@monoes/monomindcli 2.9.22 → 2.9.24

package/dist/src/orgrt/daemon.js

@@ -1,44 +1,44 @@
 // packages/@monomind/cli/src/orgrt/daemon.ts
 // monolean: single-process inter-org — upgrade path = daemon-to-daemon HTTP when multi-host is real
-import { readFileSync, mkdirSync, existsSync, unlinkSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
-import { join, isAbsolute } from 'node:path';
+import { existsSync, mkdirSync, readFileSync, unlinkSync } from 'node:fs';
+import { isAbsolute, join } from 'node:path';
 import { writeJsonFileAtomic } from '../utils/json-file.js';
-import { reapOrphanedSdkProcesses } from '../utils/resource-governor.js';
+import { configureResourceLimits, getResourceLimits, reapOrphanedSdkProcesses, } from '../utils/resource-governor.js';
+import { AntigravityAgentRunner } from './antigravity-runner.js';
+// ── Extracted module imports ────────────────────────────────────────────
+import * as approvalOps from './approvals.js';
+import { BrokerLease, normalizeCredential } from './broker.js';
 import { OrgBus } from './bus.js';
-import { PolicyEngine } from './policy.js';
-import { Mailbox } from './mailbox.js';
-import { runAgentSession } from './session.js';
+import { captureCheckpoint, generateChecksum, isCheckpointExpired, restoreMailboxQueue, validateCheckpoint, } from './checkpoint.js';
+import * as checkpointOps from './checkpoint-ops.js';
+import { CodexAgentRunner } from './codex-runner.js';
+import { CopilotAgentRunner } from './copilot-runner.js';
+import * as crossOrg from './cross-org.js';
+import { CrushAgentRunner } from './crush-runner.js';
+import * as decisionOps from './decisions.js';
+import { createFenceForRole, loadGlobalFenceConfig, mergeFenceConfigs, } from './fence.js';
 import { attachForwarder } from './forwarder.js';
-import { BrokerLease, normalizeCredential } from './broker.js';
+import { GrokAgentRunner } from './grok-runner.js';
 import { drainInbox } from './inbox.js';
-import { OrgDefSchema, ORG_DIR, } from './types.js';
-import { TaskDag } from './task-dag.js';
-import { summarizeRun, readRunEvents, readHistory, historyFile, } from './reporting.js';
-import { getResourceLimits, configureResourceLimits } from '../utils/resource-governor.js';
-import { OpencodeAgentRunner } from './opencode-runner.js';
 import { KimiCodeAgentRunner } from './kimicode-runner.js';
-import { VercelAgentRunner } from './vercel-runner.js';
-import { CodexAgentRunner } from './codex-runner.js';
-import { AntigravityAgentRunner } from './antigravity-runner.js';
-import { GrokAgentRunner } from './grok-runner.js';
-import { QwenAgentRunner } from './qwen-runner.js';
-import { CrushAgentRunner } from './crush-runner.js';
-import { CopilotAgentRunner } from './copilot-runner.js';
-import { PiAgentRunner } from './pi-runner.js';
+import { isRecoverableCloseReason, Mailbox } from './mailbox.js';
+import { OpencodeAgentRunner } from './opencode-runner.js';
+import * as orgMemory from './org-memory.js';
 import { PiRpcAgentRunner } from './pi-rpc-runner.js';
-import { captureCheckpoint, generateChecksum, validateCheckpoint, isCheckpointExpired, restoreMailboxQueue, } from './checkpoint.js';
-import { loadGlobalFenceConfig, mergeFenceConfigs, createFenceForRole, } from './fence.js';
-// ── Extracted module imports ────────────────────────────────────────────
-import * as approvalOps from './approvals.js';
+import { PiAgentRunner } from './pi-runner.js';
+import { PolicyEngine } from './policy.js';
 import * as questionOps from './questions.js';
-import * as decisionOps from './decisions.js';
-import * as crossOrg from './cross-org.js';
+import { QwenRpcAgentRunner } from './qwen-rpc-runner.js';
+import { QwenAgentRunner } from './qwen-runner.js';
+import { historyFile, readHistory, readRunEvents, summarizeRun, } from './reporting.js';
 import * as scheduler from './scheduler-integration.js';
-import * as orgMemory from './org-memory.js';
-import * as checkpointOps from './checkpoint-ops.js';
+import { runAgentSession } from './session.js';
+import { TaskDag } from './task-dag.js';
+import { ORG_DIR, OrgDefSchema, } from './types.js';
+import { VercelAgentRunner } from './vercel-runner.js';
 /** OpenTelemetry tracing helper - creates spans for major operations */
-class OtelTracer {
+class _OtelTracer {
     enabled = false;
     spans = new Map();
     enable() {
@@ -54,12 +54,12 @@ class OtelTracer {
             return;
         const span = this.spans.get(name);
         if (span) {
-            const duration = Date.now() - span.start;
+            const _duration = Date.now() - span.start;
             // Emit span as a bus event for export
             this.spans.delete(name);
         }
     }
-    recordEvent(name, attributes) {
+    recordEvent(_name, _attributes) {
         if (!this.enabled)
             return;
         // Could emit to bus for collection
@@ -79,7 +79,7 @@ function autoRuntimeFromProvider(kind) {
         return 'antigravity';
     return undefined;
 }
-export function resolveRunner(orgRuntime, providerKind) {
+export function resolveRunner(orgRuntime, providerKind, provider) {
     const selected = orgRuntime ??
         autoRuntimeFromProvider(providerKind) ??
         process.env.MONOMIND_RUNTIME;
@@ -97,14 +97,26 @@ export function resolveRunner(orgRuntime, providerKind) {
         return new GrokAgentRunner();
     if (selected === 'qwen')
         return new QwenAgentRunner();
-    if (selected === 'crush')
+    if (selected === 'crush') {
+        // Issue #177: usage-proxy accounting is opt-in via provider.usageProxy +
+        // provider.baseUrl (the upstream the crush CLI's own provider config
+        // points at). Absent either, CrushAgentRunner falls back to its
+        // documented 0-token behavior — this never blocks a turn either way.
+        if (provider?.usageProxy && provider.baseUrl) {
+            return new CrushAgentRunner({
+                usageProxy: { upstreamBaseUrl: provider.baseUrl, baseUrlEnvVar: provider.usageProxyEnvVar },
+            });
+        }
         return new CrushAgentRunner();
+    }
     if (selected === 'copilot')
         return new CopilotAgentRunner();
     if (selected === 'pi')
         return new PiAgentRunner();
     if (selected === 'pi-rpc')
         return new PiRpcAgentRunner();
+    if (selected === 'qwen-rpc')
+        return new QwenRpcAgentRunner();
     return undefined;
 }
 /** Per-session variant: a role's own `runtime` field wins over the org-level
@@ -112,11 +124,11 @@ export function resolveRunner(orgRuntime, providerKind) {
  *  the default Claude path even when the org/env select another runtime.
  *  Roles without a `runtime` inherit the org-level resolution unchanged.
  *  If no explicit runtime is set, auto-resolve from the provider kind. */
-export function resolveRoleRunner(roleRuntime, orgRuntime, roleProviderKind, orgProviderKind) {
+export function resolveRoleRunner(roleRuntime, orgRuntime, roleProviderKind, orgProviderKind, roleProvider) {
     const explicit = roleRuntime ?? orgRuntime;
     if (explicit)
-        return resolveRunner(explicit);
-    return resolveRunner(undefined, roleProviderKind ?? orgProviderKind);
+        return resolveRunner(explicit, undefined, roleProvider);
+    return resolveRunner(undefined, roleProviderKind ?? orgProviderKind, roleProvider);
 }
 /** Per-role token budget: a role's own `budget_tokens` wins; otherwise the
  *  even split of run_config.budget_tokens across all roles. */
@@ -181,7 +193,6 @@ export class OrgDaemon {
     /** @internal */ forwarders = new Map();
     /** @internal */ watchdogs = new Map();
     /** @internal */ stopping = new Map();
-    /** @internal */ otel = new OtelTracer();
     /** @internal */ approvals = new Map();
     /** @internal */ approvalLocks = new Map();
     /** @internal */ gatesLocks = new Map();
@@ -417,16 +428,36 @@ export class OrgDaemon {
         }
         // Validate per-role providers before spawning anything (fail-fast: a
         // missing env var discovered 10 minutes into a run wastes the entire run).
-        const { resolveProviderEnv: validateProvider } = await import('./provider.js');
+        const { resolveProviderEnv: validateProvider, resolveRoleProvider } = await import('./provider.js');
         for (const role of def.roles) {
-            if (role.provider) {
-                try {
+            try {
+                if (role.provider) {
                     validateProvider(role.provider);
                 }
-                catch (err) {
-                    throw new Error(`org ${name}: role "${role.id}" provider validation failed — ${err instanceof Error ? err.message : err}`);
+                else if (role.adapter_config?.provider) {
+                    // Named provider (`monomind providers configure`): resolve now so a
+                    // missing/misconfigured entry fails the run at start, not mid-flight.
+                    resolveRoleProvider(role, this.root);
                 }
             }
+            catch (err) {
+                throw new Error(`org ${name}: role "${role.id}" provider validation failed — ${err instanceof Error ? err.message : err}`);
+            }
+            // provider.kind 'gemini'/'openai' only sets env vars (GEMINI_API_KEY /
+            // OPENAI_API_KEY — see provider.ts) for a CLI that never reads them:
+            // autoRuntimeFromProvider has no case for either kind, so
+            // resolveRoleRunner falls through to `undefined` and session.ts spawns
+            // the default ClaudeAgentRunner. The role silently runs on Claude while
+            // its config claims gemini/openai — surface that loudly at start time
+            // instead of leaving it to be discovered mid-run.
+            const kind = role.provider?.kind;
+            if ((kind === 'gemini' || kind === 'openai') &&
+                !resolveRoleRunner(role.runtime, def.runtime, kind, undefined, role.provider)) {
+                console.error(`org ${name}: role "${role.id}" sets provider.kind="${kind}" but no runtime honors it — ` +
+                    `this role will actually run on the Claude Agent SDK, not ${kind}. ` +
+                    `Set role.runtime (or the org's runtime) explicitly, or use provider.kind="vercel-api-key" ` +
+                    `with vendor="${kind === 'gemini' ? 'google' : 'openai'}" to route through a real ${kind} model.`);
+            }
         }
         const bus = new OrgBus(name, run, dir);
         // Lightweight in-memory tail for busEvents() (test-loop, /api/history).
@@ -463,7 +494,11 @@ export class OrgDaemon {
             // against a concurrent manual stop.
             if (e.type === 'status' && e.reason === 'org-complete') {
                 const t = setTimeout(() => {
-                    this.stopOrg(name, { drainMs: COMPLETE_DRAIN_MS }).catch((err) => console.error(`org ${name}: auto-stop after org_complete failed:`, err instanceof Error ? err.message : err));
+                    // #206: closedBy: 'org-complete' is the ONLY signal `org run`
+                    // trusts to mean "the run ended cleanly, exit 0" — every other
+                    // stop path (idle watchdog, boss-restart-exhausted, manual stop)
+                    // leaves it unset.
+                    this.stopOrg(name, { drainMs: COMPLETE_DRAIN_MS, closedBy: 'org-complete' }).catch((err) => console.error(`org ${name}: auto-stop after org_complete failed:`, err instanceof Error ? err.message : err));
                 }, 1000);
                 t.unref?.();
             }
@@ -559,7 +594,7 @@ export class OrgDaemon {
         // and ungated — the org has no coordinator at all without it, so gating it
         // behind host memory pressure would make the whole org fail to start over a
         // condition workers are specifically designed to ride out.
-        const limits = getResourceLimits();
+        const _limits = getResourceLimits();
         // Extracted so a role that fails its gate check can be spawned later by
         // scheduleDeferredSpawn() once resources free up, without re-running the
         // gate logic or duplicating the session-wiring below.
@@ -602,13 +637,27 @@ export class OrgDaemon {
             if (roleCheckpoint?.mailboxQueue?.length) {
                 restoreMailboxQueue({ mailbox }, roleCheckpoint.mailboxQueue);
             }
-            if (roleCheckpoint?.mailboxClosed) {
-                mailbox.close();
+            // A recoverable close (budget exhaustion) is left open on resume — see
+            // isRecoverableCloseReason's doc comment. Re-closing it here would
+            // make the idle watchdog's "raise the budget and resume" remedy a
+            // no-op, since nothing in this codebase ever reopens a closed mailbox.
+            if (roleCheckpoint?.mailboxClosed &&
+                !isRecoverableCloseReason(roleCheckpoint.mailboxCloseReason)) {
+                mailbox.close(roleCheckpoint.mailboxCloseReason);
             }
-            const policy = new PolicyEngine(role.id, { maxTokens: role.budget_tokens ?? perRoleBudget, ...(role.policy ?? {}) }, bus, roleCwd);
+            const policy = new PolicyEngine(role.id, {
+                maxTokens: role.budget_tokens ?? perRoleBudget,
+                maxUsd: role.budget_usd,
+                ...(role.policy ?? {}),
+            }, bus, roleCwd);
             if (roleCheckpoint?.tokensUsed) {
                 policy.setUsage(roleCheckpoint.tokensUsed);
             }
+            // ORG-7: restore accumulated USD spend across resume so a stop/resume
+            // cycle can't reset a role's USD budget back to zero.
+            if (roleCheckpoint?.costUsd) {
+                policy.setUsageUsd(roleCheckpoint.costUsd);
+            }
             const runtime = {
                 mailbox,
                 policy,
@@ -637,11 +686,16 @@ export class OrgDaemon {
                 // (VercelAgentRunner session files) write under .monomind/orgs/<name>
                 // instead of polluting the workspace cwd.
                 orgDir: join(this.root, ORG_DIR, name),
+                // Project root for named-provider (`adapter_config.provider`) config
+                // lookup — role cwd may be an isolated workspace with no config file.
+                orgRoot: this.root,
                 maxTurns: role.max_turns_per_message ?? def.run_config.max_turns_per_message,
                 resumeSessionId: roleCheckpoint?.sessionId,
                 lastMessageId: () => runtime.lastMessageId,
                 onOutput: (line) => runtime.scrollback.push(line),
-                onSessionId: (id) => { runtime.sessionId = id; },
+                onSessionId: (id) => {
+                    runtime.sessionId = id;
+                },
                 deliver: (from, to, subject, body) => this.deliver(name, from, to, subject, body),
                 askHuman: (r, question) => this.askHuman(name, r, question),
                 onGate: (r, gateName, gateDesc) => this.createGate(name, r, gateName, gateDesc),
@@ -653,6 +707,20 @@ export class OrgDaemon {
                 })(),
                 beforeTool: (r, toolName) => this.checkApproval(name, r, toolName),
                 fence: roleFences.get(role.id),
+                // ORG-1: gatedCanUseTool denials are a natural decision point — record them so
+                // `org decisions` shows real traces instead of always reporting none.
+                onDecision: (r, toolName, message) => {
+                    this.recordDecision(name, r, {
+                        type: 'tool',
+                        context: `tool call: ${toolName}`,
+                        reasoning: message,
+                        outcome: 'denied',
+                    });
+                },
+                // ORG-9: decision gates are documented as "hard-blocking" — make that
+                // true by actually denying tool use while this role has a pending gate,
+                // the same way pending approvals already do.
+                hasPendingGate: () => this.listGates(name, 'pending').some((g) => g.roleId === role.id),
                 onComplete: role.id === bossRole.id
                     ? (r, outcome, summary) => {
                         bus.emit({
@@ -737,6 +805,9 @@ export class OrgDaemon {
                 cancelTask: (r, taskId, reason) => {
                     return this.dagCancelTask(name, r, taskId, reason);
                 },
+                blockTask: (r, taskId, untilIso, reason) => {
+                    return this.dagBlockTask(name, r, taskId, untilIso, reason);
+                },
                 planGraph: (r, specs) => {
                     return this.dagPlanGraph(name, r, specs);
                 },
@@ -748,7 +819,7 @@ export class OrgDaemon {
                 // Claude/Antigravity orgs byte-for-byte unchanged. Session opts are
                 // built per role here in spawnRole, so each role gets its own runner.
                 runner: this.opts.runner ??
-                    resolveRoleRunner(role.runtime, def.runtime, role.provider?.kind, undefined),
+                    resolveRoleRunner(role.runtime, def.runtime, role.provider?.kind, undefined, role.provider),
             };
             // Supervised session: transient crashes (provider blips, network) restart
             // with backoff; a crash with the mailbox already closed, or one that
@@ -771,6 +842,12 @@ export class OrgDaemon {
                             // during the backoff window must queue for the NEXT session, not
                             // wake the dead generator to swallow it.
                             mailbox.detach();
+                            // #203: if the crashed session's mailbox generator was abandoned
+                            // mid-yield (message already shift()ed for it, turn never
+                            // finished), put that message back on the queue — otherwise the
+                            // replacement session's stream() finds an empty queue and parks
+                            // forever, since the "delivered" message is gone for good.
+                            mailbox.reclaimInFlight();
                             const message = err instanceof Error ? err.message : String(err);
                             const isTurnLimit = /Reached maximum number of turns|error_max_turns/i.test(message);
                             // Bounded like every other recovery: attempt counts every pass
@@ -953,7 +1030,7 @@ export class OrgDaemon {
                     timeout: 10_000,
                 }).trim();
                 const count = parseInt(behind, 10);
-                if (!isNaN(count) && count > staleThreshold) {
+                if (!Number.isNaN(count) && count > staleThreshold) {
                     bus.emit({
                         type: 'audit',
                         reason: 'stale-base',
@@ -993,7 +1070,7 @@ export class OrgDaemon {
                 : '';
             running.agents
                 .get(boss.id)
-                .mailbox.push(`Org "${name}" started (run ${run}).\nGoal: ${taskOverride ?? def.goal}\n` +
+                ?.mailbox.push(`Org "${name}" started (run ${run}).\nGoal: ${taskOverride ?? def.goal}\n` +
                 `Coordinate your team via org_send. Only when the FULL goal above is achieved (or clearly can't be) — not merely "this batch of dispatched tasks finished" — record it with org_complete, then end your turn. ` +
                 `If a batch finishes but the goal has more scope left, dispatch the next batch instead of ending the run.${prevBrief}`);
             bus.emit({
@@ -1026,6 +1103,30 @@ export class OrgDaemon {
                 const pendingGates = this.readGates(name).gates.filter((g) => g.status === 'pending');
                 if (pendingGates.length > 0)
                     return;
+                // Auto-resume any task whose org_task_block time has passed: flip it
+                // back to 'running' and re-push it into the assignee's mailbox, same
+                // as a fresh dispatch. This IS real activity, so fall through to the
+                // normal idleFor check below rather than returning early — an
+                // unblocked task should reset the idle clock, not just silently
+                // update state nobody notices until the next nudge.
+                const unblocked = running.taskDag?.unblockExpired(Date.now()) ?? [];
+                for (const task of unblocked) {
+                    const agent = running.agents.get(task.assignee);
+                    if (agent && !agent.mailbox.isClosed) {
+                        agent.mailbox.push(`[task:${task.id}] Block expired — resuming: ${task.title}`);
+                    }
+                    bus.emit({
+                        type: 'status',
+                        from: 'dag',
+                        reason: 'task-unblocked',
+                        msg: `task ${task.id} block expired — resumed and re-dispatched to ${task.assignee}`,
+                        data: { taskId: task.id, assignee: task.assignee },
+                    });
+                }
+                // A task blocked on a real-world time still in the future is
+                // legitimate waiting, same as a pending gate — don't nudge about it.
+                if (running.taskDag?.hasActiveBlock(Date.now()))
+                    return;
                 const idleFor = Date.now() - lastActivity;
                 if (idleFor < idleMs) {
                     nudges = resolvedIdleNudgeCount(nudgedAt, nudges, lastToolActivity);
@@ -1038,7 +1139,19 @@ export class OrgDaemon {
                         return;
                     }
                     const bossRt = running.agents.get(bossRole.id);
-                    if (!bossRt || bossRt.status !== 'running' || bossRt.mailbox.isClosed) {
+                    // #205: a budget-exhausted boss closed its own mailbox on
+                    // purpose (session.ts) — that's a recoverable pause, not the
+                    // same "unreachable" condition as a crash. Name it distinctly so
+                    // the operator's remedy (raise the budget, resume) is obvious
+                    // instead of reading like the run died.
+                    const budgetReason = bossRt?.mailbox.closeReason;
+                    if (budgetReason === 'token-budget' || budgetReason === 'usd-budget') {
+                        idleStop(`org idle for ${Math.round(idleFor / 60_000)}m and boss "${bossRole.id}" is over its ` +
+                            `${budgetReason === 'token-budget' ? 'token' : 'USD'} budget — raise the role's ` +
+                            `${budgetReason === 'token-budget' ? 'budget_tokens' : 'budget_usd'} (or run_config's) and resume from checkpoint — stopping run`);
+                        return;
+                    }
+                    if (bossRt?.status !== 'running' || bossRt.mailbox.isClosed) {
                         idleStop(`org idle for ${Math.round(idleFor / 60_000)}m and boss "${bossRole.id}" is unreachable — stopping run`);
                         return;
                     }
@@ -1053,7 +1166,8 @@ export class OrgDaemon {
                     bossRt.mailbox.push(`[watchdog] No activity in org "${name}" for ${Math.round(idleFor / 60_000)} minute(s). ` +
                         `Check org_tasks first, then pick ONE: (1) the org's full stated goal is achieved or clearly cannot be — call org_complete now (this ends the run for good, not just this batch); ` +
                         `(2) someone has stalled or unstarted work — check on your team via org_send and reassign it; ` +
-                        `(3) the current task batch is done but the goal has more scope left — do NOT call org_complete for this case, instead dispatch the next batch of work with org_task/createTask so the org keeps making progress.`);
+                        `(3) the current task batch is done but the goal has more scope left — do NOT call org_complete for this case, instead dispatch the next batch of work with org_task/createTask so the org keeps making progress; ` +
+                        `(4) a task is stuck 'running' only because it's genuinely waiting on a real-world time (a scheduled process, a deadline) and there is nothing else to dispatch right now — do NOT just leave it and re-confirm this every time you get nudged, call org_task_block(taskId, untilIso, reason) instead so this watchdog stops nudging you about it and auto-resumes the task when the time arrives.`);
                 }
                 else if (Date.now() - nudgedAt >= idleMs) {
                     idleStop(`nudge produced no activity for another ${Math.round(idleMs / 60_000)}m — boss appears hung, stopping run`);
@@ -1104,7 +1218,12 @@ export class OrgDaemon {
     }
     /** @param opts.drainMs how long to let in-flight agent sessions finish before
      *  reaping. Defaults to the short abort bound; the planned-completion path
-     *  passes a far longer window (see COMPLETE_DRAIN_MS). */
+     *  passes a far longer window (see COMPLETE_DRAIN_MS).
+     *  @param opts.closedBy #206: tags WHY the run ended, persisted into
+     *  runtime.json so `org run` can tell a clean, goal-driven end
+     *  (closedBy: 'org-complete') from every other kind of stop (idle
+     *  watchdog, boss-restart-exhausted, manual `org stop`) and exit non-zero
+     *  for the latter. Only the org_complete auto-stop path passes this. */
     async stopOrg(name, opts) {
         // Join an in-flight stop instead of no-oping: the self-stop paths
         // (org_complete, idle watchdog) run detached, and a caller like
@@ -1124,7 +1243,7 @@ export class OrgDaemon {
         // shutdown via `stopping` instead of re-running the whole sequence and
         // double-emitting 'org stopped' (duplicate org:complete/session:complete).
         this.orgs.delete(name);
-        const p = this.finishStop(name, org, opts?.drainMs);
+        const p = this.finishStop(name, org, opts?.drainMs, opts?.closedBy);
         this.stopping.set(name, p);
         try {
             await p;
@@ -1133,7 +1252,7 @@ export class OrgDaemon {
             this.stopping.delete(name);
         }
     }
-    async finishStop(name, org, drainMs) {
+    async finishStop(name, org, drainMs, closedBy) {
         // Snapshot checkpoint BEFORE closing mailboxes / draining sessions — the
         // queue is emptied during the drain, so capturing afterwards loses all
         // unconsumed messages (the whole point of checkpoint-resume).
@@ -1182,9 +1301,7 @@ export class OrgDaemon {
             const stillActive = [...org.agents.entries()]
                 .filter(([, a]) => a.status === 'running')
                 .map(([roleId]) => roleId);
-            const rosterSuffix = stillActive.length
-                ? ` — still active: ${stillActive.join(', ')}`
-                : '';
+            const rosterSuffix = stillActive.length ? ` — still active: ${stillActive.join(', ')}` : '';
             org.bus.emit({
                 type: 'audit',
                 msg: `org stop timed out after ${stopWaitMs}ms waiting for agent sessions to finish — proceeding anyway${rosterSuffix}`,
@@ -1216,7 +1333,7 @@ export class OrgDaemon {
             if (events.length) {
                 const summary = summarizeRun(events);
                 const { appendFileSync } = await import('node:fs');
-                appendFileSync(historyFile(this.root, name), JSON.stringify(summary) + '\n', 'utf8');
+                appendFileSync(historyFile(this.root, name), `${JSON.stringify(summary)}\n`, 'utf8');
                 // Cross-run memory: make this run's outcome recallable by meaning
                 await this.storeRunMemory(name, org.def, org.run, summary);
             }
@@ -1251,7 +1368,7 @@ export class OrgDaemon {
         // 'running' record must not be overwritten with this old run's 'stopped'.
         // Pass the org directly since we already removed it from the map.
         if (!this.orgs.has(name))
-            this.persistState(name, 'stopped', org.run, org, stopCheckpoint);
+            this.persistState(name, 'stopped', org.run, org, stopCheckpoint, closedBy);
         // Clean up git worktrees — shared (workspace: 'worktree') and per-role.
         try {
             const { execFileSync } = await import('node:child_process');
@@ -1292,8 +1409,13 @@ export class OrgDaemon {
             ...this.stopping.values(), // detached self-stops still flushing
         ]);
     }
-    /** @internal */
-    persistState(name, status, run, org, checkpointOverride) {
+    /** @internal
+     *  @param closedBy #206: why the run ended — 'org-complete' for a clean,
+     *  goal-driven end (the only value any caller currently passes); absent for
+     *  every other stop (idle watchdog, boss-restart-exhausted, manual `org
+     *  stop`). Mirrors persistCrashStateAll()'s existing closedBy: 'crash-handler'
+     *  for the process-crash path, which org.ts already reads. */
+    persistState(name, status, run, org, checkpointOverride, closedBy) {
         const p = join(this.root, ORG_DIR, name, 'runtime.json');
         const missing = [...(this.abandoned.get(name) ?? [])];
         const running = org ?? this.orgs.get(name);
@@ -1310,7 +1432,10 @@ export class OrgDaemon {
             checkpoint = {
                 ...state,
                 status: validStatus,
-                checksum: generateChecksum({ ...state, status: validStatus }),
+                checksum: generateChecksum({
+                    ...state,
+                    status: validStatus,
+                }),
             };
         }
         // C4: writeJsonFileAtomic (tmp + rename) — a direct writeFileSync here
@@ -1324,11 +1449,15 @@ export class OrgDaemon {
             updated: new Date().toISOString(),
             ...(missing.length ? { abandonedRoles: missing } : {}),
             ...(checkpoint ? { checkpoint } : {}),
+            ...(closedBy ? { closedBy } : {}),
         });
     }
     /** Mark every currently-running org as crashed in runtime.json.
-     *  Called from process-level crash handlers — must be synchronous and best-effort. */
-    persistCrashStateAll() {
+     *  Called from process-level crash handlers — must be synchronous and best-effort.
+     *  @param error the uncaught error/rejection reason, if known — without
+     *  this, `runOutcomeResult` (org.ts)'s "crashed: <error>" message always
+     *  read "crashed: unknown error" regardless of what actually happened. */
+    persistCrashStateAll(error) {
         for (const [name, org] of this.orgs) {
             try {
                 const p = join(this.root, ORG_DIR, name, 'runtime.json');
@@ -1340,6 +1469,7 @@ export class OrgDaemon {
                     pid: process.pid,
                     updated: new Date().toISOString(),
                     closedBy: 'crash-handler',
+                    ...(error ? { error } : {}),
                 });
             }
             catch {
@@ -1419,6 +1549,9 @@ export class OrgDaemon {
     dagCancelTask(org, role, taskId, reason) {
         return decisionOps.dagCancelTask(this, org, role, taskId, reason);
     }
+    dagBlockTask(org, role, taskId, untilIso, reason) {
+        return decisionOps.dagBlockTask(this, org, role, taskId, untilIso, reason);
+    }
     dagPlanGraph(org, role, specs) {
         return decisionOps.dagPlanGraph(this, org, role, specs);
     }
@@ -1479,8 +1612,5 @@ export class OrgDaemon {
     async resumeOrg(name) {
         return checkpointOps.resumeOrg(this, name);
     }
-    branchCheckpoint(name, run, branchName) {
-        return checkpointOps.branchCheckpoint(this, name, run, branchName);
-    }
 }
 //# sourceMappingURL=daemon.js.map