@monoes/monomindcli 2.9.21 → 2.9.23

package/dist/src/orgrt/daemon.js

@@ -7,7 +7,7 @@ import { writeJsonFileAtomic } from '../utils/json-file.js';
 import { reapOrphanedSdkProcesses } from '../utils/resource-governor.js';
 import { OrgBus } from './bus.js';
 import { PolicyEngine } from './policy.js';
-import { Mailbox } from './mailbox.js';
+import { Mailbox, isRecoverableCloseReason } from './mailbox.js';
 import { runAgentSession } from './session.js';
 import { attachForwarder } from './forwarder.js';
 import { BrokerLease, normalizeCredential } from './broker.js';
@@ -21,6 +21,13 @@ import { KimiCodeAgentRunner } from './kimicode-runner.js';
 import { VercelAgentRunner } from './vercel-runner.js';
 import { CodexAgentRunner } from './codex-runner.js';
 import { AntigravityAgentRunner } from './antigravity-runner.js';
+import { GrokAgentRunner } from './grok-runner.js';
+import { QwenAgentRunner } from './qwen-runner.js';
+import { CrushAgentRunner } from './crush-runner.js';
+import { CopilotAgentRunner } from './copilot-runner.js';
+import { PiAgentRunner } from './pi-runner.js';
+import { PiRpcAgentRunner } from './pi-rpc-runner.js';
+import { QwenRpcAgentRunner } from './qwen-rpc-runner.js';
 import { captureCheckpoint, generateChecksum, validateCheckpoint, isCheckpointExpired, restoreMailboxQueue, } from './checkpoint.js';
 import { loadGlobalFenceConfig, mergeFenceConfigs, createFenceForRole, } from './fence.js';
 // ── Extracted module imports ────────────────────────────────────────────
@@ -73,7 +80,7 @@ function autoRuntimeFromProvider(kind) {
         return 'antigravity';
     return undefined;
 }
-export function resolveRunner(orgRuntime, providerKind) {
+export function resolveRunner(orgRuntime, providerKind, provider) {
     const selected = orgRuntime ??
         autoRuntimeFromProvider(providerKind) ??
         process.env.MONOMIND_RUNTIME;
@@ -87,6 +94,30 @@ export function resolveRunner(orgRuntime, providerKind) {
         return new CodexAgentRunner();
     if (selected === 'antigravity')
         return new AntigravityAgentRunner();
+    if (selected === 'grok')
+        return new GrokAgentRunner();
+    if (selected === 'qwen')
+        return new QwenAgentRunner();
+    if (selected === 'crush') {
+        // Issue #177: usage-proxy accounting is opt-in via provider.usageProxy +
+        // provider.baseUrl (the upstream the crush CLI's own provider config
+        // points at). Absent either, CrushAgentRunner falls back to its
+        // documented 0-token behavior — this never blocks a turn either way.
+        if (provider?.usageProxy && provider.baseUrl) {
+            return new CrushAgentRunner({
+                usageProxy: { upstreamBaseUrl: provider.baseUrl, baseUrlEnvVar: provider.usageProxyEnvVar },
+            });
+        }
+        return new CrushAgentRunner();
+    }
+    if (selected === 'copilot')
+        return new CopilotAgentRunner();
+    if (selected === 'pi')
+        return new PiAgentRunner();
+    if (selected === 'pi-rpc')
+        return new PiRpcAgentRunner();
+    if (selected === 'qwen-rpc')
+        return new QwenRpcAgentRunner();
     return undefined;
 }
 /** Per-session variant: a role's own `runtime` field wins over the org-level
@@ -94,17 +125,46 @@ export function resolveRunner(orgRuntime, providerKind) {
  *  the default Claude path even when the org/env select another runtime.
  *  Roles without a `runtime` inherit the org-level resolution unchanged.
  *  If no explicit runtime is set, auto-resolve from the provider kind. */
-export function resolveRoleRunner(roleRuntime, orgRuntime, roleProviderKind, orgProviderKind) {
+export function resolveRoleRunner(roleRuntime, orgRuntime, roleProviderKind, orgProviderKind, roleProvider) {
     const explicit = roleRuntime ?? orgRuntime;
     if (explicit)
-        return resolveRunner(explicit);
-    return resolveRunner(undefined, roleProviderKind ?? orgProviderKind);
+        return resolveRunner(explicit, undefined, roleProvider);
+    return resolveRunner(undefined, roleProviderKind ?? orgProviderKind, roleProvider);
 }
 /** Per-role token budget: a role's own `budget_tokens` wins; otherwise the
  *  even split of run_config.budget_tokens across all roles. */
 export function roleTokenBudget(role, def) {
     return (role.budget_tokens ?? Math.floor((def.run_config.budget_tokens ?? 1_000_000) / def.roles.length));
 }
+/** Idle watchdog's per-tick recovery check: given the previous nudge timestamp,
+ *  the cumulative nudge count, and the timestamp of the most recent real tool
+ *  call, returns the nudge count that should carry forward now that fresh
+ *  activity means the org is no longer idle.
+ *
+ *  `nudgedAt !== 0` means we're recovering from an outstanding nudge. Resetting
+ *  the counter here means it only ever tracks UNRESOLVED idle spells in a row,
+ *  not a lifetime total — a long-running org that goes idle and recovers any
+ *  number of times (e.g. periodic checkpoints on a slow background task) is
+ *  never punished for having had several separate, healthy idle spells over
+ *  its lifetime. Before this existed, `nudges` only ever incremented, so a run
+ *  that answered every single nudge with real work still hit the "org idle
+ *  again after 3 nudges" cap and got force-stopped on its 4th idle spell —
+ *  observed live killing an in-progress 24h soak test under 90 minutes in.
+ *
+ *  But "recovering" must mean genuine forward progress, not just any bus
+ *  event — a bare, content-free reply to the nudge (a boss that answers with
+ *  "✓ Complete" and calls no tools at all) still updates lastActivity, so the
+ *  org isn't flagged as silent, but it accomplishes nothing: nobody outside
+ *  the boss's own turn ever sees it, since role coordination only happens via
+ *  tool calls (org_send, org_task, ...). Requiring `lastToolActivity >=
+ *  nudgedAt` — a real tool call happened AFTER this nudge was sent — closes
+ *  that gap: observed live, a boss stuck responding to four consecutive
+ *  10-minute nudges with one-line acknowledgments and zero tool calls looped
+ *  indefinitely making no progress, because every trivial reply reset the cap
+ *  that was supposed to catch exactly this. */
+export function resolvedIdleNudgeCount(nudgedAt, nudges, lastToolActivity) {
+    return nudgedAt !== 0 && lastToolActivity >= nudgedAt ? 0 : nudges;
+}
 /** Bounded ring buffer for agent terminal scrollback. */
 export class ScrollbackBuffer {
     maxLines;
@@ -370,16 +430,36 @@ export class OrgDaemon {
         }
         // Validate per-role providers before spawning anything (fail-fast: a
         // missing env var discovered 10 minutes into a run wastes the entire run).
-        const { resolveProviderEnv: validateProvider } = await import('./provider.js');
+        const { resolveProviderEnv: validateProvider, resolveRoleProvider } = await import('./provider.js');
         for (const role of def.roles) {
-            if (role.provider) {
-                try {
+            try {
+                if (role.provider) {
                     validateProvider(role.provider);
                 }
-                catch (err) {
-                    throw new Error(`org ${name}: role "${role.id}" provider validation failed — ${err instanceof Error ? err.message : err}`);
+                else if (role.adapter_config?.provider) {
+                    // Named provider (`monomind providers configure`): resolve now so a
+                    // missing/misconfigured entry fails the run at start, not mid-flight.
+                    resolveRoleProvider(role, this.root);
                 }
             }
+            catch (err) {
+                throw new Error(`org ${name}: role "${role.id}" provider validation failed — ${err instanceof Error ? err.message : err}`);
+            }
+            // provider.kind 'gemini'/'openai' only sets env vars (GEMINI_API_KEY /
+            // OPENAI_API_KEY — see provider.ts) for a CLI that never reads them:
+            // autoRuntimeFromProvider has no case for either kind, so
+            // resolveRoleRunner falls through to `undefined` and session.ts spawns
+            // the default ClaudeAgentRunner. The role silently runs on Claude while
+            // its config claims gemini/openai — surface that loudly at start time
+            // instead of leaving it to be discovered mid-run.
+            const kind = role.provider?.kind;
+            if ((kind === 'gemini' || kind === 'openai') &&
+                !resolveRoleRunner(role.runtime, def.runtime, kind, undefined, role.provider)) {
+                console.error(`org ${name}: role "${role.id}" sets provider.kind="${kind}" but no runtime honors it — ` +
+                    `this role will actually run on the Claude Agent SDK, not ${kind}. ` +
+                    `Set role.runtime (or the org's runtime) explicitly, or use provider.kind="vercel-api-key" ` +
+                    `with vendor="${kind === 'gemini' ? 'google' : 'openai'}" to route through a real ${kind} model.`);
+            }
         }
         const bus = new OrgBus(name, run, dir);
         // Lightweight in-memory tail for busEvents() (test-loop, /api/history).
@@ -388,6 +468,16 @@ export class OrgDaemon {
         const MAX_COLLECTED = 1000;
         const collected = [];
         let lastActivity = Date.now();
+        // Separate from lastActivity: only real tool calls (org_send, org_task,
+        // Bash, ...) count here, not status pings or chat-only turns. The idle
+        // watchdog's nudge-recovery check (resolvedIdleNudgeCount) uses this to
+        // tell genuine forward progress apart from a boss that "answers" a nudge
+        // with a bare acknowledgment ("✓ Complete") and does nothing — a
+        // content-free reply still updates lastActivity (so the org isn't
+        // flagged as silent), but must not reset the cumulative nudge cap, or a
+        // boss that's genuinely out of ideas can loop forever making zero
+        // progress without ever tripping the watchdog.
+        let lastToolActivity = 0;
         bus.subscribe((e) => {
             const slim = e.data?.content != null ? { ...e, data: { ...e.data, content: undefined } } : e;
             collected.push(slim);
@@ -397,6 +487,8 @@ export class OrgDaemon {
             // hung boss would never trip the "nudge produced no activity" stop.
             if (e.reason !== 'idle-nudge')
                 lastActivity = Date.now();
+            if (e.type === 'tool')
+                lastToolActivity = Date.now();
             // org_complete IS the end of the run — self-stop instead of sitting
             // "running" forever after a recorded outcome. Deferred (unref'd) so the
             // tool call's receipt reaches the boss and its final turn text still
@@ -404,7 +496,11 @@ export class OrgDaemon {
             // against a concurrent manual stop.
             if (e.type === 'status' && e.reason === 'org-complete') {
                 const t = setTimeout(() => {
-                    this.stopOrg(name, { drainMs: COMPLETE_DRAIN_MS }).catch((err) => console.error(`org ${name}: auto-stop after org_complete failed:`, err instanceof Error ? err.message : err));
+                    // #206: closedBy: 'org-complete' is the ONLY signal `org run`
+                    // trusts to mean "the run ended cleanly, exit 0" — every other
+                    // stop path (idle watchdog, boss-restart-exhausted, manual stop)
+                    // leaves it unset.
+                    this.stopOrg(name, { drainMs: COMPLETE_DRAIN_MS, closedBy: 'org-complete' }).catch((err) => console.error(`org ${name}: auto-stop after org_complete failed:`, err instanceof Error ? err.message : err));
                 }, 1000);
                 t.unref?.();
             }
@@ -543,13 +639,22 @@ export class OrgDaemon {
             if (roleCheckpoint?.mailboxQueue?.length) {
                 restoreMailboxQueue({ mailbox }, roleCheckpoint.mailboxQueue);
             }
-            if (roleCheckpoint?.mailboxClosed) {
-                mailbox.close();
+            // A recoverable close (budget exhaustion) is left open on resume — see
+            // isRecoverableCloseReason's doc comment. Re-closing it here would
+            // make the idle watchdog's "raise the budget and resume" remedy a
+            // no-op, since nothing in this codebase ever reopens a closed mailbox.
+            if (roleCheckpoint?.mailboxClosed && !isRecoverableCloseReason(roleCheckpoint.mailboxCloseReason)) {
+                mailbox.close(roleCheckpoint.mailboxCloseReason);
             }
-            const policy = new PolicyEngine(role.id, { maxTokens: role.budget_tokens ?? perRoleBudget, ...(role.policy ?? {}) }, bus, roleCwd);
+            const policy = new PolicyEngine(role.id, { maxTokens: role.budget_tokens ?? perRoleBudget, maxUsd: role.budget_usd, ...(role.policy ?? {}) }, bus, roleCwd);
             if (roleCheckpoint?.tokensUsed) {
                 policy.setUsage(roleCheckpoint.tokensUsed);
             }
+            // ORG-7: restore accumulated USD spend across resume so a stop/resume
+            // cycle can't reset a role's USD budget back to zero.
+            if (roleCheckpoint?.costUsd) {
+                policy.setUsageUsd(roleCheckpoint.costUsd);
+            }
             const runtime = {
                 mailbox,
                 policy,
@@ -578,6 +683,9 @@ export class OrgDaemon {
                 // (VercelAgentRunner session files) write under .monomind/orgs/<name>
                 // instead of polluting the workspace cwd.
                 orgDir: join(this.root, ORG_DIR, name),
+                // Project root for named-provider (`adapter_config.provider`) config
+                // lookup — role cwd may be an isolated workspace with no config file.
+                orgRoot: this.root,
                 maxTurns: role.max_turns_per_message ?? def.run_config.max_turns_per_message,
                 resumeSessionId: roleCheckpoint?.sessionId,
                 lastMessageId: () => runtime.lastMessageId,
@@ -594,6 +702,20 @@ export class OrgDaemon {
                 })(),
                 beforeTool: (r, toolName) => this.checkApproval(name, r, toolName),
                 fence: roleFences.get(role.id),
+                // ORG-1: gatedCanUseTool denials are a natural decision point — record them so
+                // `org decisions` shows real traces instead of always reporting none.
+                onDecision: (r, toolName, message) => {
+                    this.recordDecision(name, r, {
+                        type: 'tool',
+                        context: `tool call: ${toolName}`,
+                        reasoning: message,
+                        outcome: 'denied',
+                    });
+                },
+                // ORG-9: decision gates are documented as "hard-blocking" — make that
+                // true by actually denying tool use while this role has a pending gate,
+                // the same way pending approvals already do.
+                hasPendingGate: () => this.listGates(name, 'pending').some(g => g.roleId === role.id),
                 onComplete: role.id === bossRole.id
                     ? (r, outcome, summary) => {
                         bus.emit({
@@ -678,6 +800,9 @@ export class OrgDaemon {
                 cancelTask: (r, taskId, reason) => {
                     return this.dagCancelTask(name, r, taskId, reason);
                 },
+                blockTask: (r, taskId, untilIso, reason) => {
+                    return this.dagBlockTask(name, r, taskId, untilIso, reason);
+                },
                 planGraph: (r, specs) => {
                     return this.dagPlanGraph(name, r, specs);
                 },
@@ -689,7 +814,7 @@ export class OrgDaemon {
                 // Claude/Antigravity orgs byte-for-byte unchanged. Session opts are
                 // built per role here in spawnRole, so each role gets its own runner.
                 runner: this.opts.runner ??
-                    resolveRoleRunner(role.runtime, def.runtime, role.provider?.kind, undefined),
+                    resolveRoleRunner(role.runtime, def.runtime, role.provider?.kind, undefined, role.provider),
             };
             // Supervised session: transient crashes (provider blips, network) restart
             // with backoff; a crash with the mailbox already closed, or one that
@@ -712,6 +837,12 @@ export class OrgDaemon {
                             // during the backoff window must queue for the NEXT session, not
                             // wake the dead generator to swallow it.
                             mailbox.detach();
+                            // #203: if the crashed session's mailbox generator was abandoned
+                            // mid-yield (message already shift()ed for it, turn never
+                            // finished), put that message back on the queue — otherwise the
+                            // replacement session's stream() finds an empty queue and parks
+                            // forever, since the "delivered" message is gone for good.
+                            mailbox.reclaimInFlight();
                             const message = err instanceof Error ? err.message : String(err);
                             const isTurnLimit = /Reached maximum number of turns|error_max_turns/i.test(message);
                             // Bounded like every other recovery: attempt counts every pass
@@ -948,8 +1079,9 @@ export class OrgDaemon {
         // org_complete) produces no bus events, and every agent just waits. After
         // idle_minutes of silence, nudge the boss to complete or reassign; if the
         // nudge itself produces no activity (boss hung/crashed), or the org keeps
-        // going idle after MAX_IDLE_NUDGES nudges, stop the run instead of letting
-        // it freeze forever. idle_minutes: 0 disables.
+        // going idle after MAX_IDLE_NUDGES nudges in a row without ever recovering
+        // (see resolvedIdleNudgeCount), stop the run instead of letting it freeze
+        // forever. idle_minutes: 0 disables.
         const idleMs = (def.run_config.idle_minutes ?? 10) * 60_000;
         if (idleMs > 0) {
             const MAX_IDLE_NUDGES = 3;
@@ -966,8 +1098,31 @@ export class OrgDaemon {
                 const pendingGates = this.readGates(name).gates.filter((g) => g.status === 'pending');
                 if (pendingGates.length > 0)
                     return;
+                // Auto-resume any task whose org_task_block time has passed: flip it
+                // back to 'running' and re-push it into the assignee's mailbox, same
+                // as a fresh dispatch. This IS real activity, so fall through to the
+                // normal idleFor check below rather than returning early — an
+                // unblocked task should reset the idle clock, not just silently
+                // update state nobody notices until the next nudge.
+                const unblocked = running.taskDag?.unblockExpired(Date.now()) ?? [];
+                for (const task of unblocked) {
+                    const agent = running.agents.get(task.assignee);
+                    if (agent && !agent.mailbox.isClosed) {
+                        agent.mailbox.push(`[task:${task.id}] Block expired — resuming: ${task.title}`);
+                    }
+                    bus.emit({
+                        type: 'status', from: 'dag', reason: 'task-unblocked',
+                        msg: `task ${task.id} block expired — resumed and re-dispatched to ${task.assignee}`,
+                        data: { taskId: task.id, assignee: task.assignee },
+                    });
+                }
+                // A task blocked on a real-world time still in the future is
+                // legitimate waiting, same as a pending gate — don't nudge about it.
+                if (running.taskDag?.hasActiveBlock(Date.now()))
+                    return;
                 const idleFor = Date.now() - lastActivity;
                 if (idleFor < idleMs) {
+                    nudges = resolvedIdleNudgeCount(nudgedAt, nudges, lastToolActivity);
                     nudgedAt = 0;
                     return;
                 }
@@ -977,6 +1132,18 @@ export class OrgDaemon {
                         return;
                     }
                     const bossRt = running.agents.get(bossRole.id);
+                    // #205: a budget-exhausted boss closed its own mailbox on
+                    // purpose (session.ts) — that's a recoverable pause, not the
+                    // same "unreachable" condition as a crash. Name it distinctly so
+                    // the operator's remedy (raise the budget, resume) is obvious
+                    // instead of reading like the run died.
+                    const budgetReason = bossRt?.mailbox.closeReason;
+                    if (budgetReason === 'token-budget' || budgetReason === 'usd-budget') {
+                        idleStop(`org idle for ${Math.round(idleFor / 60_000)}m and boss "${bossRole.id}" is over its ` +
+                            `${budgetReason === 'token-budget' ? 'token' : 'USD'} budget — raise the role's ` +
+                            `${budgetReason === 'token-budget' ? 'budget_tokens' : 'budget_usd'} (or run_config's) and resume from checkpoint — stopping run`);
+                        return;
+                    }
                     if (!bossRt || bossRt.status !== 'running' || bossRt.mailbox.isClosed) {
                         idleStop(`org idle for ${Math.round(idleFor / 60_000)}m and boss "${bossRole.id}" is unreachable — stopping run`);
                         return;
@@ -992,7 +1159,8 @@ export class OrgDaemon {
                     bossRt.mailbox.push(`[watchdog] No activity in org "${name}" for ${Math.round(idleFor / 60_000)} minute(s). ` +
                         `Check org_tasks first, then pick ONE: (1) the org's full stated goal is achieved or clearly cannot be — call org_complete now (this ends the run for good, not just this batch); ` +
                         `(2) someone has stalled or unstarted work — check on your team via org_send and reassign it; ` +
-                        `(3) the current task batch is done but the goal has more scope left — do NOT call org_complete for this case, instead dispatch the next batch of work with org_task/createTask so the org keeps making progress.`);
+                        `(3) the current task batch is done but the goal has more scope left — do NOT call org_complete for this case, instead dispatch the next batch of work with org_task/createTask so the org keeps making progress; ` +
+                        `(4) a task is stuck 'running' only because it's genuinely waiting on a real-world time (a scheduled process, a deadline) and there is nothing else to dispatch right now — do NOT just leave it and re-confirm this every time you get nudged, call org_task_block(taskId, untilIso, reason) instead so this watchdog stops nudging you about it and auto-resumes the task when the time arrives.`);
                 }
                 else if (Date.now() - nudgedAt >= idleMs) {
                     idleStop(`nudge produced no activity for another ${Math.round(idleMs / 60_000)}m — boss appears hung, stopping run`);
@@ -1043,7 +1211,12 @@ export class OrgDaemon {
     }
     /** @param opts.drainMs how long to let in-flight agent sessions finish before
      *  reaping. Defaults to the short abort bound; the planned-completion path
-     *  passes a far longer window (see COMPLETE_DRAIN_MS). */
+     *  passes a far longer window (see COMPLETE_DRAIN_MS).
+     *  @param opts.closedBy #206: tags WHY the run ended, persisted into
+     *  runtime.json so `org run` can tell a clean, goal-driven end
+     *  (closedBy: 'org-complete') from every other kind of stop (idle
+     *  watchdog, boss-restart-exhausted, manual `org stop`) and exit non-zero
+     *  for the latter. Only the org_complete auto-stop path passes this. */
     async stopOrg(name, opts) {
         // Join an in-flight stop instead of no-oping: the self-stop paths
         // (org_complete, idle watchdog) run detached, and a caller like
@@ -1063,7 +1236,7 @@ export class OrgDaemon {
         // shutdown via `stopping` instead of re-running the whole sequence and
         // double-emitting 'org stopped' (duplicate org:complete/session:complete).
         this.orgs.delete(name);
-        const p = this.finishStop(name, org, opts?.drainMs);
+        const p = this.finishStop(name, org, opts?.drainMs, opts?.closedBy);
         this.stopping.set(name, p);
         try {
             await p;
@@ -1072,7 +1245,7 @@ export class OrgDaemon {
             this.stopping.delete(name);
         }
     }
-    async finishStop(name, org, drainMs) {
+    async finishStop(name, org, drainMs, closedBy) {
         // Snapshot checkpoint BEFORE closing mailboxes / draining sessions — the
         // queue is emptied during the drain, so capturing afterwards loses all
         // unconsumed messages (the whole point of checkpoint-resume).
@@ -1190,7 +1363,7 @@ export class OrgDaemon {
         // 'running' record must not be overwritten with this old run's 'stopped'.
         // Pass the org directly since we already removed it from the map.
         if (!this.orgs.has(name))
-            this.persistState(name, 'stopped', org.run, org, stopCheckpoint);
+            this.persistState(name, 'stopped', org.run, org, stopCheckpoint, closedBy);
         // Clean up git worktrees — shared (workspace: 'worktree') and per-role.
         try {
             const { execFileSync } = await import('node:child_process');
@@ -1231,8 +1404,13 @@ export class OrgDaemon {
             ...this.stopping.values(), // detached self-stops still flushing
         ]);
     }
-    /** @internal */
-    persistState(name, status, run, org, checkpointOverride) {
+    /** @internal
+     *  @param closedBy #206: why the run ended — 'org-complete' for a clean,
+     *  goal-driven end (the only value any caller currently passes); absent for
+     *  every other stop (idle watchdog, boss-restart-exhausted, manual `org
+     *  stop`). Mirrors persistCrashStateAll()'s existing closedBy: 'crash-handler'
+     *  for the process-crash path, which org.ts already reads. */
+    persistState(name, status, run, org, checkpointOverride, closedBy) {
         const p = join(this.root, ORG_DIR, name, 'runtime.json');
         const missing = [...(this.abandoned.get(name) ?? [])];
         const running = org ?? this.orgs.get(name);
@@ -1263,11 +1441,15 @@ export class OrgDaemon {
             updated: new Date().toISOString(),
             ...(missing.length ? { abandonedRoles: missing } : {}),
             ...(checkpoint ? { checkpoint } : {}),
+            ...(closedBy ? { closedBy } : {}),
         });
     }
     /** Mark every currently-running org as crashed in runtime.json.
-     *  Called from process-level crash handlers — must be synchronous and best-effort. */
-    persistCrashStateAll() {
+     *  Called from process-level crash handlers — must be synchronous and best-effort.
+     *  @param error the uncaught error/rejection reason, if known — without
+     *  this, `runOutcomeResult` (org.ts)'s "crashed: <error>" message always
+     *  read "crashed: unknown error" regardless of what actually happened. */
+    persistCrashStateAll(error) {
         for (const [name, org] of this.orgs) {
             try {
                 const p = join(this.root, ORG_DIR, name, 'runtime.json');
@@ -1279,6 +1461,7 @@ export class OrgDaemon {
                     pid: process.pid,
                     updated: new Date().toISOString(),
                     closedBy: 'crash-handler',
+                    ...(error ? { error } : {}),
                 });
             }
             catch {
@@ -1358,6 +1541,9 @@ export class OrgDaemon {
     dagCancelTask(org, role, taskId, reason) {
         return decisionOps.dagCancelTask(this, org, role, taskId, reason);
     }
+    dagBlockTask(org, role, taskId, untilIso, reason) {
+        return decisionOps.dagBlockTask(this, org, role, taskId, untilIso, reason);
+    }
     dagPlanGraph(org, role, specs) {
         return decisionOps.dagPlanGraph(this, org, role, specs);
     }
@@ -1418,8 +1604,5 @@ export class OrgDaemon {
     async resumeOrg(name) {
         return checkpointOps.resumeOrg(this, name);
     }
-    branchCheckpoint(name, run, branchName) {
-        return checkpointOps.branchCheckpoint(this, name, run, branchName);
-    }
 }
 //# sourceMappingURL=daemon.js.map