@nbardy/oompa 0.7.0 → 0.7.1

package/agentnet/src/agentnet/worker.clj

@@ -14,11 +14,13 @@
    No separate orchestrator - workers self-organize."
   (:require [agentnet.tasks :as tasks]
             [agentnet.agent :as agent]
+            [agentnet.core :as core]
+            [agentnet.harness :as harness]
             [agentnet.worktree :as worktree]
             [agentnet.runs :as runs]
-            [cheshire.core :as json]
             [babashka.process :as process]
             [clojure.java.io :as io]
+            [clojure.set]
             [clojure.string :as str]))
 
 ;; =============================================================================
@@ -33,25 +35,11 @@
 ;; git index corruption from parallel checkout+merge operations.
 (def ^:private merge-lock (Object.))
 
-;; Resolve absolute paths for CLI binaries at first use.
-;; ProcessBuilder with :dir set can fail to find bare command names on some
-;; platforms (macOS + babashka), so we resolve once via `which` and cache.
-(def ^:private binary-paths* (atom {}))
-
-(defn- resolve-binary!
-  "Resolve the absolute path of a CLI binary. Caches result.
-   Throws if binary not found on PATH."
-  [name]
-  (or (get @binary-paths* name)
-      (let [result (try
-                     (process/sh ["which" name] {:out :string :err :string})
-                     (catch Exception _ {:exit -1 :out "" :err ""}))
-            path (when (zero? (:exit result))
-                   (str/trim (:out result)))]
-        (if path
-          (do (swap! binary-paths* assoc name path)
-              path)
-          (throw (ex-info (str "Binary not found on PATH: " name) {:binary name}))))))
+;; Set by JVM shutdown hook (SIGTERM/SIGINT). Workers check this between cycles
+;; and exit gracefully — finishing the current cycle before stopping.
+(def ^:private shutdown-requested? (atom false))
+
+(declare task-root-for-cwd)
 
 (defn- load-prompt
   "Load a prompt file. Tries path as-is first, then from package root."
@@ -59,14 +47,61 @@
   (or (agent/load-custom-prompt path)
       (agent/load-custom-prompt (str package-root "/" path))))
 
+(defn- build-template-tokens
+  "Build token map for prompt template {var} substitution.
+   Merges core/build-context (rich YAML header, queue, hotspots, etc.)
+   with worker-level context (task_status, pending_tasks) and defaults
+   for tokens that core/build-context doesn't produce (mode_hint, targets,
+   recent_sec). Without these defaults, those {vars} leak into prompts."
+  ([worker-context]
+   (build-template-tokens worker-context nil))
+  ([worker-context cwd]
+   (let [pending (tasks/list-pending)
+         core-ctx (core/build-context {:tasks pending
+                                       :repo (System/getProperty "user.dir")})
+         task-root (task-root-for-cwd (or cwd (System/getProperty "user.dir")))]
+     (merge {:mode_hint "propose"
+             :targets "*"
+             :recent_sec "180"
+             :TASK_ROOT task-root
+             :TASKS_ROOT task-root}
+            core-ctx
+            worker-context))))
+
+(defn- task-root-for-cwd
+  "Return the relative tasks root for commands issued from cwd."
+  [cwd]
+  (let [cwd-file (io/file cwd)
+        local-tasks (io/file cwd-file "tasks")
+        parent-tasks (some-> cwd-file .getParentFile (io/file "tasks"))]
+    (cond
+      (.exists local-tasks) "tasks"
+      (and parent-tasks (.exists parent-tasks)) "../tasks"
+      :else "tasks")))
+
+(defn- render-task-header
+  "Inject runtime task path into auto-injected task header."
+  [raw-header cwd]
+  (let [task-root (task-root-for-cwd cwd)]
+    (-> (or raw-header "")
+        (str/replace "{{TASK_ROOT}}" task-root)
+        (str/replace "{{TASKS_ROOT}}" task-root)
+        (str/replace "{TASK_ROOT}" task-root)
+        (str/replace "{TASKS_ROOT}" task-root))))
+
+(def ^:private default-max-working-resumes 5)
+
 (defn create-worker
   "Create a worker config.
    :prompts is a string or vector of strings — paths to prompt files.
    :can-plan when false, worker waits for tasks before starting (backpressure).
    :reasoning reasoning effort level (e.g. \"low\", \"medium\", \"high\") — codex only.
-   :review-prompts paths to reviewer prompt files (loaded and concatenated for review)."
+   :review-prompts paths to reviewer prompt files (loaded and concatenated for review).
+   :wait-between seconds to sleep between iterations (nil or 0 = no wait).
+   :max-working-resumes max consecutive working resumes before nudge+kill (default 5)."
   [{:keys [id swarm-id harness model iterations prompts can-plan reasoning
-           review-harness review-model review-prompts]}]
+           review-harness review-model review-prompts wait-between
+           max-working-resumes]}]
   {:id id
    :swarm-id swarm-id
    :harness (or harness :codex)
@@ -78,12 +113,14 @@
               :else [])
    :can-plan (if (some? can-plan) can-plan true)
    :reasoning reasoning
+   :wait-between (when (and wait-between (pos? wait-between)) wait-between)
    :review-harness review-harness
    :review-model review-model
    :review-prompts (cond
                      (vector? review-prompts) review-prompts
                      (string? review-prompts) [review-prompts]
                      :else [])
+   :max-working-resumes (or max-working-resumes default-max-working-resumes)
    :completed 0
    :status :idle})
 
@@ -93,6 +130,18 @@
 
 (def ^:private max-review-retries 3)
 
+;; Nudge prompt injected when a worker hits max-working-resumes consecutive
+;; "working" outcomes without signaling. Gives the agent one final chance to
+;; produce something mergeable before the session is killed.
+(def ^:private nudge-prompt
+  (str "You have been working for a long time without signaling completion.\n"
+       "You MUST take one of these actions NOW:\n\n"
+       "1. If you have meaningful changes: commit them and signal COMPLETE_AND_READY_FOR_MERGE\n"
+       "2. If scope is too large: create follow-up tasks in tasks/pending/ for remaining work,\n"
+       "   commit what you have (even partial notes/design docs), and signal COMPLETE_AND_READY_FOR_MERGE\n"
+       "3. If you are stuck and cannot make progress: signal __DONE__\n\n"
+       "Do NOT continue working without producing a signal."))
+
 (defn- build-context
   "Build context for agent prompts"
   []
@@ -106,66 +155,80 @@
      :task_status (format "Pending: %d, In Progress: %d, Complete: %d"
                           (count pending) (count current) (count complete))}))
 
-(defn- opencode-attach-url
-  "Optional opencode server URL for run --attach mode."
-  []
-  (let [url (or (System/getenv "OOMPA_OPENCODE_ATTACH")
-                (System/getenv "OPENCODE_ATTACH"))]
-    (when (and url (not (str/blank? url)))
-      url)))
-
-(defn- parse-opencode-run-output
-  "Parse `opencode run --format json` output.
-   Returns {:session-id string|nil, :text string|nil}."
-  [s]
-  (let [raw (or s "")
-        events (->> (str/split-lines raw)
-                    (keep (fn [line]
-                            (try
-                              (json/parse-string line true)
-                              (catch Exception _
-                                nil))))
-                    doall)
-        session-id (or (some #(or (:sessionID %)
-                                   (:sessionId %)
-                                   (get-in % [:part :sessionID])
-                                   (get-in % [:part :sessionId]))
-                             events)
-                       (some-> (re-find #"(ses_[A-Za-z0-9]+)" raw) second))
-        text (->> events
-                  (keep (fn [event]
-                          (let [event-type (or (:type event) (get-in event [:part :type]))
-                                chunk (or (:text event) (get-in event [:part :text]))]
-                            (when (and (= event-type "text")
-                                       (string? chunk)
-                                       (not (str/blank? chunk)))
-                              chunk))))
-                  (str/join ""))]
-    {:session-id session-id
-     :text (when-not (str/blank? text) text)}))
+
+(defn- execute-claims!
+  "Execute CLAIM signal: attempt to claim each task ID from pending/.
+   Returns {:claimed [ids], :failed [ids], :resume-prompt string}."
+  [claim-ids]
+  (let [results (tasks/claim-by-ids! claim-ids)
+        claimed (filterv #(= :claimed (:status %)) results)
+        failed (filterv #(not= :claimed (:status %)) results)
+        claimed-ids (mapv :id claimed)
+        failed-ids (mapv :id failed)
+        context (build-context)
+        prompt (str "## Claim Results\n"
+                    (if (seq claimed-ids)
+                      (str "Claimed: " (str/join ", " claimed-ids) "\n")
+                      "No tasks were successfully claimed.\n")
+                    (when (seq failed-ids)
+                      (str "Already taken or not found: "
+                           (str/join ", " failed-ids) "\n"))
+                    "\nTask Status: " (:task_status context) "\n"
+                    "Remaining Pending:\n"
+                    (if (str/blank? (:pending_tasks context))
+                      "(none)"
+                      (:pending_tasks context))
+                    "\n\n"
+                    (if (seq claimed-ids)
+                      "Work on your claimed tasks. Signal COMPLETE_AND_READY_FOR_MERGE when done."
+                      "No claims succeeded. CLAIM different tasks, or signal __DONE__ if no suitable work remains."))]
+    {:claimed claimed-ids
+     :failed failed-ids
+     :resume-prompt prompt}))
 
 (defn- run-agent!
-  "Run agent with prompt, return {:output string, :done? bool, :merge? bool, :exit int, :session-id string}.
-   When resume? is true and harness is :claude/:opencode, continues the existing session
-   with a lighter prompt (just task status + continue instruction)."
-  [{:keys [id swarm-id harness model prompts reasoning]} worktree-path context session-id resume?]
-  (let [;; Use provided session-id, otherwise generate one for harnesses that accept custom IDs.
-        session-id (or session-id
-                       (when (#{:codex :claude} harness)
-                         (str/lower-case (str (java.util.UUID/randomUUID)))))
-
-        ;; Build prompt — lighter for resume (agent already has full context)
-        prompt (if resume?
+  "Run agent with prompt, return {:output :done? :merge? :claim-ids :exit :session-id}.
+   When resume? is true, continues the existing session with a lighter prompt.
+   resume-prompt-override: when non-nil, replaces the default resume prompt
+   (used to inject CLAIM results). All harness-specific CLI knowledge
+   is delegated to harness/build-cmd."
+  [{:keys [id swarm-id harness model prompts reasoning]} worktree-path context session-id resume?
+   & {:keys [resume-prompt-override]}]
+  (let [session-id (or session-id (harness/make-session-id harness))
+        template-tokens (build-template-tokens context worktree-path)
+        resume-prompt-override (when resume-prompt-override
+                                 (-> resume-prompt-override
+                                     (render-task-header worktree-path)
+                                     (agent/tokenize template-tokens)))
+
+        ;; Build prompt — 3-way: override → standard resume → fresh start
+        prompt (cond
+                 ;; CLAIM results or other injected resume prompt
+                 resume-prompt-override
+                 resume-prompt-override
+
+                 ;; Standard resume — lighter (agent already has full context)
+                 resume?
                  (str "Task Status: " (:task_status context) "\n"
                       "Pending: " (:pending_tasks context) "\n\n"
                       "Continue working. Signal COMPLETE_AND_READY_FOR_MERGE when your current task is done and ready for review.")
-                 (let [task-header (or (load-prompt "config/prompts/_task_header.md") "")
+
+                 ;; Fresh start — full task header + tokenized user prompts
+                 ;; Template tokens ({context_header}, {queue_md}, etc.) are
+                 ;; replaced here. Without this, raw {var} placeholders leak
+                 ;; into the agent prompt verbatim.
+                 :else
+                 (let [task-header (render-task-header
+                                     (load-prompt "config/prompts/_task_header.md")
+                                     worktree-path)
                        user-prompts (if (seq prompts)
                                       (->> prompts
                                            (map load-prompt)
                                            (remove nil?)
+                                           (map #(agent/tokenize % template-tokens))
                                            (str/join "\n\n"))
-                                      (or (load-prompt "config/prompts/worker.md")
+                                      (or (some-> (load-prompt "config/prompts/worker.md")
+                                                  (agent/tokenize template-tokens))
                                           "You are a worker. Claim tasks, execute them, complete them."))]
                    (str task-header "\n"
                         "Task Status: " (:task_status context) "\n"
@@ -175,54 +238,29 @@
         swarm-id* (or swarm-id "unknown")
         tagged-prompt (str "[oompa:" swarm-id* ":" id "] " prompt)
         abs-worktree (.getAbsolutePath (io/file worktree-path))
-        opencode-attach (opencode-attach-url)
-
-        ;; Build command — all harnesses run with cwd=worktree, no sandbox
-        ;; so agents can `..` to reach project root for task management
-        ;; Claude: --resume flag continues existing session-id conversation
-        ;; Opencode: -s/--session + --continue continue existing session
-        ;; and --format json for deterministic per-run session capture.
-        ;; Codex: no native resume support, always fresh (but worktree state persists)
-        cmd (case harness
-              :codex (cond-> [(resolve-binary! "codex") "exec"
-                              "--dangerously-bypass-approvals-and-sandbox"
-                              "--skip-git-repo-check"
-                              "-C" abs-worktree]
-                       model (into ["--model" model])
-                       reasoning (into ["-c" (str "model_reasoning_effort=\"" reasoning "\"")])
-                       true (conj "--" tagged-prompt))
-              :claude (cond-> [(resolve-binary! "claude") "-p" "--dangerously-skip-permissions"
-                               "--session-id" session-id]
-                        resume? (conj "--resume")
-                        model (into ["--model" model]))
-              :opencode (cond-> [(resolve-binary! "opencode") "run" "--format" "json"]
-                          model (into ["-m" model])
-                          opencode-attach (into ["--attach" opencode-attach])
-                          (and resume? session-id) (into ["-s" session-id "--continue"])
-                          true (conj tagged-prompt)))
-
-        ;; Run agent — all run with cwd=worktree
+
+        cmd (harness/build-cmd harness
+              {:cwd abs-worktree :model model :reasoning reasoning
+               :session-id session-id :resume? resume?
+               :prompt tagged-prompt :format? true})
+
         result (try
-                 (if (= harness :claude)
-                   (process/sh cmd {:dir abs-worktree :in tagged-prompt :out :string :err :string})
-                   (process/sh cmd {:dir abs-worktree :out :string :err :string}))
+                 (process/sh cmd {:dir abs-worktree
+                                  :in (harness/process-stdin harness tagged-prompt)
+                                  :out :string :err :string})
                  (catch Exception e
                    (println (format "[%s] Agent exception: %s" id (.getMessage e)))
                    {:exit -1 :out "" :err (.getMessage e)}))
-        parsed-opencode (when (= harness :opencode)
-                          (parse-opencode-run-output (:out result)))
-        output (if (= harness :opencode)
-                 (or (:text parsed-opencode) (:out result))
-                 (:out result))
-        session-id' (if (= harness :opencode)
-                      (or (:session-id parsed-opencode) session-id)
-                      session-id)]
+
+        {:keys [output session-id]}
+        (harness/parse-output harness (:out result) session-id)]
 
     {:output output
      :exit (:exit result)
      :done? (agent/done-signal? output)
      :merge? (agent/merge-signal? output)
-     :session-id session-id'}))
+     :claim-ids (agent/parse-claim-signal output)
+     :session-id session-id}))
 
 (defn- run-reviewer!
   "Run reviewer on worktree changes.
@@ -238,7 +276,6 @@
                          (str (subs d 0 8000) "\n... [diff truncated at 8000 chars]")
                          d))
 
-        ;; Build review prompt — use custom prompts if configured, else default
         swarm-id* (or swarm-id "unknown")
         custom-prompt (when (seq review-prompts)
                         (->> review-prompts
@@ -246,16 +283,19 @@
                              (remove nil?)
                              (str/join "\n\n")))
 
-        ;; Include previous review history for multi-round context
+        ;; Only include the most recent round's feedback — the worker has already
+        ;; attempted fixes based on it, so the reviewer just needs to verify.
+        ;; Including all prior rounds bloats the prompt and causes empty output.
         history-block (when (seq prev-feedback)
-                        (str "\n## Previous Review Rounds\n\n"
-                             "The worker has already attempted fixes based on earlier feedback. "
-                             "Do NOT raise new issues — only verify the original issues are resolved.\n\n"
-                             (->> prev-feedback
-                                  (map-indexed (fn [i fb]
-                                    (str "### Round " (inc i) " feedback:\n" fb)))
-                                  (str/join "\n\n"))
-                             "\n\n"))
+                        (let [latest (last prev-feedback)
+                              truncated (if (> (count latest) 2000)
+                                          (str (subs latest 0 2000) "\n... [feedback truncated]")
+                                          latest)]
+                          (str "\n## Previous Review (Round " (count prev-feedback) ")\n\n"
+                               "The worker has attempted fixes based on this feedback. "
+                               "Verify the issues below are resolved. Do NOT raise new issues.\n\n"
+                               truncated
+                               "\n\n")))
 
         review-body (str (or custom-prompt
                               (str "Review the changes in this worktree.\n"
@@ -264,49 +304,40 @@
                          (when history-block history-block)
                          "\nYour verdict MUST be on its own line, exactly one of:\n"
                          "VERDICT: APPROVED\n"
-                         "VERDICT: NEEDS_CHANGES\n"
-                         "VERDICT: REJECTED\n")
+                         "VERDICT: NEEDS_CHANGES\n\n"
+                         "Do NOT use REJECTED. Always use NEEDS_CHANGES with specific, "
+                         "actionable feedback explaining what must change and why. "
+                         "The worker will attempt fixes based on your feedback.\n"
+                         "After your verdict line, list every issue as a numbered item with "
+                         "the file path and what needs to change.\n")
         review-prompt (str "[oompa:" swarm-id* ":" id "] " review-body)
 
         abs-wt (.getAbsolutePath (io/file worktree-path))
-        opencode-attach (opencode-attach-url)
-
-        ;; Build command — cwd=worktree, no sandbox
-        cmd (case review-harness
-              :codex (cond-> [(resolve-binary! "codex") "exec"
-                              "--dangerously-bypass-approvals-and-sandbox"
-                              "--skip-git-repo-check"
-                              "-C" abs-wt]
-                       review-model (into ["--model" review-model])
-                       true (conj "--" review-prompt))
-              :claude (cond-> [(resolve-binary! "claude") "-p" "--dangerously-skip-permissions"]
-                        review-model (into ["--model" review-model]))
-              :opencode (cond-> [(resolve-binary! "opencode") "run"]
-                          review-model (into ["-m" review-model])
-                          opencode-attach (into ["--attach" opencode-attach])
-                          true (conj review-prompt)))
-
-        ;; Run reviewer — cwd=worktree
+
+        ;; No session, no resume, no format flags — reviewer is stateless one-shot
+        cmd (harness/build-cmd review-harness
+              {:cwd abs-wt :model review-model :prompt review-prompt})
+
         result (try
-                 (if (= review-harness :claude)
-                   (process/sh cmd {:dir abs-wt :in review-prompt :out :string :err :string})
-                   (process/sh cmd {:dir abs-wt :out :string :err :string}))
+                 (process/sh cmd {:dir abs-wt
+                                  :in (harness/process-stdin review-harness review-prompt)
+                                  :out :string :err :string})
                  (catch Exception e
                    {:exit -1 :out "" :err (.getMessage e)}))
 
         output (:out result)
 
-        ;; Parse verdict — require explicit VERDICT: prefix to avoid false matches
+        ;; Parse verdict — require explicit VERDICT: prefix to avoid false matches.
+        ;; REJECTED is treated as NEEDS_CHANGES: the reviewer must always give
+        ;; actionable feedback so the worker can attempt fixes. Hard rejection
+        ;; only happens when max review rounds are exhausted.
         verdict (cond
                   (re-find #"VERDICT:\s*APPROVED" output) :approved
-                  (re-find #"VERDICT:\s*REJECTED" output) :rejected
                   (re-find #"VERDICT:\s*NEEDS_CHANGES" output) :needs-changes
-                  ;; Fallback to loose matching if reviewer didn't use prefix
+                  (re-find #"VERDICT:\s*REJECTED" output) :needs-changes
                   (re-find #"(?i)\bAPPROVED\b" output) :approved
-                  (re-find #"(?i)\bREJECTED\b" output) :rejected
                   :else :needs-changes)]
 
-    ;; Log reviewer output (truncated) for visibility
     (println (format "[%s] Reviewer verdict: %s" id (name verdict)))
     (let [summary (subs output 0 (min 300 (count output)))]
       (println (format "[%s] Review: %s%s" id summary
@@ -337,32 +368,94 @@
                         "Fix these issues. Do not add anything the reviewer did not ask for.")
 
         abs-wt (.getAbsolutePath (io/file worktree-path))
-        opencode-attach (opencode-attach-url)
-
-        cmd (case harness
-              :codex (cond-> [(resolve-binary! "codex") "exec"
-                              "--dangerously-bypass-approvals-and-sandbox"
-                              "--skip-git-repo-check"
-                              "-C" abs-wt]
-                       model (into ["--model" model])
-                       true (conj "--" fix-prompt))
-              :claude (cond-> [(resolve-binary! "claude") "-p" "--dangerously-skip-permissions"]
-                        model (into ["--model" model]))
-              :opencode (cond-> [(resolve-binary! "opencode") "run"]
-                          model (into ["-m" model])
-                          opencode-attach (into ["--attach" opencode-attach])
-                          true (conj fix-prompt)))
+
+        cmd (harness/build-cmd harness
+              {:cwd abs-wt :model model :prompt fix-prompt})
 
         result (try
-                 (if (= harness :claude)
-                   (process/sh cmd {:dir abs-wt :in fix-prompt :out :string :err :string})
-                   (process/sh cmd {:dir abs-wt :out :string :err :string}))
+                 (process/sh cmd {:dir abs-wt
+                                  :in (harness/process-stdin harness fix-prompt)
+                                  :out :string :err :string})
                  (catch Exception e
                    {:exit -1 :out "" :err (.getMessage e)}))]
 
     {:output (:out result)
      :exit (:exit result)}))
 
+(defn- collect-divergence-context
+  "Collect context about how a worktree branch has diverged from main.
+   Returns a map with :branch-log, :main-log, :diff-stat strings."
+  [wt-path]
+  (let [git-out (fn [& args] (:out (process/sh (vec args) {:dir wt-path :out :string :err :string})))
+        branch-log (git-out "git" "log" "--oneline" "main..HEAD")
+        main-log   (git-out "git" "log" "--oneline" "HEAD..main")
+        diff-stat  (git-out "git" "diff" "--stat" "main")]
+    {:branch-log (or branch-log "(none)")
+     :main-log   (or main-log "(none)")
+     :diff-stat  (or diff-stat "(none)")}))
+
+(defn- verify-mergeable?
+  "Dry-run merge to verify a worktree branch merges cleanly into main.
+   Does NOT leave merge state behind — always cleans up the dry-run.
+   Uses --no-commit so no actual commit is created; resets afterward."
+  [wt-path]
+  (let [result (process/sh ["git" "merge" "--no-commit" "--no-ff" "main"]
+                           {:dir wt-path :out :string :err :string})
+        clean? (zero? (:exit result))]
+    ;; Clean up: abort if conflicted, reset if staged but uncommitted
+    (if clean?
+      (process/sh ["git" "reset" "--hard" "HEAD"] {:dir wt-path})
+      (process/sh ["git" "merge" "--abort"] {:dir wt-path}))
+    clean?))
+
+(defn- sync-worktree-to-main!
+  "Sync worktree branch with main before merge-to-main!.
+   Fast path: git merge main succeeds cleanly → :synced.
+   Conflict path: abort merge, give agent a clean worktree + divergence
+   context, let agent make the branch mergeable (rebase, cherry-pick,
+   manual resolution — agent's choice), verify with dry-run merge.
+   Runs OUTSIDE the merge-lock so the agent doesn't block other workers.
+   Returns :synced | :resolved | :failed."
+  [worker wt-path worker-id]
+  (let [merge-result (process/sh ["git" "merge" "main" "--no-edit"]
+                                 {:dir wt-path :out :string :err :string})]
+    (if (zero? (:exit merge-result))
+      (do (println (format "[%s] Worktree synced to main" worker-id))
+          :synced)
+      ;; Conflict — abort merge to restore clean worktree state, then
+      ;; hand the problem to the agent with full divergence context.
+      (let [_ (process/sh ["git" "merge" "--abort"] {:dir wt-path})
+            _ (println (format "[%s] Branch diverged from main, launching resolver agent" worker-id))
+            {:keys [branch-log main-log diff-stat]} (collect-divergence-context wt-path)
+            resolve-prompt (str "[oompa:" (or (:swarm-id worker) "unknown") ":" worker-id "] "
+                                "Your branch has diverged from main and cannot merge cleanly.\n\n"
+                                "Your branch's commits (not on main):\n" branch-log "\n\n"
+                                "Commits on main since you branched:\n" main-log "\n\n"
+                                "Divergence scope:\n" diff-stat "\n\n"
+                                "Make this branch cleanly mergeable into main. "
+                                "Preserve the intent of your branch's changes.\n"
+                                "You have full git access — rebase, cherry-pick, resolve conflicts, "
+                                "whatever works.\n"
+                                "When done, verify with: git diff main --stat")
+            abs-wt (.getAbsolutePath (io/file wt-path))
+            cmd (harness/build-cmd (:harness worker)
+                  {:cwd abs-wt :model (:model worker) :prompt resolve-prompt})
+            result (try
+                     (process/sh cmd {:dir abs-wt
+                                      :in (harness/process-stdin (:harness worker) resolve-prompt)
+                                      :out :string :err :string})
+                     (catch Exception e
+                       {:exit -1 :out "" :err (.getMessage e)}))]
+        (if (zero? (:exit result))
+          ;; Agent ran — verify the branch actually merges cleanly now
+          (if (verify-mergeable? wt-path)
+            (do (println (format "[%s] Agent resolved divergence, branch is mergeable" worker-id))
+                :resolved)
+            (do (println (format "[%s] Agent ran but branch still can't merge cleanly" worker-id))
+                :failed))
+          (do (println (format "[%s] Resolver agent failed (exit %d)" worker-id (:exit result)))
+              :failed))))))
+
 (defn- worktree-has-changes?
   "Check if worktree has committed OR uncommitted changes vs main.
    Workers commit before signaling merge, so we must check both:
@@ -395,6 +488,46 @@
                         {:dir wt-dir :branch wt-branch}))))
     {:dir wt-dir :branch wt-branch :path wt-path}))
 
+(defn- detect-claimed-tasks
+  "Diff current/ task IDs before and after agent ran.
+   Returns set of task IDs this worker claimed during iteration."
+  [pre-current-ids]
+  (let [post-ids (tasks/current-task-ids)]
+    (clojure.set/difference post-ids pre-current-ids)))
+
+(defn- emit-cycle-log!
+  "Write cycle event log. Called at every cycle exit point.
+   session-id links to the Claude CLI conversation transcript on disk.
+   No mutable summary state — all state is derived from immutable cycle logs."
+  [swarm-id worker-id cycle start-ms session-id
+   {:keys [outcome claimed-task-ids recycled-tasks error-snippet review-rounds]}]
+  (let [duration-ms (- (System/currentTimeMillis) start-ms)]
+    (runs/write-cycle-log!
+      swarm-id worker-id cycle
+      {:outcome outcome
+       :duration-ms duration-ms
+       :claimed-task-ids (vec (or claimed-task-ids []))
+       :recycled-tasks (or recycled-tasks [])
+       :error-snippet error-snippet
+       :review-rounds (or review-rounds 0)
+       :session-id session-id})))
+
+(defn- recycle-orphaned-tasks!
+  "Recycle tasks that a worker claimed but didn't complete.
+   Compares current/ task IDs before and after the agent ran —
+   new IDs that appeared are tasks this worker claimed. On failure
+   or rejection, move them back to pending/ so other workers can
+   pick them up. Returns count of recycled tasks."
+  [worker-id pre-current-ids]
+  (let [post-current-ids (tasks/current-task-ids)
+        orphaned-ids (clojure.set/difference post-current-ids pre-current-ids)
+        recycled (when (seq orphaned-ids)
+                   (tasks/recycle-tasks! orphaned-ids))]
+    (when (seq recycled)
+      (println (format "[%s] Recycled %d orphaned task(s): %s"
+                       worker-id (count recycled) (str/join ", " recycled))))
+    (count (or recycled []))))
+
 (defn- cleanup-worktree!
   "Remove worktree and branch."
   [project-root wt-dir wt-branch]
@@ -433,10 +566,10 @@
 
 (defn- merge-to-main!
   "Merge worktree changes to main branch. Serialized via merge-lock to prevent
-   concurrent workers from corrupting the git index. On success, annotates any
-   newly-completed tasks with worker metadata. Returns true on success.
-   review-rounds: number of review rounds (0 for auto-merged task-only changes)."
-  [wt-path wt-id worker-id project-root review-rounds]
+   concurrent workers from corrupting the git index. On success, moves claimed
+   tasks current→complete and annotates metadata. Returns true on success.
+   claimed-task-ids: set of task IDs this worker claimed (framework owns completion)."
+  [wt-path wt-id worker-id project-root review-rounds claimed-task-ids]
   (locking merge-lock
     (println (format "[%s] Merging changes to main" worker-id))
     (let [;; Commit in worktree if needed (no-op if already committed)
@@ -457,10 +590,26 @@
       (if success
         (do
           (println (format "[%s] Merge successful" worker-id))
-          ;; Annotate completed tasks while still holding merge-lock
+          ;; Framework-owned completion: move claimed tasks current→complete
+          (when (seq claimed-task-ids)
+            (let [completed (tasks/complete-by-ids! claimed-task-ids)]
+              (when (seq completed)
+                (println (format "[%s] Completed %d task(s): %s"
+                                 worker-id (count completed) (str/join ", " completed))))))
+          ;; Annotate completed tasks with metadata while still holding merge-lock
           (annotate-completed-tasks! project-root worker-id review-rounds))
-        (when merge-result
-          (println (format "[%s] MERGE FAILED: %s" worker-id (:err merge-result)))))
+        ;; FAILED: Clean up git state before releasing merge-lock.
+        ;; Without this, a conflict leaves .git/MERGE_HEAD and poisons the
+        ;; shared index — every subsequent worker fails on `git checkout main`.
+        (do
+          (println (format "[%s] MERGE FAILED: %s" worker-id
+                           (or (:err merge-result) (:err checkout-result))))
+          (let [abort-result (process/sh ["git" "merge" "--abort"]
+                                         {:dir project-root :out :string :err :string})]
+            (when-not (zero? (:exit abort-result))
+              ;; Abort failed (no merge in progress, or other issue) — hard reset.
+              (process/sh ["git" "reset" "--hard" "HEAD"]
+                          {:dir project-root :out :string :err :string})))))
       success)))
 
 (defn- task-only-diff?
@@ -516,12 +665,8 @@
             (println (format "[%s] Reviewer APPROVED (attempt %d)" worker-id attempt))
             {:approved? true :attempts attempt})
 
-          :rejected
-          (do
-            (println (format "[%s] Reviewer REJECTED (attempt %d)" worker-id attempt))
-            {:approved? false :attempts attempt})
-
-          ;; :needs-changes
+          ;; :needs-changes — always give the worker a chance to fix.
+          ;; Hard rejection only happens when max review rounds are exhausted.
           (let [all-feedback (conj prev-feedback output)]
             (if (>= attempt max-review-retries)
               (do
@@ -536,27 +681,38 @@
 ;; Worker Loop
 ;; =============================================================================
 
-(def ^:private max-wait-for-tasks 60)
-(def ^:private wait-poll-interval 5)
+;; Workers wait up to 10 minutes for tasks to appear before giving up.
+;; This keeps workers alive while planners/designers ramp up the queue.
+(def ^:private max-wait-for-tasks 600)
+(def ^:private wait-poll-interval 10)
 (def ^:private max-consecutive-errors 3)
 
 (defn- wait-for-tasks!
-  "Wait up to 60s for pending/current tasks to appear. Used for backpressure
-   on workers that can't create their own tasks (can_plan: false)."
+  "Wait up to 10 minutes for pending/current tasks to appear. Used for
+   backpressure on workers that can't create their own tasks (can_plan: false).
+   Polls every 10 seconds, logs every 60 seconds."
   [worker-id]
   (loop [waited 0]
     (cond
       (pos? (tasks/pending-count)) true
       (pos? (tasks/current-count)) true
       (>= waited max-wait-for-tasks)
-      (do (println (format "[%s] No tasks after %ds, proceeding anyway" worker-id waited))
+      (do (println (format "[%s] No tasks after %ds, giving up" worker-id waited))
           false)
       :else
-      (do (when (zero? (mod waited 15))
-            (println (format "[%s] Waiting for tasks... (%ds)" worker-id waited)))
+      (do (when (zero? (mod waited 60))
+            (println (format "[%s] Waiting for tasks... (%ds/%ds)" worker-id waited max-wait-for-tasks)))
           (Thread/sleep (* wait-poll-interval 1000))
           (recur (+ waited wait-poll-interval))))))
 
+(defn- maybe-sleep-between!
+  "Sleep between iterations when wait-between is configured.
+   Called at the start of each iteration (except the first)."
+  [worker-id wait-between iter]
+  (when (and wait-between (> iter 1))
+    (println (format "[%s] Sleeping %ds before next iteration" worker-id wait-between))
+    (Thread/sleep (* wait-between 1000))))
+
 (defn run-worker!
   "Run worker loop with persistent sessions.
 
@@ -568,41 +724,74 @@
    Returns final worker state with metrics attached."
   [worker]
   (tasks/ensure-dirs!)
-  (let [{:keys [id iterations]} worker
+  (let [{:keys [id iterations swarm-id wait-between]} worker
         project-root (System/getProperty "user.dir")]
-    (println (format "[%s] Starting worker (%s:%s%s, %d iterations)"
+    (println (format "[%s] Starting worker (%s:%s%s, %d iterations%s)"
                      id
                      (name (:harness worker))
                      (or (:model worker) "default")
                      (if (:reasoning worker) (str ":" (:reasoning worker)) "")
-                     iterations))
+                     iterations
+                     (if wait-between (format ", %ds between" wait-between) "")))
 
     ;; Backpressure: workers that can't create tasks wait for tasks to exist
     (when-not (:can-plan worker)
       (wait-for-tasks! id))
 
-    ;; metrics tracks: {:merges N :rejections N :errors N :review-rounds-total N}
+    ;; metrics tracks: {:merges N :rejections N :errors N :recycled N :review-rounds-total N :claims N}
     (loop [iter 1
            completed 0
            consec-errors 0
-           metrics {:merges 0 :rejections 0 :errors 0 :review-rounds-total 0}
-           session-id nil    ;; persistent session-id (nil = start fresh)
-           wt-state nil]     ;; {:dir :branch :path} or nil
+           metrics {:merges 0 :rejections 0 :errors 0 :recycled 0 :review-rounds-total 0 :claims 0}
+           session-id nil            ;; persistent session-id (nil = start fresh)
+           wt-state nil              ;; {:dir :branch :path} or nil
+           claimed-ids #{}           ;; task IDs claimed this session (reset on worktree destroy)
+           claim-resume-prompt nil   ;; override prompt for next iteration (from CLAIM results)
+           working-resumes 0]        ;; consecutive "working" outcomes in current session
       (let [finish (fn [status]
                      (assoc worker :completed completed :status status
                                    :merges (:merges metrics)
                                    :rejections (:rejections metrics)
                                    :errors (:errors metrics)
-                                   :review-rounds-total (:review-rounds-total metrics)))]
-        (if (> iter iterations)
+                                   :recycled (:recycled metrics)
+                                   :review-rounds-total (:review-rounds-total metrics)
+                                   :claims (:claims metrics)))]
+        (cond
+          (> iter iterations)
           (do
             ;; Cleanup any lingering worktree
             (when wt-state
               (cleanup-worktree! project-root (:dir wt-state) (:branch wt-state)))
-            (println (format "[%s] Completed %d iterations (%d merges, %d rejections, %d errors)"
-                             id completed (:merges metrics) (:rejections metrics) (:errors metrics)))
+            (println (format "[%s] Completed %d iterations (%d merges, %d claims, %d rejections, %d errors, %d recycled)"
+                             id completed (:merges metrics) (:claims metrics) (:rejections metrics) (:errors metrics) (:recycled metrics)))
             (finish :exhausted))
 
+          @shutdown-requested?
+          (do
+            (println (format "[%s] Shutdown requested, stopping after %d iterations" id (dec iter)))
+            (when wt-state
+              ;; Recycle any claimed tasks back to pending so other workers can pick them up
+              (when (seq claimed-ids)
+                (let [recycled (tasks/recycle-tasks! claimed-ids)]
+                  (when (seq recycled)
+                    (println (format "[%s] Recycled %d claimed task(s) on shutdown" id (count recycled))))))
+              (cleanup-worktree! project-root (:dir wt-state) (:branch wt-state)))
+            (emit-cycle-log! swarm-id id iter (System/currentTimeMillis) session-id
+              {:outcome :interrupted})
+            (finish :interrupted))
+
+          :else
+          (do
+          ;; Sleep between iterations when wait_between is configured
+          (maybe-sleep-between! id wait-between iter)
+
+          ;; Backpressure: non-planner workers wait for tasks between iterations too
+          (when (and (not (:can-plan worker))
+                     (not (pos? (tasks/pending-count)))
+                     (not (pos? (tasks/current-count))))
+            (println (format "[%s] Queue empty, waiting for tasks before iteration %d" id iter))
+            (wait-for-tasks! id))
+
           ;; Ensure worktree exists (create fresh if nil, reuse if persisted)
           (let [wt-state (try
                            (or wt-state (create-iteration-worktree! project-root id iter))
@@ -617,102 +806,177 @@
                   (do
                     (println (format "[%s] %d consecutive errors, stopping" id errors))
                     (finish :error))
-                  (recur (inc iter) completed errors metrics nil nil)))
+                  (recur (inc iter) completed errors metrics nil nil #{} nil 0)))
 
               ;; Worktree ready — run agent
-              (let [resume? (some? session-id)
+              (let [resume? (or (some? session-id) (some? claim-resume-prompt))
+                    iter-start-ms (System/currentTimeMillis)
+                    ;; Snapshot current/ task IDs before agent runs so we can
+                    ;; detect any direct mv claims (safety net for old behavior).
+                    pre-current-ids (tasks/current-task-ids)
                     _ (println (format "[%s] %s iteration %d/%d"
                                        id (if resume? "Resuming" "Starting") iter iterations))
                     context (build-context)
-                    {:keys [output exit done? merge?] :as agent-result}
-                    (run-agent! worker (:path wt-state) context session-id resume?)
-                    new-session-id (:session-id agent-result)]
+                    {:keys [output exit done? merge? claim-ids] :as agent-result}
+                    (run-agent! worker (:path wt-state) context session-id resume?
+                                :resume-prompt-override claim-resume-prompt)
+                    new-session-id (:session-id agent-result)
+                    ;; Safety net: detect any direct mv claims (old behavior)
+                    mv-claimed-tasks (detect-claimed-tasks pre-current-ids)]
 
                 (cond
-                  ;; Agent errored — cleanup, reset session
+                  ;; Agent errored — recycle claimed tasks, cleanup, reset session
                   (not (zero? exit))
                   (let [errors (inc consec-errors)
-                        metrics (update metrics :errors inc)]
-                    (println (format "[%s] Agent error (exit %d): %s"
-                                     id exit (subs (or output "") 0 (min 200 (count (or output ""))))))
+                        recycled (recycle-orphaned-tasks! id pre-current-ids)
+                        metrics (-> metrics
+                                    (update :errors inc)
+                                    (update :recycled + recycled))
+                        error-msg (subs (or output "") 0 (min 200 (count (or output ""))))]
+                    (println (format "[%s] Agent error (exit %d): %s" id exit error-msg))
+                    (emit-cycle-log! swarm-id id iter iter-start-ms new-session-id
+                      {:outcome :error :claimed-task-ids (vec (into claimed-ids mv-claimed-tasks))
+                       :recycled-tasks (when (pos? recycled) (vec mv-claimed-tasks))
+                       :error-snippet error-msg})
                     (cleanup-worktree! project-root (:dir wt-state) (:branch wt-state))
                     (if (>= errors max-consecutive-errors)
                       (do
                         (println (format "[%s] %d consecutive errors, stopping" id errors))
                         (finish :error))
-                      (recur (inc iter) completed errors metrics nil nil)))
+                      (recur (inc iter) completed errors metrics nil nil #{} nil 0)))
+
+                  ;; CLAIM signal — framework claims tasks, resumes agent with results
+                  ;; Only honored when no MERGE or DONE signal (lowest priority)
+                  (and (seq claim-ids) (not merge?) (not done?))
+                  (let [_ (println (format "[%s] CLAIM signal: %s" id (str/join ", " claim-ids)))
+                        {:keys [claimed failed resume-prompt]} (execute-claims! claim-ids)
+                        new-claimed-ids (into claimed-ids claimed)
+                        metrics (update metrics :claims + (count claimed))]
+                    (println (format "[%s] Claimed %d/%d tasks" id (count claimed) (count claim-ids)))
+                    (emit-cycle-log! swarm-id id iter iter-start-ms new-session-id
+                      {:outcome :claimed :claimed-task-ids (vec claimed)})
+                    (recur (inc iter) completed 0 metrics new-session-id wt-state
+                           new-claimed-ids resume-prompt 0))
 
                   ;; COMPLETE_AND_READY_FOR_MERGE — review, merge, reset session
                   merge?
                   (if (worktree-has-changes? (:path wt-state))
                     (if (task-only-diff? (:path wt-state))
-                      ;; Task-only changes — skip review, auto-merge
+                      ;; Task-only changes — skip review, sync to main, auto-merge
                       (do
                         (println (format "[%s] Task-only diff, auto-merging" id))
-                        (let [merged? (merge-to-main! (:path wt-state) (:branch wt-state) id project-root 0)
-                              metrics (if merged? (update metrics :merges inc) metrics)]
-                          (println (format "[%s] Iteration %d/%d complete" id iter iterations))
-                          (cleanup-worktree! project-root (:dir wt-state) (:branch wt-state))
-                          (if (and done? (:can-plan worker))
+                        (let [sync-status (sync-worktree-to-main! worker (:path wt-state) id)
+                              all-claimed (into claimed-ids mv-claimed-tasks)]
+                          (if (= :failed sync-status)
+                            ;; Sync failed — cannot merge safely, skip
                             (do
-                              (println (format "[%s] Worker done after merge" id))
-                              (assoc worker :completed (inc completed) :status :done
-                                            :merges (:merges metrics)
-                                            :rejections (:rejections metrics)
-                                            :errors (:errors metrics)
-                                            :review-rounds-total (:review-rounds-total metrics)))
-                            (recur (inc iter) (inc completed) 0 metrics nil nil))))
+                              (println (format "[%s] Sync to main failed, skipping merge" id))
+                              (emit-cycle-log! swarm-id id iter iter-start-ms new-session-id
+                                {:outcome :sync-failed :claimed-task-ids (vec all-claimed)})
+                              (cleanup-worktree! project-root (:dir wt-state) (:branch wt-state))
+                              (recur (inc iter) completed 0 metrics nil nil #{} nil 0))
+                            ;; Synced — proceed with merge
+                            (let [merged? (merge-to-main! (:path wt-state) (:branch wt-state) id project-root 0 all-claimed)
+                                  metrics (if merged? (update metrics :merges inc) metrics)]
+                              (println (format "[%s] Cycle %d/%d complete" id iter iterations))
+                              (emit-cycle-log! swarm-id id iter iter-start-ms new-session-id
+                                {:outcome :merged :claimed-task-ids (vec all-claimed) :review-rounds 0})
+                              (cleanup-worktree! project-root (:dir wt-state) (:branch wt-state))
+                              (recur (inc iter) (inc completed) 0 metrics nil nil #{} nil 0)))))
                       ;; Code changes — full review loop
                       (let [{:keys [approved? attempts]} (review-loop! worker (:path wt-state) id iter)
+                            ;; Don't pre-increment :merges — defer to after actual merge succeeds
                             metrics (-> metrics
                                         (update :review-rounds-total + (or attempts 0))
-                                        (update (if approved? :merges :rejections) inc))]
+                                        (cond-> (not approved?) (update :rejections inc)))]
                         (if approved?
-                          (do
-                            (merge-to-main! (:path wt-state) (:branch wt-state) id project-root (or attempts 0))
-                            (println (format "[%s] Iteration %d/%d complete" id iter iterations))
-                            (cleanup-worktree! project-root (:dir wt-state) (:branch wt-state))
-                            ;; If also __DONE__, stop after merge
-                            (if (and done? (:can-plan worker))
+                          (let [sync-status (sync-worktree-to-main! worker (:path wt-state) id)
+                                all-claimed (into claimed-ids mv-claimed-tasks)]
+                            (if (= :failed sync-status)
+                              ;; Sync failed after approval — treat as sync failure, skip merge
                               (do
-                                (println (format "[%s] Worker done after merge" id))
-                                (assoc worker :completed (inc completed) :status :done
-                                              :merges (:merges metrics)
-                                              :rejections (:rejections metrics)
-                                              :errors (:errors metrics)
-                                              :review-rounds-total (:review-rounds-total metrics)))
-                              (recur (inc iter) (inc completed) 0 metrics nil nil)))
-                          (do
-                            (println (format "[%s] Iteration %d/%d rejected" id iter iterations))
+                                (println (format "[%s] Sync to main failed after approval, skipping merge" id))
+                                (emit-cycle-log! swarm-id id iter iter-start-ms new-session-id
+                                  {:outcome :sync-failed :claimed-task-ids (vec all-claimed)
+                                   :review-rounds (or attempts 0)})
+                                (cleanup-worktree! project-root (:dir wt-state) (:branch wt-state))
+                                (recur (inc iter) completed 0 metrics nil nil #{} nil 0))
+                              ;; Synced — proceed with merge, capture return value
+                              (let [merged? (merge-to-main! (:path wt-state) (:branch wt-state) id project-root (or attempts 0) all-claimed)
+                                    metrics (if merged? (update metrics :merges inc) metrics)]
+                                (println (format "[%s] Cycle %d/%d complete" id iter iterations))
+                                (emit-cycle-log! swarm-id id iter iter-start-ms new-session-id
+                                  {:outcome (if merged? :merged :merge-failed)
+                                   :claimed-task-ids (vec all-claimed)
+                                   :review-rounds (or attempts 0)})
+                                (cleanup-worktree! project-root (:dir wt-state) (:branch wt-state))
+                                (recur (inc iter) (inc completed) 0 metrics nil nil #{} nil 0))))
+                          (let [recycled (recycle-orphaned-tasks! id pre-current-ids)
+                                metrics (update metrics :recycled + recycled)]
+                            (println (format "[%s] Cycle %d/%d rejected" id iter iterations))
+                            (emit-cycle-log! swarm-id id iter iter-start-ms new-session-id
+                              {:outcome :rejected :claimed-task-ids (vec (into claimed-ids mv-claimed-tasks))
+                               :recycled-tasks (when (pos? recycled) (vec mv-claimed-tasks))
+                               :review-rounds (or attempts 0)})
                             (cleanup-worktree! project-root (:dir wt-state) (:branch wt-state))
-                            (recur (inc iter) completed 0 metrics nil nil)))))
-                    (do
+                            (recur (inc iter) completed 0 metrics nil nil #{} nil 0)))))
+                    (let [recycled (recycle-orphaned-tasks! id pre-current-ids)
+                          metrics (update metrics :recycled + recycled)]
                       (println (format "[%s] Merge signaled but no changes, skipping" id))
+                      (emit-cycle-log! swarm-id id iter iter-start-ms new-session-id
+                        {:outcome :no-changes :claimed-task-ids (vec (into claimed-ids mv-claimed-tasks))
+                         :recycled-tasks (when (pos? recycled) (vec mv-claimed-tasks))})
                       (cleanup-worktree! project-root (:dir wt-state) (:branch wt-state))
-                      (recur (inc iter) completed 0 metrics nil nil)))
-
-                  ;; __DONE__ without merge — only honor for planners
-                  (and done? (:can-plan worker))
-                  (do
-                    (println (format "[%s] Received __DONE__ signal" id))
-                    (cleanup-worktree! project-root (:dir wt-state) (:branch wt-state))
-                    (println (format "[%s] Worker done after %d/%d iterations" id iter iterations))
-                    (finish :done))
-
-                  ;; __DONE__ from executor — ignore signal, but reset session since
-                  ;; the agent process exited. Resuming a dead session causes exit 1
-                  ;; which cascades into consecutive errors and premature stopping.
-                  (and done? (not (:can-plan worker)))
-                  (do
-                    (println (format "[%s] Ignoring __DONE__ (executor), resetting session" id))
+                      (recur (inc iter) completed 0 metrics nil nil #{} nil 0)))
+
+                  ;; __DONE__ — agent signaled it finished this cycle's work.
+                  ;; Always reset session and continue to next iteration.
+                  ;; Planners re-plan as tasks complete; executors pick up new tasks.
+                  done?
+                  (let [recycled (recycle-orphaned-tasks! id pre-current-ids)
+                        metrics (update metrics :recycled + recycled)]
+                    (println (format "[%s] __DONE__ signal, resetting session (iter %d/%d)" id iter iterations))
+                    (emit-cycle-log! swarm-id id iter iter-start-ms new-session-id
+                      {:outcome :executor-done :claimed-task-ids (vec (into claimed-ids mv-claimed-tasks))
+                       :recycled-tasks (when (pos? recycled) (vec mv-claimed-tasks))})
                     (cleanup-worktree! project-root (:dir wt-state) (:branch wt-state))
-                    (recur (inc iter) completed 0 metrics nil nil))
+                    (recur (inc iter) completed 0 metrics nil nil #{} nil 0))
 
-                  ;; No signal — agent still working, resume next iteration
+                  ;; No signal — agent still working, resume next iteration.
+                  ;; Track consecutive working resumes. After max-working-resumes,
+                  ;; inject a nudge prompt. If still no signal after nudge, kill session.
                   :else
-                  (do
-                    (println (format "[%s] Working... (will resume)" id))
-                    (recur (inc iter) completed 0 metrics new-session-id wt-state)))))))))))
+                  (let [wr (inc working-resumes)
+                        max-wr (:max-working-resumes worker)]
+                    (cond
+                      ;; Already nudged last iteration, still no signal — stuck
+                      (> wr max-wr)
+                      (let [recycled (recycle-orphaned-tasks! id pre-current-ids)
+                            metrics (update metrics :recycled + recycled)]
+                        (println (format "[%s] Stuck after %d working resumes + nudge, resetting session" id wr))
+                        (emit-cycle-log! swarm-id id iter iter-start-ms new-session-id
+                          {:outcome :stuck :claimed-task-ids (vec (into claimed-ids mv-claimed-tasks))
+                           :recycled-tasks (when (pos? recycled) (vec mv-claimed-tasks))})
+                        (cleanup-worktree! project-root (:dir wt-state) (:branch wt-state))
+                        (recur (inc iter) completed 0 metrics nil nil #{} nil 0))
+
+                      ;; Hit the limit — nudge on next resume
+                      (= wr max-wr)
+                      (do
+                        (println (format "[%s] Working... %d/%d resumes, nudging agent to wrap up" id wr max-wr))
+                        (emit-cycle-log! swarm-id id iter iter-start-ms new-session-id
+                          {:outcome :working :claimed-task-ids (vec (into claimed-ids mv-claimed-tasks))})
+                        (recur (inc iter) completed 0 metrics new-session-id wt-state
+                               claimed-ids nudge-prompt wr))
+
+                      ;; Under limit — normal resume
+                      :else
+                      (do
+                        (println (format "[%s] Working... (will resume, %d/%d)" id wr max-wr))
+                        (emit-cycle-log! swarm-id id iter iter-start-ms new-session-id
+                          {:outcome :working :claimed-task-ids (vec (into claimed-ids mv-claimed-tasks))})
+                        (recur (inc iter) completed 0 metrics new-session-id wt-state
+                               claimed-ids nil wr))))))))))))))
 
 ;; =============================================================================
 ;; Multi-Worker Execution
@@ -720,7 +984,7 @@
 
 (defn run-workers!
   "Run multiple workers in parallel.
-   Writes swarm summary to runs/{swarm-id}/summary.edn on completion.
+   Writes stopped event to runs/{swarm-id}/stopped.json on completion.
 
    Arguments:
      workers - seq of worker configs
@@ -731,32 +995,53 @@
   (let [swarm-id (-> workers first :swarm-id)]
     (println (format "Launching %d workers..." (count workers)))
 
-    (let [futures (doall
-                    (map-indexed
-                      (fn [idx worker]
-                        (let [worker (assoc worker :id (or (:id worker) (str "w" idx)))]
-                          (future (run-worker! worker))))
-                      workers))]
-
-      (println "All workers launched. Waiting for completion...")
-      (let [results (mapv deref futures)]
-        (println "\nAll workers complete.")
-        (doseq [w results]
-          (println (format "  [%s] %s - %d completed, %d merges, %d rejections, %d errors, %d review rounds"
-                           (:id w)
-                           (name (:status w))
-                           (:completed w)
-                           (or (:merges w) 0)
-                           (or (:rejections w) 0)
-                           (or (:errors w) 0)
-                           (or (:review-rounds-total w) 0))))
-
-        ;; Write swarm summary to disk
-        (when swarm-id
-          (runs/write-summary! swarm-id results)
-          (println (format "\nSwarm summary written to runs/%s/summary.edn" swarm-id)))
-
-        results))))
+    ;; Register JVM shutdown hook so SIGTERM/SIGINT triggers graceful stop.
+    ;; Sets the shutdown atom — workers check it between cycles and exit cleanly.
+    ;; The hook waits for workers to finish, then writes stopped.json only if
+    ;; the clean exit path hasn't already done so (guarded by the atom).
+    (let [hook (Thread. (fn []
+                          (println "\nShutdown signal received, stopping workers after current cycle...")
+                          (reset! shutdown-requested? true)
+                          ;; Give workers time to finish current cycle and cleanup.
+                          ;; After sleep, write stopped.json only if still in shutdown
+                          ;; (clean exit resets the atom to false before writing :completed).
+                          (Thread/sleep 10000)
+                          (when (and swarm-id @shutdown-requested?)
+                            (runs/write-stopped! swarm-id :interrupted))))]
+      (.addShutdownHook (Runtime/getRuntime) hook)
+
+      (let [futures (doall
+                      (map-indexed
+                        (fn [idx worker]
+                          (let [worker (assoc worker :id (or (:id worker) (str "w" idx)))]
+                            (future (run-worker! worker))))
+                        workers))]
+
+        (println "All workers launched. Waiting for completion...")
+        (let [results (mapv deref futures)]
+          ;; Clean exit — tell shutdown hook not to write stopped.json
+          (reset! shutdown-requested? false)
+          ;; Remove the hook so it doesn't accumulate across calls
+          (try (.removeShutdownHook (Runtime/getRuntime) hook) (catch Exception _))
+          (println "\nAll workers complete.")
+          (doseq [w results]
+            (println (format "  [%s] %s - %d completed, %d merges, %d claims, %d rejections, %d errors, %d recycled, %d review rounds"
+                             (:id w)
+                             (name (:status w))
+                             (:completed w)
+                             (or (:merges w) 0)
+                             (or (:claims w) 0)
+                             (or (:rejections w) 0)
+                             (or (:errors w) 0)
+                             (or (:recycled w) 0)
+                             (or (:review-rounds-total w) 0))))
+
+          ;; Write stopped event — all state derivable from cycle logs
+          (when swarm-id
+            (runs/write-stopped! swarm-id :completed)
+            (println (format "\nStopped event written to runs/%s/stopped.json" swarm-id)))
+
+          results)))))
 
 ;; =============================================================================
 ;; Planner — first-class config concept, NOT a worker
@@ -781,10 +1066,12 @@
         {:tasks-created 0})
       ;; Run agent
       (let [context (build-context)
+            template-tokens (build-template-tokens context)
             prompt-text (str (when (seq prompts)
                                (->> prompts
                                     (map load-prompt)
                                     (remove nil?)
+                                    (map #(agent/tokenize % template-tokens))
                                     (str/join "\n\n")))
                              "\n\nTask Status: " (:task_status context) "\n"
                              "Pending: " (:pending_tasks context) "\n\n"
@@ -794,29 +1081,17 @@
             swarm-id* (or swarm-id "unknown")
             tagged-prompt (str "[oompa:" swarm-id* ":planner] " prompt-text)
             abs-root (.getAbsolutePath (io/file project-root))
-            opencode-attach (opencode-attach-url)
-
-            cmd (case harness
-                  :codex (cond-> [(resolve-binary! "codex") "exec"
-                                  "--dangerously-bypass-approvals-and-sandbox"
-                                  "--skip-git-repo-check"
-                                  "-C" abs-root]
-                           model (into ["--model" model])
-                           true (conj "--" tagged-prompt))
-                  :claude (cond-> [(resolve-binary! "claude") "-p" "--dangerously-skip-permissions"]
-                            model (into ["--model" model]))
-                  :opencode (cond-> [(resolve-binary! "opencode") "run"]
-                              model (into ["-m" model])
-                              opencode-attach (into ["--attach" opencode-attach])
-                              true (conj tagged-prompt)))
+
+            cmd (harness/build-cmd harness
+                  {:cwd abs-root :model model :prompt tagged-prompt})
 
             _ (println (format "[planner] Running (%s:%s, max_pending: %d, current: %d)"
                                (name harness) (or model "default") max-pending pending-before))
 
             result (try
-                     (if (= harness :claude)
-                       (process/sh cmd {:dir abs-root :in tagged-prompt :out :string :err :string})
-                       (process/sh cmd {:dir abs-root :out :string :err :string}))
+                     (process/sh cmd {:dir abs-root
+                                      :in (harness/process-stdin harness tagged-prompt)
+                                      :out :string :err :string})
                      (catch Exception e
                        (println (format "[planner] Agent exception: %s" (.getMessage e)))
                        {:exit -1 :out "" :err (.getMessage e)}))