@opsee/cli 0.11.9

package/src/foreman/core/run.ts

@@ -0,0 +1,2836 @@
+/**
+ * The Run loop (see ../../../CONTEXT.md: Run, Ready Issue, Workspace, Context Assembly, Completion
+ * Report, Status Label, Run Record, Hand-off). Each tick takes one Ready Task of the Initiative,
+ * creates its Workspace, installs dependencies once, assembles the Worker's context, runs one
+ * unattended turn pinned to the Workspace, hands a `done` turn off as a draft pull request
+ * (core/handoff.ts) linked to the Task, then writes the Completion Report as Initiative memory
+ * with a linking comment, moves the Task through the board with a Status Label, and appends
+ * dispatch and attempt events to the Run Record. It stops when no Ready Task remains, and then
+ * gathers the Run's Proposed Learnings into one draft pull request against the repository's
+ * learnings file (core/learnings.ts, story 45).
+ *
+ * Gates (gates.ts, OPS-271) sit between the Hand-off and the settlement: once the draft pull request
+ * is open, the base's Run Recipe test, lint and typecheck commands run in the Workspace and are
+ * judged by exit code alone. A pass settles the Task In review as before; a failure resumes the same
+ * Worker session with the failing command and its output tail, and once its next `done` turn has
+ * updated the Hand-off the Gates run again, up to the retry cap, past which the Task is blocked
+ * with a comment naming the Gate. Every Gate result reaches the Run Record as a `gate` event in the
+ * orchestrator Ledger's Verification shape before anything else moves, and the rounds are
+ * summarised as a comment on the pull request, whatever the verdict; Reconcile reads those events
+ * back to finish a settlement, so a Hand-off the Gates held is never settled as handed off.
+ *
+ * The Verifier (verifier.ts, OPS-272) follows the Gates: once they pass (or the recipe names none),
+ * a Task whose Verification section describes a user journey gets the app started from the base's
+ * Run Recipe on a leased port and a separate Verifier Worker with Playwright MCP, whose prompt is
+ * that section and the URL and nothing of the implementer's turn. Its Verdict goes to the Run
+ * Record as a `verdict` event (the Ledger's shape, screenshots uploaded to the pull request first
+ * so the Defects carry their evidence URL), then to the pull request as a comment; a passed
+ * Verdict settles the Task In review, Defects leave it In Progress under `foreman:blocked` for the
+ * Defect filer (OPS-273). A Task with commands only in its Verification section skips the browser
+ * and is verified at its Gates.
+ *
+ * Scheduling (core/scheduler.ts, OPS-276): each tick fills the Account's free Slots rather than
+ * dispatching one Task and waiting. The Account's `cap` is how many Slots it has, one of them
+ * reserved for Verifiers, so `cap` 3 is two implementers and a Verifier round beside them; a
+ * dispatch swaps its implementer Slot for the reserved one when it reaches verification, which is
+ * what keeps a fleet of implementers from starving it. Ready Tasks are taken in the Tracker's
+ * readiness set but the Foreman's order: priority descending, then oldest first. `--once` and
+ * `--task` still mean exactly one dispatch. A dispatch that throws is caught, left blocked as
+ * before, and reported in the Run's outcome; the other Slots go on.
+ *
+ * `runForeman` is the seam the daemon wraps: it takes the adapters and an Account and
+ * knows nothing about daemons. Reconcile is here (story 51): with a Process Table in the deps, each
+ * tick first Reconciles (reconcile.ts) and drains the outbox, every live Worker is recorded in the
+ * table (its session id the moment `started` arrives, its last output as it streams), and a turn
+ * that the stored session id can continue is resumed through the same settle path as a fresh one.
+ * Transcripts go to the local store; the Run Record gets an output tail (story 49).
+ *
+ * Readiness is the Tracker's (`listReadyTasks`, ADR-0008); the loop never walks blockers itself.
+ * Run Record writes come before the board moves they describe (ADR-0009: that write is the commit).
+ *
+ * Before the dispatch event the Task's work contract is checked (work-contract.ts, story 23): a Task
+ * missing Goal or Acceptance Criteria is blocked and loses its dispatch label; one missing only
+ * Verification gets a Triage turn (triage.ts) whose draft is posted as a comment and joins the
+ * Worker's context, or reuses a draft an earlier turn left; a complete one dispatches as is.
+ *
+ * The human steers through the Process Table (stories 53-56; commands/foreman-control.ts): a
+ * paused Initiative stops the loop from picking a Task, and the Run either returns with `paused`
+ * set (the daemon then puts the request back and serves others) or, asked to wait, idles at the
+ * daemon's tick until resumed or stopped; a
+ * turn whose row was marked `attached` when its stream ended is left open (no attempt event, the
+ * row stays) for the human's attended turn, and Reconcile resumes it unattended once `released`;
+ * one marked `cancelled` is closed as a `stopped` attempt whose summary starts with the cancelled
+ * marker, the Task blocked with a comment. The attempt outcome vocabulary is the Run Record's
+ * (RunAttemptEvent.outcome), which has no cancelled value; the `control` event beside it says who
+ * stopped the Worker and why.
+ */
+import { DEFECT_LABEL } from "@opsee/mcp-server/src/utils/defect.js";
+import { timestampFromMs } from "@bufbuild/protobuf/wkt";
+import { existsSync, readFileSync } from "node:fs";
+import { basename, join } from "node:path";
+import { create, type MessageInitShape } from "@bufbuild/protobuf";
+import { RunEventInputSchema, type RunEventInput } from "@opsee/mcp-server/gen/api/v1/initiative_pb.js";
+import {
+  clearCredentialFailures,
+  clearResumed,
+  CREDENTIAL_FAILURES_BEFORE_QUARANTINE,
+  DEFAULT_PAUSE_MS,
+  isPaused,
+  isQuarantined,
+  MIN_PAUSE_MS,
+  noteCredentialFailure,
+  pauseAccount,
+  pausedUntil,
+  pauseUntilFrom,
+  quarantineAccount,
+  type Account,
+} from "../account.js";
+import type { AccountStore } from "../account-store.js";
+import type { CompletionReport } from "../completion-report.js";
+import { blockerIdsOf, DISPATCH_LABEL, type TaskWithContext, type TrackerAdapter, type TrackerTask } from "../tracker-adapter.js";
+import type { Vendor } from "../vendor.js";
+import type { Verdict } from "../verdict.js";
+import type { AdapterEvent, TurnFailureReason, TurnHandle, WorkerAdapter } from "../worker-adapter.js";
+import { triageDraftFrom } from "../triage-draft.js";
+import type { RemoteApi } from "../remote-api.js";
+import { assembleContext, SIBLING_LEARNING_LIMIT, type AcceptedLearnings, type BlockerReports, type SiblingLearning } from "./context.js";
+import { isRoundFailure, type DefectEvidenceLink, type DefectsFn, type FiledDefect } from "./defects.js";
+import { DEFAULT_GATE_RETRIES, gateComment, gateEvent, gateFixPrompt, gateLine, gatePassed, gateSummary, gateVerdictOf, type GateOutcome, type GateReason, type GateRound, type GatesFn, truncateCodePoints } from "./gates.js";
+import type { HandOffFn, HandOffResult } from "./handoff.js";
+import { inferInstallCommand, runInstall, tail, type InstallResult } from "./install.js";
+import { collectProposedLearnings, DEFAULT_LEARNINGS_FILE, type LearningsFn, type LearningsResult } from "./learnings.js";
+import { describePin, pinAllows, pinOf, pinToken, unplaceable, type Pin, type Unplaceable } from "./pin.js";
+import { otherForemanWorkersOn, type DrainResult, type ProcessTableApi, type WorkerRow } from "./process-table.js";
+import { reconcile } from "./reconcile.js";
+import { failureComment, reportComment, reportToMemory } from "./report.js";
+import { orderReadyTasks, priorityScale, Slots, type SlotHold } from "./scheduler.js";
+import { runSummaryComment } from "./summary.js";
+import { count, printableOneLine } from "./text.js";
+import { driveTriageTurn, isTriageSummary, TRIAGE_MARKER } from "./triage.js";
+import { failureVerdict, verdictComment, verdictEvent, verdictOf, verdictStatusOf, verificationPassed, verifySummary, type DefectEvidence, type VerifierFn, type VerifyOutcome } from "./verifier.js";
+import {
+  blockedComment,
+  draftedVerificationFrom,
+  parseWorkContract,
+  triageComment,
+  triageCappedComment,
+  triageFailedComment,
+  validateWorkContract,
+  type WorkContract,
+  type WorkContractSection,
+} from "./work-contract.js";
+import type { TranscriptStore, TranscriptWriter } from "./transcripts.js";
+import type { Workspace, WorkspaceManager } from "./workspace.js";
+
+/** A refusal the Foreman makes on purpose, reported as a plain message. */
+export class ForemanError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "ForemanError";
+  }
+}
+
+/** The Status Labels (story 63) the Foreman keeps on the Tasks it touches; created when missing. */
+export const STATUS_LABELS = {
+  running: "foreman:running",
+  /** Worn *alongside* `running` for the Verifier's browser round, not instead of it. The round is
+   * the longest and most failure-prone phase and the board could not tell it from implementation.
+   * Additive because Reconcile finds a dead Foreman's orphans by `running` alone (core/reconcile.ts,
+   * RUNNING_LABEL): swapping the label out would hide a Task that died mid-verify from the one
+   * thing built to recover it. Cleared when the attempt settles. */
+  verifying: "foreman:verifying",
+  blocked: "foreman:blocked",
+  done: "foreman:done",
+} as const;
+type StatusLabel = (typeof STATUS_LABELS)[keyof typeof STATUS_LABELS];
+
+/** What the Run Record calls each vendor (RunDispatchEvent.vendor). */
+export const RUN_RECORD_VENDOR: Readonly<Record<Vendor, string>> = { claude: "claude-code", codex: "codex" };
+
+/** RunAttemptEvent.outcome values. */
+export type AttemptOutcome = "completed" | "failed" | "stalled" | "rate_limited" | "stopped";
+
+/** RunControlEvent.action values: what a human did from the CLI. */
+export type ControlAction = "attach" | "release" | "pause" | "resume" | "cancel";
+
+/** What a cancelled attempt's summary starts with: the outcome is `stopped` (the Run Record's
+ * vocabulary), the marker says the human stopped it on purpose. */
+export const CANCELLED_MARKER = "cancelled:";
+
+/** How often a foreground Run that waits through a pause looks for its resume: the daemon's idle
+ * tick (foreman-up.ts takes its DEFAULT_DAEMON_TICK_MS from here), since each look reads the Run
+ * Record for every row the Initiative has. */
+export const PAUSE_POLL_MS = 5_000;
+
+/** The shortest that poll may be set to. `pausePollMs` reaches a `sleep` inside the loop, so 0 is
+ * not "check often", it is a spin: the Run would re-read the Run Record for every row of the
+ * Initiative thousands of times a second while an Account waits out an hour. */
+export const MIN_PAUSE_POLL_MS = 100;
+
+/** How long a dependency install may run before it is killed and recorded as such; a wedged
+ * install must not hold the Run where no Worker stall timer can reach it. */
+export const INSTALL_TIMEOUT_MS = 15 * 60_000;
+
+/** How many further attempts a Task gets after a turn ended without reporting for a reason that is
+ * the machine's rather than the work's (`RETRYABLE_FAILURES`). Under the cap the Task is made Ready
+ * again and the next tick dispatches it afresh — on another Account of the same vendor, when its
+ * own is Paused by then (story 31); at the cap it is settled blocked with a comment naming the
+ * cause that used the attempts up (story 34, `Settlement.capped`), and the Run goes on with the
+ * other Tasks.
+ *
+ * The attempts are spaced by `retryBackoff` rather than taken as fast as the machine can fail. */
+export const DEFAULT_ATTEMPT_RETRIES = 2;
+
+/**
+ * How long the first retry of a Task waits, with each further one waiting twice as long
+ * (`retryBackoff`).
+ *
+ * Without a delay the retry cap bounds the number of attempts and nothing bounds their speed. An
+ * adapter that fails in milliseconds — a vendor that answers at once, a launch that cannot start —
+ * takes a Task through every attempt it has and gives the Slot back before a human sees a line of
+ * log, and every free Slot does it at the same time. The Paused Account was the only clock of that
+ * kind, and it only covers the vendor saying "not yet" out loud.
+ *
+ * Thirty seconds is chosen against what the delay is for: long enough that a transient condition
+ * (a vendor's bad minute, a machine still releasing a port) has time to clear, short enough to be
+ * invisible on the overnight Run this exists to protect. At the default cap a Task waits 30s and
+ * then 60s across its whole life.
+ */
+export const DEFAULT_RETRY_BACKOFF_MS = 30_000;
+
+/** The longest a retry waits, however many attempts a Task has been given. Doubling is only useful
+ * while the wait is short: past a few minutes a Task that could have run is simply idle, and the
+ * Run has other Tasks it should be spending the night on. Reached at the fifth retry, which only a
+ * raised `attemptRetries` gets to. */
+export const MAX_RETRY_BACKOFF_MS = 5 * 60_000;
+
+/**
+ * How long a Task waits before its next attempt, given how many retryable failures it has had
+ * (`retryableFailuresOf`, this one included). Doubles per failure from `base`, capped.
+ *
+ * `spent` is the count the retry cap itself is measured in, so the backoff and the cap always agree
+ * about which attempt this is; a count of zero or less is not a retry and waits not at all.
+ */
+/** " in 30s" for a wait worth mentioning, and nothing at all for one that is not. A Run configured
+ * with no backoff must not tell a human its Task comes back "in 0s", which reads as a bug in the
+ * sentence rather than as the absence of a delay. */
+function inSeconds(ms: number): string {
+  return ms > 0 ? ` in ${Math.round(ms / 1000)}s` : "";
+}
+
+export function retryBackoff(spent: number, base: number = DEFAULT_RETRY_BACKOFF_MS): number {
+  if (spent < 1) return 0;
+  // Shifting rather than `Math.pow` would overflow at 31 doublings; the cap is applied to a number
+  // that may be Infinity, which `Math.min` handles, so a huge `spent` is the cap and not a NaN.
+  return Math.min(base * 2 ** (spent - 1), MAX_RETRY_BACKOFF_MS);
+}
+
+/** How many Defect Tasks one Run may dispatch before the Breaker stops it starting anything new.
+ *
+ * A Defect is filed as a sibling Task carrying the dispatch label, so the same Run picks it up; its
+ * own Verdict can file more, and nothing counted. One bad plan could spend a whole night on
+ * defect, fix, defect, and the morning summary would show a Run that never stopped and never
+ * finished. This is the count that ends it.
+ *
+ * The count is this Run's own and in memory, so a Foreman that crashes and is restarted begins a
+ * fresh Run with a fresh count. That is the honest scope of the guard: it bounds a night, not a
+ * week, and a crash-looping Foreman is a different failure with a different fix. */
+export const DEFAULT_DEFECT_DISPATCH_CAP = 10;
+
+/**
+ * The turn failures another attempt is worth trying, because they are the machine's or the
+ * vendor's rather than the work's: the Worker went quiet and the adapter stopped it (story 33), or
+ * the vendor refused the turn on a rate limit (story 30) — neither of which says anything about
+ * whether the Task can be done.
+ *
+ * A rate limit is here for the same reason Failover exists: with the Account Paused, the next tick
+ * puts the Task on a sibling Account of the same vendor, or on the same one once the reset has
+ * passed, and nothing is lost. The rest are deliberately not retried — `invalid_report` and
+ * `max_turns` are turns that really ran and would only run the same way again, `launch_failed` and
+ * `vendor_error` are a machine or a configuration a human must look at, and `stopped` is a human's
+ * own doing.
+ */
+export const RETRYABLE_FAILURES: ReadonlySet<AttemptOutcome> = new Set<AttemptOutcome>(["stalled", "rate_limited"]);
+
+/**
+ * The same question asked of the turn's reason rather than of the outcome it was recorded under
+ * (OPS-288).
+ *
+ * `credential_failed` has to be retried for the reason a rate limit does — with its Account
+ * quarantined, the next tick puts the Task on a sibling and nothing is lost, where blocking it
+ * outright would strand work that a healthy Account could do. But it cannot join
+ * `RETRYABLE_FAILURES`: that set is keyed by `AttemptOutcome`, a credential failure is recorded as
+ * the generic `failed` (the proto's outcome list is closed), and adding `failed` there would make
+ * every `vendor_error` and `invalid_report` retryable too.
+ *
+ * So the live decision reads the reason, and the Run Record read-back reads the outcome plus
+ * `CREDENTIAL_MARKER` in the summary, which is how a past credential failure is still counted
+ * against the retry cap. The alternative — a new outcome in the proto — is four generated trees for
+ * a fact the summary already carries, and the marker precedent is `TRIAGE_MARKER`'s.
+ */
+export const RETRYABLE_FAILURE_REASONS: ReadonlySet<TurnFailureReason> = new Set<TurnFailureReason>(["stalled", "rate_limited", "credential_failed"]);
+
+/** What an attempt event's summary starts with when the turn failed for a credential reason, so
+ * `retryableFailuresOf` can count it back off the Run Record despite its generic `failed` outcome. */
+export const CREDENTIAL_MARKER = "[credential]";
+
+export interface RunDeps {
+  tracker: TrackerAdapter;
+  worker: WorkerAdapter;
+  account: Account;
+  /** Sibling Accounts of the same vendor a not-yet-started Ready Task may Fail over to while this
+   * Run's own Account is Paused (story 31, CONTEXT.md: Failover). Each carries its own Worker
+   * Adapter and the per-Account steps built from it, and gets its own Slots inside the Run, so the
+   * concurrency one vendor identity sees is still its own cap and no more (ADR-0013). A live
+   * session never changes Account: a Task with a Process Table row runs on that row's Account
+   * alone. Its Workspace is not pinned with it — the row goes when the attempt is settled, so a
+   * retry after a machine-side failure takes whichever Lane is open and reuses the same git
+   * worktree; nothing of the old Account travels with it but the commits. */
+  failover?: RunAccount[];
+  /** Accounts of *another* vendor that only a pinned Task may use (story 24, core/pin.ts). A Run on
+   * a Claude Account with a Codex Account registered beside it carries that Codex Account here: a
+   * Task labelled `foreman:vendor:codex` (or `foreman:account:<its name>`) runs there, and nothing
+   * else ever does. They are Lanes like any other — their own Slots from their own cap, checked
+   * against the Process Table each tick — so one vendor identity still runs its own cap and no more
+   * (ADR-0013); what they are not is Failover targets, which stays within a vendor because a
+   * session, a prompt contract and an adapter do not cross one. `pinnableAccountsFor`
+   * (commands/foreman.ts) builds them. */
+  pinnable?: RunAccount[];
+  /** Where an Account's Paused state is written when a vendor reports a rate limit, and read back
+   * each time Slots are filled (story 30). It is the store rather than a callback because the fact
+   * outlives the Run: a pause this Foreman hit is one the next Foreman, and `foreman account list`,
+   * must see. Without one a rate limit is logged and no Account is Paused. */
+  accounts?: AccountStore;
+  /** How long an Account is Paused when the vendor named no reset; `DEFAULT_PAUSE_MS` when unset,
+   * and never below `MIN_PAUSE_MS`, since a window of zero is no pause at all. */
+  pauseMs?: number;
+  workspaces: Pick<WorkspaceManager, "create">;
+  /** Installs dependencies in a new Workspace; resolves undefined when there is nothing to install.
+   * Defaults to the Run Recipe's `commands.install`, else the lockfile inference in install.ts. */
+  install?: (workspacePath: string) => Promise<InstallResult | undefined>;
+  /** The Hand-off after a `done` turn: pushes the Workspace branch and opens or updates the draft
+   * pull request (core/handoff.ts). Its result decides whether the Task goes to In review. Absent,
+   * every `done` turn is an incomplete attempt that says so; `foreman run` always wires one. */
+  handOff?: HandOffFn;
+  /** The Gates after a Hand-off (gates.ts): runs the base's Run Recipe commands in the Workspace
+   * and reports each by exit code. `foreman run` always wires the real ones (`gatesWith`, which
+   * needs the guarded git and the checkout); absent, the Gates are skipped and the Hand-off stands. */
+  gates?: GatesFn;
+  /** How many times a failing Gate goes back to the same Worker before the Task is blocked;
+   * `DEFAULT_GATE_RETRIES` when unset. */
+  gateRetries?: number;
+  /** The code host of the Hand-off, for the Gates' summary and the Verdict on the pull request
+   * and the Verifier's screenshots. Absent, the summary is logged and the Run Record still has
+   * every result. */
+  remote?: Pick<RemoteApi, "addPullRequestComment" | "uploadAttachment">;
+  /** The Verifier after the Gates (verifier.ts): starts the app from the base's Run Recipe and
+   * runs the Verifier Worker on the Task's Verification section. `foreman run` always wires the
+   * real one (`verifierWith`); absent, verification is skipped and the Gates are the whole of it. */
+  verifier?: VerifierFn;
+  /** The Defect filer after a failed Verdict (defects.ts): one sibling Bug Task per observed
+   * Defect, related to the Task the Verifier found it on, so the next tick dispatches the fix.
+   * `foreman run` always wires the real one (`defectFilerWith`); absent, the Verdict is recorded
+   * and nothing is filed, which is what the loop's own tests want. */
+  defects?: DefectsFn;
+  /** The learnings step at the end of the Run: every Proposed Learning of its Completion Reports
+   * into one draft pull request against the learnings file (core/learnings.ts). Absent, the
+   * learnings stay in Initiative memory only; `foreman run` always wires one. */
+  learnings?: LearningsFn;
+  /** The repository's learnings file, relative to its root, read from each Workspace for Context
+   * Assembly as the Accepted Learnings; `docs/learnings.md` unless the Run Recipe says otherwise. */
+  learningsFile?: string;
+  /** The daemon log: every decision the loop makes goes here. */
+  log: (line: string) => void;
+  maxTurns?: number;
+  stallTimeoutMs?: number;
+  /** How many further attempts a stalled Task gets before it is settled blocked;
+   * `DEFAULT_ATTEMPT_RETRIES` when unset. */
+  attemptRetries?: number;
+  /** How long the first retry of a Task waits, doubling per further retry (`retryBackoff`);
+   * `DEFAULT_RETRY_BACKOFF_MS` when unset. */
+  retryBackoffMs?: number;
+  /** How many Defect Tasks this Run may dispatch before the Breaker halts new dispatch;
+   * `DEFAULT_DEFECT_DISPATCH_CAP` when unset. */
+  defectDispatchCap?: number;
+  /** Pause between ticks, so a Tracker that just released a successor is not hammered; 0 in tests. */
+  tickDelayMs?: number;
+  now?: () => number;
+  sleep?: (ms: number) => Promise<void>;
+  /** The Process Table (ADR-0009). Without one the loop keeps no local record and never Reconciles. */
+  processTable?: ProcessTableApi;
+  /** Where each turn's raw event stream is written; unset keeps no transcript. */
+  transcripts?: TranscriptStore;
+  /** Sends the outbox's queued Run Record batches (OutboxTracker.drain); called at the top of each tick. */
+  drainOutbox?: (initiativeId: number) => Promise<DrainResult>;
+  /** Whether a Process Table row's pid is a live process; the real check by default. */
+  isAlive?: (pid: number | undefined) => boolean;
+  /** How often a Run that waits through a pause (`RunOptions.waitWhilePaused`) checks for its
+   * resume; PAUSE_POLL_MS by default. */
+  pausePollMs?: number;
+}
+
+/** How often at most an `output` event bumps the row's last_output_at. */
+export const TOUCH_INTERVAL_MS = 1000;
+
+export interface RunOptions {
+  initiativeId: number;
+  /** Stop after one dispatch. */
+  once?: boolean;
+  /** Dispatch this Task and stop; it must be a Ready Task of the Initiative. */
+  taskId?: number;
+  /** Asked before each pick: true ends the Run after the dispatch in flight (the daemon was told
+   * to stop). The turn itself is stopped by the process hooks; this keeps the loop from starting
+   * another. */
+  shouldStop?: () => boolean;
+  /** Resolves when the Run should stop, for the waits a poll cannot reach: a Reconcile turn that
+   * needs an implementer Slot waits on this beside the Slot, and abandons the wait rather than
+   * holding the loop — and with it the stop and the pause — until a Worker turn ends. The daemon
+   * passes the same promise its `shouldStop` reads. */
+  untilStop?: Promise<void>;
+  /** Idle through a pause of the Initiative (story 55), polling for the resume, instead of returning
+   * with `paused` set; a foreground `foreman run` does, the daemon does not. */
+  waitWhilePaused?: boolean;
+}
+
+/** A Triage turn the Foreman ran on a Task before dispatching it. On the Run Record as an `attempt`
+ * event whose summary starts `triage:`, so it counts as a turn on the Account like any other. */
+export interface TriageTurn {
+  attempt: number;
+  outcome: AttemptOutcome;
+  /** The drafted Verification section, when the turn produced one. */
+  verification?: string;
+  /** Why it produced none: the turn's failure, or what the Worker reported instead. */
+  reason?: string;
+  sessionId?: string;
+  durationMs: number;
+}
+
+export interface Dispatch {
+  task: TrackerTask;
+  workspace: Workspace;
+  attempt: number;
+  outcome: AttemptOutcome;
+  report?: CompletionReport;
+  sessionId?: string;
+  durationMs: number;
+  install?: InstallResult;
+  /** Present for a `done` report: the draft pull request, or why there is none. */
+  handOff?: HandOffResult;
+  /** The Gates that ran on the Hand-off, round by round; absent when the recipe names none. */
+  gates?: GateOutcome;
+  /** The Verifier's round after the Gates passed: skipped, a Verdict, or a failed round; absent
+   * when the Gates held the Hand-off or there was none. */
+  verification?: VerifyOutcome;
+  /** The Triage turn that ran before this dispatch, when the Task had no Verification section. */
+  triage?: TriageTurn;
+  /** The Verification section the Worker was given because the Task had none: this dispatch's
+   * Triage turn's, or one an earlier turn left in the comments. */
+  draftedVerification?: string;
+  /** True when Reconcile continued this attempt from its stored session id (story 51). */
+  resumed?: boolean;
+  /** True when the turn ended because a human attached (story 53): nothing was recorded, the
+   * attempt is still open and its row stays until the human releases it. */
+  attached?: boolean;
+  /** True when the attempt was closed by `foreman cancel` (story 56). */
+  cancelled?: boolean;
+  /** True when the attempt ended stalled or rate limited under the retry cap: the Task was made
+   * Ready again instead of blocked, and a later tick dispatches it as the next attempt (story 33). */
+  retrying?: boolean;
+  /** True when that retry cap is what blocked the Task (story 34): the attempt failed for a reason
+   * another attempt would have been worth, and there were none left. */
+  blockedByCap?: boolean;
+  /** When the Task may be dispatched again, for a `retrying` dispatch (`retryBackoff`). Absolute
+   * rather than a duration, so the Run compares it against the same clock it schedules on.
+   *
+   * Decided here and held by the Run: this is where the facts are (which attempt, how many
+   * retryable failures the Run Record counts), while the waiting is the tick's business. Carrying
+   * it on the Dispatch keeps the backoff out of `RunDeps` — the settlement path has no mutable Run
+   * state to write to, and giving it some would be a seam every future turn could reach through. */
+  retryNotBefore?: number;
+}
+
+/** A dispatch whose work reached review: the turn reported `done`, the Hand-off is open, the
+ * Gates passed (or there were none to run), and the Verifier passed it or had no browser journey
+ * to run. */
+export function isHandedOff(d: Dispatch): boolean {
+  return d.outcome === "completed" && d.report?.outcome === "done" && d.handOff?.kind === "handed_off" && (d.gates?.passed ?? true) && verificationPassed(d.verification);
+}
+
+/** A Ready Task the Foreman refused to dispatch: its work contract is incomplete, and the Triage
+ * turn, when one applied, drafted nothing. It lost its dispatch label and carries `foreman:blocked`. */
+export interface BlockedTask {
+  task: TrackerTask;
+  missing: WorkContractSection[];
+  triage?: TriageTurn;
+  /** The Workspace created for the Triage turn, when one ran; kept, and reused by a later dispatch.  */
+  workspace?: Workspace;
+  /** The Task was left Ready because the Triage turn failed for a reason that is not the contract's
+   * — a stall, a rate limit — and the retry cap still allows another go. A later tick of *this* Run
+   * picks it up again (on a sibling Account when its own is Paused by then); it is not deferred to
+   * the next Run, which would cost a Task the whole night for one bad minute at 3am. `attemptsLeft`
+   * is what the retry cap has left, counted the same way a failed dispatch counts it
+   * (`retryableFailuresOf`), and `notBefore` is when that later tick may take it (`retryBackoff`):
+   * a Triage turn that fails in milliseconds is the same hot loop a dispatch's is. */
+  retry?: { attemptsLeft: number; notBefore: number };
+  /** The Task keeps its dispatch label but this Run will not look at it again: the Triage turn
+   * failed for something no tick of this Run can change (an adapter that will not start, a vendor
+   * error), so trying again in a second would only spin. The next Run picks it up. */
+  defer?: boolean;
+}
+
+/** A Slot whose dispatch threw something that is not a turn outcome: a Tracker write refused, a
+ * board without the column, an adapter that would not start. `dispatch` has already commented on
+ * the Task and marked it blocked; the Run reports it here and fills the Slot with the next Task
+ * rather than dying, so one bad Task does not end the Run (OPS-276). */
+export interface DispatchFailure {
+  task: TrackerTask;
+  reason: string;
+}
+
+/**
+ * A Ready Task this Run left alone because its label pins it somewhere this Run cannot reach: an
+ * Account it has no Lane for, a vendor it has no Account of, or a `foreman:` label it cannot read
+ * as a pin at all (story 24, core/pin.ts).
+ *
+ * It is deliberately *not* a `BlockedTask`. Nothing is wrong with the Task: it keeps its dispatch
+ * label, stays Ready, is never marked `foreman:blocked`, and spends none of its retry cap — the
+ * Foreman simply has nowhere to put it. Registering the Account (or fixing the label) is the whole
+ * of the fix, and the next Run dispatches it with nothing to undo. It is skipped for the rest of
+ * *this* Run, because no tick of it can change the answer.
+ */
+export interface QueuedTask {
+  task: TrackerTask;
+  pin: Pin;
+  /** What the comment on the Task said, in one sentence. */
+  reason: string;
+}
+
+export interface RunOutcome {
+  /** In the order they settled, which with Slots filled in parallel is not the order they were
+   * dispatched in: the Run Record's `dispatch` events are what carry that. */
+  dispatches: Dispatch[];
+  blocked: BlockedTask[];
+  /** Ready Tasks left queued because their pin named an Account this Run does not have (story 24).
+   * Absent when there were none. */
+  queued?: QueuedTask[];
+  /** Dispatches that threw; each Task is blocked on the Tracker and left for a human. */
+  failures: DispatchFailure[];
+  /** Set when a Breaker halted new dispatch: what tripped, and what a human should read. The Run
+   * still drained what was in flight before returning. */
+  breaker?: { condition: string; message: string };
+  /** What became of the Run's Proposed Learnings; absent when the Run has no learnings step. */
+  learnings?: LearningsResult;
+  /** The Run stopped because its Initiative is paused (story 55) and it was not asked to wait: the
+   * caller decides what to do with the rest of the work (the daemon puts the request back). */
+  paused?: boolean;
+}
+
+const defaultInstall = async (workspacePath: string): Promise<InstallResult | undefined> => {
+  const command = inferInstallCommand(workspacePath);
+  return command ? runInstall(command, workspacePath, { timeoutMs: INSTALL_TIMEOUT_MS }) : undefined;
+};
+
+const defaultSleep = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms));
+
+const noHandOff: HandOffFn = async () => ({ kind: "incomplete", reason: "this Run has no Hand-off configured (RunDeps.handOff), so nothing was pushed" });
+
+const noGates: GatesFn = async () => ({ skipped: true, reason: "this Run has no Gates configured (RunDeps.gates)" });
+
+
+/**
+ * One Account a Run may dispatch on: the Account, the Worker Adapter for its vendor, and the
+ * per-Account steps built from the two (the Verifier runs a second turn on the same Account; the
+ * Gates run their shell without its key). `RunDeps` carries the Run's own; `RunDeps.failover`
+ * carries the siblings (`runDepsFor`, commands/foreman.ts, builds them from the registered
+ * Accounts of the same vendor).
+ */
+export type RunAccount = Pick<RunDeps, "account" | "worker" | "verifier" | "gates" | "maxTurns" | "stallTimeoutMs">;
+
+/** An Account inside a Run: its `RunAccount` and the Slots the Run gives it. Slots are per Account
+ * because the cap is (ADR-0013): a Run with two Accounts runs each one's cap, not the sum on one. */
+interface Lane extends RunAccount {
+  slots: Slots;
+  /** True for a Lane of another vendor (`RunDeps.pinnable`): only a Task whose label pins it here
+   * may use it, so an unpinned Ready Task never sees it and Failover never reaches it. */
+  pinOnly?: boolean;
+}
+
+/** The Run's deps with its Slots and the Tasks it has in flight: what every dispatch of one Run
+ * shares. `runForeman` builds one per Lane; nothing outside this module constructs one. */
+interface Scheduling extends RunDeps {
+  slots: Slots;
+  /** Whether this Run has the Task's turn in flight, for Reconcile (a row it is driving is not a
+   * row a tick may restart). In-process only: it is this Run's own map, so a *second* Foreman on
+   * the same Process Table still sees a row whose adapter reports no pid as one to restart, and
+   * would dispatch a live Task twice. What keeps that from happening is the guard on starting a
+   * second Run on the Account at all (commands/foreman.ts), not this. */
+  owns: (taskId: number) => boolean;
+  /** Resolves when the Run is stopping; the Slot waits of Reconcile race against it. */
+  untilStop?: Promise<void>;
+}
+
+/**
+ * Runs the Initiative's Ready Tasks, filling the free Slots of every Account it may use each tick
+ * until none remains (or once, for `--once` and `--task`).
+ *
+ * A tick Reconciles, checks the pause and the stop, then takes Ready Tasks in priority-then-age
+ * order and starts each in a free Slot without waiting for the ones already going. It then waits
+ * for a dispatch to settle — or, when it ran out of Slots before it ran out of Tasks, for a Slot to
+ * come back; or, when every Account it could have used is Paused, for the soonest reset — and ticks
+ * again. The Run ends when nothing is in flight, no Ready Task remains and nothing is waiting on a
+ * reset, and its Proposed Learnings go out then (story 45).
+ *
+ * **Accounts (stories 30-31).** The Run's own Account is its first Lane; `RunDeps.failover` adds a
+ * Lane per sibling Account of the same vendor, each with its own Slots. A Ready Task takes the
+ * first Lane that is not Paused, is not another Foreman's (`contendedNow`) and has a Slot, which is
+ * the Failover: while Account A is Paused, the next Ready Task starts on Account B and A's own
+ * Workers finish where they are. A live session never changes Account — a Task with a Process Table
+ * row is pinned to that row's Lane and waits for it — so a session and the credential behind it
+ * always stay together; the Workspace is the Task's rather than the Account's, so a retry after a
+ * machine-side failure reuses it wherever it lands, and is told the tree is not clean
+ * (core/context.ts). Paused itself is
+ * read from the AccountStore each tick and is nothing but a timestamp: the tick after the reset
+ * passes fills that Account's Slots again, with no operator action.
+ *
+ * **The pin (story 24, core/pin.ts).** A Task labelled `foreman:vendor:codex` or
+ * `foreman:account:spare` narrows that Lane set to the Lanes the label allows, before any of the
+ * above is asked. `RunDeps.pinnable` adds a Lane per Account of another vendor, which only a pinned
+ * Task ever sees, so a Codex-pinned Task runs on the Codex Account while the Claude Slots beside it
+ * sit free. Everything the Lane set means afterwards is unchanged: a pinned Task whose only Lane is
+ * Paused **waits for that reset** rather than failing over — routing the work elsewhere is the one
+ * thing the label ruled out — and a pinned Task whose Lane is another Foreman's waits the same way.
+ * A pin no Lane can satisfy leaves the Task Ready with a comment (`leaveQueued`); it is never run
+ * somewhere else and never blocked.
+ */
+export async function runForeman(deps: RunDeps, options: RunOptions): Promise<RunOutcome> {
+  const { tracker, account, log } = deps;
+  const { initiativeId } = options;
+  const now = deps.now ?? Date.now;
+  const dispatches: Dispatch[] = [];
+  /** Defect Tasks this Run has dispatched, against `defectDispatchCap`. */
+  let defectDispatches = 0;
+  /**
+   * The earliest this Run may dispatch a Task again, by Task id, for Tasks a retryable failure made
+   * Ready again (`retryBackoff`). Written where an attempt settles, read where the tick picks.
+   *
+   * This Run's own and in memory, exactly as `defectDispatches` is, so a Foreman that crashes and
+   * is restarted begins a fresh Run with nothing held back. That is the honest scope: the delay
+   * exists to stop one Run burning a Task's attempts as fast as an adapter can fail them, and a
+   * restarted Foreman is not that loop. Nothing durable is needed for it either — the Run Record
+   * already counts what the retry cap spends, and this only decides *when*, not *whether*.
+   */
+  const retryBackoffs = new Map<number, number>();
+  const blocked: BlockedTask[] = [];
+  const failures: DispatchFailure[] = [];
+  /** The Tasks this Run has a turn going for, by Task id; the promise never rejects. */
+  const inFlight = new Map<number, Promise<void>>();
+  const owns = (taskId: number) => inFlight.has(taskId);
+
+  // The Lanes, in the order a Ready Task tries them: this Run's own Account first, so Failover is
+  // the exception and the default Account is where work lands while nothing is Paused.
+  const siblings = (deps.failover ?? []).filter((s) => {
+    if (s.account.name === account.name) return false;
+    // Failover is within a vendor (CONTEXT.md): the Workspace is vendor-neutral but the session,
+    // the prompt contract and the adapter are not, so another vendor is a different Worker, not
+    // the same work moved.
+    if (s.account.vendor !== account.vendor) {
+      log(`run: Account "${s.account.name}" is ${s.account.vendor}, not ${account.vendor}; Failover is within a vendor, so it is not used for this Run`);
+      return false;
+    }
+    return true;
+  });
+  // Lanes only a pinned Task may use (story 24): the Accounts of another vendor. Deduplicated
+  // against the Lanes above by name, because two Lanes on one Account would be two Slots objects on
+  // one vendor identity — the cap counted twice, which is the one thing Lanes must never do.
+  const pinnable = (deps.pinnable ?? []).filter((p) => {
+    if (p.account.name === account.name || siblings.some((s) => s.account.name === p.account.name)) return false;
+    // `RunDeps.pinnable` says another vendor, and `pinnableAccountsFor` only ever builds it that
+    // way; enforced here as well because this is where it is relied on. A same-vendor Account is a
+    // Failover Lane — one an *unpinned* Task may use too — and quietly making it pin-only would
+    // narrow the fleet by dropping it out of `openLanes`.
+    if (p.account.vendor === account.vendor) {
+      log(`run: Account "${p.account.name}" is ${p.account.vendor}, the same vendor as "${account.name}"; a pin-only Lane is another vendor's Account, so it is not used for this Run (a sibling of the same vendor belongs in Failover)`);
+      return false;
+    }
+    return true;
+  });
+  const lanes: Lane[] = [
+    { account, worker: deps.worker, verifier: deps.verifier, gates: deps.gates, slots: new Slots(account.cap) },
+    ...siblings.map((s) => ({ ...s, slots: new Slots(s.account.cap) })),
+    ...pinnable.map((p) => ({ ...p, slots: new Slots(p.account.cap), pinOnly: true })),
+  ];
+  const slots = lanes[0].slots;
+  /** The Lanes an unpinned Ready Task may use: every Lane but the pin-only ones. */
+  const openLanes = lanes.filter((l) => !l.pinOnly);
+
+  // Lifts a human made through `foreman account resume`, which had no Initiative to record them
+  // against. This Run has one and a Lane on the Account, so it reports them now, dated when they
+  // happened rather than when they were noticed.
+  await reportResumedAccounts(deps, initiativeId, lanes);
+  /** One Lane's view of the Run: its Account and adapter in place of the Run's own, its per-turn
+   * limits (story 33: `foreman account set --max-turns` on a Failover Account must reach its own
+   * Workers, not the primary Account's numbers), its Slots. */
+  const schedulingFor = (lane: Lane): Scheduling => ({
+    ...deps,
+    account: lane.account,
+    worker: lane.worker,
+    verifier: lane.verifier,
+    gates: lane.gates,
+    maxTurns: lane.maxTurns ?? deps.maxTurns,
+    stallTimeoutMs: lane.stallTimeoutMs ?? deps.stallTimeoutMs,
+    slots: lane.slots,
+    owns,
+    untilStop: options.untilStop,
+  });
+  const scheduling = schedulingFor(lanes[0]);
+  const sleep = deps.sleep ?? defaultSleep;
+  // A poll of 0 is not "poll as fast as possible", it is a 1ms hot loop that burns a core while an
+  // Account waits out an hour; the floor makes a mistyped flag slow rather than harmful.
+  const pausePollMs = Math.max(MIN_PAUSE_POLL_MS, deps.pausePollMs ?? PAUSE_POLL_MS);
+  // `--once` and `--task` are one dispatch, whatever the cap: the human asked for one.
+  const single = options.once === true || options.taskId !== undefined;
+  log(
+    `run: Initiative ${initiativeId} on Account "${account.name}" (${account.vendor}), cap ${slots.cap}: ${single ? "one dispatch (asked for)" : `${count(slots.implementerCap, "implementer Slot")}${slots.reservesVerifierSlot ? " and one reserved for Verifiers" : " and no Slot to reserve for Verifiers"}`}${siblings.length ? `; Failover to ${siblings.map((s) => `"${s.account.name}" (cap ${s.account.cap})`).join(", ")} while it is Paused` : ""}${pinnable.length ? `; ${pinnable.map((p) => `"${p.account.name}" (${p.account.vendor}, cap ${p.account.cap})`).join(", ")} for a Task pinned there and nothing else` : ""}`,
+  );
+
+  /**
+   * Which Accounts are Paused right now, and until when (story 30). Read from the AccountStore
+   * rather than from the Lane, so a pause written by the turn that hit the limit — or by another
+   * Foreman on the same Account — is seen the moment the next Slot is filled, and a pause whose
+   * reset has passed is already gone (`pausedUntil`). Without a store the Lane's own snapshot is
+   * all there is, which is the shape a test that hands in no store wants.
+   */
+  const pausedNow = (at: number, stored = deps.accounts?.load()): Map<string, Date> => {
+    const paused = new Map<string, Date>();
+    for (const lane of lanes) {
+      const current = stored?.find((a) => a.name === lane.account.name) ?? lane.account;
+      const until = pausedUntil(current, at);
+      if (until) paused.set(lane.account.name, until);
+    }
+    return paused;
+  };
+
+  /**
+   * Which Lanes are quarantined right now (OPS-288). Read from the AccountStore every tick for the
+   * reasons `pausedNow` is: the turn that proved the credential dead wrote it a moment ago, and a
+   * quarantine another Foreman wrote is just as binding — the Account is one vendor identity and
+   * its credential is dead for everyone.
+   *
+   * Unlike a pause this takes no `at`: nothing about a quarantine changes with the clock, which is
+   * exactly what makes it worth reporting differently when a Run runs out of Lanes.
+   */
+  const quarantinedNow = (stored = deps.accounts?.load()): Map<string, string> => {
+    const quarantined = new Map<string, string>();
+    for (const lane of lanes) {
+      const current = stored?.find((a) => a.name === lane.account.name) ?? lane.account;
+      if (current.quarantined) quarantined.set(lane.account.name, current.quarantined.reason);
+    }
+    return quarantined;
+  };
+
+  /** Lanes already reported as quarantined, so the log says it once rather than once per tick. */
+  const quarantineLogged = new Set<string>();
+
+  /** Lanes already reported as another Foreman's, so the log says it once. */
+  const contendedLogged = new Set<string>();
+
+  /** Which of the Lanes after the first — Failover Lanes and pin-only Lanes alike — another Foreman
+   * has Workers on, and how many, at `at`.
+   *
+   * `failoverAccountsFor` and `pinnableAccountsFor` (commands/foreman.ts) ask the same question,
+   * but they can only ask once, before the Run starts: an Account with no live rows then is a Lane,
+   * and nothing stops a second `foreman run --account b` from starting on it a minute later, since
+   * that Run's own guard (`refuseSecondRunOnAccount`) sees no Workers on b either. Two Runs would
+   * then have their own Slots on one vendor identity, which is the thing per-Account caps exist to
+   * prevent (ADR-0013). So the Process Table is asked again every tick, and a Lane that is not
+   * clean is not used this tick. This Run's own turns are not contention (`owns`), and the Run's
+   * first Lane is left out: it is guarded at start, and dropping the Account the human named would
+   * be a Run that does nothing rather than one that keeps within the cap.
+   *
+   * **Without a Process Table there is no second ask**, and this returns nothing: the Run has only
+   * the snapshot the two functions above took, which is `RunDeps` without `processTable` — the
+   * shape a unit test hands in, never `foreman run`, which always opens one (commands/foreman.ts).
+   */
+  const contendedNow = (at: number): Map<string, number> => {
+    const contended = new Map<string, number>();
+    if (!deps.processTable || lanes.length < 2) return contended;
+    for (const lane of lanes.slice(1)) {
+      const live = otherForemanWorkersOn(deps.processTable, lane.account.name, at, { isAlive: deps.isAlive, owns });
+      if (live.length === 0) {
+        contendedLogged.delete(lane.account.name);
+        continue;
+      }
+      contended.set(lane.account.name, live.length);
+      // Once per spell, not once per tick: a Foreman that holds the Lane for an hour must not write
+      // a line every poll.
+      if (contendedLogged.has(lane.account.name)) continue;
+      contendedLogged.add(lane.account.name);
+      log(
+        `run: Account "${lane.account.name}" now has ${count(live.length, "Worker")} running under another Foreman (${live.map((r) => `${r.identifier}${r.pid === undefined ? " (starting)" : ` (pid ${r.pid})`}`).join(", ")}); ` +
+          `it is not used for ${lane.pinOnly ? "a pinned Task" : "Failover"} while that lasts, since its cap is that Foreman's to fill`,
+      );
+    }
+    return contended;
+  };
+
+  /** Tasks whose row and whose label disagree, so the log says it once rather than every tick. */
+  const disagreementLogged = new Set<number>();
+
+  /** Where a Ready Task may run: the Lanes it is allowed, or why there are none. */
+  type LanePick =
+    | { kind: "lanes"; lanes: Lane[] }
+    /** Its Process Table row is under an Account this Run has no Lane for. */
+    | { kind: "foreign"; account: string }
+    /** Its label pins it somewhere this Run cannot reach, or cannot be read as a pin at all. */
+    | { kind: "unplaceable"; pin: Pin; why: Unplaceable };
+
+  /**
+   * The Lanes a Task may run in, narrowed twice.
+   *
+   * First by its Process Table row, when it has one: a row is what "started" means (ADR-0009: it
+   * exists from the moment the dispatch is committed), and started work does not change Account.
+   * **The row wins over the label**, always — a vendor session cannot be resumed under another
+   * identity, so a label added after a Worker started cannot move it, and re-pinning takes effect
+   * on the Task's next attempt. A disagreement between the two is worth a line, because to the
+   * developer who wrote the label it looks like the pin was ignored.
+   *
+   * Then by the pin its labels carry (story 24, core/pin.ts): a vendor, one named Account, or
+   * nothing. An unpinned Task never sees a pin-only Lane. A pin that no Lane satisfies does *not*
+   * fall back to running somewhere else — that is the whole point of a pin — so the Task comes back
+   * unplaceable and is left Ready with a comment. `registered` is every Account on the machine,
+   * which is what lets that comment tell "you never registered this Account" apart from "another
+   * Foreman is on it, wait": two conditions with opposite remedies (`unplaceable`, core/pin.ts).
+   */
+  const lanesFor = (task: TrackerTask, registered?: readonly Account[]): LanePick => {
+    const row = deps.processTable?.worker(task.id);
+    const pin = pinOf(task.labels);
+    if (row) {
+      const started = lanes.find((l) => l.account.name === row.account);
+      // A row under an Account this Run does not have is not this Run's Task at all; Reconcile skips
+      // it for the same reason, and picking it here would take it off its own Foreman.
+      if (!started) return { kind: "foreign", account: row.account };
+      if (pin && !pinAllows(pin, started.account) && !disagreementLogged.has(task.id)) {
+        disagreementLogged.add(task.id);
+        log(
+          `run: ${task.identifier} is ${describePin(pin)} but has a live Worker on Account "${started.account.name}"; ` +
+            `a started session never changes Account, so the row wins and the pin applies to its next attempt`,
+        );
+      }
+      return { kind: "lanes", lanes: [started] };
+    }
+    if (!pin) return { kind: "lanes", lanes: openLanes };
+    const why = unplaceable(
+      pin,
+      lanes.map((l) => l.account),
+      registered,
+    );
+    if (why) return { kind: "unplaceable", pin, why };
+    return { kind: "lanes", lanes: lanes.filter((l) => pinAllows(pin, l.account)) };
+  };
+
+  // Tasks whose dispatch threw and Tasks pinned where this Run cannot reach: retried by the next
+  // Run, never by this one, so a Run cannot spin on them.
+  //
+  // A Triage turn that stalled or hit a rate limit is deliberately *not* here. It is a machine-side
+  // failure like any other, and the thing that bounds it is the retry cap the Run Record already
+  // counts (`retryableFailuresOf`), not the length of the night: deferring it would cost a Task the
+  // whole Run for one bad minute at 3am, when a rate limit resolves by itself as soon as the
+  // Account's window resets.
+  const deferred = new Set<number>();
+  const queued: QueuedTask[] = [];
+
+  /**
+   * Leaves a pinned Task Ready with one comment saying where it wanted to go, what this Run has,
+   * and which of the three things fixes it (story 24).
+   *
+   * Deferred, so it is passed over for the rest of the Run: no tick of this Run can register an
+   * Account or fix a label, so looking again would only be a way to comment twice. Nothing else is
+   * touched — the dispatch label stays on, no Status Label goes on, no Run Record event is written
+   * and this Run spends no attempt on it — so the Task is exactly as Ready as it was, for the next
+   * Run or for a human. A Tracker that refuses the comment is logged and the Task is still left
+   * alone: failing to say why must not turn into running the Task somewhere the developer ruled out.
+   *
+   * **Once per condition, not once per Run.** The deferral above only covers this process:
+   * `deferred` does not survive a restart, a second `foreman run`, or the daemon building a fresh
+   * Run for the next request, and a Task pinned at an Account nobody intends to register is a
+   * condition that lasts indefinitely — a nightly daemon would leave an identical comment every
+   * night. So the Tracker is the record, the way the Defect filer makes filing idempotent
+   * (core/defects.ts): the comment carries `pinToken(pin)`, and a Task that already has one for
+   * this pin is left in silence. The token is the pin's, not the Run's, so correcting a label into
+   * a *different* unplaceable pin is a new condition and is said again.
+   */
+  const leaveQueued = async (task: TrackerTask, pin: Pin, why: Unplaceable): Promise<void> => {
+    deferred.add(task.id);
+    queued.push({ task, pin, reason: why.reason });
+    log(`run: ${task.identifier} ${why.reason} It stays Ready with its "${DISPATCH_LABEL}" label; nothing was dispatched and this Run spent no attempt on it.`);
+    const token = pinToken(pin);
+    try {
+      const { comments } = await tracker.getTask(task.id);
+      if (comments.some((c) => c.body.includes(token))) {
+        log(`run: ${task.identifier} was already told this about ${token}; the comment is not repeated`);
+        return;
+      }
+    } catch (error) {
+      // The Task's own comments could not be read. Saying it twice is a worse outcome than saying
+      // it once, but a silent Task is worse than both, so the comment goes out.
+      log(`run: ${task.identifier} comments could not be read back, so this may repeat an earlier one: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    try {
+      await tracker.addComment(task.id, `Foreman: this Task ${why.reason} It is left Ready and untouched — this Run spent no attempt on it and it is not blocked — so ${why.remedy}. ${token}`);
+    } catch (error) {
+      log(`run: ${task.identifier} could not be commented on: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  };
+  const record = (settled: Dispatch | BlockedTask) => {
+    if (!("missing" in settled)) {
+      dispatches.push(settled);
+      // A retried dispatch says when it may be taken again; anything else has finished with the
+      // Task, so an entry an earlier attempt left is dropped rather than outliving what set it.
+      if (settled.retryNotBefore !== undefined) retryBackoffs.set(settled.task.id, settled.retryNotBefore);
+      else retryBackoffs.delete(settled.task.id);
+      return;
+    }
+    blocked.push(settled);
+    // `retry` means the Task kept its dispatch label and is Ready again, and a later tick of this
+    // Run takes it: not deferred, but not immediately either. `defer` is the Task that kept its
+    // label for a reason no tick of this Run can change. Everything else is blocked and has lost
+    // the label anyway.
+    if (settled.retry) retryBackoffs.set(settled.task.id, settled.retry.notBefore);
+    else retryBackoffs.delete(settled.task.id);
+    if (settled.defer) deferred.add(settled.task.id);
+  };
+
+  /** Pin-only Lanes this Run has actually dispatched onto, which is what makes one of them a Lane
+   * this Run may Reconcile (see the Reconcile loop). */
+  const workedPinOnly = new Set<string>();
+
+  /** Starts a dispatch in the Lane's Slot it has been given and keeps its promise until it settles. */
+  const fill = (task: TrackerTask, lane: Lane, hold: SlotHold): void => {
+    if (lane.pinOnly) workedPinOnly.add(lane.account.name);
+    const running = (async () => {
+      try {
+        record(await dispatch(schedulingFor(lane), initiativeId, task, hold));
+      } catch (error) {
+        // `dispatch` has already commented on the Task and marked it blocked; a Slot's failure is
+        // the Run's to report, never the other Slots' to die of.
+        const reason = error instanceof Error ? error.message : String(error);
+        log(`run: ${task.identifier} was left blocked by a failed dispatch; the other Slots go on: ${reason}`);
+        failures.push({ task, reason });
+        deferred.add(task.id);
+      } finally {
+        hold.release();
+        inFlight.delete(task.id);
+      }
+    })();
+    if (task.labels?.includes(DEFECT_LABEL)) defectDispatches += 1;
+    inFlight.set(task.id, running);
+  };
+
+  /** Settles every turn still going, so the Run never returns with Workers it started unaccounted. */
+  const drain = async () => {
+    while (inFlight.size) await Promise.all([...inFlight.values()]);
+  };
+
+  let pausedLogged = false;
+  let started = 0;
+  /** The project's priority scale, logged the first tick that shows one (core/scheduler.ts). */
+  let scaleLogged = false;
+  // Whatever ends the loop — no Ready Task, a stop, or a throw from the Tracker — the turns this
+  // Run started are settled before it reports, so it never leaves Workers unaccounted.
+  try {
+    for (;;) {
+      // The stop is read before Reconcile, not after it: a Reconcile that must resume or restart a row
+      // takes an implementer Slot for it, and at the default cap there is one, so it can be waiting
+      // on a Worker turn to end. Asking here means a stop that arrived while the last tick waited is
+      // acted on now rather than a whole turn later, and the wait inside Reconcile is abandoned by
+      // `untilStop` besides. The pause is deliberately *not* moved up with it: a paused Run still
+      // finishes what is in flight (story 55), and Reconcile is what finishes it.
+      if (options.shouldStop?.()) {
+        log(`run: stopping as asked, after ${count(dispatches.length, "dispatch", "dispatches")}${inFlight.size ? `, waiting for ${count(inFlight.size, "turn")} in flight` : ""}`);
+        break;
+      }
+
+      // Reconcile before anything new is picked (story 51): what a previous process left in the
+      // Process Table is settled first, so a resumed Task is never dispatched a second time. Rows
+      // this Run is driving are left alone (`owns`), whatever their pid says. One pass per Lane,
+      // since a row is reconciled by a Run under its own Account and skipped by every other
+      // (reconcile.ts): that is how a Worker left on Account B is resumed on B, whichever Account
+      // this Run calls its own. The outbox is drained by the first pass alone — it is the Run's,
+      // not the Lane's.
+      for (const [index, lane] of lanes.entries()) {
+        // A pin-only Lane is another vendor's Account this Run adopted for pinned Tasks alone, and
+        // until it has dispatched onto one it is not this Run's to settle. `owns` is per-Run and
+        // in-process, so a row another Foreman on that Account wrote — one whose settle path is
+        // between the Worker ending and `removeWorker` — reads here as a dead pid with a session,
+        // which `planReconcile` calls a resume: this Run would drive a second turn on that
+        // Foreman's Task, in its Workspace, under its identity. Merely having a Codex Account
+        // registered must not make a Claude Run adopt its rows. Nothing is orphaned by waiting:
+        // the daemon's idle Reconcile groups live rows by their own Account and settles them under
+        // it (commands/foreman-up.ts), and a Run started on that Account settles them itself.
+        if (lane.pinOnly && !workedPinOnly.has(lane.account.name)) continue;
+        const laneDeps = index === 0 ? scheduling : { ...schedulingFor(lane), drainOutbox: undefined };
+        for (const settled of await reconcileTick(laneDeps, initiativeId)) record(settled);
+      }
+      // Paused (story 55): nothing new starts, and what is in flight is settled before the Run
+      // reports. A Run asked to wait idles here until the resume, at the daemon's tick; any other
+      // returns the pause as its outcome, so a daemon can put the request back and serve others.
+      if (deps.processTable?.isPaused(initiativeId)) {
+        if (!options.waitWhilePaused) {
+          await drain();
+          log(`run: Initiative ${initiativeId} is paused; stopping after ${count(dispatches.length, "dispatch", "dispatches")}, the rest waits for foreman resume ${initiativeId}`);
+          return { dispatches, blocked, failures, ...(queued.length ? { queued } : {}), paused: true };
+        }
+        if (!pausedLogged) log(`run: Initiative ${initiativeId} is paused; no new dispatch until foreman resume ${initiativeId}`);
+        pausedLogged = true;
+        await sleep(pausePollMs);
+        continue;
+      }
+      if (pausedLogged) log(`run: Initiative ${initiativeId} resumed; dispatch continues`);
+      pausedLogged = false;
+
+      // The Breaker (CONTEXT.md: Breaker). Same shape as the pause above and for the same reason:
+      // nothing new starts, what is in flight is settled before the Run reports, and the fact is on
+      // the Run Record for the morning. Checked here rather than at the dispatch site so a Run that
+      // trips mid-tick still finishes the turns it already started.
+      const defectCap = deps.defectDispatchCap ?? DEFAULT_DEFECT_DISPATCH_CAP;
+      if (defectDispatches >= defectCap) {
+        const message =
+          `${count(defectDispatches, "Defect Task")} dispatched in this Run, which is the cap (${defectCap}).` +
+          ` New dispatch is stopped so a defect-fix-defect loop cannot spend the rest of the night;` +
+          ` the Tasks already running finish. Raise it with defectDispatchCap, or look at the Initiative's plan.`;
+        log(`run: breaker: ${message}`);
+        await tracker.appendRunEvents(initiativeId, [runEvent(undefined, { payload: { case: "breaker", value: { condition: "defect_loop", message } } })]);
+        await drain();
+        return await summarised(deps, initiativeId, { dispatches, blocked, failures, ...(queued.length ? { queued } : {}), breaker: { condition: "defect_loop", message } });
+      }
+
+      /** True when Ready Tasks were left over for want of a Slot: the tick then waits for one back. */
+      let slotLimited = false;
+      /** True when the only Lanes left for a Ready Task are ones another Foreman has Workers on:
+       * the tick polls rather than stopping, since that Foreman's Workers do end. */
+      let laneContended = false;
+      /** Ready Tasks whose Process Table row is under an Account this Run has no Lane for; counted
+       * so the Run's tally says they were left rather than implying there was nothing to do. */
+      let skippedForeign = 0;
+      /** The soonest reset a Ready Task is waiting on, when every Lane it may use is Paused: the
+       * tick sleeps until then rather than spinning, and dispatch resumes with no operator action. */
+      let waitingOnReset: Date | undefined;
+      /** True when a Ready Task's every Lane is quarantined (OPS-288). Unlike a pause there is
+       * nothing to wait for and unlike contention nobody else's Workers will end, so this is the one
+       * of the three that ends the Run rather than making it poll. */
+      let laneQuarantined = false;
+      /** The soonest a Ready Task held back by `retryBackoff` may be taken. Shaped like
+       * `waitingOnReset` and waited on the same way: both are a moment this tick knows about and
+       * neither needs anyone to do anything when it arrives. */
+      let waitingOnBackoff: number | undefined;
+      /** Which Accounts are Paused this tick; read once, and reused by the wait below. */
+      let paused = new Map<string, Date>();
+      if (single && started > 0) {
+        // The one dispatch has started; nothing more is picked, only awaited.
+        if (inFlight.size === 0) break;
+      } else {
+        const candidates = await pickTasks(tracker, options, deferred, inFlight);
+        if (!scaleLogged) {
+          // Dispatch takes the highest `TaskPriority.level` first, which is the seeded scale's
+          // convention and not something Opsee enforces (core/scheduler.ts): a project that numbers
+          // the other way would silently run in reverse, so the Run says what it is seeing.
+          const scale = priorityScale(candidates);
+          if (scale) {
+            log(`run: priority levels in this project, highest first: ${scale}; dispatch takes the highest level first`);
+            scaleLogged = true;
+          }
+        }
+        // Every Account on the machine, read once and used twice: for Paused below, and for the
+        // comment on a Task no Lane can take, where an Account that is registered but not a Lane is
+        // one to wait for rather than one to register (core/pin.ts).
+        const registered = deps.accounts?.load();
+        paused = pausedNow(now(), registered);
+        const quarantined = quarantinedNow(registered);
+        // Which Lanes after the first — Failover and pin-only alike — another Foreman is on right
+        // now, asked once per tick and again every tick: `failoverAccountsFor` and
+        // `pinnableAccountsFor` (commands/foreman.ts) can only ask before the Run starts, and a
+        // Lane that was latent then may be a second Foreman's by the time it is first used.
+        const contended = contendedNow(now());
+        let taken = 0;
+        for (const task of candidates) {
+          // Held back after a retryable failure, so its next attempt is not taken as fast as the
+          // last one failed (`retryBackoff`). Asked before the Lanes, because the answer does not
+          // depend on them: a Task waiting out its own backoff is waiting wherever it would run,
+          // and a free Slot found for it here would only be handed straight back.
+          // An entry whose moment has passed is simply not a reason to skip; it is left for the
+          // Task's next settlement to replace or drop (`record`), rather than swept here, since a
+          // Map keyed by Task id cannot grow past the Initiative and a second place that edits it
+          // is a second place to get it wrong.
+          const notBefore = retryBackoffs.get(task.id);
+          if (notBefore !== undefined && notBefore > now()) {
+            if (waitingOnBackoff === undefined || notBefore < waitingOnBackoff) waitingOnBackoff = notBefore;
+            continue;
+          }
+          // The Lanes this Task may use, then the ones that are neither Paused nor another
+          // Foreman's, then the first with a free Slot. A Task pinned to a Lane gets exactly one
+          // candidate, so a Paused Account holds its own started work rather than handing it to a
+          // sibling.
+          const pick = lanesFor(task, registered);
+          if (pick.kind === "foreign") {
+            // The row is under an Account this Run does not have: another Foreman's Task, which
+            // Reconcile skips for the same reason. Said out loud, because a silent skip here made
+            // the Run claim below that no Ready Task remained.
+            log(`run: ${task.identifier} has a Process Table row under Account "${pick.account}", which is not one of this Run's Lanes (${lanes.map((l) => `"${l.account.name}"`).join(", ")}); it belongs to that Account's Foreman and is left alone`);
+            skippedForeign++;
+            continue;
+          }
+          if (pick.kind === "unplaceable") {
+            // Pinned somewhere this Run has no Lane for, or a `foreman:` label that is not a pin at
+            // all. Either way running it here is the one thing the label rules out.
+            await leaveQueued(task, pick.pin, pick.why);
+            continue;
+          }
+          // Quarantine is asked before Paused, because it is the stronger fact: an Account whose
+          // credential is dead cannot run this Task when its pause lifts either, and a Task waiting
+          // on the reset of an Account that will never work again is a Task that never runs
+          // (OPS-288). A quarantined Lane contributes no Slots to anyone.
+          const usable = pick.lanes.filter((l) => !quarantined.has(l.account.name));
+          if (usable.length === 0) {
+            for (const lane of pick.lanes) {
+              if (quarantineLogged.has(lane.account.name)) continue;
+              quarantineLogged.add(lane.account.name);
+              log(
+                `run: Account "${lane.account.name}" (${lane.account.vendor}) is quarantined (${printableOneLine(quarantined.get(lane.account.name) ?? "")}); ` +
+                  `it contributes no Slots and is not a Failover target. Log the vendor back in, then: opsee foreman account resume ${lane.account.name}`,
+              );
+            }
+            // A pinned Task is refused rather than merely skipped, and is told so on the Task
+            // itself: the label ruled out running it anywhere else, so nothing this Run does next
+            // will place it, and the human who wrote the pin is the only one who can. An unpinned
+            // Task gets no comment — it can run on any Lane, so what it is waiting for is the Run's
+            // fact and not the Task's, and a comment on every Ready Task would be noise.
+            // A pin that could not be read never reaches here: `lanesFor` answers `unplaceable`
+            // for those and the branch above has already refused the Task.
+            const pin = pinOf(task.labels);
+            if (pin) {
+              await leaveQueued(task, pin, {
+                reason: `is ${describePin(pin)}, and every Account that satisfies it is quarantined: its credential is dead, not rate limited.`,
+                remedy: `log the vendor back in and run "opsee foreman account resume <name>" (or re-register the Account), or change the pin`,
+              });
+              continue;
+            }
+            laneQuarantined = true;
+            continue;
+          }
+          const notPaused = usable.filter((l) => !paused.has(l.account.name));
+          if (notPaused.length === 0) {
+            // Every Lane this Task may use is Paused: it waits for the soonest of their resets.
+            for (const lane of usable) {
+              const until = paused.get(lane.account.name)!;
+              if (!waitingOnReset || until < waitingOnReset) waitingOnReset = until;
+            }
+            continue;
+          }
+          const open = notPaused.filter((l) => !contended.has(l.account.name));
+          if (open.length === 0) {
+            // Only Lanes another Foreman has Workers on are left: opening Slots of our own there
+            // would double one vendor identity's concurrency (ADR-0013), so the Task waits.
+            laneContended = true;
+            continue;
+          }
+          const lane = open.find((l) => l.slots.free > 0);
+          if (!lane) {
+            slotLimited = true;
+            continue;
+          }
+          if (lane !== lanes[0]) {
+            const pin = pinOf(task.labels);
+            // Landing off the Run's own Account is either the pin doing its job or Failover doing
+            // its job, and the two want different sentences: one is what the developer asked for,
+            // the other is what the Foreman did because it had to.
+            // Why the Run's own Account was passed over. There are two answers now, and the wrong
+            // one is worse than none: a quarantine has no reset, so the pause wording would print
+            // "Paused until ?" for a state that is not a pause and never lifts (OPS-288).
+            const why = quarantined.has(lanes[0].account.name)
+              ? `"${lanes[0].account.name}" is quarantined (${printableOneLine(quarantined.get(lanes[0].account.name) ?? "")})`
+              : `"${lanes[0].account.name}" is Paused until ${paused.get(lanes[0].account.name)?.toISOString() ?? "?"}`;
+            log(
+              pin && pinAllows(pin, lane.account)
+                ? `run: ${task.identifier} runs on Account "${lane.account.name}" (${lane.account.vendor}): it is ${describePin(pin)}`
+                : `run: ${task.identifier} fails over to Account "${lane.account.name}": ${why}`,
+            );
+          }
+          fill(task, lane, lane.slots.acquire());
+          taken++;
+          started++;
+          if (single) break;
+        }
+        // Before the tally below, which would otherwise report "no Ready Task remains" for a Run
+        // that has plenty of Ready Tasks and nowhere to run them. A quarantine is not waited out:
+        // nothing lifts it but a human, so the Run says what to do and ends (OPS-288).
+        //
+        // `waitingOnBackoff` holds this back too: a Task serving out the delay after its last
+        // failed attempt may still have a Lane to run on, so ending the Run on another Task's
+        // quarantine would abandon work that was only waiting.
+        if (laneQuarantined && taken === 0 && !slotLimited && !waitingOnReset && !laneContended && waitingOnBackoff === undefined && inFlight.size === 0) {
+          log(
+            `run: every Account a Ready Task could use is quarantined; ${count(dispatches.length, "dispatch", "dispatches")} made and Ready Tasks remain. ` +
+              `Nothing lifts a quarantine by itself: log the vendor back in and run "opsee foreman account resume <name>", or register another Account, then start the Run again.`,
+          );
+          break;
+        }
+        if (taken === 0 && !slotLimited && !waitingOnReset && !laneContended && !laneQuarantined && waitingOnBackoff === undefined && inFlight.size === 0) {
+          const tally = `${count(dispatches.length, "dispatch", "dispatches")}${blocked.length ? `, ${count(blocked.length, "Task")} blocked before dispatch` : ""}${failures.length ? `, ${count(failures.length, "failed dispatch", "failed dispatches")}` : ""}${skippedForeign ? `, ${count(skippedForeign, "Task")} left to another Account's Foreman` : ""}${queued.length ? `, ${count(queued.length, "Task")} left Ready with a pin this Run has no Account for` : ""}`;
+          log(`run: no Ready Task remains in Initiative ${initiativeId}; stopping after ${tally}`);
+          break;
+        }
+        if (taken) {
+          const inUse = lanes.map((l) => `"${l.account.name}" ${l.slots.inFlight}/${l.slots.cap}`).join(", ");
+          log(`run: ${count(taken, "Slot")} filled, ${inUse} in use${slotLimited ? "; Ready Tasks are waiting for a Slot" : ""}`);
+        }
+        if (waitingOnReset && taken === 0 && inFlight.size === 0) {
+          log(`run: every Account a Ready Task could use is Paused; waiting for the reset at ${waitingOnReset.toISOString()}`);
+        }
+        if (waitingOnBackoff !== undefined && taken === 0 && inFlight.size === 0) {
+          log(`run: every Ready Task is waiting out the delay after its last failed attempt; the next may be dispatched in ${Math.max(0, Math.round((waitingOnBackoff - now()) / 1000))}s`);
+        }
+        // One dispatch was asked for and no Lane can take it: say why and stop, rather than idling
+        // out a pause that is up to `MAX_PAUSE_MS` away with nobody watching. The daemon's own Runs
+        // are `--once` too, and a request it cannot serve now belongs back in its queue.
+        if (single && taken === 0 && inFlight.size === 0 && (waitingOnReset || laneContended)) {
+          log(
+            waitingOnReset
+              ? `run: one dispatch was asked for and every Account a Ready Task could use is Paused until ${waitingOnReset.toISOString()}; nothing is dispatched. Try again after the reset, or run it on another Account (--account <name>).`
+              : `run: one dispatch was asked for and every Account a Ready Task could use has Workers under another Foreman; nothing is dispatched. Wait for that Foreman, or run it on another Account (--account <name>).`,
+          );
+          break;
+        }
+      }
+
+      // Wait for something to change: a dispatch settling (its Task may release successors); or,
+      // when Ready Tasks were waiting, a Slot coming back on any Lane that could take one — which a
+      // dispatch entering verification gives without settling anything; or, when the only thing in
+      // the way is a Paused Account, the reset itself, capped at the pause poll so a pause lifted
+      // by hand (or by another Foreman) is noticed too.
+      const waits: Promise<unknown>[] = [...inFlight.values()];
+      if (slotLimited) for (const lane of lanes) if (!paused.has(lane.account.name)) waits.push(lane.slots.nextRelease());
+      if (waitingOnReset) waits.push(sleep(Math.max(1, Math.min(waitingOnReset.getTime() - now(), pausePollMs))));
+      // Unlike a pause, nothing but this Run's own clock can end a backoff early, so it is slept
+      // out whole rather than polled. `Math.max(1, ...)` keeps a wait that has just elapsed from
+      // becoming a zero-length sleep the loop would spin on.
+      if (waitingOnBackoff !== undefined) waits.push(sleep(Math.max(1, waitingOnBackoff - now())));
+      // Another Foreman's Workers on the only Lane left: nothing here is notified when they end, so
+      // the Process Table is polled at the same interval a pause is.
+      if (laneContended && !waitingOnReset) waits.push(sleep(pausePollMs));
+      if (waits.length === 0) break;
+      await Promise.race(waits);
+      if (deps.tickDelayMs) await sleep(deps.tickDelayMs);
+    }
+  } finally {
+    await drain();
+  }
+  return await summarised(deps, initiativeId, { dispatches, blocked, failures, ...(queued.length ? { queued } : {}), learnings: await submitLearnings(deps, initiativeId, dispatches) });
+}
+
+/**
+ * Leaves the Run's summary on the Initiative and hands the outcome back unchanged (story 62).
+ *
+ * Here rather than in the command, so the daemon's Runs get it too: `foreman run` and `foreman up`
+ * both come through `runForeman` and both used to end with a line on a terminal nobody was watching
+ * at 3am. Every exit goes through this, an early stop included — a Breaker halting dispatch is the
+ * night that most needs explaining, and it is exactly the night that would otherwise be silent.
+ *
+ * The Run's own facts are already committed by the time this runs: the Run Record has every event
+ * and each Task carries its comment and its Status Label. So a Tracker that refuses this write costs
+ * the morning its summary and nothing else, and it must not turn a Run that worked into a Run that
+ * threw on its last line.
+ */
+async function summarised(deps: RunDeps, initiativeId: number, outcome: RunOutcome): Promise<RunOutcome> {
+  try {
+    // No line on success. `submitLearnings`, the other last step of a Run, reports through the
+    // outcome and logs only what went wrong; a routine write announcing itself every Run is noise
+    // in a log read to find out what did not happen.
+    await deps.tracker.addInitiativeComment(initiativeId, runSummaryComment(outcome));
+  } catch (error) {
+    deps.log(`run: the Run summary could not be posted on Initiative ${initiativeId}, so the morning has only this terminal: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  return outcome;
+}
+
+/** The Run's last step: its Proposed Learnings, gathered from every dispatch that reported, into
+ * the learnings pull request. Its failure is the Run's to report, never to die of: the work is
+ * handed off already, and the learnings are in Initiative memory whatever happens here. */
+async function submitLearnings(deps: RunDeps, initiativeId: number, dispatches: Dispatch[]): Promise<LearningsResult | undefined> {
+  if (!deps.learnings) return undefined;
+  const learnings = collectProposedLearnings(dispatches);
+  try {
+    return await deps.learnings({ initiativeId, learnings });
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    deps.log(`learnings: failed: ${reason}`);
+    return { kind: "failed", count: learnings.length, reason };
+  }
+}
+
+/**
+ * One Reconcile pass for an Initiative: drain the outbox, then resume, restart or release every
+ * Process Table row. The daemon runs this on its idle ticks too, per Initiative it has rows for.
+ * Without a Process Table there is nothing to reconcile.
+ *
+ * Inside a Run the deps carry its Slots: a resumed or restarted turn is a turn on the Account like
+ * any other, so it takes an implementer Slot and waits for one when the Run has none free. Rows the
+ * Run is driving in its own Slots are left alone. The daemon's idle tick hands in plain `RunDeps`,
+ * where there is no Run to share Slots with and its one Reconcile at a time is the whole of it.
+ */
+export async function reconcileTick(deps: RunDeps, initiativeId: number): Promise<Array<Dispatch | BlockedTask>> {
+  if (deps.drainOutbox) await deps.drainOutbox(initiativeId);
+  if (!deps.processTable) return [];
+  const scheduling = "slots" in deps ? (deps as Scheduling) : undefined;
+  // A Paused Account starts no new Workers, and a restart is a new Worker: a row with no session to
+  // resume waits, exactly as it waits through a paused Initiative. Resuming is not held back — the
+  // glossary's promise is that a Paused Account's running Workers stay resumable, and a resumed
+  // session is the turn that was already going, not a new one.
+  const current = deps.accounts?.load().find((a) => a.name === deps.account.name) ?? deps.account;
+  const accountPaused = isPaused(current, (deps.now ?? Date.now)());
+  if (accountPaused) deps.log(`reconcile: Account "${deps.account.name}" is Paused until ${current.paused?.until}; its Workers are resumed, nothing is dispatched afresh on it`);
+  /** Runs one Reconcile turn in a Slot of the Run, when there is a Run to take one from. A Run that
+   * is stopping does not wait for a Slot that is in use: the row stays as it is, for the next tick
+   * or the next Foreman, and the loop gets its stop back without a Worker turn's delay. */
+  const inSlot = async (row: WorkerRow, turn: (hold?: SlotHold) => Promise<Dispatch | BlockedTask>): Promise<Dispatch | BlockedTask | undefined> => {
+    if (!scheduling) return turn();
+    const hold = await scheduling.slots.acquireWhenFree(scheduling.untilStop);
+    if (!hold) {
+      deps.log(`reconcile: ${row.identifier} attempt ${row.attempt}: the Run is stopping and no Slot came free; leaving the row as it is`);
+      return undefined;
+    }
+    try {
+      return await turn(hold);
+    } finally {
+      hold.release();
+    }
+  };
+  const { results } = await reconcile<Dispatch | BlockedTask>(
+    {
+      table: deps.processTable,
+      tracker: deps.tracker,
+      account: deps.account,
+      log: deps.log,
+      isAlive: deps.isAlive,
+      paused: (id) => accountPaused || (deps.processTable?.isPaused(id) ?? false),
+      owns: scheduling?.owns,
+      resume: (row, sessionId, released) => inSlot(row, (hold) => resumeTurn(deps, initiativeId, row, sessionId, released, hold)),
+      restart: (row) => inSlot(row, (hold) => restartTurn(deps, initiativeId, row, hold)),
+      cancel: (row) => cancelTurn(deps, initiativeId, row),
+      finishSettlement: (row, outcome) => finishSettlement(deps, initiativeId, row, outcome),
+    },
+    initiativeId,
+  );
+  return results;
+}
+
+/** Finishes what a crash between the attempt event and the board left undone. The attempt event is
+ * the commit (ADR-0009); memory is agent-written and may already be there, so only the comment and
+ * the board are replayed: a Task whose attempt completed goes to In review under `foreman:done`
+ * when the event names a Hand-off and the attempt's `gate` events say its last round passed (or
+ * there are none, the recipe having named no Gate), else it is blocked, and the comment points at
+ * the events. The full report is not reconstructed: the transcript and the event's summary carry
+ * what a reader needs. */
+async function finishSettlement(deps: RunDeps, initiativeId: number, row: WorkerRow, outcome: string): Promise<void> {
+  const { tracker, log } = deps;
+  const { task } = await tracker.getTask(row.taskId);
+  const { events } = await tracker.readRunRecord(initiativeId, { taskId: row.taskId, kinds: ["attempt"] });
+  // Never the Triage turn's, which carries this same attempt number and is written before the
+  // dispatch event (core/triage.ts `TRIAGE_MARKER`): settling from it would report the drafting
+  // turn's outcome as the implementer attempt's.
+  const event = events.find(
+    (e) => e.payload?.payload.case === "attempt" && e.payload.payload.value.attempt === row.attempt && !isTriageSummary(e.payload.payload.value.summary),
+  );
+  // The attempt event is the commit (ADR-0009): it carries the Hand-off URL when the draft pull
+  // request was opened, whether or not the Gates then held it. The Gates' own events, written before
+  // the attempt, carry the verdict, so both are read: a URL with a failed last round is a blocked
+  // Task whose pull request is still open, not a handed-off one.
+  const handOffUrl = event?.payload?.payload.case === "attempt" ? event.payload.payload.value.handOffUrl : undefined;
+  const verdict = gateVerdictOf((await tracker.readRunRecord(initiativeId, { taskId: row.taskId, kinds: ["gate"] })).events, row.attempt);
+  // The Verifier's word, written after the Gates': a failed Verdict holds the Hand-off the way a
+  // failed Gate does. The dispatch events are read with it: a Verdict written without an app (the
+  // round failed before the app started) is the attempt's by its place after that attempt's
+  // dispatch event (verifier.ts, the invariant on `verdictEvent`).
+  const verified = verdictStatusOf((await tracker.readRunRecord(initiativeId, { taskId: row.taskId, kinds: ["dispatch", "verdict"] })).events, row.attempt, row.identifier);
+  const handedOff = outcome === "completed" && !!handOffUrl && verdict !== "failed" && verified !== "failed";
+  const state = handedOff
+    ? ` Handed off as ${handOffUrl}${verdict === "passed" ? ", its Gates passed" : ""}${verified === "passed" ? ", its Verdict passed" : ""}.`
+    : handOffUrl
+      ? verdict === "failed"
+        ? ` Hand-off ${handOffUrl} is held by its Gates: the last round failed. The Task stays In Progress under foreman:blocked; see the gate events and the transcript.`
+        : ` Hand-off ${handOffUrl} is held by its Verdict: the Verifier found Defects. The Task stays In Progress under foreman:blocked; see the verdict event and the transcript.`
+      : " The Task stays In Progress under foreman:blocked; see the attempt event and the transcript.";
+  await tracker.addComment(task.id, `Foreman: attempt ${row.attempt} was recorded (${outcome}) but the Foreman stopped before finishing; settled now from the Run Record.${state}`);
+  // A Task that died mid-round still wears it; detach is a no-op when it does not.
+  await tracker.detachLabel(row.taskId, STATUS_LABELS.verifying);
+  if (handedOff) {
+    await tracker.detachLabel(task.id, STATUS_LABELS.running);
+    await tracker.moveTask(task.id, "in_review");
+    await markStatus(tracker, task, undefined, STATUS_LABELS.done);
+  } else {
+    await markStatus(tracker, task, STATUS_LABELS.running, STATUS_LABELS.blocked);
+  }
+  log(`reconcile: ${row.identifier} attempt ${row.attempt}: settlement finished (${handedOff ? "handed off" : handOffUrl ? (verdict === "failed" ? "blocked, Hand-off held by Gates" : "blocked, Hand-off held by the Verdict") : "blocked"})`);
+}
+
+/** Continues an interrupted attempt from its stored session id, in the same Workspace, and settles
+ * it the way a fresh turn is settled; the attempt event carries a `resumed` marker. A `released`
+ * row (story 54) is resumed the same way, told that a human had the session in between; its mark
+ * comes off as the turn starts, so the row is an ordinary live Worker's again. */
+async function resumeTurn(deps: RunDeps, initiativeId: number, row: WorkerRow, sessionId: string, released = false, slot?: SlotHold): Promise<Dispatch> {
+  const { tracker, worker, account, log } = deps;
+  const now = deps.now ?? Date.now;
+  const ctx = await tracker.getTask(row.taskId);
+  const workspace: Workspace = { path: row.workspace, branch: row.branch, created: false };
+  if (released) deps.processTable?.setControl(row.taskId, undefined, now());
+  const started = now();
+  const handle = worker.resume(sessionId, { account, cwd: workspace.path, prompt: resumePrompt(ctx.task, released), maxTurns: deps.maxTurns, stallTimeoutMs: deps.stallTimeoutMs });
+  if (handle.pid !== undefined) deps.processTable?.setPid(row.taskId, handle.pid);
+  log(`worker: ${account.vendor} resumed turn on ${row.identifier} in ${workspace.path} (session ${sessionId}${released ? ", after an attended turn" : ""})`);
+  return observeTurn(deps, initiativeId, ctx, workspace, row.attempt, handle, { started, installNote: "", resumed: true, draftedVerification: draftedVerificationFrom(ctx.comments)?.verification, slot });
+}
+
+/** What a resumed Worker is told: the turn it was in ended with the Foreman, not with it; or, after
+ * a release, that a human took the session over for a while and has handed it back. */
+export function resumePrompt(task: TrackerTask, released = false): string {
+  const first = released
+    ? `A human attached to your session on Task ${task.identifier} ("${task.title}") for an attended turn and has now released it; the Foreman has restarted you unattended in the same Workspace with everything that was said and done.`
+    : `The Foreman that ran your previous turn on Task ${task.identifier} ("${task.title}") stopped before you reported, and has restarted you in the same Workspace with your earlier context.`;
+  return [first, "Check the working tree for what you had already done, continue from there, finish the Task, and end with the Completion Report."].join("\n");
+}
+
+/** Closes the attempt of a Worker `foreman cancel` stopped when the process that owned its turn is
+ * not there to do it (it died, or the row was left by a daemon that is gone): the same settlement
+ * the owner would have made, from the row alone. */
+async function cancelTurn(deps: RunDeps, initiativeId: number, row: WorkerRow): Promise<Dispatch> {
+  const ctx = await deps.tracker.getTask(row.taskId);
+  const workspace: Workspace = { path: row.workspace, branch: row.branch, created: false };
+  return settleCancelled(deps, initiativeId, ctx, workspace, row.attempt, `\n\nThe process that owned the turn did not close the attempt; closed by Reconcile.`, { started: deps.now?.() ?? Date.now(), installNote: "", resumed: true });
+}
+
+/** A cancelled attempt (story 56): `stopped` on the Run Record with the cancelled marker first in
+ * the summary, a comment saying the human cancelled it, the Task blocked, the row released. */
+async function settleCancelled(deps: RunDeps, initiativeId: number, ctx: TaskWithContext, workspace: Workspace, attempt: number, detail: string, obs: TurnObservation): Promise<Dispatch> {
+  const { tracker, log } = deps;
+  const task = ctx.task;
+  const durationMs = (deps.now ?? Date.now)() - obs.started;
+  const marker = obs.resumed ? `${RESUMED_MARKER} ` : "";
+  await settle(
+    tracker,
+    initiativeId,
+    task,
+    {
+      attempt,
+      outcome: "stopped",
+      summary: `${marker}${CANCELLED_MARKER} stopped by opsee foreman cancel${detail}${obs.installNote}\n\nTurn: ${durationMs}ms.`,
+      memory: [],
+      comment: () => `Foreman: attempt ${attempt} was cancelled (opsee foreman cancel ${task.id}); the Worker was stopped and the Task stays In Progress under ${STATUS_LABELS.blocked}. Its Workspace ${workspace.path} (branch ${workspace.branch}) is kept for the next attempt.`,
+      gateRetries: deps.gateRetries ?? DEFAULT_GATE_RETRIES,
+    },
+    log,
+  );
+  deps.processTable?.removeWorker(task.id);
+  log(`attempt: ${task.identifier} cancelled by the human after ${durationMs}ms; the Task is blocked`);
+  return { task, workspace, attempt, outcome: "stopped", durationMs, install: obs.install, resumed: obs.resumed, cancelled: true };
+}
+
+/** A Worker that died before it had a session cannot be resumed: the Task is dispatched again,
+ * which the Run Record counts as the next attempt. */
+async function restartTurn(deps: RunDeps, initiativeId: number, row: WorkerRow, slot?: SlotHold): Promise<Dispatch | BlockedTask> {
+  deps.processTable?.removeWorker(row.taskId);
+  const { task } = await deps.tracker.getTask(row.taskId);
+  return dispatch(deps, initiativeId, task, slot);
+}
+
+/** The Task outside any Initiative is refused (story 15); so is one in a different Initiative. */
+export function assertInInitiative(task: TrackerTask, initiativeId: number): void {
+  if (task.initiativeId === undefined || task.initiativeId === 0) {
+    throw new ForemanError(
+      `Task ${task.identifier} (id ${task.id}) is not in any Initiative. The Foreman only runs Initiative Tasks, so every Completion Report has a memory log to land in: link it to Initiative ${initiativeId} (or another) and label it "${DISPATCH_LABEL}".`,
+    );
+  }
+  if (task.initiativeId !== initiativeId) {
+    throw new ForemanError(`Task ${task.identifier} (id ${task.id}) is in Initiative ${task.initiativeId}, not Initiative ${initiativeId}.`);
+  }
+}
+
+/**
+ * The Ready Tasks this tick may fill Slots with, in dispatch order: priority descending, then
+ * oldest first (core/scheduler.ts, story 28). Readiness is the Tracker's (ADR-0008); what is
+ * dropped here is only what this Run must not pick again — a Task it already has in flight, and one
+ * it deferred. `--task` names one Task instead and is refused when that Task is not Ready.
+ */
+async function pickTasks(
+  tracker: TrackerAdapter,
+  options: RunOptions,
+  deferred: ReadonlySet<number>,
+  inFlight: ReadonlyMap<number, unknown>,
+): Promise<TrackerTask[]> {
+  const ready = await tracker.listReadyTasks(options.initiativeId);
+  if (!ready.dispatchLabelExists) {
+    throw new ForemanError(`Initiative ${options.initiativeId}: the project has no "${ready.dispatchLabel}" label, so no Task can be ready.`);
+  }
+  if (options.taskId === undefined) {
+    return orderReadyTasks(ready.tasks.filter((t) => !deferred.has(t.id) && !inFlight.has(t.id)));
+  }
+
+  const { task } = await tracker.getTask(options.taskId);
+  assertInInitiative(task, options.initiativeId);
+  const hit = ready.tasks.find((t) => t.id === options.taskId);
+  if (!hit) {
+    throw new ForemanError(
+      `Task ${task.identifier} (id ${task.id}) is not Ready in Initiative ${options.initiativeId}: it needs the "${ready.dispatchLabel}" label, an open column, and every blocker Done.`,
+    );
+  }
+  return [hit];
+}
+
+function runEvent(taskId: number | undefined, payload: MessageInitShape<typeof RunEventInputSchema>["payload"]): RunEventInput {
+  return create(RunEventInputSchema, { taskId, payload });
+}
+
+/** `runEvent` for a fact that happened at a moment other than now: the server stamps `occurredAt`
+ * itself when it is absent, which is right for everything the Run does as it does it, and wrong for
+ * a lift a human made before this Run started (`reportResumedAccounts`). */
+function runEventAt(taskId: number | undefined, occurredAt: Date | undefined, payload: MessageInitShape<typeof RunEventInputSchema>["payload"]): RunEventInput {
+  return create(RunEventInputSchema, { taskId, payload, ...(occurredAt ? { occurredAt: timestampFromMs(occurredAt.getTime()) } : {}) });
+}
+
+/** A `spend` event: what one turn cost, on which Account. Written for any turn that reported a
+ * cost whatever its outcome, because a turn that failed still spent; only a `completed` turn
+ * carries one, since that is the only terminal event the vendors put a total on.
+ *
+ * Credits are the Run Record's unit -- a thousandth of a dollar (`InitiativeCostRollup`: 1 credit
+ * = $0.001) -- rounded to the nearest whole one. A cost that rounds to nothing is left unwritten
+ * rather than recorded as free: an event saying a turn cost zero is worse than no event, because
+ * the rollup would sum it as fact.
+ *
+ * `model`, `inputTokens` and `outputTokens` stay unset. The streams this Foreman reads report a
+ * turn's total and not its token split, and a zero in those fields would read as "no tokens" where
+ * the truth is "not reported". */
+export function spendEvent(taskId: number, vendor: Vendor, accountName: string, costUsd: number | undefined): RunEventInput | undefined {
+  if (typeof costUsd !== "number" || !Number.isFinite(costUsd) || costUsd <= 0) return undefined;
+  const credits = Math.round(costUsd * 1000);
+  if (credits <= 0) return undefined;
+  return runEvent(taskId, { payload: { case: "spend", value: { credits: BigInt(credits), vendor: RUN_RECORD_VENDOR[vendor], account: accountName } } });
+}
+
+/** A `control` event (stories 53-56): what the human did, from the CLI. Task-scoped for attach,
+ * release and cancel; Run-wide for pause and resume. */
+/** The state an Account moved to, as the Run Record names it (`RunAccountEvent.state`). */
+export type AccountState = "paused" | "quarantined" | "active";
+
+/**
+ * An Account's state on the Run Record: the vendor refused a turn on it, its credential was judged
+ * dead, or a human brought it back.
+ *
+ * `state` is where the Account arrived rather than what happened to it, so one vocabulary covers a
+ * lift from either a pause or a quarantine. What identifies the Account is the label its operator
+ * gave it and nothing else — never the config directory or key variable behind it (ADR-0013), which
+ * is the same line `RunDispatchEvent.account` holds.
+ *
+ * `taskId` is the turn that discovered it, for a pause or a quarantine; an Account brought back was
+ * caused by no Task and carries none.
+ */
+export function accountEvent(state: AccountState, vendor: Vendor, accountName: string, reason: string, options: { taskId?: number; until?: Date; occurredAt?: Date } = {}): RunEventInput {
+  return runEventAt(options.taskId, options.occurredAt, {
+    payload: {
+      case: "account",
+      value: {
+        state,
+        vendor: RUN_RECORD_VENDOR[vendor],
+        account: accountName,
+        // The vendor's own prose in places, on its way to a record other people read: one printable
+        // line, as it is for the accounts file and the terminal views.
+        reason: printableOneLine(reason, ACCOUNT_REASON_MAX),
+        ...(options.until ? { until: timestampFromMs(options.until.getTime()) } : {}),
+      },
+    },
+  });
+}
+
+/** What `RunAccountEvent.reason` takes (proto: `max_len: 4000`). Well under it: the reason is one
+ * line of a vendor's refusal, and the Run Record is not where a stack trace belongs. */
+const ACCOUNT_REASON_MAX = 500;
+
+export function controlEvent(action: ControlAction, message: string, taskId?: number): RunEventInput {
+  return runEvent(taskId, { payload: { case: "control", value: { action, message } } });
+}
+
+function attemptOutcomeOf(reason: TurnFailureReason): AttemptOutcome {
+  switch (reason) {
+    case "stalled":
+      return "stalled";
+    case "rate_limited":
+      return "rate_limited";
+    case "stopped":
+      return "stopped";
+    // A credential failure has no outcome of its own: `RunAttemptEvent.outcome` is a closed set in
+    // the proto and widening it is a change to four generated trees for a fact the summary already
+    // carries in words. Written as its own case rather than left to the default, so that reading
+    // this function answers the question instead of raising it.
+    case "credential_failed":
+      return "failed";
+    default:
+      return "failed";
+  }
+}
+
+/**
+ * How many attempts on this Task have already ended in a `RETRYABLE_FAILURES` outcome, read back
+ * off the Run Record: what the retry cap is spent on (story 34).
+ *
+ * Deliberately not `attempt - 1`. The attempt number counts every turn the Task ever had, whatever
+ * ended it — a failed Gate round, a Verdict with Defects, a human relabelling a blocked Task — and
+ * none of those is a machine-side failure the cap exists to bound. A Triage turn that ended
+ * `rate_limited` does count: it is a turn on the Account that the vendor refused, exactly the thing
+ * another attempt is worth trying.
+ */
+async function retryableFailuresOf(tracker: TrackerAdapter, initiativeId: number, taskId: number): Promise<number> {
+  const { events } = await tracker.readRunRecord(initiativeId, { taskId, kinds: ["attempt"] });
+  return events.filter((e) => {
+    const payload = e.payload?.payload;
+    if (payload?.case !== "attempt") return false;
+    // The outcome answers for `stalled` and `rate_limited`; a credential failure was recorded as
+    // the generic `failed` and is recognised by its marker instead (`RETRYABLE_FAILURE_REASONS`).
+    return RETRYABLE_FAILURES.has(payload.value.outcome as AttemptOutcome) || isCredentialSummary(payload.value.summary);
+  }).length;
+}
+
+/** Whether an attempt event's summary is a turn that failed for a credential reason. The marker is
+ * written after the resumed and triage markers, so this is a search rather than a prefix test. */
+export function isCredentialSummary(summary: string): boolean {
+  return summary.includes(CREDENTIAL_MARKER);
+}
+
+/** Swaps the Task's Status Label: `from` comes off, `to` goes on (created in the project first). */
+async function markStatus(tracker: TrackerAdapter, task: TrackerTask, from: StatusLabel | undefined, to: StatusLabel): Promise<void> {
+  if (from) await tracker.detachLabel(task.id, from);
+  await tracker.ensureLabel(task.projectId, to);
+  await tracker.attachLabel(task.id, to);
+}
+
+type HandedOff = Extract<HandOffResult, { kind: "handed_off" }>;
+
+interface Settlement {
+  attempt: number;
+  outcome: AttemptOutcome;
+  /** The attempt event's summary: what happened, the install exit code, the output tail. */
+  summary: string;
+  /** The linking comment, given the ids of the memory entries just written (outcome first) and
+   * the Run loop's note about the Hand-off. */
+  comment: (memoryIds: number[], note: string) => string;
+  /** Memory entries to write before the comment; empty for a turn without a report. */
+  memory: Parameters<TrackerAdapter["addMemory"]>[1][];
+  /** The Hand-off of a `done` turn. Open: the Task goes to In review under `foreman:done` with the
+   * pull request linked, provided the Gates passed. Incomplete or absent: it stays In Progress
+   * under `foreman:blocked`. */
+  handOff?: HandOffResult;
+  /** The Gates that ran on the Hand-off. Failed: the pull request is still linked and named in the
+   * attempt event, but the Task stays In Progress under `foreman:blocked`. */
+  gates?: GateOutcome;
+  /** The Verifier's round after passing Gates. Defects or a failed round: the pull request stays
+   * linked, the Task stays In Progress under `foreman:blocked`. */
+  verification?: VerifyOutcome;
+  gateRetries: number;
+  /** Set when the attempt failed for a reason worth another go under the retry cap
+   * (`RETRYABLE_FAILURES`): the Task gets its dispatch label back instead of `foreman:blocked`, so
+   * the Tracker counts it Ready again and a later tick dispatches the next attempt — on a sibling
+   * Account when its own is Paused by then (story 31), and no sooner than `waitMs` from now
+   * (`retryBackoff`). */
+  retry?: { attemptsLeft: number; waitMs: number };
+  /** Set when that same kind of failure has used the retry cap up (story 34): the Task is blocked
+   * like any other failed attempt, and the comment says which cause spent the attempts, so a human
+   * reading the Task alone knows whether to retry it or to fix something first. `attempts` is how
+   * many attempts ended in a retryable failure (`retryableFailuresOf`, this one included), which is
+   * what the comment claims — never the Task's total dispatch count. */
+  capped?: { cause: TurnFailureReason; attempts: number; retries: number };
+}
+
+/** Records how a turn ended: the attempt event first (ADR-0009, carrying the Hand-off URL when
+ * there is one), then the pull request link, memory, the comment, and the board with its Status
+ * Label. Returns the ids of the memory entries written. */
+async function settle(tracker: TrackerAdapter, initiativeId: number, task: TrackerTask, s: Settlement, log: (line: string) => void): Promise<number[]> {
+  const opened = s.handOff?.kind === "handed_off" ? s.handOff : undefined;
+  const gatesPassed = s.gates?.passed ?? true;
+  const handedOff = gatesPassed && verificationPassed(s.verification) ? opened : undefined;
+  await tracker.appendRunEvents(initiativeId, [
+    runEvent(task.id, { payload: { case: "attempt", value: { attempt: s.attempt, outcome: s.outcome, summary: attemptSummary(s.summary), handOffUrl: opened?.pullRequest.url } } }),
+  ]);
+  let note = "";
+  if (opened) note = await linkHandOff(tracker, task, opened, log);
+  else if (s.handOff?.kind === "incomplete") note = ` Hand-off incomplete: ${s.handOff.reason}. The Task stays In Progress.`;
+  if (s.gates) note += gateNote(s.gates, s.gateRetries);
+  if (s.verification) note += verifyNote(s.verification);
+  const retry = handedOff ? undefined : s.retry;
+  if (retry) note += ` The Task is Ready again and the Foreman dispatches it as attempt ${s.attempt + 1}${inSeconds(retry.waitMs)}: ${count(retry.attemptsLeft, "attempt")} left under the retry cap.`;
+  const capped = handedOff ? undefined : s.capped;
+  if (capped) {
+    note +=
+      ` Every attempt this Task gets is spent: ${count(capped.attempts, "attempt")} ended ${capped.cause}, which is the retry cap (${count(capped.retries, "further attempt")}) reached.` +
+      ` It stays In Progress under ${STATUS_LABELS.blocked} for a human, and the Foreman goes on with the Initiative's other Tasks.`;
+  }
+  const ids: number[] = [];
+  for (const entry of s.memory) ids.push((await tracker.addMemory(initiativeId, entry)).id);
+  await tracker.addComment(task.id, s.comment(ids, note));
+  await tracker.detachLabel(task.id, STATUS_LABELS.verifying);
+  if (handedOff) {
+    await tracker.detachLabel(task.id, STATUS_LABELS.running);
+    await tracker.moveTask(task.id, "in_review");
+    await markStatus(tracker, task, undefined, STATUS_LABELS.done);
+  } else if (retry) {
+    // The dispatch label back on is what makes the Task Ready again; the column is already an open
+    // one (In Progress), so the Tracker's own readiness rule lets the next tick pick it up.
+    await tracker.detachLabel(task.id, STATUS_LABELS.running);
+    await tracker.attachLabel(task.id, DISPATCH_LABEL);
+  } else {
+    await markStatus(tracker, task, STATUS_LABELS.running, STATUS_LABELS.blocked);
+  }
+  return ids;
+}
+
+/** Links the pull request to the Task through the project's connected repository that matches
+ * the origin, so it rolls up into the Initiative. With no match the link is not guessed: the
+ * comment says which repository to connect. Returns the note for the comment. */
+async function linkHandOff(tracker: TrackerAdapter, task: TrackerTask, handOff: HandedOff, log: (line: string) => void): Promise<string> {
+  const repositories = await tracker.projectRepositories(task.projectId);
+  const wanted = handOff.repositoryFullName?.toLowerCase();
+  const repository =
+    repositories.find((r) => wanted !== undefined && r.fullName.toLowerCase() === wanted) ??
+    (wanted === undefined && repositories.length === 1 ? repositories[0] : undefined);
+  if (!repository) {
+    const connected = repositories.map((r) => r.fullName).join(", ") || "none";
+    log(`hand-off: ${task.identifier} not linked: no connected repository matches origin ${wanted ?? "(unknown)"} (connected: ${connected})`);
+    return ` Not linked to a repository: the project has no connected repository "${wanted ?? "?"}" (connected: ${connected}); connect it so the pull request rolls up into the Initiative.`;
+  }
+  const { pullRequest } = handOff;
+  await tracker.linkPullRequest(task.id, {
+    projectRepositoryId: repository.id,
+    number: pullRequest.number,
+    url: pullRequest.url,
+    title: pullRequest.title,
+    headBranch: pullRequest.headBranch,
+    headSha: handOff.headSha,
+  });
+  log(`hand-off: ${task.identifier} linked ${pullRequest.url} to repository ${repository.fullName}`);
+  return "";
+}
+
+/** What the Task comment says about the Gates: short when they passed, and naming the Gate,
+ * its command and exit code when they did not (story 34). */
+export function gateNote(gates: GateOutcome, retries: number): string {
+  // Said as plainly as a skipped Verifier says it (`verifyNote`): a reader of the Task alone must
+  // never be able to conclude the work was checked when nothing checked it.
+  if (gates.reason === "skipped") {
+    return ` Gates ${gateSummary(gates, retries)}. Nothing on this machine ran the repository's tests, lint or typecheck against this Hand-off; read it as unchecked, not as passing.`;
+  }
+  if (gates.passed) {
+    return ` Gates passed in ${count(gates.rounds.length, "round")}${gates.resumes ? ` after ${count(gates.resumes, "resumed turn")}` : ""}.`;
+  }
+  return ` Gates ${gateSummary(gates, retries)}. The Task stays In Progress under ${STATUS_LABELS.blocked}.`;
+}
+
+/** What the Task comment says about the Verifier: passed, skipped and why, or the Defects. */
+export function verifyNote(outcome: VerifyOutcome): string {
+  if (verificationPassed(outcome)) return ` Verification ${verifySummary(outcome)}.`;
+  return ` Verification ${verifySummary(outcome)}. The Task stays In Progress under ${STATUS_LABELS.blocked}.`;
+}
+
+/** Refuses a Ready Task before its dispatch event: the dispatch label comes off first so the Task
+ * is not picked again next tick, then the comment says why, then the blocked Status Label. No Run
+ * Record event: nothing was dispatched, and a Triage turn that ran has recorded itself already. */
+async function refuse(
+  deps: RunDeps,
+  task: TrackerTask,
+  missing: WorkContractSection[],
+  comment: string,
+  why: string,
+  after?: { triage: TriageTurn; workspace: Workspace },
+): Promise<BlockedTask> {
+  const { tracker, log } = deps;
+  log(`contract: ${task.identifier} blocked, ${why}; "${DISPATCH_LABEL}" removed${after ? `, Workspace ${after.workspace.path} kept` : ""}`);
+  await tracker.detachLabel(task.id, DISPATCH_LABEL);
+  await tracker.addComment(task.id, comment);
+  await markStatus(tracker, task, undefined, STATUS_LABELS.blocked);
+  return { task, missing, ...after };
+}
+
+/** Runs the Triage turn and records it: the attempt event first (ADR-0009), then the draft as a
+ * comment, which is the record later slices read (`draftedVerificationFrom`). */
+async function triageTurn(deps: RunDeps, initiativeId: number, task: TrackerTask, contract: WorkContract, workspace: Workspace, attempt: number, now: () => number): Promise<TriageTurn> {
+  const { tracker, worker, account, log } = deps;
+  const { terminal, durationMs, outputTail, rateLimit } = await driveTriageTurn({
+    worker,
+    account,
+    task,
+    contract,
+    workspace,
+    maxTurns: deps.maxTurns,
+    stallTimeoutMs: deps.stallTimeoutMs,
+    log,
+    now,
+  });
+  const trailer = `\n\nTurn: ${durationMs}ms.${outputTail ? `\n\nOutput tail:\n${outputTail}` : ""}`;
+  // A Triage turn is a turn on the Account, so a limit it hit Pauses the Account exactly as a
+  // Worker turn's would (story 30); the Task itself keeps its dispatch label and is retried.
+  if (terminal.type === "failed" && terminal.reason === "rate_limited") await pauseOnRateLimit(deps, initiativeId, task.id, rateLimit, terminal.message, now());
+  // And a credential it refused counts against the Account exactly as a Worker turn's would
+  // (OPS-288): a Triage turn is a turn on the Account, and a dead login refuses it identically.
+  if (terminal.type === "failed" && terminal.reason === "credential_failed") await noteCredentialFailureOnAccount(deps, initiativeId, task.id, terminal.message, now());
+  // A Triage turn the vendor accepted is proof the credential is live, so it closes an open streak
+  // the same way an implementer turn does.
+  if (terminal.type === "completed") clearCredentialStreak(deps);
+
+  let result: TriageTurn;
+  let summary: string;
+  if (terminal.type === "completed") {
+    const parsed = triageDraftFrom(terminal.report);
+    if (parsed.ok) {
+      result = { attempt, outcome: "completed", verification: parsed.draft.verification, sessionId: terminal.sessionId, durationMs };
+      summary = `triage: drafted Verification section (${parsed.draft.verification.length} chars)${trailer}`;
+    } else {
+      result = { attempt, outcome: "completed", reason: parsed.reason, sessionId: terminal.sessionId, durationMs };
+      summary = `triage: no draft: ${parsed.reason}${trailer}`;
+    }
+  } else {
+    const reason = `${terminal.reason}: ${terminal.message}`;
+    const details = terminal.details?.length ? `\n${terminal.details.join("\n")}` : "";
+    result = { attempt, outcome: attemptOutcomeOf(terminal.reason), reason, sessionId: terminal.sessionId, durationMs };
+    summary = `triage: ${reason}${details}${trailer}`;
+  }
+
+  // The attempt event has no account field, so the summary names it: a Triage turn is a turn on
+  // the Account, and a reader of the Run Record must be able to charge it to one. The marker comes
+  // first and is machine-read: this event shares its attempt number with the implementer turn that
+  // follows it, and the two settlement paths tell them apart by it (core/triage.ts `TRIAGE_MARKER`).
+  summary = `${TRIAGE_MARKER} ${summary.replace(/^triage:/, `triage on ${RUN_RECORD_VENDOR[account.vendor]} Account "${account.name}":`)}`;
+  const turnSpend = spendEvent(task.id, account.vendor, account.name, terminal.type === "completed" ? terminal.costUsd : undefined);
+  await tracker.appendRunEvents(initiativeId, [
+    ...(turnSpend ? [turnSpend] : []),
+    runEvent(task.id, { payload: { case: "attempt", value: { attempt, outcome: result.outcome, summary: attemptSummary(summary) } } }),
+  ]);
+  if (result.verification !== undefined) {
+    await tracker.addComment(task.id, triageComment(result.verification));
+    log(`triage: ${task.identifier} drafted Verification section (${result.verification.length} chars) after ${durationMs}ms`);
+  } else {
+    log(`triage: ${task.identifier} ${result.outcome} after ${durationMs}ms: ${result.reason}`);
+  }
+  return result;
+}
+
+async function dispatch(deps: RunDeps, initiativeId: number, picked: TrackerTask, slot?: SlotHold): Promise<Dispatch | BlockedTask> {
+  const { tracker, worker, account, log } = deps;
+  const now = deps.now ?? Date.now;
+  const ctx = await tracker.getTask(picked.id);
+  const task = ctx.task;
+  assertInInitiative(task, initiativeId);
+
+  // The work contract, before anything is written: a Task that cannot be worked is refused here.
+  const contract = parseWorkContract(task.description);
+  const verdict = validateWorkContract(contract);
+  if (verdict.status === "blocked") {
+    return refuse(deps, task, verdict.missing, blockedComment(verdict.missing), `the work contract is missing: ${verdict.missing.join(", ")}`);
+  }
+
+  const priorDispatches = (await tracker.readRunRecord(initiativeId, { taskId: task.id, kinds: ["dispatch"] })).events.length;
+  const attempt = priorDispatches + 1;
+  const workspace = await deps.workspaces.create(task.identifier);
+
+  let triage: TriageTurn | undefined;
+  let draftedVerification: string | undefined;
+  if (verdict.status === "ok") {
+    log(`contract: ${task.identifier} complete`);
+  } else {
+    const earlier = draftedVerificationFrom(ctx.comments);
+    if (earlier) {
+      log(`contract: ${task.identifier} has no Verification section; using the one drafted in comment #${earlier.commentId}`);
+      draftedVerification = earlier.verification;
+    } else {
+      log(`contract: ${task.identifier} has no Verification section; Triage turn`);
+      triage = await triageTurn(deps, initiativeId, task, contract, workspace, attempt, now);
+      if (triage.verification === undefined) {
+        // Only the Worker saying the contract is too thin to draft is a contract defect. A limit,
+        // a stall, or an adapter failure is the Account's or the machine's, so the Task stays
+        // Ready and the next tick retries, as a Worker turn in the same state would.
+        if (triage.outcome === "completed") {
+          return refuse(deps, task, verdict.missing, triageFailedComment(triage.reason ?? "no draft"), `the Triage turn drafted nothing (${triage.reason})`, { triage, workspace });
+        }
+        // A stall or a rate limit is worth another go within this Run; anything else that ended the
+        // turn without a report (an adapter that would not start, a vendor error, a stop) is not:
+        // no tick of this Run can change it, and looking again in a second would only spin. Only
+        // the retryable outcomes write an attempt event `retryableFailuresOf` counts, so only they
+        // have a cap to be bounded by.
+        if (!RETRYABLE_FAILURES.has(triage.outcome)) {
+          log(`contract: ${task.identifier} Triage turn ${triage.outcome} (${triage.reason}); "${DISPATCH_LABEL}" kept, left to the next Run`);
+          await tracker.addComment(task.id, `Foreman: the Triage turn ended ${triage.outcome} (${triage.reason}); the Task stays Ready and the next Run retries it.`);
+          return { task, missing: verdict.missing, triage, workspace, defer: true };
+        }
+        // Bounded by the same retry cap a failed dispatch is bounded by, and by nothing else: the
+        // Triage turn's own attempt event is one of the retryable failures `retryableFailuresOf`
+        // counts (deliberately, see its comment), so this cannot spin — but it is retried on a
+        // later tick of this Run rather than deferred to the next one.
+        const attemptRetries = deps.attemptRetries ?? DEFAULT_ATTEMPT_RETRIES;
+        const spent = await retryableFailuresOf(tracker, initiativeId, task.id);
+        const attemptsLeft = attemptRetries - (spent - 1);
+        if (attemptsLeft <= 0) {
+          return refuse(
+            deps,
+            task,
+            verdict.missing,
+            triageCappedComment(triage.outcome, triage.reason ?? "no reason given", spent, attemptRetries),
+            `every Triage turn it is allowed ended ${triage.outcome} (${count(spent, "attempt")}, the retry cap)`,
+            { triage, workspace },
+          );
+        }
+        const waitMs = retryBackoff(spent, deps.retryBackoffMs ?? DEFAULT_RETRY_BACKOFF_MS);
+        log(`contract: ${task.identifier} Triage turn ${triage.outcome} (${triage.reason}); "${DISPATCH_LABEL}" kept, retried on a later tick${inSeconds(waitMs)} (${count(attemptsLeft, "attempt")} left under the retry cap)`);
+        await tracker.addComment(
+          task.id,
+          `Foreman: the Triage turn ended ${triage.outcome} (${triage.reason}); the Task stays Ready and is retried${inSeconds(waitMs)}: ${count(attemptsLeft, "attempt")} left under the retry cap.`,
+        );
+        return { task, missing: verdict.missing, triage, workspace, retry: { attemptsLeft, notBefore: (deps.now ?? Date.now)() + waitMs } };
+      }
+      draftedVerification = triage.verification;
+    }
+  }
+
+  const origin = workspace.created ? `new Workspace${workspace.base ? ` from ${workspace.base}` : ""}` : "existing Workspace";
+  log(`dispatch: ${task.identifier} "${task.title}" attempt ${attempt} -> ${workspace.path} (branch ${workspace.branch}, ${origin})`);
+
+  // Run Record first (ADR-0009), then the board. The dispatch label comes off at dispatch so the
+  // Task is never picked twice; the Status Label says who has it.
+  await tracker.appendRunEvents(initiativeId, [
+    runEvent(task.id, {
+      payload: {
+        case: "dispatch",
+        value: { vendor: RUN_RECORD_VENDOR[account.vendor], account: account.name, workspace: workspace.path, branch: workspace.branch, attempt },
+      },
+    }),
+  ]);
+  // The row exists from the moment the dispatch is committed (story 50): a crash anywhere between
+  // here and the vendor's `started` leaves a row with no session, which Reconcile restarts.
+  deps.processTable?.upsertWorker({
+    taskId: task.id,
+    initiativeId,
+    identifier: task.identifier,
+    account: account.name,
+    vendor: account.vendor,
+    workspace: workspace.path,
+    branch: workspace.branch,
+    startedAt: now(),
+    lastOutputAt: now(),
+    attempt,
+  });
+  // From here the Task is being taken. Whatever goes wrong below that is not a typed turn outcome
+  // (a Tracker write failing, a board without the column, an adapter rejecting) must not leave the
+  // Task half-claimed with no trace: it is marked blocked with the reason, and the error still
+  // propagates. The abort writes are best-effort so they cannot mask the original error.
+  let running = false;
+  try {
+    await tracker.detachLabel(task.id, DISPATCH_LABEL);
+    await tracker.moveTask(task.id, "in_progress");
+    await markStatus(tracker, task, undefined, STATUS_LABELS.running);
+    running = true;
+    const done = await work(deps, initiativeId, ctx, workspace, attempt, now, draftedVerification, slot);
+    return { ...done, triage, draftedVerification };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    log(`dispatch: ${task.identifier} aborted: ${message}`);
+    // No Worker is running for the Task any more, so the row would only ever be released.
+    deps.processTable?.removeWorker(task.id);
+    try {
+      await tracker.addComment(task.id, `Foreman: dispatch aborted: ${message}`);
+      await markStatus(tracker, task, running ? STATUS_LABELS.running : undefined, STATUS_LABELS.blocked);
+    } catch (abortError) {
+      log(`dispatch: ${task.identifier} could not record the abort: ${abortError instanceof Error ? abortError.message : String(abortError)}`);
+    }
+    throw error;
+  }
+}
+
+async function work(
+  deps: RunDeps,
+  initiativeId: number,
+  ctx: TaskWithContext,
+  workspace: Workspace,
+  attempt: number,
+  now: () => number,
+  draftedVerification?: string,
+  slot?: SlotHold,
+): Promise<Dispatch> {
+  const { tracker, worker, account, log } = deps;
+  const task = ctx.task;
+
+  let install: InstallResult | undefined;
+  if (!workspace.created) {
+    log("install: skipped, the Workspace already existed");
+  } else {
+    try {
+      install = await (deps.install ?? defaultInstall)(workspace.path);
+    } catch (error) {
+      install = { command: "(install)", exitCode: null, durationMs: 0, outputTail: error instanceof Error ? error.message : String(error) };
+    }
+    if (install) log(`install: ${install.command} exited ${install.exitCode ?? "without a code"} after ${install.durationMs}ms`);
+    else log("install: no install command in the Run Recipe and no lockfile at the Workspace root; nothing to install");
+  }
+  const installNote = install ? `\n\nInstall: ${install.command} exited ${install.exitCode ?? "without a code"}.` : "";
+
+  const prompt = await assemble(deps, initiativeId, ctx, workspace, log, draftedVerification);
+
+  const started = now();
+  const handle = worker.launch({ account, cwd: workspace.path, prompt, maxTurns: deps.maxTurns, stallTimeoutMs: deps.stallTimeoutMs });
+  // The pid goes to the row as soon as there is one (story 50): a crash before the vendor's first
+  // line then leaves a row Reconcile can see is still running, rather than one it would restart
+  // beside the live Worker.
+  if (handle.pid !== undefined) deps.processTable?.setPid(task.id, handle.pid);
+  log(`worker: ${account.vendor} turn on ${task.identifier} in ${workspace.path}`);
+  return observeTurn(deps, initiativeId, ctx, workspace, attempt, handle, { started, installNote, install, draftedVerification, slot });
+}
+
+interface TurnObservation {
+  started: number;
+  installNote: string;
+  install?: InstallResult;
+  resumed?: boolean;
+  /** The Verification section the Worker was given because the Task has none; what the Verifier
+   * follows in that case. */
+  draftedVerification?: string;
+  /** The Slot this turn is running in, when a Run gave it one: swapped for the Account's reserved
+   * Verifier Slot before the Verifier round (core/scheduler.ts). Unset for a turn outside a Run's
+   * Slots (the daemon's idle Reconcile), which is one turn at a time anyway. */
+  slot?: SlotHold;
+}
+
+/** The Verification section the Verifier follows: the Task's own, else the drafted one. */
+function verificationSectionOf(task: TrackerTask, drafted: string | undefined): string | undefined {
+  return parseWorkContract(task.description).sections.Verification ?? drafted;
+}
+
+type TerminalEvent = Extract<AdapterEvent, { type: "completed" | "failed" }>;
+type CompletedEvent = Extract<AdapterEvent, { type: "completed" }>;
+
+/** Where one attempt's turns write: the local transcript and the output lines the tail is cut
+ * from. A Gate's resumed turns append to the same. */
+interface TurnSink {
+  transcript?: TranscriptWriter;
+  output: string[];
+  /** The vendor's last rate-limit report of this turn (story 30). The terminal `failed` event says
+   * only that the turn ended `rate_limited`; the reset the vendor named came on the event before
+   * it, and that is what decides how long the Account is Paused. */
+  rateLimit?: { resetAt?: string; message: string };
+}
+
+/** Follows one turn's event stream to its terminal event: the Process Table learns the session id
+ * the moment `started` arrives and the last output time as text streams (throttled); every event
+ * goes to the local transcript; the output lines are kept for the tail. Shared by a fresh launch,
+ * a Reconcile resume and a Gate's resumed turn. */
+async function followTurn(deps: RunDeps, task: TrackerTask, handle: TurnHandle, sink: TurnSink, started: number): Promise<TerminalEvent> {
+  const { log } = deps;
+  const now = deps.now ?? Date.now;
+  let lastTouch = started;
+  let terminal: TerminalEvent | undefined;
+  for await (const event of handle.events) {
+    sink.transcript?.append(event);
+    switch (event.type) {
+      case "started":
+        deps.processTable?.setSession(task.id, event.sessionId, handle.pid);
+        log(`worker: session ${event.sessionId}${handle.pid !== undefined ? ` (pid ${handle.pid})` : ""}`);
+        break;
+      case "output": {
+        if (deps.processTable) {
+          const at = now();
+          if (at - lastTouch >= TOUCH_INTERVAL_MS) {
+            deps.processTable.touch(task.id, at);
+            lastTouch = at;
+          }
+        }
+        for (const line of event.text.split("\n")) {
+          sink.output.push(line);
+          log(`  | ${line}`);
+        }
+        break;
+      }
+      case "tool":
+        log(`  tool ${event.name}`);
+        break;
+      case "rate_limited":
+        sink.rateLimit = { resetAt: event.resetAt, message: event.message };
+        log(`worker: rate limited: ${event.message}${event.resetAt ? ` (resets ${event.resetAt})` : ""}`);
+        break;
+      case "stalled":
+        log(`worker: stalled, no output for ${event.silentMs}ms`);
+        break;
+      case "completed":
+      case "failed":
+        terminal = event;
+        break;
+    }
+  }
+  if (!terminal) throw new Error("Worker Adapter contract violated: the event stream ended without a terminal event");
+  return terminal;
+}
+
+/** Where a `done` turn stands after its Hand-off (and, when it opened, its Gates). */
+interface DoneState {
+  terminal: CompletedEvent;
+  /** The report as recorded: with the Hand-off the Foreman verified on the remote, over anything
+   * the Worker claimed. */
+  report: CompletionReport;
+  handOff: HandOffResult;
+  handOffNote: string;
+  gates?: GateOutcome;
+  verification?: VerifyOutcome;
+  /** The last `done` report whose Hand-off stands, when `report` is a later turn's that did not
+   * reach one (a blocked report, an incomplete Hand-off); written to memory beside it. */
+  priorDone?: CompletionReport;
+}
+
+/** A `done` turn whose Hand-off opened: the state the Gates judge and the pull request they hold. */
+type HandedOffState = DoneState & { handOff: HandedOff };
+
+/** The Hand-off of a `done` report: pushes and opens or updates the draft pull request, and puts
+ * the verified pull request into the report so memory and the comment name it. */
+async function handOffTurn(deps: RunDeps, initiativeId: number, task: TrackerTask, workspace: Workspace, terminal: CompletedEvent): Promise<DoneState> {
+  let report = terminal.report;
+  const handOff = await (deps.handOff ?? noHandOff)({ task, workspace, report, initiativeId });
+  let handOffNote: string;
+  if (handOff.kind === "handed_off") {
+    report = { ...report, handOff: { branch: workspace.branch, prUrl: handOff.pullRequest.url } };
+    handOffNote = `\n\nHand-off: ${handOff.pullRequest.url}${handOff.reused ? " (updated)" : ""}`;
+  } else {
+    deps.log(`hand-off: ${task.identifier} incomplete: ${handOff.reason}`);
+    handOffNote = `\n\nHand-off incomplete: ${handOff.reason}`;
+  }
+  return { terminal, report, handOff, handOffNote };
+}
+
+/** What the Gates left the attempt in: the state of its last `done` turn (with the Hand-off that
+ * stands, whichever turn opened it), or the failure of a resumed turn beside the last handed-off
+ * state, with the Gates' rounds either way. */
+type GateDrive = { done: DoneState } | { failed: Extract<AdapterEvent, { type: "failed" }>; last: HandedOffState; gates: GateOutcome };
+
+/** Runs the Gates on an open Hand-off and, while they fail and the retry cap allows, resumes the
+ * same Worker session with the failing command and its output, hands its next `done` turn off
+ * again (the same pull request, updated) and runs the Gates once more. Every round's results go to
+ * the Run Record before anything else (ADR-0009); the rounds are summarised on the pull request at
+ * the end, whatever the end was. A resumed turn that ends without a `done` report, or whose
+ * Hand-off is incomplete, ends the Gates as failed with that as the reason: the Task is settled
+ * blocked with what happened, and the last Hand-off that did open stays the attempt's, on the Run
+ * Record, linked to the Task and carrying the comment. */
+async function driveGates(deps: RunDeps, initiativeId: number, ctx: TaskWithContext, workspace: Workspace, attempt: number, state: DoneState, sink: TurnSink): Promise<GateDrive> {
+  const { tracker, worker, account, log } = deps;
+  const now = deps.now ?? Date.now;
+  const task = ctx.task;
+  const gates = deps.gates ?? noGates;
+  const retries = deps.gateRetries ?? DEFAULT_GATE_RETRIES;
+  const rounds: GateRound[] = [];
+  let resumes = 0;
+  // A skip does not hold the Hand-off (a repository may name no Gate), but it is not a pass either:
+  // `gateSummary` and `gateNote` say "skipped" wherever a pass would have said "passed".
+  const outcome = (reason: GateReason, detail?: string): GateOutcome => ({ rounds, passed: reason === "passed" || reason === "skipped", resumes, reason, detail });
+
+  // No Gates without a Hand-off: a turn with nothing to push is settled as it is.
+  if (state.handOff.kind !== "handed_off") return { done: state };
+  let handedOff: HandedOffState = { ...state, handOff: state.handOff };
+  const summarise = async (gates: GateOutcome) => {
+    const { pullRequest } = handedOff.handOff;
+    await commentOnPullRequest(deps, task, pullRequest.number, pullRequest.url, gateComment(gates, retries));
+  };
+
+  for (;;) {
+    const round = rounds.length + 1;
+    const run = await gates(workspace);
+    if (run.skipped) {
+      log(`gate: ${task.identifier} skipped: ${run.reason}; the Hand-off stands as it is, unchecked`);
+      // Past round 1 the base stopped naming Gates between rounds: earlier rounds did judge this
+      // Hand-off, so that is a pass with the reason. At round 1 nothing judged it at all, and that
+      // is carried as a `skipped` outcome rather than as no outcome: with none, `settle` writes no
+      // gate note on the Task and no gate trailer on the attempt event, the Verifier skips too, and
+      // the Task reaches In review under foreman:done with the only trace a line in the daemon log.
+      return { done: { ...handedOff, gates: outcome(rounds.length ? "passed" : "skipped", run.reason) } };
+    }
+    const passed = run.results.every(gatePassed);
+    // Run Record first (ADR-0009): the results are the commit, whatever the resume or the board do next.
+    await tracker.appendRunEvents(
+      initiativeId,
+      run.results.map((r) => gateEvent(task, attempt, round, r)),
+    );
+    rounds.push({ round, results: run.results, passed });
+    for (const r of run.results) log(`gate: ${task.identifier} round ${round}: ${gateLine(r)}`);
+    if (passed) {
+      log(`gate: ${task.identifier} passed in round ${round}${resumes ? ` after ${count(resumes, "resumed turn")}` : ""}`);
+      const done = { ...handedOff, gates: outcome("passed") };
+      await summarise(done.gates);
+      return { done };
+    }
+    const failing = run.results.find((r) => !gatePassed(r))!;
+    if (resumes >= retries) {
+      log(`gate: ${task.identifier} ${failing.name} failed in round ${round}, past the retry cap (${retries}); the Task is blocked`);
+      const done = { ...handedOff, gates: outcome("cap") };
+      await summarise(done.gates);
+      return { done };
+    }
+
+    // The same session, so the Worker keeps its context; the same Process Table row, since the
+    // attempt goes on. The next Hand-off updates the pull request already open for the branch.
+    resumes++;
+    const sessionId = handedOff.terminal.sessionId;
+    log(`gate: ${task.identifier} ${failing.name} failed in round ${round} (${gateLine(failing)}); resuming session ${sessionId}, retry ${resumes} of ${retries}`);
+    const handle = worker.resume(sessionId, {
+      account,
+      cwd: workspace.path,
+      prompt: gateFixPrompt(task, failing, round, retries - resumes),
+      maxTurns: deps.maxTurns,
+      stallTimeoutMs: deps.stallTimeoutMs,
+    });
+    if (handle.pid !== undefined) deps.processTable?.setPid(task.id, handle.pid);
+    const terminal = await followTurn(deps, task, handle, sink, now());
+    if (terminal.type === "failed") {
+      log(`gate: ${task.identifier} resumed turn ${terminal.reason}: ${terminal.message}; the Task is blocked`);
+      const gates = outcome("turn_failed", `${terminal.reason}: ${terminal.message}`);
+      await summarise(gates);
+      return { failed: terminal, last: handedOff, gates };
+    }
+    if (terminal.report.outcome !== "done") {
+      log(`gate: ${task.identifier} resumed turn reported ${terminal.report.outcome}; the Task is blocked`);
+      // The pull request from before is still the attempt's Hand-off; the new report says why it
+      // stopped, and the report it supersedes goes to memory beside it.
+      const gates = outcome("turn_not_done", terminal.report.outcome);
+      await summarise(gates);
+      return { done: { ...handedOff, terminal, report: { ...terminal.report, handOff: handedOff.report.handOff }, gates, priorDone: handedOff.report } };
+    }
+    const next = await handOffTurn(deps, initiativeId, task, workspace, terminal);
+    if (next.handOff.kind !== "handed_off") {
+      log(`gate: ${task.identifier} resumed turn's Hand-off incomplete: ${next.handOff.reason}; the Task is blocked`);
+      // The new report is the work's latest word, but the pull request that stands is the earlier one.
+      const gates = outcome("handoff_incomplete", next.handOff.reason);
+      await summarise(gates);
+      return {
+        done: {
+          ...handedOff,
+          terminal: next.terminal,
+          report: { ...next.report, handOff: handedOff.report.handOff },
+          handOffNote: `${handedOff.handOffNote}\n\nHand-off of the resumed turn incomplete: ${next.handOff.reason}`,
+          gates,
+        },
+      };
+    }
+    handedOff = { ...next, handOff: next.handOff };
+  }
+}
+
+/** Posts the Gates' summary on the pull request; best effort, since the Run Record already has
+ * every result, and a Run without a code host client only logs it. */
+async function commentOnPullRequest(deps: RunDeps, task: TrackerTask, number: number, url: string, body: string, stage: "gate" | "verify" = "gate"): Promise<void> {
+  const what = stage === "gate" ? "summary" : "Verdict";
+  if (!deps.remote) {
+    deps.log(`${stage}: ${task.identifier}: no code host client in this Run, so the ${what} is not posted on ${url}`);
+    return;
+  }
+  try {
+    await deps.remote.addPullRequestComment(number, body);
+    deps.log(`${stage}: ${task.identifier} ${what} posted on ${url}`);
+  } catch (error) {
+    deps.log(`${stage}: ${task.identifier} could not post the ${what} on ${url}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+
+/** The Verifier's round on a Hand-off whose Gates passed: the seam runs the app and the Verifier
+ * Worker; here the screenshots go to the pull request (or stay on this machine, named), the
+ * Verdict goes to the Run Record first (ADR-0009), then to the pull request as a comment. A round
+ * that failed without a Verdict is recorded as a failed Verdict with one Defect saying why. */
+async function driveVerifier(deps: RunDeps, initiativeId: number, task: TrackerTask, workspace: Workspace, attempt: number, handedOff: HandedOff, verification: string | undefined): Promise<VerifyOutcome | undefined> {
+  const { tracker, log } = deps;
+  const now = deps.now ?? Date.now;
+  // No Verifier in the deps: as with the Gates, the loop skips by itself and records nothing;
+  // `foreman run` is what wires the real one.
+  if (!deps.verifier) {
+    log(`verify: ${task.identifier} skipped: this Run has no Verifier configured (RunDeps.verifier); the Hand-off stands as it is`);
+    return undefined;
+  }
+  if (verification === undefined) {
+    log(`verify: ${task.identifier} skipped: the Task has no Verification section and none was drafted`);
+    return { kind: "skipped", reason: "the Task has no Verification section and none was drafted" };
+  }
+  // The Verifier's processes go on the Task's Process Table row: the turn's pid as the row's pid
+  // (the implementer's turn is over), the app's beside it, so `foreman cancel` stops both and
+  // Reconcile stops an app a dead Foreman left running.
+  const onPid = (which: "app" | "verifier", pid: number | undefined) => {
+    if (!deps.processTable) return;
+    if (which === "app") deps.processTable.setAppPid(task.id, pid);
+    else if (pid !== undefined) deps.processTable.setPid(task.id, pid);
+  };
+  let outcome: VerifyOutcome;
+  await markStatus(tracker, task, undefined, STATUS_LABELS.verifying);
+  try {
+    outcome = await deps.verifier({ task, workspace, attempt, initiativeId, verification, onPid });
+  } catch (error) {
+    // The seam threw instead of reporting: a failed round, never an aborted dispatch, so the attempt
+    // event is still written and the Task still lands somewhere a human can see.
+    const reason = `the Verifier failed unexpectedly: ${error instanceof Error ? error.message : String(error)}`;
+    log(`verify: ${task.identifier} ${reason}; the round failed`);
+    outcome = { kind: "failed", reason, durationMs: 0 };
+  }
+  // Off as soon as the round is over, whichever way it went. The catch above does not rethrow, so
+  // every path reaches here; the settlement clears it again as a backstop.
+  await tracker.detachLabel(task.id, STATUS_LABELS.verifying);
+  if (outcome.kind === "skipped") return outcome;
+  let recorded: RecordedVerdict | undefined;
+  try {
+    recorded = await recordVerdict(deps, initiativeId, task, attempt, handedOff, outcome);
+  } catch (error) {
+    // The Verdict could not be recorded (the backend refused the event, say): the round is still
+    // a failed one, recorded as such with a short reason if that at least will go.
+    const reason = `the Verdict could not be recorded: ${error instanceof Error ? error.message : String(error)}`;
+    log(`verify: ${task.identifier} ${reason}; the round failed`);
+    const failed: VerifyOutcome = { kind: "failed", reason, app: outcome.app, durationMs: outcome.durationMs, sessionId: outcome.sessionId, outputTail: outcome.outputTail };
+    try {
+      await tracker.appendRunEvents(initiativeId, [verdictEvent(task, attempt, failureVerdict(reason), [], outcome.app, now())]);
+    } catch (again) {
+      log(`verify: ${task.identifier} the failed round could not be recorded either: ${again instanceof Error ? again.message : String(again)}`);
+    }
+    return failed;
+  }
+  // Every Defect becomes a sibling Task (OPS-273), after the Verdict is committed and outside its
+  // try: a filer that fails leaves a recorded Verdict a human can still act on, never a round
+  // reported as failed for a reason that has nothing to do with what the Verifier saw.
+  await fileDefects(deps, initiativeId, task, handedOff, recorded);
+  return outcome;
+}
+
+/** Files each observed Defect of a failed Verdict as a sibling Task through the seam (defects.ts).
+ * Never throws and never changes what the round was: the Verdict is already the commit, and the
+ * original Task's Hand-off stays open and blocked whether or not its fixes could be filed. */
+async function fileDefects(deps: RunDeps, initiativeId: number, task: TrackerTask, handedOff: HandedOff, recorded: RecordedVerdict): Promise<FiledDefect[]> {
+  const { log } = deps;
+  const { verdict, evidence } = recorded;
+  if (verdict.passed) return [];
+  if (!deps.defects) {
+    log(`defect: ${task.identifier} ${count(verdict.defects.length, "Defect")} not filed: this Run has no Defect filer configured (RunDeps.defects)`);
+    return [];
+  }
+  // A round that failed before the Verifier observed anything carries one stand-in Defect that
+  // says so; there is nothing there for a Worker to fix, and the filer skips it. The Verdict's own
+  // flag says which kind it is, so no Verifier can suppress filing by how it titles a Defect.
+  if (isRoundFailure(verdict)) {
+    log(`defect: ${task.identifier} nothing to file: the round failed before the Verifier observed a Defect`);
+    return [];
+  }
+  try {
+    // No attempt: a Defect is keyed by its title alone, so the same failure seen on a later
+    // attempt is the same Defect and is not filed twice (see core/defects.ts).
+    const filed = await deps.defects({ initiativeId, task, verdict, evidence, pullRequestUrl: handedOff.pullRequest.url });
+    const created = filed.filter((f) => f.task);
+    log(
+      `defect: ${task.identifier} ${count(created.length, "Defect")} filed as ${created.length === 1 ? "a sibling Task" : "sibling Tasks"}${created.length ? `: ${created.map((f) => f.task!.identifier).join(", ")}` : ""}${filed.length > created.length ? ` (${filed.length - created.length} skipped)` : ""}`,
+    );
+    return filed;
+  } catch (error) {
+    log(`defect: ${task.identifier} the Defects could not be filed: ${error instanceof Error ? error.message : String(error)}; the Verdict stands on ${handedOff.pullRequest.url}`);
+    return [];
+  }
+}
+
+/** What `recordVerdict` committed: the Verdict as it was written to the Run Record and where each
+ * Defect's screenshot ended up, so the Defect filer links the evidence rather than pasting it. */
+interface RecordedVerdict {
+  verdict: Verdict;
+  attempt: number;
+  evidence: DefectEvidenceLink[];
+}
+
+/** The screenshots to the pull request (or kept here, named), the `verdict` event to the Run
+ * Record first (ADR-0009), then the Verdict as a comment. Throws only when the Run Record refused
+ * the event; the upload and the comment are best effort and logged. */
+async function recordVerdict(deps: RunDeps, initiativeId: number, task: TrackerTask, attempt: number, handedOff: HandedOff, outcome: Exclude<VerifyOutcome, { kind: "skipped" }>): Promise<RecordedVerdict> {
+  const { tracker, log } = deps;
+  const now = deps.now ?? Date.now;
+  const verdict = verdictOf(outcome);
+  const { pullRequest } = handedOff;
+  const evidence: DefectEvidence[] = [];
+  const links: DefectEvidenceLink[] = [];
+  const urls: string[] = [];
+  for (let i = 0; i < verdict.defects.length; i++) {
+    const shot = outcome.kind === "verified" ? outcome.screenshots.find((s) => s.defect === i) : undefined;
+    if (!shot?.path) {
+      evidence.push({});
+      links.push({});
+      urls.push("");
+      continue;
+    }
+    let uploaded: Awaited<ReturnType<NonNullable<RunDeps["remote"]>["uploadAttachment"]>> | undefined;
+    try {
+      uploaded = await deps.remote?.uploadAttachment(pullRequest.number, shot.path);
+    } catch (error) {
+      log(`verify: ${task.identifier} could not upload ${shot.path} to ${pullRequest.url}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (uploaded) {
+      log(`verify: ${task.identifier} uploaded ${shot.path} as ${uploaded.url}`);
+      evidence.push({ markdown: uploaded.markdown });
+      // The Defect Task links the upload; the bytes stay on the pull request.
+      links.push({ url: uploaded.url });
+      urls.push(uploaded.url);
+    } else {
+      evidence.push({ localPath: shot.path });
+      // No upload on this code host: the Defect Task names the file, never the Foreman's home.
+      links.push({ localFile: basename(shot.path) });
+      urls.push(shot.path);
+    }
+  }
+  // Run Record first (ADR-0009): the Verdict is the commit, whatever the comment or the board do next.
+  await tracker.appendRunEvents(initiativeId, [verdictEvent(task, attempt, verdict, urls, outcome.app, now())]);
+  await commentOnPullRequest(deps, task, pullRequest.number, pullRequest.url, verdictComment(verdict, evidence, outcome.app), "verify");
+  return { verdict, attempt, evidence: links };
+}
+
+/** Follows one attempt to its settlement: the turn, then for a `done` turn the Hand-off and the
+ * Gates (with their resumed turns), then the Run Record, memory, comment and board. Shared by a
+ * fresh launch and a Reconcile resume. */
+async function observeTurn(deps: RunDeps, initiativeId: number, ctx: TaskWithContext, workspace: Workspace, attempt: number, handle: TurnHandle, obs: TurnObservation): Promise<Dispatch> {
+  const { tracker, log } = deps;
+  const now = deps.now ?? Date.now;
+  const task = ctx.task;
+  const { started, installNote, install } = obs;
+  const gateRetries = deps.gateRetries ?? DEFAULT_GATE_RETRIES;
+  const sink: TurnSink = { transcript: deps.transcripts?.open(initiativeId, task.identifier, attempt), output: [] };
+  const first = await followTurn(deps, task, handle, sink, started);
+
+  // Only a `done` turn is handed off: a blocked or failed one keeps its Workspace, and the branch
+  // with it, for the next attempt. What gets recorded is the report with the Hand-off the Foreman
+  // verified on the remote (over anything the Worker claimed), so the memory entries get it as
+  // their source URL and the comment names it; the Worker's own report is left as it was.
+  let terminal: TerminalEvent = first;
+  let done: DoneState | undefined;
+  /** The last handed-off state when a resumed turn then failed: its pull request stands. */
+  let lastDone: HandedOffState | undefined;
+  let gates: GateOutcome | undefined;
+  let handOff: HandOffResult | undefined;
+  if (first.type === "completed" && first.report.outcome === "done") {
+    const drive = await driveGates(deps, initiativeId, ctx, workspace, attempt, await handOffTurn(deps, initiativeId, task, workspace, first), sink);
+    if ("done" in drive) {
+      done = drive.done;
+      terminal = done.terminal;
+      // The Verifier follows passing Gates (story 37): a Hand-off the Gates held, or none, gets no round.
+      if (done.handOff.kind === "handed_off" && (done.gates?.passed ?? true)) {
+        const section = verificationSectionOf(task, obs.draftedVerification);
+        // Into the Account's reserved Verifier Slot (story 29), which gives the implementer Slot
+        // back so the next Ready Task can start. Only for a round that will really run: a Run
+        // without a Verifier, or a Task with nothing to verify, must not hold the reserved Slot
+        // while it decides to skip. (A Task the seam itself then skips — commands only, no user
+        // journey — does hold it, for as long as that decision takes, which is no time at all.)
+        if (deps.verifier && section !== undefined) await obs.slot?.enterVerification();
+        let verification: VerifyOutcome | undefined;
+        try {
+          verification = await driveVerifier(deps, initiativeId, task, workspace, attempt, done.handOff, section);
+        } finally {
+          // The round is over, so the reserved Slot goes to the next dispatch waiting to verify.
+          // What follows — the Verdict comment, the settlement, the board, the row — is round-trips
+          // with nothing running on the Account, and holding the one reserved Slot through them
+          // would stall every other Verifier for the length of a settlement.
+          obs.slot?.leaveVerification();
+        }
+        if (verification) done = { ...done, verification };
+      }
+    } else {
+      terminal = drive.failed;
+      lastDone = drive.last;
+      handOff = lastDone.handOff;
+      gates = drive.gates;
+    }
+  }
+  const durationMs = now() - started;
+  // Before the attempt event, because the spend happened during the turn the attempt settles.
+  const turnSpend = spendEvent(task.id, deps.account.vendor, deps.account.name, terminal.type === "completed" ? terminal.costUsd : undefined);
+  if (turnSpend) await deps.tracker.appendRunEvents(initiativeId, [turnSpend]);
+  const outputTail = tail(sink.output.join("\n"));
+  const trailer = `${installNote}\n\nTurn: ${durationMs}ms.${outputTail ? `\n\nOutput tail:\n${outputTail}` : ""}`;
+  const marker = obs.resumed ? `${RESUMED_MARKER} ` : "";
+  const resumed = obs.resumed ? " (resumed)" : "";
+  const gateTrailer = (g: GateOutcome | undefined) => (g ? `\n\nGates: ${gateSummary(g, gateRetries)}` : "");
+  const verifyTrailer = (v: VerifyOutcome | undefined) => (v ? `\n\nVerification: ${verifySummary(v)}` : "");
+
+  if (terminal.type === "completed") {
+    // A turn the vendor accepted is proof the credential is live: it closes any open streak, so the
+    // failures that quarantine are consecutive ones and a Run's unlucky 401 cannot accumulate with
+    // another an hour later (OPS-288).
+    clearCredentialStreak(deps);
+    const report = done?.report ?? terminal.report;
+    handOff = done?.handOff;
+    gates = done?.gates;
+    const verification = done?.verification;
+    // The recorded report's entries first, so the comment's outcome entry is its own; then the
+    // `done` report it superseded without reaching a Hand-off, so that report is not lost.
+    const own = reportToMemory(task, report);
+    const prior = done?.priorDone ? reportToMemory(task, done.priorDone) : [];
+    const memory = [...own, ...prior];
+    await settle(
+      tracker,
+      initiativeId,
+      task,
+      {
+        attempt,
+        outcome: "completed",
+        summary: `${marker}${report.outcome}: ${report.summary}${done?.handOffNote ?? ""}${gateTrailer(gates)}${verifyTrailer(verification)}${trailer}`,
+        memory,
+        comment: (ids, note) => reportComment(report, ids, `${prior.length ? priorReportNote(ids[own.length]) : ""}${note}`),
+        handOff,
+        gates,
+        verification,
+        gateRetries,
+      },
+      log,
+    );
+    deps.processTable?.removeWorker(task.id);
+    const handedOff =
+      handOff?.kind === "handed_off"
+        ? gates?.passed === false
+          ? `; Hand-off ${handOff.pullRequest.url} held by Gates`
+          : !verificationPassed(verification)
+            ? `; Hand-off ${handOff.pullRequest.url} held by the Verdict`
+            : `; handed off as ${handOff.pullRequest.url}`
+        : handOff
+          ? "; Hand-off incomplete"
+          : "";
+    log(`attempt: ${task.identifier} completed${resumed} (${report.outcome}) after ${durationMs}ms; ${count(memory.length, "memory entry", "memory entries")} written${handedOff}`);
+    return { task, workspace, attempt, outcome: "completed", report, sessionId: terminal.sessionId, durationMs, install, handOff, gates, verification, resumed: obs.resumed };
+  }
+
+  // The stream ended without a report. If a human stopped it from the CLI, the row says so and
+  // the settlement is theirs, not the failure's (stories 53, 56): an attached Worker's attempt
+  // stays open for the attended turn; a cancelled one is closed as cancelled.
+  const control = deps.processTable?.worker(task.id)?.control;
+  if (control === "attached" || control === "released") {
+    // Released already: the attach could not open its session (or the human was quick) and handed
+    // the Worker back before this stream ended; the attempt stays open all the same, for Reconcile.
+    log(
+      control === "attached"
+        ? `attempt: ${task.identifier} attempt ${attempt} stopped for a human to attach after ${durationMs}ms; the attempt stays open until foreman release`
+        : `attempt: ${task.identifier} attempt ${attempt} stopped for a human to attach after ${durationMs}ms and already released; the attempt stays open for the next tick to resume`,
+    );
+    return { task, workspace, attempt, outcome: "stopped", sessionId: terminal.sessionId, durationMs, install, resumed: obs.resumed, attached: true };
+  }
+  if (control === "cancelled") {
+    const details = terminal.details?.length ? `\n${terminal.details.join("\n")}` : "";
+    return settleCancelled(deps, initiativeId, ctx, workspace, attempt, `\n\nThe turn ended ${terminal.reason}: ${terminal.message}${details}${outputTail ? `\n\nOutput tail:\n${outputTail}` : ""}`, obs);
+  }
+
+
+  const failure = terminal;
+  const outcome = attemptOutcomeOf(failure.reason);
+  // After the resumed marker, so a resumed turn still reads as one; `isCredentialSummary` searches
+  // rather than testing a prefix for exactly that reason.
+  const credentialMarker = failure.reason === "credential_failed" ? `${CREDENTIAL_MARKER} ` : "";
+  const details = failure.details?.length ? `\n${failure.details.join("\n")}` : "";
+  const handOffNote = handOff?.kind === "handed_off" ? `\n\nHand-off: ${handOff.pullRequest.url}` : "";
+  // A resumed turn that failed after a `done` turn had been handed off: that report is still the
+  // work's record and goes to memory, though the attempt itself ended without one.
+  const memory = lastDone ? reportToMemory(task, lastDone.report) : [];
+  // The vendor said it is rate limited: the Account is Paused until the reset it named (story 30),
+  // before the Task is settled, so the very next Slot this Run fills already sees it and goes to a
+  // sibling Account instead. The pause is written through the AccountStore rather than held in the
+  // Run, because it outlives the Run: the next Foreman and `foreman account list` read the same
+  // fact. Its own Workers are untouched — they finish where they are, and Reconcile may resume
+  // them; what is Paused is starting new ones.
+  if (failure.reason === "rate_limited") await pauseOnRateLimit(deps, initiativeId, task.id, sink.rateLimit, failure.message, now());
+  // The credential behind the Account is dead rather than busy (OPS-288). Recorded before the Task
+  // is settled for the same reason a pause is: the Slot this frees is filled on the same tick, and
+  // it must not be filled on the Account that just proved it cannot run anything.
+  if (failure.reason === "credential_failed") await noteCredentialFailureOnAccount(deps, initiativeId, task.id, failure.message, now());
+
+  // A stall or a rate limit is the machine's or the vendor's failure, not the work's
+  // (`RETRYABLE_FAILURES`): the Worker went quiet and the adapter stopped it, or the vendor refused
+  // the turn, neither of which says anything about whether the Task can be done. Under the retry
+  // cap the Task is made Ready again and a later tick dispatches it as the next attempt — on
+  // whichever Account is not Paused by then — rather than being left blocked for a human who would
+  // only tell it to try again. At the cap it is blocked like any other failed attempt, with the
+  // comment naming the cause that spent the attempts (story 34), and the Run goes on with its other
+  // Tasks. The next attempt comes on the next tick with no backoff (`DEFAULT_ATTEMPT_RETRIES`): a
+  // fast-failing adapter spends them in milliseconds, on every Slot at once.
+  //
+  // What the cap counts is retryable failures, not dispatches: `attempt` numbers every turn the
+  // Task ever had (the Run Record's numbering, which other components match on), and a Task whose
+  // Gates failed, or whose Verdict found Defects, spent no machine-side attempt at all. Counting
+  // dispatches would let a Task that a human relabelled twice hit its very first rate limit with
+  // nothing left, blocked on a vendor's bad minute with no Failover ever tried; and the comment
+  // would then say "3 attempts ended rate_limited" when one did.
+  const attemptRetries = deps.attemptRetries ?? DEFAULT_ATTEMPT_RETRIES;
+  // The reason, not the outcome: a credential failure is recorded as the generic `failed` and would
+  // otherwise be read as work that cannot be retried (`RETRYABLE_FAILURE_REASONS`).
+  const retryable = RETRYABLE_FAILURE_REASONS.has(failure.reason) && !handOff;
+  // Read only when it can matter: one more Run Record read per retryable failure, none otherwise.
+  const spent = retryable ? (await retryableFailuresOf(tracker, initiativeId, task.id)) + 1 : 0;
+  const attemptsLeft = attemptRetries - (spent - 1);
+  // How long the next attempt waits. Decided from `spent`, the same count the cap is measured in,
+  // so the two never disagree about which attempt this is, and turned into an absolute moment here
+  // against the Run's own clock rather than a duration the tick would have to date itself.
+  const backoffMs = retryable && attemptsLeft > 0 ? retryBackoff(spent, deps.retryBackoffMs ?? DEFAULT_RETRY_BACKOFF_MS) : 0;
+  const retry = retryable && attemptsLeft > 0 ? { attemptsLeft, waitMs: backoffMs } : undefined;
+  const retryNotBefore = retry ? now() + backoffMs : undefined;
+  const capped = retryable && attemptsLeft <= 0 ? { cause: failure.reason, attempts: spent, retries: attemptRetries } : undefined;
+  await settle(
+    tracker,
+    initiativeId,
+    task,
+    {
+      attempt,
+      outcome,
+      summary: `${marker}${credentialMarker}${failure.reason}: ${failure.message}${details}${handOffNote}${gateTrailer(gates)}${trailer}`,
+      memory,
+      comment: (ids, note) => `${failureComment(failure.reason, failure.message)}${memory.length ? priorReportNote(ids[0]) : ""}${note}`,
+      handOff,
+      gates,
+      gateRetries,
+      retry,
+      capped,
+    },
+    log,
+  );
+  deps.processTable?.removeWorker(task.id);
+  log(
+    `attempt: ${task.identifier} ${outcome}${resumed} (${failure.reason}) after ${durationMs}ms: ${failure.message}${memory.length ? `; ${count(memory.length, "memory entry", "memory entries")} written for the earlier done report` : ""}${retry ? `; Ready again${inSeconds(backoffMs)}, ${count(retry.attemptsLeft, "attempt")} left under the retry cap` : ""}${capped ? `; the retry cap (${capped.retries}) is spent on ${capped.cause}, so the Task is blocked and the Run goes on` : ""}`,
+  );
+  return { task, workspace, attempt, outcome, sessionId: failure.sessionId, durationMs, install, handOff, gates, resumed: obs.resumed, retrying: retry !== undefined, blockedByCap: capped !== undefined, retryNotBefore };
+}
+
+/** Pauses the turn's Account after a rate limit (story 30): until the reset the vendor named, or
+ * `DEFAULT_PAUSE_MS` when it named none (`pauseUntilFrom` also refuses a reset far enough ahead to
+ * be a parsing mistake). A Run with no AccountStore has nowhere to put the fact and says so, since
+ * "the Account is Paused" that only one process can see is worse than none. */
+async function pauseOnRateLimit(deps: RunDeps, initiativeId: number, taskId: number | undefined, reported: TurnSink["rateLimit"], fallbackMessage: string, at: number): Promise<void> {
+  const { account, log } = deps;
+  // The reason is the vendor's own prose, parsed out of the Worker's stdout: it is stored in
+  // `~/.opsee/foreman-accounts.json` and printed by `foreman account list`, so it is made one
+  // printable line of a sane length first. An ANSI escape reaching that table would move the
+  // operator's cursor, and its own padding would measure a width the terminal never shows.
+  const reason = printableOneLine(reported?.message ?? fallbackMessage);
+  if (!deps.accounts) {
+    log(`account: "${account.name}" (${account.vendor}) reported a rate limit (${reason}) but this Run has no Account store to record the pause in; nothing is Paused`);
+    return;
+  }
+  // `pauseMs` 0 is not "do not pause": it would set the reset to now, which `pausedUntil` reads as
+  // no pause at all, so the Run would go straight back at the limit that just refused it. A pause
+  // is at least `MIN_PAUSE_MS`.
+  const until = pauseUntilFrom(at, reported?.resetAt, Math.max(MIN_PAUSE_MS, deps.pauseMs ?? DEFAULT_PAUSE_MS));
+  const paused = pauseAccount(deps.accounts, account.name, until, reason);
+  if (!paused) {
+    log(`account: "${account.name}" reported a rate limit but is no longer registered; nothing is Paused`);
+    return;
+  }
+  log(
+    `account: "${account.name}" (${account.vendor}) is Paused until ${until.toISOString()}${reported?.resetAt ? " (the reset the vendor named)" : ` (the vendor named no reset, so ${deps.pauseMs ?? DEFAULT_PAUSE_MS}ms)`}: ${reason}. ` +
+      `No new Worker starts on it until then; the Workers it has keep going, and a Ready Task that has not started goes to another Account of this vendor.`,
+  );
+  await recordAccountState(deps, initiativeId, accountEvent("paused", account.vendor, account.name, reason, { taskId, until }));
+}
+
+/**
+ * Reports on the Run Record every hand-made lift this Run's Accounts are still carrying, then
+ * forgets them (`ResumedState`).
+ *
+ * `foreman account resume` cannot write the event itself: it is a local command over the accounts
+ * file with no Initiative, and a Run Record belongs to one. So it stamps the moment and the next
+ * Run with a Lane on that Account reports it here, carrying the stamp as `occurredAt` — the field
+ * that exists because facts reach this Record late.
+ *
+ * Two consequences, both deliberate. The lift is missing from the Record until a Run next touches
+ * that Account, which is honest rather than invented: nothing had read it yet. And where several
+ * Initiatives could report it, whichever Run gets there first does — an Account belongs to no one
+ * Initiative, so the attribution is arbitrary, which is why the event carries no `taskId`.
+ *
+ * The stamp is cleared only after the append is accepted. Through the outbox that includes a write
+ * that was queued rather than delivered, which is the same commit the rest of the Run Record takes;
+ * a refusal leaves the stamp for the next Run rather than losing the lift.
+ */
+async function reportResumedAccounts(deps: RunDeps, initiativeId: number, lanes: Lane[]): Promise<void> {
+  if (!deps.accounts) return;
+  const stored = deps.accounts.load();
+  for (const lane of lanes) {
+    const current = stored.find((a) => a.name === lane.account.name);
+    const resumed = current?.resumedAt;
+    if (!resumed) continue;
+    const at = new Date(resumed.at);
+    if (!Number.isFinite(at.getTime())) {
+      // A hand-edited accounts file. Dropped rather than dated to now, which would put a moment on
+      // the Record that nobody chose.
+      deps.log(`account: "${lane.account.name}" carries an unreadable resume timestamp (${resumed.at}); it is dropped rather than recorded at the wrong time`);
+      clearResumed(deps.accounts, lane.account.name);
+      continue;
+    }
+    const reason = resumed.from === "both" ? "a human lifted its quarantine and its pause" : `a human lifted its ${resumed.from === "quarantined" ? "quarantine" : "pause"}`;
+    try {
+      await deps.tracker.appendRunEvents(initiativeId, [accountEvent("active", lane.account.vendor, lane.account.name, reason, { occurredAt: at })]);
+      clearResumed(deps.accounts, lane.account.name);
+      deps.log(`account: "${lane.account.name}" was brought back by hand at ${resumed.at}; recorded on the Run Record of Initiative ${initiativeId}`);
+    } catch (error) {
+      deps.log(`account: "${lane.account.name}" was brought back by hand at ${resumed.at}, but the Run Record would not take it, so it stays for the next Run: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+}
+
+/**
+ * Puts an Account's state on the Run Record, and never lets that write cost the Run anything.
+ *
+ * The Run Record is the commit for an *attempt* (ADR-0009): losing one loses the fact that a turn
+ * happened. This is not that. The state itself is already in the accounts file, which is the copy
+ * every Run and every `account list` reads, so a backend that refuses this leaves the schedule
+ * correct and only the record of *when* it changed missing. Failing the turn over it would trade
+ * something that matters for something that does not.
+ */
+async function recordAccountState(deps: RunDeps, initiativeId: number, event: RunEventInput): Promise<void> {
+  try {
+    await deps.tracker.appendRunEvents(initiativeId, [event]);
+  } catch (error) {
+    deps.log(`account: the Account state change could not be written to the Run Record, so the morning summary will not explain it: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+
+/**
+ * Records one credential failure against the turn's Account, and quarantines it once the streak
+ * reaches `CREDENTIAL_FAILURES_BEFORE_QUARANTINE` (OPS-288, story 32).
+ *
+ * The counting is why this is not simply "quarantine on a credential failure". Every vendor pattern
+ * the adapters match is a guess about prose, and the cost of guessing wrong is asymmetric: a false
+ * positive pulls a working Account until a human re-adds it, which overnight is the whole Lane,
+ * where a false negative only spends the Task's retry cap. A `CredentialError` is exempt because it
+ * is not a guess — the Foreman established it about its own Account record before spawning anything
+ * — but it reaches here as a `credential_failed` turn like any other, so the exemption is the
+ * adapter's `launchFailureReason` doing its job upstream and not a second rule here.
+ *
+ * The transition goes to the Initiative's memory log as a `blocker`, which is what `foreman review`
+ * reads in the morning: a Run that went quiet because its only Account died must be able to say so
+ * somewhere a human looks. Deliberately not a Run Record event — there is no Account-state kind, and
+ * `control` means a human steered the Run — which is also why a Pause has never been recorded there.
+ * Written once, on the transition: the check is that the Account was not already quarantined, so a
+ * later Run that meets the same dead login says nothing rather than repeating itself.
+ */
+async function noteCredentialFailureOnAccount(deps: RunDeps, initiativeId: number, taskId: number | undefined, message: string, at: number): Promise<void> {
+  const { account, log } = deps;
+  // The vendor's own prose, on its way to `~/.opsee/foreman-accounts.json` and to two terminal
+  // views: made one printable line first, exactly as a pause reason is.
+  const reason = printableOneLine(message);
+  if (!deps.accounts) {
+    log(`account: "${account.name}" (${account.vendor}) failed for a credential reason (${reason}) but this Run has no Account store to record it in; nothing is quarantined`);
+    return;
+  }
+  const noted = noteCredentialFailure(deps.accounts, account.name, new Date(at), reason);
+  if (!noted) {
+    log(`account: "${account.name}" failed for a credential reason but is no longer registered; nothing is quarantined`);
+    return;
+  }
+  const count = noted.credentialFailures?.count ?? 1;
+  if (count < CREDENTIAL_FAILURES_BEFORE_QUARANTINE) {
+    log(
+      `account: "${account.name}" (${account.vendor}) failed for a credential reason (${reason}); that is ${count} in a row and ${CREDENTIAL_FAILURES_BEFORE_QUARANTINE} quarantines it. ` +
+        `The Account stays in the schedule: one such failure is not enough to take a working Account out of rotation, and a turn that completes on it clears the count.`,
+    );
+    return;
+  }
+  const alreadyQuarantined = isQuarantined(noted);
+  const quarantined = quarantineAccount(deps.accounts, account.name, new Date(at), reason);
+  if (!quarantined) {
+    log(`account: "${account.name}" failed for a credential reason but is no longer registered; nothing is quarantined`);
+    return;
+  }
+  log(
+    `account: "${account.name}" (${account.vendor}) is quarantined after ${count} credential failures in a row: ${reason}. ` +
+      `It contributes no Slots and is not a Failover target; nothing lifts it by itself. Log the vendor back in, then: opsee foreman account resume ${account.name}`,
+  );
+  if (alreadyQuarantined) return;
+  // The Run Record, not the Initiative's memory log. The memory entry only ever existed because the
+  // Record had no Account-state event to put this in; now that it does, one fact lives in one place
+  // and `foreman review` reads it from there.
+  await recordAccountState(deps, initiativeId, accountEvent("quarantined", account.vendor, account.name, reason, { taskId }));
+}
+
+/** Closes an open credential-failure streak on the turn's Account after the vendor accepted a turn.
+ * A no-op without an Account store, and — inside `clearCredentialFailures` — no store write at all
+ * when there is no streak, which is every turn of a healthy Account. */
+function clearCredentialStreak(deps: RunDeps): void {
+  if (deps.accounts) clearCredentialFailures(deps.accounts, deps.account.name);
+}
+
+/** The comment's pointer at the `done` report a later turn superseded without reaching a Hand-off. */
+function priorReportNote(outcomeId: number): string {
+  return ` The earlier done report is in Initiative memory (outcome entry #${outcomeId}).`;
+}
+
+/** What a resumed attempt's summary starts with, so the Run Record says the turn was continued. */
+export const RESUMED_MARKER = "[resumed]";
+
+/** What `RunAttemptEvent.summary` takes (proto/api/v1/initiative.proto: `max_len: 20000`, counted
+ * in code points). */
+export const ATTEMPT_SUMMARY_MAX = 20_000;
+
+/** What the cut says, so the Run Record never ends mid-word with no explanation — every other
+ * truncation here (a Defect's text, a Gate's command and tails) names itself the same way. */
+const SUMMARY_CUT = "\n\n… (summary cut to the Run Record's 20000-character limit; the rest is in the transcript)";
+
+/**
+ * An attempt event's summary within the proto's limit.
+ *
+ * The summary is assembled from a Completion Report's own summary (which the report schema does not
+ * bound), the Hand-off note, the Gate and Verification trailers, the install note and an output
+ * tail. Past 20000 code points the backend answers `InvalidArgument`, which is not queueable
+ * (core/outbox-tracker.ts) — `appendNow` rethrows, `settle` throws, and the dispatch is marked
+ * blocked with no attempt event on the Run Record at all. Under ADR-0009 that is the loss of the
+ * commit itself, so the summary is cut here rather than refused there.
+ */
+export function attemptSummary(text: string): string {
+  if (Array.from(text).length <= ATTEMPT_SUMMARY_MAX) return text;
+  return `${truncateCodePoints(text, ATTEMPT_SUMMARY_MAX - Array.from(SUMMARY_CUT).length)}${SUMMARY_CUT}`;
+}
+
+/** A Task a memory entry or edge points at, or a stand-in when the Tracker no longer has it (a
+ * reconcile deleted it): a missing neighbour must not abort the dispatch of a Task that is fine. */
+async function taskOrPlaceholder(tracker: TrackerAdapter, id: number): Promise<TrackerTask> {
+  try {
+    return (await tracker.getTask(id)).task;
+  } catch {
+    return { id, identifier: `deleted Task ${id}`, title: "(no longer on the Tracker)", description: "", projectId: 0, labels: [] };
+  }
+}
+
+/** The learnings file as the Workspace has it: what the default branch carries, since a Workspace
+ * starts from its remote head. Absent when the repository has none yet. */
+export function acceptedLearningsIn(workspace: Pick<Workspace, "path">, file: string = DEFAULT_LEARNINGS_FILE): AcceptedLearnings | undefined {
+  const path = join(workspace.path, file);
+  return existsSync(path) ? { file, body: readFileSync(path, "utf8") } : undefined;
+}
+
+/** Context Assembly for one Task: reads the blockers' Completion Reports and the siblings'
+ * Proposed Learnings from the Initiative's memory log and the Accepted Learnings from the
+ * Workspace, renders the prompt, and logs what went in. */
+async function assemble(
+  deps: RunDeps,
+  initiativeId: number,
+  ctx: TaskWithContext,
+  workspace: Workspace,
+  log: (line: string) => void,
+  draftedVerification?: string,
+): Promise<string> {
+  const { tracker } = deps;
+  const identifiers = new Map<number, string>([[ctx.task.id, ctx.task.identifier]]);
+  const blockers: BlockerReports[] = [];
+  for (const id of blockerIdsOf(ctx.task.id, ctx.dependencies)) {
+    const blocker = await taskOrPlaceholder(tracker, id);
+    identifiers.set(id, blocker.identifier);
+    // The Tracker writes its own `outcome` entries when a Task moves to Done; those are bookkeeping,
+    // not a Completion Report, and stay out.
+    const reports = (await tracker.listMemory(initiativeId, { kinds: ["outcome"], sourceTaskId: id })).filter((r) => !r.isSystem);
+    blockers.push({ task: blocker, reports });
+  }
+
+  const learnings = (await tracker.listMemory(initiativeId, { kinds: ["learning"] }))
+    .filter((l) => !l.isSystem && l.sourceTaskId !== ctx.task.id)
+    .slice(0, SIBLING_LEARNING_LIMIT);
+  const siblingLearnings: SiblingLearning[] = [];
+  for (const l of learnings) {
+    if (l.sourceTaskId !== undefined && !identifiers.has(l.sourceTaskId)) {
+      identifiers.set(l.sourceTaskId, (await taskOrPlaceholder(tracker, l.sourceTaskId)).identifier);
+    }
+    siblingLearnings.push({ body: l.body, identifier: l.sourceTaskId === undefined ? undefined : identifiers.get(l.sourceTaskId), isAgent: l.isAgent });
+  }
+
+  const assembled = assembleContext({ task: ctx.task, parent: ctx.parent, blockers, acceptedLearnings: acceptedLearningsIn(workspace, deps.learningsFile), siblingLearnings, workspace, draftedVerification });
+  for (const line of assembled.summary) log(`context: ${line}`);
+  return assembled.prompt;
+}