@monoes/monomindcli 2.10.10 → 2.10.14

package/dist/src/orgrt/daemon.js

@@ -1,6 +1,7 @@
 // packages/@monomind/cli/src/orgrt/daemon.ts
 // monolean: single-process inter-org — upgrade path = daemon-to-daemon HTTP when multi-host is real
 import { execFileSync } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, unlinkSync } from 'node:fs';
 import { isAbsolute, join } from 'node:path';
 import { writeJsonFileAtomic } from '../utils/json-file.js';
@@ -10,7 +11,7 @@ import { AntigravityAgentRunner } from './antigravity-runner.js';
 import * as approvalOps from './approvals.js';
 import { BrokerLease, normalizeCredential } from './broker.js';
 import { OrgBus } from './bus.js';
-import { captureCheckpoint, generateChecksum, isCheckpointExpired, restoreMailboxQueue, validateCheckpoint, } from './checkpoint.js';
+import { captureCheckpoint, generateChecksum, isCheckpointExpired, migrateCheckpoint, restoreMailboxQueue, validateCheckpoint, } from './checkpoint.js';
 import * as checkpointOps from './checkpoint-ops.js';
 import { CodexAgentRunner } from './codex-runner.js';
 import { CopilotAgentRunner } from './copilot-runner.js';
@@ -20,7 +21,7 @@ import * as decisionOps from './decisions.js';
 import { createFenceForRole, loadGlobalFenceConfig, mergeFenceConfigs, } from './fence.js';
 import { attachForwarder } from './forwarder.js';
 import { GrokAgentRunner } from './grok-runner.js';
-import { drainInbox } from './inbox.js';
+import { drainInbox, queueMessage } from './inbox.js';
 import { KimiCodeAgentRunner } from './kimicode-runner.js';
 import { isRecoverableCloseReason, Mailbox } from './mailbox.js';
 import { OpencodeAgentRunner } from './opencode-runner.js';
@@ -28,9 +29,12 @@ import * as orgMemory from './org-memory.js';
 import { PiRpcAgentRunner } from './pi-rpc-runner.js';
 import { PiAgentRunner } from './pi-runner.js';
 import { PolicyEngine } from './policy.js';
+import { resolveRoleProvider } from './provider.js';
 import * as questionOps from './questions.js';
 import { QwenRpcAgentRunner } from './qwen-rpc-runner.js';
 import { QwenAgentRunner } from './qwen-runner.js';
+import { buildRespawnReceipt, computeReplacementBudget, mergeEffectiveRoleConfig, redactRoleConfig, validateRespawnInput, } from './role-slot.js';
+import { buildRuntimeOptions } from './runtime-options.js';
 import { historyFile, readHistory, readRunEvents, summarizeRun, } from './reporting.js';
 import * as scheduler from './scheduler-integration.js';
 import { runAgentSession } from './session.js';
@@ -183,6 +187,17 @@ export class ScrollbackBuffer {
         this.lines.length = 0;
     }
 }
+/** Bug 4: number of roles for this org that are actually spawned and running
+ *  right now — the live count run_config.max_concurrent_agents caps. A role
+ *  that crashed or ended no longer counts, so a slot frees up automatically
+ *  the moment that happens; nothing needs to explicitly decrement a counter. */
+export function activeRoleCount(org) {
+    let n = 0;
+    for (const rt of org.agents.values())
+        if (rt.status === 'running')
+            n++;
+    return n;
+}
 export class OrgDaemon {
     root;
     opts;
@@ -193,6 +208,12 @@ export class OrgDaemon {
     /** @internal */ forwarders = new Map();
     /** @internal */ watchdogs = new Map();
     /** @internal */ stopping = new Map();
+    /** @internal Bug 2 (TOCTOU race): names currently reserved by an in-flight
+     *  startOrg() call, from the synchronous existence check through
+     *  registration in `orgs`. Closes the window where two concurrent
+     *  startOrg(name) calls could both pass the `orgs.has(name)` check before
+     *  either registered and spawn duplicate runs. */
+    /** @internal */ startingOrgs = new Set();
     /** @internal */ approvals = new Map();
     /** @internal */ approvalLocks = new Map();
     /** @internal */ gatesLocks = new Map();
@@ -215,10 +236,10 @@ export class OrgDaemon {
         this.opts = opts;
     }
     /** Publish this daemon's inbox so orgs started AFTER this call register with the broker. */
-    setInboxUrl(url, credential) {
+    setInboxUrl(url, operatorCredential) {
         this.opts.inboxUrl = url;
-        if (credential !== undefined)
-            this.opts.inboxCredential = credential;
+        if (operatorCredential !== undefined)
+            this.opts.operatorCredential = operatorCredential;
     }
     /** subscribe to events from ALL running orgs (dashboard server uses this) */
     subscribe(fn) {
@@ -333,8 +354,48 @@ export class OrgDaemon {
         const inflightStop = this.stopping.get(name);
         if (inflightStop)
             await inflightStop;
+        // Bug 2 (TOCTOU race): this existence check is synchronous, but the real
+        // registration into `this.orgs` doesn't happen until deep inside
+        // startOrgInner, after several genuine `await` points (the provider
+        // validation dynamic import, `git worktree add` for workspace:
+        // 'worktree'). Two concurrent startOrg(name) calls — e.g. the
+        // scheduler's tick, the runfile poll loop, and autoWake firing close
+        // together — could each pass this check before either registered,
+        // spawning two duplicate runs with separate budget/policy counters that
+        // both write the same shared per-org files. Reserve the name in
+        // `startingOrgs` synchronously, in the same tick as the check, so a
+        // second concurrent call sees the reservation and is rejected instead of
+        // racing ahead to spawn a duplicate.
         if (this.orgs.has(name))
             throw new Error(`org ${name} already running`);
+        if (this.startingOrgs.has(name))
+            throw new Error(`org ${name} already starting`);
+        this.startingOrgs.add(name);
+        try {
+            return await this.startOrgInner(name, taskOverride, options);
+        }
+        catch (err) {
+            // startOrgInner registers the org in `this.orgs` (and spawns the boss,
+            // installs the exit listener, starts the broker lease) well before it
+            // returns; persistState (ENOSPC/EACCES) and BrokerLease.start() can
+            // still throw after that. Left alone, that was a live, unreachable org:
+            // sessions running, `this.orgs` still holding it, every later startOrg
+            // rejected with "already running", and nothing ever calling stopOrg.
+            // Only this call can have registered the name (the reservation above
+            // holds until `finally`), so anything in the map is ours to tear down.
+            if (this.orgs.has(name)) {
+                await this.stopOrg(name).catch((stopErr) => console.error(`org ${name}: teardown after failed start failed:`, stopErr instanceof Error ? stopErr.message : stopErr));
+            }
+            throw err;
+        }
+        finally {
+            this.startingOrgs.delete(name);
+        }
+    }
+    /** The actual startOrg implementation. Split out of startOrg() so the
+     *  reservation guard above runs synchronously, before any `await` in here —
+     *  see the bug 2 comment in startOrg(). */
+    async startOrgInner(name, taskOverride, options) {
         const defPath = join(this.root, ORG_DIR, `${name}.json`);
         const def = OrgDefSchema.parse(JSON.parse(readFileSync(defPath, 'utf8')));
         let run;
@@ -348,8 +409,13 @@ export class OrgDaemon {
                 throw new Error(`cannot resume org "${name}": no valid checkpoint found`);
             if (isCheckpointExpired(rt.checkpoint))
                 throw new Error(`cannot resume org "${name}": checkpoint expired`);
-            if (!validateCheckpoint(rt.checkpoint))
+            // Migrate an older-schema checkpoint (verifying ITS OWN stored checksum
+            // first) before validating it against CHECKPOINT_VERSION — see
+            // migrateCheckpoint's doc comment in checkpoint.ts.
+            const migrated = migrateCheckpoint(rt.checkpoint);
+            if (!migrated || !validateCheckpoint(migrated))
                 throw new Error(`cannot resume org "${name}": checkpoint validation failed`);
+            rt.checkpoint = migrated;
             run = rt.run;
             checkpoint = rt.checkpoint;
             if (rt.abandonedRoles) {
@@ -476,6 +542,10 @@ export class OrgDaemon {
         // boss that's genuinely out of ideas can loop forever making zero
         // progress without ever tripping the watchdog.
         let lastToolActivity = 0;
+        // Org-wide budget ceiling (bug 1): tracks whether run_config.budget_tokens
+        // has already been enforced this run, so the close-all-mailboxes sweep
+        // below only fires once instead of on every subsequent usage event.
+        let orgBudgetClosed = false;
         bus.subscribe((e) => {
             const slim = e.data?.content != null ? { ...e, data: { ...e.data, content: undefined } } : e;
             collected.push(slim);
@@ -512,6 +582,42 @@ export class OrgDaemon {
                     }
                 }
             }
+            // Bug 1: run_config.budget_tokens is an org-wide ceiling, not just a
+            // per-role one — a role's explicit budget_tokens override lets IT spend
+            // more without raising what every other role can spend, so nothing
+            // upstream of this ever summed real usage across the whole roster and
+            // stopped the org when the declared total was reached. Mirror the
+            // per-role budget-exhausted handling (session.ts's mailbox.close('token-budget'))
+            // at the org level: once the sum of every role's PolicyEngine.usage
+            // reaches the ceiling, close every mailbox and stop lazy-spawning new
+            // ones so the org can't keep spending past its declared cap.
+            if (e.type === 'usage' && !orgBudgetClosed) {
+                const orgBudget = def.run_config.budget_tokens;
+                if (orgBudget != null) {
+                    let orgUsage = 0;
+                    for (const rt of running.agents.values())
+                        orgUsage += rt.policy.usage;
+                    // Mid-run role replacement retires a policy engine's usage into the
+                    // slot instead of discarding it (see role-slot.ts / respawnRole) -
+                    // include it here or a replacement could silently reset spend and
+                    // let the org exceed its declared ceiling.
+                    for (const slot of running.roleSlots.values())
+                        orgUsage += slot.retiredUsage.tokens;
+                    if (orgUsage >= orgBudget) {
+                        orgBudgetClosed = true;
+                        running.pendingRoles?.clear(); // prevent lazy spawns after the org budget is exhausted
+                        for (const rt of running.agents.values()) {
+                            if (!rt.mailbox.isClosed)
+                                rt.mailbox.close('token-budget');
+                        }
+                        bus.emit({
+                            type: 'status',
+                            reason: 'org-budget-exhausted',
+                            msg: `org-wide token budget exhausted (${orgUsage}/${orgBudget}) — closing all roles`,
+                        });
+                    }
+                }
+            }
             // Track last message ID for threading responses
             if ((e.type === 'message' || e.type === 'xorg') && e.from) {
                 const runtime = running.agents.get(e.from);
@@ -537,8 +643,13 @@ export class OrgDaemon {
             run,
             bus,
             agents: new Map(),
+            roleSlots: new Map(),
+            bossRoleId: '', // set below, once bossRole is computed
+            glossary: [],
+            respawning: new Set(),
             busEvents: () => [...collected],
             workdir: cwd,
+            credential: randomUUID(),
         };
         this.orgs.set(name, running);
         // ── MonoFence guardrail: pre-create per-role instances ────────────────
@@ -569,402 +680,72 @@ export class OrgDaemon {
         if (roleFences.size > 0)
             running.fences = roleFences;
         // Even-split budget; a role's own budget_tokens overrides it (roleTokenBudget).
-        const perRoleBudget = Math.floor((def.run_config.budget_tokens ?? 1_000_000) / def.roles.length);
+        // Bug 1: roles WITH an explicit override spend on top of the even split
+        // rather than out of it, so the roster's ceilings could sum to well over
+        // the declared org-wide budget (e.g. 4 roles @ 250k + one role overridden
+        // to 2M = 2.75M achievable against a declared 1M cap). Subtract the sum of
+        // every role's explicit override from the org-wide budget first, then
+        // split only the remainder among the roles WITHOUT an override, so the
+        // static split is honest about what's left. (Live usage is still tracked
+        // and enforced as a real ceiling above, independent of this static split.)
+        const orgBudgetTokens = def.run_config.budget_tokens ?? 1_000_000;
+        const overriddenTokenSum = def.roles.reduce((sum, r) => sum + (r.budget_tokens ?? 0), 0);
+        const unoverriddenRoleCount = def.roles.filter((r) => r.budget_tokens == null).length;
+        const perRoleBudget = unoverriddenRoleCount > 0
+            ? Math.max(0, Math.floor((orgBudgetTokens - overriddenTokenSum) / unoverriddenRoleCount))
+            : 0;
         // Single boss-selection rule for kickoff AND org_complete gating — the
         // session layer previously keyed the tool on reports_to===null while the
         // kickoff went to (type==='boss' || reports_to===null || roles[0]), so a
         // fallback-selected boss could be told to call org_complete without having
         // the tool.
         const bossRole = def.roles.find((r) => r.type === 'boss' || r.reports_to === null) ?? def.roles[0];
-        // Canonical entity names from the org KG — injected into the coordinator
+        running.bossRoleId = bossRole.id;
+        // Canonical entity names from THIS org's KG — injected into the coordinator
         // prompt so org_learn extractions reuse them instead of minting duplicates.
+        // Scoped: an unscoped glossary handed every org's entity names to every
+        // coordinator, which is how one org's claims got merged into another's.
         const glossary = await (async () => {
             try {
                 if (!(await this.orgMemoryUsable()))
                     return [];
                 const kg = await import('../memory/memory-kg.js');
-                return await kg.kgGlossary({ dbPath: this.orgMemoryDbPath() });
+                return await kg.kgGlossary({
+                    dbPath: this.orgMemoryDbPath(),
+                    scope: orgMemory.orgKgScope(name),
+                });
             }
             catch {
                 return [];
             }
         })();
+        running.glossary = glossary;
         // Resource-gated staggered spawn: check memory/process limits before each
         // NON-BOSS agent, wait if under pressure. The boss always spawns immediately
         // and ungated — the org has no coordinator at all without it, so gating it
         // behind host memory pressure would make the whole org fail to start over a
         // condition workers are specifically designed to ride out.
-        const _limits = getResourceLimits();
         // Extracted so a role that fails its gate check can be spawned later by
         // scheduleDeferredSpawn() once resources free up, without re-running the
         // gate logic or duplicating the session-wiring below.
         const spawnRole = (role, roleCheckpoint) => {
             if (running.agents.has(role.id))
                 return;
-            let roleCwd = cwd;
-            if (ws === 'worktree-per-role' && role.id !== bossRole.id) {
-                const wtPath = join(this.root, ORG_DIR, name, `worktree-${role.id}`);
-                try {
-                    // Q7: top-level `import { execFileSync }` replaces the inlined
-                    // `require('node:child_process')` that broke ESM at runtime —
-                    // vitest's CJS shim masked it in tests but the built package
-                    // threw "require is not defined" in real Node ESM execution.
-                    // SEC-5: argv-array form, no shell.
-                    if (existsSync(wtPath)) {
-                        try {
-                            execFileSync('git', ['worktree', 'remove', '--force', wtPath], {
-                                cwd: this.root,
-                                stdio: 'ignore',
-                                timeout: 30_000,
-                            });
-                        }
-                        catch {
-                            /* best-effort */
-                        }
-                    }
-                    execFileSync('git', ['worktree', 'add', wtPath, 'HEAD', '--detach'], {
-                        cwd: this.root,
-                        stdio: 'ignore',
-                        timeout: 30_000,
-                    });
-                    roleCwd = wtPath;
-                }
-                catch {
-                    /* fallback to shared cwd if git worktree fails */
-                }
-            }
-            const mailbox = new Mailbox();
-            if (roleCheckpoint?.mailboxQueue?.length) {
-                restoreMailboxQueue({ mailbox }, roleCheckpoint.mailboxQueue);
-            }
-            // A recoverable close (budget exhaustion) is left open on resume — see
-            // isRecoverableCloseReason's doc comment. Re-closing it here would
-            // make the idle watchdog's "raise the budget and resume" remedy a
-            // no-op, since nothing in this codebase ever reopens a closed mailbox.
-            if (roleCheckpoint?.mailboxClosed &&
-                !isRecoverableCloseReason(roleCheckpoint.mailboxCloseReason)) {
-                mailbox.close(roleCheckpoint.mailboxCloseReason);
-            }
-            const policy = new PolicyEngine(role.id, {
-                maxTokens: role.budget_tokens ?? perRoleBudget,
-                maxUsd: role.budget_usd,
-                ...(role.policy ?? {}),
-            }, bus, roleCwd);
-            if (roleCheckpoint?.tokensUsed) {
-                policy.setUsage(roleCheckpoint.tokensUsed);
-            }
-            // ORG-7: restore accumulated USD spend across resume so a stop/resume
-            // cycle can't reset a role's USD budget back to zero.
-            if (roleCheckpoint?.costUsd) {
-                policy.setUsageUsd(roleCheckpoint.costUsd);
-            }
-            const runtime = {
-                mailbox,
-                policy,
-                status: roleCheckpoint?.status ?? 'running',
-                done: Promise.resolve(),
-                metrics: { tokens: roleCheckpoint?.tokensUsed ?? 0, costUsd: roleCheckpoint?.costUsd ?? 0 },
-                lastMessageId: roleCheckpoint?.lastMessageId,
-                error: roleCheckpoint?.error,
-                sessionId: roleCheckpoint?.sessionId,
-                worktreePath: roleCwd !== cwd ? roleCwd : undefined,
-                scrollback: new ScrollbackBuffer(),
-            };
-            if (roleCheckpoint?.scrollback?.length) {
-                for (const line of roleCheckpoint.scrollback)
-                    runtime.scrollback.push(line);
-            }
-            const sessionOpts = {
-                org: name,
-                role,
-                bus,
-                policy,
-                mailbox,
-                cwd: roleCwd,
-                def,
-                // Pass the org state directory so runners that persist per-role state
-                // (VercelAgentRunner session files) write under .monomind/orgs/<name>
-                // instead of polluting the workspace cwd.
-                orgDir: join(this.root, ORG_DIR, name),
-                // Project root for named-provider (`adapter_config.provider`) config
-                // lookup — role cwd may be an isolated workspace with no config file.
-                orgRoot: this.root,
-                maxTurns: role.max_turns_per_message ?? def.run_config.max_turns_per_message,
-                resumeSessionId: roleCheckpoint?.sessionId,
-                lastMessageId: () => runtime.lastMessageId,
-                onOutput: (line) => runtime.scrollback.push(line),
-                onSessionId: (id) => {
-                    runtime.sessionId = id;
-                },
-                deliver: (from, to, subject, body) => this.deliver(name, from, to, subject, body),
-                askHuman: (r, question) => this.askHuman(name, r, question),
-                onGate: (r, gateName, gateDesc) => this.createGate(name, r, gateName, gateDesc),
-                circuitBreaker: (() => {
-                    const cb = def.run_config.circuit_breaker;
-                    if (!cb)
-                        return undefined;
-                    return { threshold: cb.failure_threshold ?? 5, state: { failures: 0, tripped: false } };
-                })(),
-                beforeTool: (r, toolName) => this.checkApproval(name, r, toolName),
-                fence: roleFences.get(role.id),
-                // ORG-1: gatedCanUseTool denials are a natural decision point — record them so
-                // `org decisions` shows real traces instead of always reporting none.
-                onDecision: (r, toolName, message) => {
-                    this.recordDecision(name, r, {
-                        type: 'tool',
-                        context: `tool call: ${toolName}`,
-                        reasoning: message,
-                        outcome: 'denied',
-                    });
-                },
-                // ORG-9: decision gates are documented as "hard-blocking" — make that
-                // true by actually denying tool use while this role has a pending gate,
-                // the same way pending approvals already do.
-                hasPendingGate: () => this.listGates(name, 'pending').some((g) => g.roleId === role.id),
-                onComplete: role.id === bossRole.id
-                    ? (r, outcome, summary) => {
-                        bus.emit({
-                            type: 'status',
-                            from: r,
-                            reason: 'org-complete',
-                            msg: `run outcome: ${outcome}`,
-                            data: { outcome, summary },
-                        });
-                    }
-                    : undefined,
-                // #11: a boss that overflows its context window isn't a crash (it keeps
-                // returning +0-token errors forever), so without this the idle watchdog
-                // just nudges it for ~30 min before idle-stopping. Restart the whole org
-                // with fresh sessions instead — bounded by MAX_BOSS_RESTARTS.
-                onContextLimit: role.id === bossRole.id ? () => this.scheduleBossRestart(name) : undefined,
-                recall: async (r, q) => {
-                    const answer = await this.recallOrgMemory(name, def, q, r);
-                    bus.emit({
-                        type: 'status',
-                        from: r,
-                        reason: 'org-recall',
-                        msg: `recall: ${q.slice(0, 80)}`,
-                        data: { hits: answer.hits },
-                    });
-                    return answer.text;
-                },
-                searchKnowledge: async (r, q) => {
-                    const answer = await this.searchProjectKnowledge(q);
-                    bus.emit({
-                        type: 'status',
-                        from: r,
-                        reason: 'knowledge-search',
-                        msg: `knowledge: ${q.slice(0, 80)}`,
-                        data: { hits: answer.hits },
-                    });
-                    return answer.text;
-                },
-                glossary,
-                remember: async (r, content, scope) => {
-                    const text = await this.rememberOrgMemory(name, def, r, content, scope, run);
-                    bus.emit({
-                        type: 'status',
-                        from: r,
-                        reason: 'org-remember',
-                        msg: `remember (${scope}): ${content.slice(0, 80)}`,
-                        data: { scope },
-                    });
-                    return text;
-                },
-                learn: async (r, payload) => {
-                    const text = await this.learnOrgKnowledge(name, run, payload);
-                    bus.emit({
-                        type: 'status',
-                        from: r,
-                        reason: 'org-learn',
-                        msg: `learn: ${text.slice(0, 120)}`,
-                        data: {
-                            nodes: payload.nodes?.length ?? 0,
-                            edges: payload.edges?.length ?? 0,
-                            rules: payload.rules?.length ?? 0,
-                        },
-                    });
-                    return text;
-                },
-                createTask: (r, title, assignee, deps) => {
-                    return this.dagCreateTask(name, r, title, assignee, deps);
-                },
-                completeTask: (r, taskId, result) => {
-                    return this.dagCompleteTask(name, r, taskId, result);
-                },
-                listTasks: () => {
-                    const running = this.orgs.get(name);
-                    return JSON.stringify(running?.taskDag?.all() ?? [], null, 2);
-                },
-                splitTask: (r, parentId, children) => {
-                    return this.dagSplitTask(name, r, parentId, children);
-                },
-                mergeTask: (r, sourceId, targetId) => {
-                    return this.dagMergeTask(name, r, sourceId, targetId);
-                },
-                cancelTask: (r, taskId, reason) => {
-                    return this.dagCancelTask(name, r, taskId, reason);
-                },
-                blockTask: (r, taskId, untilIso, reason) => {
-                    return this.dagBlockTask(name, r, taskId, untilIso, reason);
-                },
-                planGraph: (r, specs) => {
-                    return this.dagPlanGraph(name, r, specs);
-                },
-                queryFn: this.opts.queryFn,
-                // Runner resolution: explicit opts.runner > role `runtime` field >
-                // org def `runtime` field > MONOMIND_RUNTIME env (opencode/kimicode) >
-                // undefined (session.ts falls back to ClaudeAgentRunner via queryFn).
-                // Leaving it undefined for the default path is what keeps
-                // Claude/Antigravity orgs byte-for-byte unchanged. Session opts are
-                // built per role here in spawnRole, so each role gets its own runner.
-                runner: this.opts.runner ??
-                    resolveRoleRunner(role.runtime, def.runtime, role.provider?.kind, undefined, role.provider),
-            };
-            // Supervised session: transient crashes (provider blips, network) restart
-            // with backoff; a crash with the mailbox already closed, or one that
-            // exhausts the retry budget, is terminal. runAgentSession already emits a
-            // 'status' event for the raw error; the terminal 'audit' event is for
-            // dashboards/alerts that filter on actionable failures (not routine
-            // status chatter) so a dead agent surfaces instead of a run that
-            // silently never progresses.
-            const BACKOFFS_MS = this.opts.crashBackoffsMs ?? [1000, 5000, 15000];
-            if (!mailbox.isClosed && runtime.status !== 'crashed') {
-                runtime.done = (async () => {
-                    for (let attempt = 0;; attempt++) {
-                        try {
-                            await runAgentSession(sessionOpts);
-                            runtime.status = 'ended';
-                            return;
-                        }
-                        catch (err) {
-                            // Drop the crashed session's stale waker immediately: a push()
-                            // during the backoff window must queue for the NEXT session, not
-                            // wake the dead generator to swallow it.
-                            mailbox.detach();
-                            // #203: if the crashed session's mailbox generator was abandoned
-                            // mid-yield (message already shift()ed for it, turn never
-                            // finished), put that message back on the queue — otherwise the
-                            // replacement session's stream() finds an empty queue and parks
-                            // forever, since the "delivered" message is gone for good.
-                            mailbox.reclaimInFlight();
-                            const message = err instanceof Error ? err.message : String(err);
-                            const isTurnLimit = /Reached maximum number of turns|error_max_turns/i.test(message);
-                            // Bounded like every other recovery: attempt counts every pass
-                            // through this loop, so a role that keeps surfacing max-turns
-                            // errors here (session.ts already swallows the normal ones)
-                            // falls through to crash handling instead of looping forever.
-                            if (isTurnLimit && !mailbox.isClosed && attempt < BACKOFFS_MS.length) {
-                                sessionOpts.resumeSessionId = undefined;
-                                mailbox.push(`${Mailbox.CONTINUE_PREFIX} You reached the turn limit on your task. Continue your in-progress work from where you left off; if finished, end your turn.`);
-                                bus.emit({
-                                    type: 'status',
-                                    from: role.id,
-                                    reason: 'turn-limit-recover',
-                                    msg: `agent "${role.id}" hit turn limit error — continuing with fresh session`,
-                                });
-                                continue;
-                            }
-                            // Exit 143 = SIGTERM. If the mailbox is already closed, we
-                            // sent the signal ourselves during stop — not a crash.
-                            const killedByStop = mailbox.isClosed && /exit(?:ed)? with code 143/.test(message);
-                            const crash = () => {
-                                if (killedByStop) {
-                                    runtime.status = 'ended';
-                                    bus.emit({
-                                        type: 'status',
-                                        from: role.id,
-                                        msg: `agent "${role.id}" terminated by stop (was still working when drain window expired)`,
-                                        reason: 'terminated-by-stop',
-                                    });
-                                    return;
-                                }
-                                runtime.status = 'crashed';
-                                runtime.error = message;
-                                // Close the mailbox so deliver()/receiveRemote() report a real
-                                // error instead of pushing into a queue no session will read
-                                // (and returning a false "delivered" receipt to the sender).
-                                mailbox.close();
-                                const isContextLimit = OrgDaemon.CONTEXT_LIMIT_RE.test(message);
-                                bus.emit({
-                                    type: 'audit',
-                                    from: role.id,
-                                    msg: `agent "${role.id}" crashed: ${message}`,
-                                    reason: isContextLimit ? 'agent-context-limit' : 'agent-session-crash',
-                                    data: {
-                                        agentId: role.id,
-                                        error: message,
-                                        restarts: attempt,
-                                        contextLimit: isContextLimit,
-                                    },
-                                });
-                                if (role.id !== bossRole.id) {
-                                    // #2/#3: a worker is gone for the rest of this run. Without this
-                                    // notice the coordinator keeps messaging a corpse (observed: four
-                                    // unanswered org_send calls to a developer that had crashed on a
-                                    // context-window limit). Tell the boss to reassign — and if the
-                                    // crash was a context overflow, tell it to chunk smaller, since
-                                    // re-dispatching the same task verbatim fails the same way.
-                                    const bossRt = running.agents.get(bossRole.id);
-                                    if (bossRt && !bossRt.mailbox.isClosed) {
-                                        const guidance = isContextLimit
-                                            ? ' This was a context-window overflow — re-dispatching the same task verbatim will fail identically. Break the work into smaller pieces (one file or section at a time) and do not paste large file contents in a single message.'
-                                            : '';
-                                        bossRt.mailbox.push(`[system] Worker "${role.id}" crashed and will not recover this run (${message}). It can no longer receive messages — stop messaging it. Reassign its outstanding work to another agent or take it on yourself.${guidance}`);
-                                        bus.emit({
-                                            type: 'audit',
-                                            from: bossRole.id,
-                                            reason: 'worker-crashed',
-                                            msg: `worker "${role.id}" crashed (contextLimit=${isContextLimit}); coordinator notified to reassign`,
-                                        });
-                                    }
-                                }
-                                else {
-                                    // #4: the coordinator itself died. Don't go silent and wait for a
-                                    // human — attempt a bounded whole-org restart with fresh sessions
-                                    // (which also sheds whatever bloated context caused the crash).
-                                    this.scheduleBossRestart(name);
-                                }
-                            };
-                            // Fatal errors (provider auth/quota/billing — tagged with
-                            // err.fatal by the runner) can NEVER be fixed by a restart: the
-                            // same call fails identically or hangs. Skip the backoff loop
-                            // and go straight to terminal crash handling instead of burning
-                            // the retry budget and wall-clock on a guaranteed failure.
-                            const fatal = err?.fatal === true;
-                            if (fatal) {
-                                bus.emit({
-                                    type: 'status',
-                                    from: role.id,
-                                    reason: 'agent-fatal',
-                                    msg: `agent "${role.id}" hit a fatal (non-retryable) error — not restarting`,
-                                });
-                                crash();
-                                return;
-                            }
-                            if (mailbox.isClosed || attempt >= BACKOFFS_MS.length) {
-                                crash();
-                                return;
-                            }
-                            bus.emit({
-                                type: 'status',
-                                from: role.id,
-                                reason: 'agent-restart',
-                                msg: `agent "${role.id}" crashed (${message}) — restarting in ${BACKOFFS_MS[attempt]}ms (attempt ${attempt + 1}/${BACKOFFS_MS.length})`,
-                            });
-                            await new Promise((r) => {
-                                const t = setTimeout(r, BACKOFFS_MS[attempt]);
-                                t.unref?.();
-                            });
-                            if (mailbox.isClosed) {
-                                crash();
-                                return;
-                            } // org stopped during backoff — never recovered
-                        }
-                    }
-                })();
-            }
+            const { runtime, abort } = this.spawnRoleIncarnation(name, running, role, roleCheckpoint?.generation ?? 0, { roleCheckpoint });
             running.agents.set(role.id, runtime);
+            running.roleSlots.set(role.id, {
+                generation: roleCheckpoint?.generation ?? 0,
+                phase: 'running',
+                runtime,
+                abort,
+                effectiveRole: roleCheckpoint?.effectiveRoleOverrides &&
+                    Object.keys(roleCheckpoint.effectiveRoleOverrides).length > 0
+                    ? mergeEffectiveRoleConfig(role, roleCheckpoint.effectiveRoleOverrides)
+                    : role,
+                respawnCount: roleCheckpoint?.respawnCount ?? 0,
+                queuedDuringSwap: roleCheckpoint?.queuedDuringSwap ?? [],
+                retiredUsage: roleCheckpoint?.retiredUsage ?? { tokens: 0, costUsd: 0 },
+            });
         };
         if (options?.resume && checkpoint) {
             const restoredRoles = new Set(Object.keys(checkpoint.roleState));
@@ -981,7 +762,23 @@ export class OrgDaemon {
             }
             running.pendingRoles = pendingRoles;
             running.spawnRole = spawnRole;
-            running.taskDag = new TaskDag();
+            running.taskDag =
+                checkpoint.tasks && checkpoint.tasks.length > 0
+                    ? TaskDag.fromJSON(checkpoint.tasks)
+                    : new TaskDag();
+            // A 'running' task's "[task:…]" message was consumed by the session that
+            // was working it. If that role's SDK session is resumed (checkpointed
+            // sessionId) the task is still in its context; otherwise — role not
+            // restored at all, or restored into a fresh session — nothing knows
+            // about the task, so put it back to 'ready' and re-dispatch.
+            for (const task of running.taskDag.all()) {
+                if (task.status !== 'running')
+                    continue;
+                if (checkpoint.roleState[task.assignee]?.sessionId)
+                    continue;
+                running.taskDag.requeue(task.id);
+            }
+            decisionOps.dispatchReadyTasks(this, name, running);
             if (worktreePath)
                 running.worktreePath = worktreePath;
         }
@@ -1103,6 +900,18 @@ export class OrgDaemon {
                 const pendingGates = this.readGates(name).gates.filter((g) => g.status === 'pending');
                 if (pendingGates.length > 0)
                     return;
+                // Bug 3: a pending ask_human question is the same kind of legitimate
+                // wait as a pending gate — askHuman()'s receipt tells the role to end
+                // its turn and wait for the resolution, so a role that follows that
+                // instruction and goes quiet looks identical to a genuinely stalled
+                // agent. Without this check the watchdog nudges (and, after enough
+                // nudges, idle-stops) an org that's simply waiting on a human answer
+                // that's already on its way.
+                const pendingQuestions = questionOps
+                    .readQuestions(this.root, name)
+                    .questions.filter((q) => q.answer === null);
+                if (pendingQuestions.length > 0)
+                    return;
                 // Auto-resume any task whose org_task_block time has passed: flip it
                 // back to 'running' and re-push it into the assignee's mailbox, same
                 // as a fresh dispatch. This IS real activity, so fall through to the
@@ -1177,7 +986,8 @@ export class OrgDaemon {
             this.watchdogs.set(name, wd);
         }
         if (this.opts.crossProcess && this.opts.inboxUrl) {
-            const lease = new BrokerLease(name, this.opts.inboxUrl, this.opts.brokerDir, undefined, normalizeCredential(this.opts.inboxCredential));
+            const operatorCred = normalizeCredential(this.opts.operatorCredential);
+            const lease = new BrokerLease(name, this.opts.inboxUrl, this.opts.brokerDir, undefined, running.credential, operatorCred ? { credential: operatorCred, dir: this.opts.operatorDir } : undefined);
             lease.start();
             this.leases.set(name, lease);
         }
@@ -1191,8 +1001,19 @@ export class OrgDaemon {
             // queueMessage had already reported them accepted.
             if (!running.agents.has(msg.toRole) && running.pendingRoles?.has(msg.toRole)) {
                 const pending = running.pendingRoles.get(msg.toRole);
-                running.pendingRoles.delete(msg.toRole);
-                running.spawnRole?.(pending);
+                // Bug 4: don't spawn past run_config.max_concurrent_agents. Requeue
+                // this message (queueMessage, not a silent drop) and defer the spawn
+                // the same way a concurrency-gated lazy spawn defers elsewhere.
+                const concurrencyLimit = def.run_config.max_concurrent_agents;
+                if (concurrencyLimit != null && activeRoleCount(running) >= concurrencyLimit) {
+                    running.pendingRoles.delete(msg.toRole);
+                    queueMessage(this.root, name, msg);
+                    this.scheduleConcurrencyDeferredSpawn(name, running, pending, running.spawnRole);
+                }
+                else {
+                    running.pendingRoles.delete(msg.toRole);
+                    running.spawnRole?.(pending);
+                }
             }
             const agent = running.agents.get(msg.toRole);
             if (agent && !agent.mailbox.isClosed) {
@@ -1203,13 +1024,751 @@ export class OrgDaemon {
                     subject: msg.subject,
                     msg: msg.body,
                 });
-                agent.mailbox.push(this.mailBody(name, running, `[message from ${msg.fromQualified}] subject: ${msg.subject}`, msg.body, `inbox-${msg.ts}-${Math.random().toString(36).slice(2, 8)}`));
+                await crossOrg.pushMessage(this, name, running, msg.toRole, msg.fromQualified, msg.subject, msg.body, `inbox-${msg.ts}-${Math.random().toString(36).slice(2, 8)}`);
             }
         }
         if (queued.length)
             bus.emit({ type: 'status', msg: `drained ${queued.length} queued message(s) from inbox` });
         return running;
     }
+    /** Build one role incarnation: mailbox, policy, AgentRuntime, sessionOpts,
+     *  and the supervised crash-retry loop. Used by BOTH the startup lazy-spawn
+     *  path (generation 0, via the `spawnRole` closure inside startOrgInner)
+     *  and respawnRole() (generation N+1). Does not touch running.agents or
+     *  running.roleSlots — callers publish the result themselves. */
+    spawnRoleIncarnation(name, running, role, generation, opts = {}) {
+        const { roleCheckpoint } = opts;
+        const abort = opts.abort ?? new AbortController();
+        const { def, bus, run } = running;
+        const cwd = running.workdir;
+        const ws = this.workspaceSetting(def);
+        const perRoleBudget = opts.budgetTokensOverride ?? computeReplacementBudget(def, role.id);
+        let roleCwd = cwd;
+        const existingSlot = running.roleSlots.get(role.id);
+        if (ws === 'worktree-per-role' && role.id !== running.bossRoleId) {
+            const wtPath = join(this.root, ORG_DIR, name, `worktree-${role.id}`);
+            if (existingSlot?.runtime?.worktreePath === wtPath && existsSync(wtPath)) {
+                // A replacement (generation > 0) reuses the SAME worktree path —
+                // recreating it here would delete any uncommitted work the old
+                // incarnation left behind (design constraint #5).
+                roleCwd = wtPath;
+            }
+            else {
+                try {
+                    // Q7: top-level `import { execFileSync }` replaces the inlined
+                    // `require('node:child_process')` that broke ESM at runtime —
+                    // vitest's CJS shim masked it in tests but the built package
+                    // threw "require is not defined" in real Node ESM execution.
+                    // SEC-5: argv-array form, no shell.
+                    if (existsSync(wtPath)) {
+                        try {
+                            execFileSync('git', ['worktree', 'remove', '--force', wtPath], {
+                                cwd: this.root,
+                                stdio: 'ignore',
+                                timeout: 30_000,
+                            });
+                        }
+                        catch {
+                            /* best-effort */
+                        }
+                    }
+                    execFileSync('git', ['worktree', 'add', wtPath, 'HEAD', '--detach'], {
+                        cwd: this.root,
+                        stdio: 'ignore',
+                        timeout: 30_000,
+                    });
+                    roleCwd = wtPath;
+                }
+                catch {
+                    /* fallback to shared cwd if git worktree fails */
+                }
+            }
+        }
+        const mailbox = new Mailbox();
+        if (roleCheckpoint?.mailboxQueue?.length) {
+            restoreMailboxQueue({ mailbox }, roleCheckpoint.mailboxQueue);
+        }
+        // A recoverable close (budget exhaustion) is left open on resume — see
+        // isRecoverableCloseReason's doc comment. Re-closing it here would
+        // make the idle watchdog's "raise the budget and resume" remedy a
+        // no-op, since nothing in this codebase ever reopens a closed mailbox.
+        if (roleCheckpoint?.mailboxClosed &&
+            !isRecoverableCloseReason(roleCheckpoint.mailboxCloseReason)) {
+            mailbox.close(roleCheckpoint.mailboxCloseReason);
+        }
+        const policy = new PolicyEngine(role.id, {
+            maxTokens: role.budget_tokens ?? perRoleBudget,
+            maxUsd: role.budget_usd,
+            ...(role.policy ?? {}),
+        }, bus, roleCwd);
+        if (roleCheckpoint?.tokensUsed) {
+            policy.setUsage(roleCheckpoint.tokensUsed);
+        }
+        // ORG-7: restore accumulated USD spend across resume so a stop/resume
+        // cycle can't reset a role's USD budget back to zero.
+        if (roleCheckpoint?.costUsd) {
+            policy.setUsageUsd(roleCheckpoint.costUsd);
+        }
+        const runtime = {
+            mailbox,
+            policy,
+            status: roleCheckpoint?.status ?? 'running',
+            done: Promise.resolve(),
+            metrics: { tokens: roleCheckpoint?.tokensUsed ?? 0, costUsd: roleCheckpoint?.costUsd ?? 0 },
+            lastMessageId: roleCheckpoint?.lastMessageId,
+            error: roleCheckpoint?.error,
+            sessionId: roleCheckpoint?.sessionId,
+            worktreePath: roleCwd !== cwd ? roleCwd : undefined,
+            scrollback: new ScrollbackBuffer(),
+        };
+        if (roleCheckpoint?.scrollback?.length) {
+            for (const line of roleCheckpoint.scrollback)
+                runtime.scrollback.push(line);
+        }
+        const sessionOpts = {
+            org: name,
+            role,
+            bus,
+            policy,
+            mailbox,
+            cwd: roleCwd,
+            def,
+            // Pass the org state directory so runners that persist per-role state
+            // (VercelAgentRunner session files) write under .monomind/orgs/<name>
+            // instead of polluting the workspace cwd.
+            orgDir: join(this.root, ORG_DIR, name),
+            // Project root for named-provider (`adapter_config.provider`) config
+            // lookup — role cwd may be an isolated workspace with no config file.
+            orgRoot: this.root,
+            maxTurns: role.max_turns_per_message ?? def.run_config.max_turns_per_message,
+            resumeSessionId: roleCheckpoint?.sessionId,
+            lastMessageId: () => runtime.lastMessageId,
+            onOutput: (line) => runtime.scrollback.push(line),
+            onSessionId: (id) => {
+                runtime.sessionId = id;
+            },
+            deliver: (from, to, subject, body) => this.deliver(name, from, to, subject, body),
+            askHuman: (r, question) => this.askHuman(name, r, question),
+            onGate: (r, gateName, gateDesc) => this.createGate(name, r, gateName, gateDesc),
+            circuitBreaker: (() => {
+                const cb = def.run_config.circuit_breaker;
+                if (!cb)
+                    return undefined;
+                return { threshold: cb.failure_threshold ?? 5, state: { failures: 0, tripped: false } };
+            })(),
+            beforeTool: (r, toolName, input) => this.checkApproval(name, r, toolName, input),
+            fence: running.fences?.get(role.id),
+            // ORG-1: gatedCanUseTool denials are a natural decision point — record them so
+            // `org decisions` shows real traces instead of always reporting none.
+            onDecision: (r, toolName, message) => {
+                this.recordDecision(name, r, {
+                    type: 'tool',
+                    context: `tool call: ${toolName}`,
+                    reasoning: message,
+                    outcome: 'denied',
+                });
+            },
+            // ORG-9: decision gates are documented as "hard-blocking" — make that
+            // true by actually denying tool use while this role has a pending gate,
+            // the same way pending approvals already do.
+            hasPendingGate: () => this.listGates(name, 'pending').some((g) => g.roleId === role.id),
+            onComplete: role.id === running.bossRoleId
+                ? (r, outcome, summary) => {
+                    bus.emit({
+                        type: 'status',
+                        from: r,
+                        reason: 'org-complete',
+                        msg: `run outcome: ${outcome}`,
+                        data: { outcome, summary },
+                    });
+                }
+                : undefined,
+            // #11: a boss that overflows its context window isn't a crash (it keeps
+            // returning +0-token errors forever), so without this the idle watchdog
+            // just nudges it for ~30 min before idle-stopping. Restart the whole org
+            // with fresh sessions instead — bounded by MAX_BOSS_RESTARTS.
+            onContextLimit: role.id === running.bossRoleId ? () => this.scheduleBossRestart(name) : undefined,
+            onListRuntimeOptions: role.id === running.bossRoleId && (def.run_config.max_role_respawns ?? 0) > 0
+                ? () => this.listRuntimeOptions()
+                : undefined,
+            onRespawnRole: role.id === running.bossRoleId && (def.run_config.max_role_respawns ?? 0) > 0
+                ? (callerId, args) => this.respawnRole(name, callerId, args)
+                : undefined,
+            recall: async (r, q) => {
+                const answer = await this.recallOrgMemory(name, def, q, r);
+                bus.emit({
+                    type: 'status',
+                    from: r,
+                    reason: 'org-recall',
+                    msg: `recall: ${q.slice(0, 80)}`,
+                    data: { hits: answer.hits },
+                });
+                return answer.text;
+            },
+            searchKnowledge: async (r, q) => {
+                const answer = await this.searchProjectKnowledge(q);
+                bus.emit({
+                    type: 'status',
+                    from: r,
+                    reason: 'knowledge-search',
+                    msg: `knowledge: ${q.slice(0, 80)}`,
+                    data: { hits: answer.hits },
+                });
+                return answer.text;
+            },
+            glossary: running.glossary,
+            remember: async (r, content, scope) => {
+                const text = await this.rememberOrgMemory(name, def, r, content, scope, run);
+                bus.emit({
+                    type: 'status',
+                    from: r,
+                    reason: 'org-remember',
+                    msg: `remember (${scope}): ${content.slice(0, 80)}`,
+                    data: { scope },
+                });
+                return text;
+            },
+            learn: async (r, payload) => {
+                const text = await this.learnOrgKnowledge(name, run, payload);
+                bus.emit({
+                    type: 'status',
+                    from: r,
+                    reason: 'org-learn',
+                    msg: `learn: ${text.slice(0, 120)}`,
+                    data: {
+                        nodes: payload.nodes?.length ?? 0,
+                        edges: payload.edges?.length ?? 0,
+                        rules: payload.rules?.length ?? 0,
+                    },
+                });
+                return text;
+            },
+            createTask: (r, title, assignee, deps) => {
+                return this.dagCreateTask(name, r, title, assignee, deps);
+            },
+            completeTask: (r, taskId, result) => {
+                return this.dagCompleteTask(name, r, taskId, result);
+            },
+            listTasks: () => {
+                const running = this.orgs.get(name);
+                return JSON.stringify(running?.taskDag?.all() ?? [], null, 2);
+            },
+            splitTask: (r, parentId, children) => {
+                return this.dagSplitTask(name, r, parentId, children);
+            },
+            mergeTask: (r, sourceId, targetId) => {
+                return this.dagMergeTask(name, r, sourceId, targetId);
+            },
+            cancelTask: (r, taskId, reason) => {
+                return this.dagCancelTask(name, r, taskId, reason);
+            },
+            blockTask: (r, taskId, untilIso, reason) => {
+                return this.dagBlockTask(name, r, taskId, untilIso, reason);
+            },
+            planGraph: (r, specs) => {
+                return this.dagPlanGraph(name, r, specs);
+            },
+            queryFn: this.opts.queryFn,
+            // Runner resolution: explicit opts.runner > role `runtime` field >
+            // org def `runtime` field > MONOMIND_RUNTIME env (opencode/kimicode) >
+            // undefined (session.ts falls back to ClaudeAgentRunner via queryFn).
+            // Leaving it undefined for the default path is what keeps
+            // Claude/Antigravity orgs byte-for-byte unchanged. Session opts are
+            // built per role here, so each role gets its own runner.
+            runner: this.opts.runner ??
+                resolveRoleRunner(role.runtime, def.runtime, role.provider?.kind, undefined, role.provider),
+            // Lets respawnRole force-stop THIS specific incarnation (mid-run role
+            // replacement's forced-stop step) without reaching into runAgentSession's
+            // internals.
+            externalAbort: abort,
+        };
+        // Supervised session: transient crashes (provider blips, network) restart
+        // with backoff; a crash with the mailbox already closed, or one that
+        // exhausts the retry budget, is terminal. runAgentSession already emits a
+        // 'status' event for the raw error; the terminal 'audit' event is for
+        // dashboards/alerts that filter on actionable failures (not routine
+        // status chatter) so a dead agent surfaces instead of a run that
+        // silently never progresses.
+        const BACKOFFS_MS = this.opts.crashBackoffsMs ?? [1000, 5000, 15000];
+        const myGeneration = generation;
+        const isStaleGeneration = () => (running.roleSlots.get(role.id)?.generation ?? 0) !== myGeneration;
+        if (!mailbox.isClosed && runtime.status !== 'crashed') {
+            runtime.done = (async () => {
+                for (let attempt = 0;; attempt++) {
+                    try {
+                        await runAgentSession(sessionOpts);
+                        runtime.status = 'ended';
+                        return;
+                    }
+                    catch (err) {
+                        // A deliberate respawn (see respawnRole) bumps the slot's
+                        // generation and force-stops this incarnation via its
+                        // externalAbort - that abort makes runAgentSession reject here
+                        // exactly like a real crash would. Recognize supersession
+                        // FIRST: this generation's retry loop must never restart,
+                        // never run terminal crash handling, and never notify the
+                        // boss - the replacement (a new generation, spawned
+                        // separately) already owns this role id.
+                        if (isStaleGeneration())
+                            return;
+                        // Drop the crashed session's stale waker immediately: a push()
+                        // during the backoff window must queue for the NEXT session, not
+                        // wake the dead generator to swallow it.
+                        mailbox.detach();
+                        // #203: if the crashed session's mailbox generator was abandoned
+                        // mid-yield (message already shift()ed for it, turn never
+                        // finished), put that message back on the queue — otherwise the
+                        // replacement session's stream() finds an empty queue and parks
+                        // forever, since the "delivered" message is gone for good.
+                        mailbox.reclaimInFlight();
+                        const message = err instanceof Error ? err.message : String(err);
+                        const isTurnLimit = /Reached maximum number of turns|error_max_turns/i.test(message);
+                        // Bounded like every other recovery: attempt counts every pass
+                        // through this loop, so a role that keeps surfacing max-turns
+                        // errors here (session.ts already swallows the normal ones)
+                        // falls through to crash handling instead of looping forever.
+                        if (isTurnLimit && !mailbox.isClosed && attempt < BACKOFFS_MS.length) {
+                            sessionOpts.resumeSessionId = undefined;
+                            mailbox.push(`${Mailbox.CONTINUE_PREFIX} You reached the turn limit on your task. Continue your in-progress work from where you left off; if finished, end your turn.`);
+                            bus.emit({
+                                type: 'status',
+                                from: role.id,
+                                reason: 'turn-limit-recover',
+                                msg: `agent "${role.id}" hit turn limit error — continuing with fresh session`,
+                            });
+                            continue;
+                        }
+                        // Exit 143 = SIGTERM. If the mailbox is already closed, we
+                        // sent the signal ourselves during stop — not a crash.
+                        const killedByStop = mailbox.isClosed && /exit(?:ed)? with code 143/.test(message);
+                        const crash = () => {
+                            if (killedByStop) {
+                                runtime.status = 'ended';
+                                bus.emit({
+                                    type: 'status',
+                                    from: role.id,
+                                    msg: `agent "${role.id}" terminated by stop (was still working when drain window expired)`,
+                                    reason: 'terminated-by-stop',
+                                });
+                                return;
+                            }
+                            runtime.status = 'crashed';
+                            runtime.error = message;
+                            // Close the mailbox so deliver()/receiveRemote() report a real
+                            // error instead of pushing into a queue no session will read
+                            // (and returning a false "delivered" receipt to the sender).
+                            mailbox.close();
+                            const isContextLimit = OrgDaemon.CONTEXT_LIMIT_RE.test(message);
+                            bus.emit({
+                                type: 'audit',
+                                from: role.id,
+                                msg: `agent "${role.id}" crashed: ${message}`,
+                                reason: isContextLimit ? 'agent-context-limit' : 'agent-session-crash',
+                                data: {
+                                    agentId: role.id,
+                                    error: message,
+                                    restarts: attempt,
+                                    contextLimit: isContextLimit,
+                                },
+                            });
+                            if (role.id !== running.bossRoleId) {
+                                // #2/#3: a worker is gone for the rest of this run. Without this
+                                // notice the coordinator keeps messaging a corpse (observed: four
+                                // unanswered org_send calls to a developer that had crashed on a
+                                // context-window limit). Tell the boss to reassign — and if the
+                                // crash was a context overflow, tell it to chunk smaller, since
+                                // re-dispatching the same task verbatim fails the same way.
+                                const bossRt = running.agents.get(running.bossRoleId);
+                                if (bossRt && !bossRt.mailbox.isClosed) {
+                                    const guidance = isContextLimit
+                                        ? ' This was a context-window overflow — re-dispatching the same task verbatim will fail identically. Break the work into smaller pieces (one file or section at a time) and do not paste large file contents in a single message.'
+                                        : '';
+                                    bossRt.mailbox.push(`[system] Worker "${role.id}" crashed and will not recover this run (${message}). It can no longer receive messages — stop messaging it. Reassign its outstanding work to another agent or take it on yourself.${guidance}`);
+                                    bus.emit({
+                                        type: 'audit',
+                                        from: running.bossRoleId,
+                                        reason: 'worker-crashed',
+                                        msg: `worker "${role.id}" crashed (contextLimit=${isContextLimit}); coordinator notified to reassign`,
+                                    });
+                                }
+                            }
+                            else {
+                                // #4: the coordinator itself died. Don't go silent and wait for a
+                                // human — attempt a bounded whole-org restart with fresh sessions
+                                // (which also sheds whatever bloated context caused the crash).
+                                this.scheduleBossRestart(name);
+                            }
+                        };
+                        // Fatal errors (provider auth/quota/billing — tagged with
+                        // err.fatal by the runner) can NEVER be fixed by a restart: the
+                        // same call fails identically or hangs. Skip the backoff loop
+                        // and go straight to terminal crash handling instead of burning
+                        // the retry budget and wall-clock on a guaranteed failure.
+                        const fatal = err?.fatal === true;
+                        if (fatal) {
+                            bus.emit({
+                                type: 'status',
+                                from: role.id,
+                                reason: 'agent-fatal',
+                                msg: `agent "${role.id}" hit a fatal (non-retryable) error — not restarting`,
+                            });
+                            crash();
+                            return;
+                        }
+                        if (mailbox.isClosed || attempt >= BACKOFFS_MS.length) {
+                            crash();
+                            return;
+                        }
+                        bus.emit({
+                            type: 'status',
+                            from: role.id,
+                            reason: 'agent-restart',
+                            msg: `agent "${role.id}" crashed (${message}) — restarting in ${BACKOFFS_MS[attempt]}ms (attempt ${attempt + 1}/${BACKOFFS_MS.length})`,
+                        });
+                        await new Promise((r) => {
+                            const t = setTimeout(r, BACKOFFS_MS[attempt]);
+                            t.unref?.();
+                            // Org stop (finishStop) aborts every active slot's controller —
+                            // without racing it here, this wait wouldn't notice for up to
+                            // BACKOFFS_MS[attempt] (default up to 15s), well past finishStop's
+                            // own bounded drain window. That let this loop's crash() —
+                            // and the bus.emit() it triggers — fire AFTER finishStop had
+                            // already declared the org stopped and returned, capable of
+                            // recreating files in a run directory a caller was already
+                            // deleting.
+                            if (abort.signal.aborted) {
+                                clearTimeout(t);
+                                r();
+                                return;
+                            }
+                            abort.signal.addEventListener('abort', () => {
+                                clearTimeout(t);
+                                r();
+                            }, { once: true });
+                        });
+                        if (isStaleGeneration())
+                            return; // superseded during the backoff wait
+                        if (mailbox.isClosed) {
+                            crash();
+                            return;
+                        } // org stopped during backoff — never recovered
+                    }
+                }
+            })();
+        }
+        return { runtime, abort };
+    }
+    /** org_respawn_role's daemon-owned implementation. See the design doc's
+     *  "Replacement algorithm" (13 steps) — this method's body follows those
+     *  steps in order, numbered in comments. */
+    async respawnRole(name, callerId, rawInput) {
+        const running = this.orgs.get(name);
+        if (!running) {
+            return {
+                success: false,
+                roleId: '',
+                generation: 0,
+                respawnCount: 0,
+                respawnsRemaining: 0,
+                error: `org "${name}" is not running`,
+            };
+        }
+        // Step 1: authorize (defense in depth — buildOrgTools only ever wires
+        // onRespawnRole for the selected coordinator, but re-check here too).
+        if (callerId !== running.bossRoleId) {
+            return {
+                success: false,
+                roleId: '',
+                generation: 0,
+                respawnCount: 0,
+                respawnsRemaining: 0,
+                error: 'only the selected coordinator may call org_respawn_role',
+            };
+        }
+        if (this.stopping.has(name)) {
+            return {
+                success: false,
+                roleId: '',
+                generation: 0,
+                respawnCount: 0,
+                respawnsRemaining: 0,
+                error: `org "${name}" is stopping`,
+            };
+        }
+        const validated = validateRespawnInput(rawInput);
+        if (!validated.ok) {
+            return {
+                success: false,
+                roleId: '',
+                generation: 0,
+                respawnCount: 0,
+                respawnsRemaining: 0,
+                error: validated.error,
+            };
+        }
+        const input = validated.value;
+        if (input.roleId === running.bossRoleId) {
+            return {
+                success: false,
+                roleId: input.roleId,
+                generation: 0,
+                respawnCount: 0,
+                respawnsRemaining: 0,
+                error: 'cannot replace the selected coordinator',
+            };
+        }
+        const slot = running.roleSlots.get(input.roleId);
+        if (!slot) {
+            return {
+                success: false,
+                roleId: input.roleId,
+                generation: 0,
+                respawnCount: 0,
+                respawnsRemaining: 0,
+                error: `unknown or not-yet-started role "${input.roleId}"`,
+            };
+        }
+        const maxRespawns = running.def.run_config.max_role_respawns ?? 0;
+        if (slot.phase === 'removed') {
+            return buildRespawnReceipt(slot, maxRespawns, false, {
+                roleId: input.roleId,
+                error: `role "${input.roleId}" was removed from this org`,
+            });
+        }
+        // Step 2: acquire the role slot (reject a concurrent replacement).
+        if (running.respawning.has(input.roleId) || slot.respawnPromise) {
+            return buildRespawnReceipt(slot, maxRespawns, false, {
+                roleId: input.roleId,
+                error: `role "${input.roleId}" is already undergoing replacement`,
+            });
+        }
+        if (slot.respawnCount >= maxRespawns) {
+            return buildRespawnReceipt(slot, maxRespawns, false, {
+                roleId: input.roleId,
+                error: `role "${input.roleId}" has reached its respawn limit (${slot.respawnCount}/${maxRespawns}) for this run`,
+            });
+        }
+        // Step 3: resolve the candidate configuration.
+        if (input.providerName !== undefined && slot.effectiveRole.provider) {
+            return buildRespawnReceipt(slot, maxRespawns, false, {
+                roleId: input.roleId,
+                error: `role "${input.roleId}" has an inline provider, which always takes precedence over adapter_config.provider — replacing an inline provider is a separate design`,
+            });
+        }
+        const candidateRole = mergeEffectiveRoleConfig(slot.effectiveRole, {
+            runtime: input.runtime,
+            model: input.model,
+            providerName: input.providerName,
+        });
+        const budgetTokens = input.budgetTokens ?? computeReplacementBudget(running.def, input.roleId);
+        // Step 4: preflight — must not mutate the old runtime.
+        try {
+            resolveRoleProvider(candidateRole, this.root);
+        }
+        catch (err) {
+            return buildRespawnReceipt(slot, maxRespawns, false, {
+                roleId: input.roleId,
+                error: `preflight failed: ${err instanceof Error ? err.message : String(err)}`,
+            });
+        }
+        // resolveRoleRunner's undefined return is the valid Claude default, not
+        // an error — nothing further to validate for the runtime dimension here.
+        resolveRoleRunner(candidateRole.runtime, running.def.runtime, candidateRole.provider?.kind, undefined, candidateRole.provider);
+        // Step 5: consume one attempt — only after validation/preflight succeed.
+        running.respawning.add(input.roleId);
+        slot.respawnCount++;
+        running.bus.emit({
+            type: 'audit',
+            from: callerId,
+            reason: 'role-respawn-started',
+            msg: `replacing role "${input.roleId}": ${input.reason}`,
+            data: {
+                roleId: input.roleId,
+                from: redactRoleConfig(slot.effectiveRole),
+                to: redactRoleConfig(candidateRole),
+                generation: slot.generation,
+                caller: callerId,
+            },
+        });
+        // Step 6: quiesce the old incarnation. Bump the generation NOW, before
+        // draining starts — not at the final publish (step 11-13) — so the OLD
+        // generation's crash-retry loop (spawnRoleIncarnation's isStaleGeneration
+        // check) recognizes supersession immediately. Without this, a backoff
+        // timer firing during the drain/force-stop window, or the forced abort's
+        // own rejection, would still see itself as the current generation:
+        // the abort's rejection doesn't match killedByStop's SIGTERM-only regex,
+        // so it would run full terminal crash handling — a duplicate live runner
+        // (mid-backoff restart) or a false worker-crashed notification, exactly
+        // what the guard exists to prevent.
+        const newGeneration = slot.generation + 1;
+        slot.generation = newGeneration;
+        slot.phase = 'draining';
+        // Every await from here on can race a stop/restart of this org — verify
+        // ownership before EVERY subsequent step, not just once before the final
+        // publish, so a stale operation can never mutate accounting, force-stop
+        // a runtime, or spawn into an org that's no longer the live one.
+        const stillOwned = () => this.orgs.get(name) === running && running.roleSlots.get(input.roleId) === slot;
+        const abandonedReceipt = () => {
+            running.respawning.delete(input.roleId);
+            return buildRespawnReceipt(slot, maxRespawns, false, {
+                roleId: input.roleId,
+                error: `org "${name}" stopped or restarted during replacement`,
+            });
+        };
+        const oldRuntime = slot.runtime;
+        const sweptQueue = oldRuntime.mailbox.beginDrain();
+        slot.queuedDuringSwap.push(...sweptQueue);
+        const drainTimeoutMs = running.def.run_config.respawn_drain_timeout_ms ?? 30_000;
+        const drained = await Promise.race([
+            oldRuntime.done.then(() => true),
+            new Promise((r) => setTimeout(() => r(false), drainTimeoutMs)),
+        ]);
+        if (!stillOwned())
+            return abandonedReceipt();
+        let drainTimedOut = false;
+        if (!drained) {
+            drainTimedOut = true;
+            // Step 7: force stop.
+            slot.abort?.abort();
+            const forceStopMs = running.def.run_config.respawn_force_stop_timeout_ms ?? 5_000;
+            const stopped = await Promise.race([
+                oldRuntime.done.then(() => true).catch(() => true),
+                new Promise((r) => setTimeout(() => r(false), forceStopMs)),
+            ]);
+            if (!stillOwned())
+                return abandonedReceipt();
+            if (!stopped) {
+                slot.phase = 'stuck';
+                running.respawning.delete(input.roleId);
+                running.bus.emit({
+                    type: 'audit',
+                    from: callerId,
+                    reason: 'role-respawn-failed',
+                    msg: `role "${input.roleId}" forced stop did not confirm termination — refusing to spawn a replacement`,
+                });
+                return buildRespawnReceipt(slot, maxRespawns, false, {
+                    roleId: input.roleId,
+                    error: `role "${input.roleId}" could not be confirmed stopped; not replaced`,
+                });
+            }
+        }
+        // Step 8: preserve durable role state (worktree path, task ownership, and
+        // the DAG survive untouched — they live outside AgentRuntime/Mailbox
+        // entirely, keyed by role.id, which never changes). Reclaim any message
+        // abandoned mid-yield by a forced stop for at-least-once redelivery.
+        oldRuntime.mailbox.reclaimInFlight();
+        const reclaimedQueue = oldRuntime.mailbox.serialize().queue;
+        slot.queuedDuringSwap.push(...reclaimedQueue);
+        // Step 9: retire accounting BEFORE replacing the runtime.
+        slot.retiredUsage = {
+            tokens: slot.retiredUsage.tokens + oldRuntime.policy.usage,
+            costUsd: slot.retiredUsage.costUsd + oldRuntime.metrics.costUsd,
+        };
+        // Step 10: spawn generation N+1 (generation already bumped in step 6).
+        const { runtime: newRuntime, abort: newAbort } = this.spawnRoleIncarnation(name, running, candidateRole, newGeneration, { budgetTokensOverride: budgetTokens });
+        // Seed the new mailbox with everything swapped/reclaimed, delivered
+        // FIFO, plus a delimited coordinator briefing appended last so it reads
+        // as the newest context once the replacement starts its first turn.
+        for (const queued of slot.queuedDuringSwap)
+            newRuntime.mailbox.push(queued);
+        newRuntime.mailbox.push(`[system: role replacement briefing — not a system prompt] You are a fresh session replacing the previous incarnation of role "${input.roleId}". Reason: ${input.reason}\n\n${input.briefing}`);
+        // Seed USD accounting from retained totals so a respawn cannot reset
+        // role.budget_usd.
+        if (running.def.roles.find((r) => r.id === input.roleId)?.budget_usd !== undefined) {
+            newRuntime.policy.setUsageUsd(slot.retiredUsage.costUsd);
+        }
+        // "Ready" here means "did not crash within the startup window" — a
+        // silent-but-healthy runner (one that never emits a chat/tool/usage
+        // event, e.g. because it hasn't finished its first turn yet) must not be
+        // misreported as a startup failure, so this does NOT wait for a positive
+        // signal. It races the new incarnation's own crash-retry loop (which
+        // shares this generation, so it is NOT superseded and behaves normally)
+        // against the timeout: a config that fails immediately (bad model,
+        // missing runtime binary, auth failure) crashes fast and newRuntime.done
+        // resolves with status 'crashed' well before startTimeoutMs, correctly
+        // failing readiness and triggering rollback.
+        const startTimeoutMs = running.def.run_config.respawn_start_timeout_ms ?? 60_000;
+        const ready = await Promise.race([
+            newRuntime.done.then(() => newRuntime.status !== 'crashed'),
+            new Promise((r) => setTimeout(() => r(true), startTimeoutMs)),
+        ]);
+        // Step 11: publish atomically — verify ownership is still current.
+        if (!stillOwned()) {
+            newAbort.abort();
+            return abandonedReceipt();
+        }
+        if (!ready) {
+            // Step 12: rollback — one attempt with the prior effective config.
+            newAbort.abort();
+            running.bus.emit({
+                type: 'audit',
+                from: callerId,
+                reason: 'role-respawn-failed',
+                msg: `role "${input.roleId}" replacement did not become ready within ${startTimeoutMs}ms — attempting rollback`,
+            });
+            try {
+                const { runtime: rolledBack, abort: rolledBackAbort } = this.spawnRoleIncarnation(name, running, slot.effectiveRole, newGeneration + 1, {});
+                for (const queued of slot.queuedDuringSwap)
+                    rolledBack.mailbox.push(queued);
+                running.agents.set(input.roleId, rolledBack);
+                slot.runtime = rolledBack;
+                slot.abort = rolledBackAbort;
+                slot.generation = newGeneration + 1;
+                slot.phase = 'running';
+                slot.queuedDuringSwap = [];
+                running.respawning.delete(input.roleId);
+                running.bus.emit({
+                    type: 'audit',
+                    from: callerId,
+                    reason: 'role-respawn-failed',
+                    msg: `role "${input.roleId}" replacement failed; rolled back to prior config`,
+                });
+                return buildRespawnReceipt(slot, maxRespawns, false, {
+                    roleId: input.roleId,
+                    drainTimedOut,
+                    error: `replacement failed to start; rolled back to prior configuration`,
+                });
+            }
+            catch (rollbackErr) {
+                slot.phase = 'crashed';
+                running.respawning.delete(input.roleId);
+                running.bus.emit({
+                    type: 'audit',
+                    from: callerId,
+                    reason: 'role-respawn-rollback-failed',
+                    msg: `role "${input.roleId}" replacement AND rollback both failed: ${rollbackErr instanceof Error ? rollbackErr.message : String(rollbackErr)}`,
+                });
+                return buildRespawnReceipt(slot, maxRespawns, false, {
+                    roleId: input.roleId,
+                    drainTimedOut,
+                    error: `replacement and rollback both failed; role "${input.roleId}" is unavailable`,
+                });
+            }
+        }
+        running.agents.set(input.roleId, newRuntime);
+        slot.runtime = newRuntime;
+        slot.abort = newAbort;
+        slot.generation = newGeneration;
+        slot.effectiveRole = candidateRole;
+        slot.phase = 'running';
+        slot.queuedDuringSwap = [];
+        running.respawning.delete(input.roleId);
+        // Step 13: audit and persist.
+        running.bus.emit({
+            type: 'audit',
+            from: callerId,
+            reason: 'role-respawned',
+            msg: `role "${input.roleId}" replaced (generation ${newGeneration})`,
+            data: {
+                roleId: input.roleId,
+                generation: newGeneration,
+                respawnCount: slot.respawnCount,
+                drainTimedOut,
+            },
+        });
+        this.persistState(name, 'running', running.run);
+        return buildRespawnReceipt(slot, maxRespawns, true, { roleId: input.roleId, drainTimedOut });
+    }
     /** @internal */
     hasOrgDef(name) {
         if (!/^[a-z0-9][a-z0-9_-]{0,63}$/i.test(name))
@@ -1275,6 +1834,14 @@ export class OrgDaemon {
         this.leases.delete(name);
         for (const a of org.agents.values())
             a.mailbox.close();
+        // Closing the mailbox stops new work being handed to a session, but does
+        // NOT cancel a turn already in flight (e.g. mid provider call) — that
+        // session can keep running, and eventually crash/finish, well past this
+        // function's own bounded drain below. Abort each slot's live incarnation
+        // too, reusing respawnRole's existing force-stop handle, so in-flight
+        // work is told to stop now instead of merely being denied new input.
+        for (const slot of org.roleSlots.values())
+            slot.abort?.abort();
         // Bounded: a genuinely hung agent session (stuck mid-tool-call, not just
         // idle) must not make stopOrg() hang forever — callers like the scheduler
         // already race their own timeout around a run, and this wait re-blocking
@@ -1286,10 +1853,20 @@ export class OrgDaemon {
         // session ends, so a long drain is a ceiling, not a delay.
         const stopWaitMs = drainMs ?? this.opts.stopWaitMs ?? 15_000;
         const allDone = Promise.allSettled([...org.agents.values()].map((a) => a.done)).then(() => false);
+        // Clear the ceiling timer once the sessions win the race: left pending, a
+        // COMPLETE_DRAIN_MS stop kept `org run` (which returns without
+        // process.exit on a clean completion) alive for up to five minutes after
+        // every session had already ended. Deliberately NOT unref'd — on the
+        // timed-out path this timer may be the only thing keeping the loop alive
+        // long enough to write 'stopped' to runtime.json and flush the bus.
+        let drainTimer;
         const timedOut = await Promise.race([
             allDone,
-            new Promise((r) => setTimeout(() => r(true), stopWaitMs)),
+            new Promise((r) => {
+                drainTimer = setTimeout(() => r(true), stopWaitMs);
+            }),
         ]);
+        clearTimeout(drainTimer);
         if (timedOut) {
             // #152: "proceeding anyway" alone didn't say WHO got cut off — a run
             // reviewer had no way to tell whether real, in-progress work (a
@@ -1325,6 +1902,13 @@ export class OrgDaemon {
         }
         org.bus.emit({ type: 'status', msg: 'org stopped' });
         await org.bus.flush();
+        // flush() only awaits a snapshot of writes queued at call time (see its
+        // own doc comment) — it has no visibility into a session that crashes
+        // after the abort signal above but before this function returns. Seal
+        // the bus now so any such late bus.emit() still reaches in-memory
+        // listeners but can never schedule a new disk write into a run
+        // directory a caller (e.g. a test's afterEach) may already be deleting.
+        await org.bus.seal();
         // Append this run's summary to <org>/history.jsonl — read back from the
         // flushed bus.jsonl (the full durable record) rather than the bounded
         // in-memory buffer, so long runs summarize completely.
@@ -1461,6 +2045,17 @@ export class OrgDaemon {
         for (const [name, org] of this.orgs) {
             try {
                 const p = join(this.root, ORG_DIR, name, 'runtime.json');
+                // Capture separately from the write below: a throw here (e.g. a
+                // cyclic structure in roleState reaching generateChecksum) must not
+                // suppress the base crash record, which is the actually-important
+                // best-effort write this method exists for.
+                let checkpoint;
+                try {
+                    checkpoint = captureCheckpoint(org, 'crashed');
+                }
+                catch {
+                    /* best effort — proceed without a checkpoint */
+                }
                 // C4: atomic write — crash handler is the most likely place to hit
                 // a partial write since the process is mid-teardown.
                 writeJsonFileAtomic(p, {
@@ -1469,6 +2064,7 @@ export class OrgDaemon {
                     pid: process.pid,
                     updated: new Date().toISOString(),
                     closedBy: 'crash-handler',
+                    ...(checkpoint ? { checkpoint } : {}),
                     ...(error ? { error } : {}),
                 });
             }
@@ -1508,8 +2104,8 @@ export class OrgDaemon {
     }
     // ── Delegated methods — extracted to focused modules ──────────────────
     // approvals.ts
-    checkApproval(org, role, action) {
-        return approvalOps.checkApproval(this, org, role, action);
+    checkApproval(org, role, action, input) {
+        return approvalOps.checkApproval(this, org, role, action, input);
     }
     async setApproval(org, role, action, approved) {
         return approvalOps.setApproval(this, org, role, action, approved);
@@ -1562,11 +2158,12 @@ export class OrgDaemon {
     async deliver(fromOrg, fromRole, to, subject, body) {
         return crossOrg.deliver(this, fromOrg, fromRole, to, subject, body);
     }
-    receiveRemote(toOrg, toRole, fromQualified, subject, body) {
-        return crossOrg.receiveRemote(this, toOrg, toRole, fromQualified, subject, body);
+    receiveRemote(toOrg, toRole, fromQualified, subject, body, fromCredential) {
+        return crossOrg.receiveRemote(this, toOrg, toRole, fromQualified, subject, body, fromCredential);
     }
-    mailBody(orgName, org, header, body, id) {
-        return crossOrg.mailBody(this.root, orgName, org, header, body, id);
+    // runtime-options.ts
+    listRuntimeOptions() {
+        return buildRuntimeOptions(this.root);
     }
     // scheduler-integration.ts
     /** @internal */
@@ -1580,6 +2177,13 @@ export class OrgDaemon {
     scheduleDeferredSpawn(name, running, role, spawnRole) {
         scheduler.scheduleDeferredSpawn(this, name, running, role, spawnRole);
     }
+    /** Bug 4: mirrors scheduleDeferredSpawn, but for a role deferred because the
+     *  org is already at run_config.max_concurrent_agents rather than under host
+     *  resource pressure — see scheduleConcurrencyDeferredSpawn's doc comment. */
+    /** @internal */
+    scheduleConcurrencyDeferredSpawn(name, running, role, spawnRole) {
+        scheduler.scheduleConcurrencyDeferredSpawn(this, name, running, role, spawnRole);
+    }
     // org-memory.ts
     orgMemoryNamespace(name, def) {
         return orgMemory.orgMemoryNamespace(name, def);