forum_chat"
+    });
+    await sendTelegramText(
+      ctx,
+      conversationId,
+      "A Fabrica precisa de um grupo de projetos configurado para criar projetos automaticamente. Configure 'telegram.projectsForumChatId' no openclaw.json do plugin."
+    );
+    return true;
+  }
+  const candidateSlug = inferProjectSlug(request.projectName ?? request.rawIdea);
+  if (!candidateSlug) return false;
+  const projects = await readProjects(workspaceDir).catch(() => null);
+  if (!projects?.projects?.[candidateSlug]) return false;
+  await upsertTelegramBootstrapSession(workspaceDir, {
+    conversationId,
+    rawIdea: request.rawIdea,
+    projectName: request.projectName ?? void 0,
+    stackHint: request.stackHint ?? void 0,
+    repoUrl: request.repoUrl ?? void 0,
+    repoPath: request.repoPath ?? void 0,
+    sourceRoute,
+    status: "failed",
+    projectSlug: candidateSlug,
+    language,
+    error: "duplicate_project_slug"
+  });
+  await sendTelegramText(
+    ctx,
+    conversationId,
+    `Ja existe um projeto registrado com o slug "${candidateSlug}". Use o fluxo administrativo para vincular canais ou ajustar o projeto existente.`
+  );
+  return true;
+}
 async function classifyAndBootstrap(ctx, workspaceDir, conversationId, content) {
   await upsertTelegramBootstrapSession(workspaceDir, {
     conversationId,
@@ -138734,7 +139108,6 @@ async function classifyAndBootstrap(ctx, workspaceDir, conversationId, content)
     return;
   }
   const language = classification.language ?? "pt";
-  await sendTelegramText(ctx, conversationId, BOOTSTRAP_MESSAGES.ack[language]);
   const parsed = parseBootstrapRequest(content);
   if (classification.stackHint && !parsed.stackHint) {
     parsed.stackHint = classification.stackHint;
@@ -138763,6 +139136,18 @@ async function classifyAndBootstrap(ctx, workspaceDir, conversationId, content)
     }
   }
   const sourceRoute = { channel: "telegram", channelId: conversationId };
+  if (parsed.stackHint) {
+    const handled = await runBootstrapPreflightOrFail(
+      ctx,
+      conversationId,
+      workspaceDir,
+      incomingRequest,
+      sourceRoute,
+      { language }
+    );
+    if (handled) return;
+  }
+  await sendTelegramText(ctx, conversationId, BOOTSTRAP_MESSAGES.ack[language]);
   const session = await upsertTelegramBootstrapSession(workspaceDir, {
     conversationId,
     ...incomingRequest,
@@ -138805,15 +139190,10 @@ function bootstrapWithTimeout(ctx, conversationId, workspaceDir, request, source
   });
 }
 async function continueBootstrap(ctx, conversationId, workspaceDir, request, sourceRoute) {
-  const telegramConfig = readFabricaTelegramConfig(ctx.pluginConfig);
-  if (!telegramConfig.projectsForumChatId) {
-    await sendTelegramText(
-      ctx,
-      conversationId,
-      "A Fabrica precisa de um grupo de projetos configurado para criar projetos automaticamente. Configure 'telegram.projectsForumChatId' no openclaw.json do plugin."
-    );
+  if (await runBootstrapPreflightOrFail(ctx, conversationId, workspaceDir, request, sourceRoute)) {
     return;
   }
+  const telegramConfig = readFabricaTelegramConfig(ctx.pluginConfig);
   const stackHint = request.stackHint;
   if (!stackHint) {
     const existingSession = await readTelegramBootstrapSession(workspaceDir, conversationId);
@@ -138864,18 +139244,6 @@ async function continueBootstrap(ctx, conversationId, workspaceDir, request, sou
       }
     }
   }
-  const candidateSlug = inferProjectSlug(request.projectName ?? request.rawIdea);
-  if (candidateSlug) {
-    const projects = await readProjects(workspaceDir).catch(() => null);
-    if (projects?.projects?.[candidateSlug]) {
-      await sendTelegramText(
-        ctx,
-        conversationId,
-        `Ja existe um projeto registrado com o slug "${candidateSlug}". Use o fluxo administrativo para vincular canais ou ajustar o projeto existente.`
-      );
-      return;
-    }
-  }
   const stepCtx = {
     runCommand: async (cmd, args, opts) => {
       const result2 = await ctx.runCommand([cmd, ...args], {
@@ -138931,7 +139299,7 @@ async function continueBootstrap(ctx, conversationId, workspaceDir, request, sou
   const result = await runPipeline(payload, stepCtx);
   if (!result.success) {
     const orphanedRepoArtifact = result.artifacts?.find((a) => a.type === "github_repo" || a.type === "gitlab_repo");
-    const projectRegistered = result.payload?.project_registered === true;
+    const projectRegistered = result.payload?.metadata?.project_registered === true;
     if (orphanedRepoArtifact && !projectRegistered) {
       await upsertTelegramBootstrapSession(workspaceDir, {
         conversationId,
@@ -139121,6 +139489,20 @@ function registerTelegramBootstrapHook(api, ctx) {
         repoPath: existingSession.repoPath ?? null
       };
       ctx.logger.info(`[telegram-bootstrap] clarification resolved: stack=${mergedRequest.stackHint}, idea="${mergedRequest.rawIdea}" (conversation: ${conversationId})`);
+      if (mergedRequest.stackHint) {
+        const handled2 = await runBootstrapPreflightOrFail(
+          ctx,
+          conversationId,
+          workspaceDir,
+          mergedRequest,
+          existingSession.sourceRoute ?? {
+            channel: "telegram",
+            channelId: conversationId
+          },
+          { language: existingSession.language ?? "pt" }
+        );
+        if (handled2) return;
+      }
       bootstrapWithTimeout(ctx, conversationId, workspaceDir, mergedRequest, existingSession.sourceRoute ?? {
         channel: "telegram",
         channelId: conversationId
@@ -139185,19 +139567,19 @@ function registerTelegramBootstrapHook(api, ctx) {
       repoPath: parsed.repoPath ?? null
     };
     const language = /\b(cria|crie|criar|construa|desenvolva|registre|novo projeto)\b/i.test(content) ? "pt" : "en";
-    await sendTelegramText(ctx, conversationId, BOOTSTRAP_MESSAGES.ack[language]);
-    const session = await upsertTelegramBootstrapSession(workspaceDir, {
-      conversationId,
-      ...incomingRequest,
-      sourceRoute: {
-        channel: "telegram",
-        channelId: conversationId
-      },
-      sourceChannel: "telegram",
-      status: "received",
-      language
-    });
     if (!parsed.stackHint) {
+      await sendTelegramText(ctx, conversationId, BOOTSTRAP_MESSAGES.ack[language]);
+      const session = await upsertTelegramBootstrapSession(workspaceDir, {
+        conversationId,
+        ...incomingRequest,
+        sourceRoute: {
+          channel: "telegram",
+          channelId: conversationId
+        },
+        sourceChannel: "telegram",
+        status: "received",
+        language
+      });
       const pendingClarification = !parsed.projectName ? "stack_and_name" : "stack";
       await upsertTelegramBootstrapSession(workspaceDir, {
         conversationId,
@@ -139210,6 +139592,30 @@ function registerTelegramBootstrapHook(api, ctx) {
       await sendTelegramText(ctx, conversationId, buildClarificationMessage(parsed, pendingClarification, language));
       return;
     }
+    const handled = await runBootstrapPreflightOrFail(
+      ctx,
+      conversationId,
+      workspaceDir,
+      incomingRequest,
+      {
+        channel: "telegram",
+        channelId: conversationId
+      },
+      { language }
+    );
+    if (handled) return;
+    await sendTelegramText(ctx, conversationId, BOOTSTRAP_MESSAGES.ack[language]);
+    await upsertTelegramBootstrapSession(workspaceDir, {
+      conversationId,
+      ...incomingRequest,
+      sourceRoute: {
+        channel: "telegram",
+        channelId: conversationId
+      },
+      sourceChannel: "telegram",
+      status: "received",
+      language
+    });
     bootstrapWithTimeout(ctx, conversationId, workspaceDir, incomingRequest, {
       channel: "telegram",
       channelId: conversationId
@@ -139529,7 +139935,7 @@ function registerGatewayLifecycleHook(api, ctx) {
 init_audit();
 
 // lib/dispatch/reactive-dispatch-hook.ts
-var COMPLETION_TOOLS = /* @__PURE__ */ new Set(["work_finish", "review_submit"]);
+var COMPLETION_TOOLS = /* @__PURE__ */ new Set(["work_finish"]);
 var spawnTimes = /* @__PURE__ */ new Map();
 function getSpawnTime(sessionKey) {
   return spawnTimes.get(sessionKey);
@@ -139538,6 +139944,18 @@ function clearSpawnTime(sessionKey) {
   spawnTimes.delete(sessionKey);
 }
 function registerReactiveDispatchHooks(api, ctx) {
+  const workspaceDir = resolveWorkspaceDir(ctx.config);
+  api.on("before_tool_call", async (event, eventCtx) => {
+    if (event.toolName !== "work_finish") return;
+    const runId = eventCtx.runId ?? event.runId;
+    if (!runId) return;
+    return {
+      params: {
+        ...event.params,
+        _dispatchRunId: runId
+      }
+    };
+  });
   api.on("after_tool_call", async (event, _eventCtx) => {
     if (!COMPLETION_TOOLS.has(event.toolName)) return;
     ctx.runtime?.system.requestHeartbeatNow({ reason: "work_finish", coalesceMs: 2e3 });
@@ -139557,6 +139975,10 @@ function registerReactiveDispatchHooks(api, ctx) {
     const sessionKey = event.childSessionKey;
     if (!sessionKey) return;
     spawnTimes.set(sessionKey, Date.now());
+    if (workspaceDir && event.runId) {
+      await bindDispatchRunIdBySessionKey(workspaceDir, sessionKey, event.runId).catch(() => {
+      });
+    }
   });
 }
 
@@ -139599,7 +140021,7 @@ function registerSubagentLifecycleHook(api, ctx) {
       let foundSlot;
       for (const [level, slots] of Object.entries(roleWorker.levels)) {
         for (let i2 = 0; i2 < slots.length; i2++) {
-          if (slots[i2].sessionKey === sessionKey && slots[i2].active) {
+          if (slots[i2].sessionKey === sessionKey) {
             foundLevel = level;
             foundSlotIndex = i2;
             foundSlot = slots[i2];
@@ -139609,24 +140031,88 @@ function registerSubagentLifecycleHook(api, ctx) {
         if (foundSlot) break;
       }
       if (!foundSlot || foundLevel == null || foundSlotIndex == null) return;
-      const issueId = foundSlot.issueId;
-      await deactivateWorker(workspaceDir, projectSlug, role, {
-        level: foundLevel,
-        slotIndex: foundSlotIndex
-      });
+      const issueId = foundSlot.issueId ?? foundSlot.lastIssueId;
+      const issueRuntime = issueId ? project.issueRuntime?.[String(issueId)] : void 0;
+      const currentDispatchRunId = foundSlot.dispatchRunId ?? issueRuntime?.dispatchRunId ?? null;
+      const currentDispatchCycleId = foundSlot.dispatchCycleId ?? issueRuntime?.lastDispatchCycleId ?? null;
+      if (event.runId && currentDispatchRunId && event.runId !== currentDispatchRunId) {
+        await log(workspaceDir, "subagent_ended_slot_cleanup_rejected", {
+          sessionKey,
+          project: projectName,
+          projectSlug,
+          role,
+          level: foundLevel,
+          slotIndex: foundSlotIndex,
+          issueId,
+          reason: "stale_dispatch_cycle",
+          eventRunId: event.runId,
+          currentDispatchRunId,
+          currentDispatchCycleId
+        }).catch(() => {
+        });
+        return;
+      }
+      if (foundSlot.dispatchCycleId && issueRuntime?.lastDispatchCycleId && foundSlot.dispatchCycleId !== issueRuntime.lastDispatchCycleId) {
+        await log(workspaceDir, "subagent_ended_slot_cleanup_rejected", {
+          sessionKey,
+          project: projectName,
+          projectSlug,
+          role,
+          level: foundLevel,
+          slotIndex: foundSlotIndex,
+          issueId,
+          reason: "stale_dispatch_cycle",
+          eventRunId: event.runId ?? null,
+          currentDispatchRunId,
+          slotDispatchCycleId: foundSlot.dispatchCycleId,
+          runtimeDispatchCycleId: issueRuntime.lastDispatchCycleId
+        }).catch(() => {
+        });
+        return;
+      }
+      if (foundSlot.active) {
+        await deactivateWorker(workspaceDir, projectSlug, role, {
+          level: foundLevel,
+          slotIndex: foundSlotIndex
+        });
+      }
       if (issueId) {
         try {
-          const config2 = await loadConfig(workspaceDir, projectSlug);
-          const activeLabel = getActiveLabel(config2.workflow, role);
-          const revertLabel = getRevertLabel(config2.workflow, role);
-          const { provider } = await createProvider({
-            repo: project.repo,
-            provider: project.provider,
-            runCommand: ctx.runCommand
-          });
-          const issue2 = await provider.getIssue(Number(issueId));
-          if (issue2.labels.includes(activeLabel)) {
-            await provider.transitionLabel(Number(issueId), activeLabel, revertLabel);
+          if (role === "reviewer") {
+            const reviewResult = await handleReviewerAgentEnd({
+              sessionKey,
+              runtime: ctx.runtime,
+              workspaceDir,
+              runCommand: ctx.runCommand,
+              fallbackToQueueOnUndetermined: true
+            });
+            if (!reviewResult) {
+              const { workflow } = await loadConfig(workspaceDir, projectSlug);
+              const activeLabel = getActiveLabel(workflow, role);
+              const revertLabel = getRevertLabel(workflow, role);
+              const { provider } = await createProvider({
+                repo: project.repo,
+                provider: project.provider,
+                runCommand: ctx.runCommand
+              });
+              const issue2 = await provider.getIssue(Number(issueId));
+              if (issue2.labels.includes(activeLabel)) {
+                await provider.transitionLabel(Number(issueId), activeLabel, revertLabel);
+              }
+            }
+          } else {
+            const { workflow } = await loadConfig(workspaceDir, projectSlug);
+            const activeLabel = getActiveLabel(workflow, role);
+            const revertLabel = getRevertLabel(workflow, role);
+            const { provider } = await createProvider({
+              repo: project.repo,
+              provider: project.provider,
+              runCommand: ctx.runCommand
+            });
+            const issue2 = await provider.getIssue(Number(issueId));
+            if (issue2.labels.includes(activeLabel)) {
+              await provider.transitionLabel(Number(issueId), activeLabel, revertLabel);
+            }
           }
         } catch {
         }
@@ -139711,13 +140197,25 @@ When you have finished your task, you MUST call the \`work_finish\` tool to sign
 Do NOT rely on your session ending automatically \u2014 you must explicitly call \`work_finish\`.
 This is required for the pipeline to advance to the next stage.
 `;
+var REVIEWER_COMPLETION_CONTEXT = `## Task Completion
+
+When you finish the review, signal completion by ending your response with the decision line below.
+End your response with exactly one decision line in plain text:
+- \`Review result: APPROVE\`
+- \`Review result: REJECT\`
+
+The orchestrator reads that line directly from your response and advances the review stage automatically.
+If you need the project slug for follow-up tools such as \`task_create\`, use the value from the \`Channel:\` line in the task message.
+`;
 function registerWorkerContextHook(api, _ctx) {
   api.on("before_agent_start", async (_event, eventCtx) => {
     const sessionKey = eventCtx.sessionKey;
     if (!sessionKey) return;
     const parsed = parseFabricaSessionKey(sessionKey);
     if (!parsed) return;
-    return { prependSystemContext: WORK_FINISH_CONTEXT };
+    return {
+      prependSystemContext: parsed.role === "reviewer" ? REVIEWER_COMPLETION_CONTEXT : WORK_FINISH_CONTEXT
+    };
   });
 }
 
@@ -139758,14 +140256,30 @@ var plugin = {
                 type: "string",
                 description: "Environment variable containing the GitHub App webhook secret."
               },
+              webhookSecret: {
+                type: "string",
+                description: "Inline GitHub App webhook secret."
+              },
+              webhookSecretPath: {
+                type: "string",
+                description: "Filesystem path containing the GitHub App webhook secret."
+              },
+              webhookMode: {
+                type: "string",
+                enum: ["required", "optional", "disabled"],
+                description: "Controls GitHub webhook route registration behavior."
+              },
               authProfiles: {
                 type: "object",
                 additionalProperties: {
                   type: "object",
                   properties: {
                     mode: { type: "string", enum: ["github-app"] },
+                    appId: { type: "string" },
                     appIdEnv: { type: "string" },
+                    privateKey: { type: "string" },
                     privateKeyEnv: { type: "string" },
+                    privateKeyPath: { type: "string" },
                     privateKeyPathEnv: { type: "string" },
                     baseUrl: { type: "string" },
                     fallbackMode: { type: "string", enum: ["pr-conversation-comment"] },