@quickchatai/quickreview 1.3.1 → 1.3.2

package/extensions/vendor/openviking-pi/patches/0014-one-turn-sync-in-flight.patch

@@ -0,0 +1,239 @@
+diff --git a/extensions/vendor/openviking-pi/NOTICE b/extensions/vendor/openviking-pi/NOTICE
+index 15992e4a..1afc0e01 100644
+--- a/extensions/vendor/openviking-pi/NOTICE
++++ b/extensions/vendor/openviking-pi/NOTICE
+@@ -60,6 +60,11 @@ Changed by the quickreviewd maintainers, 2026-08-20:
+  12. The extension is a factory over a configuration value; the process's
+      environment, argv, working directory and home directory are read once, by
+      a shim, and every hook runs under a deadline and a catch (2026-10-19).
++ 13. One turn sync runs at a time per session: a turn that ends while one
++     runs queues its branch, the running sync sends the queued branches in
++     order, each entry sent once by its pi entry id, and agent_end waits for
++     them under turn_end's deadline, so a hook deadline can no longer start a
++     second sync that re-sends the same messages (2026-10-29).
+ 
+ Plus vendoring scaffolding: build-conformance fixes for this repo's stricter
+ tsconfig (ambient type declarations while pi was not installed, retired once
+diff --git a/extensions/vendor/openviking-pi/README.md b/extensions/vendor/openviking-pi/README.md
+index 670e38b2..ca289c2d 100644
+--- a/extensions/vendor/openviking-pi/README.md
++++ b/extensions/vendor/openviking-pi/README.md
+@@ -1,7 +1,7 @@
+ # openviking-pi — vendored, patched fork
+ 
+ The OpenViking pi extension our sessions load. Vendored, not depended on:
+-upstream ships it as an `examples/` directory, not a package, and we need twelve
++upstream ships it as an `examples/` directory, not a package, and we need thirteen
+ behaviour changes that upstream has no reason to make.
+ 
+ | | |
+@@ -20,7 +20,7 @@ fails on drift between the two.
+ 
+ ## Why a fork rather than configuration
+ 
+-Every one of the twelve patches was tried as configuration first and does not
++Every one of the thirteen patches was tried as configuration first and does not
+ exist there. The evidence is a spike against a **running v0.4.15 server plus
+ the pinned pi 0.84.1**, with transcripts, kept with the project's design
+ records. The short version: several of its findings contradict the OpenViking
+@@ -29,12 +29,13 @@ anything here.
+ 
+ ## The patch series
+ 
+-Twelve numbered behaviour patches, applied in order over the vendored upstream
++Thirteen numbered behaviour patches, applied in order over the vendored upstream
+ files, plus two unnumbered build patches (0000 scaffolding, 0012 typing). They live in `patches/` as
+ `git apply`-able diffs — verified by applying the first thirteen, in order, to a
+ pristine `v0.4.15` extraction and diffing the result against this directory:
+-byte-identical. (0013 is checked to apply on the tree the first thirteen
+-produce; the full pristine-extraction replay has not been re-run with it.) (`patches/` and `upstream.json` are meta and are not themselves
++byte-identical. (0013 and 0014 are checked to apply on the tree the patches
++before them produce; the full pristine-extraction replay has not been re-run
++with them.) (`patches/` and `upstream.json` are meta and are not themselves
+ part of the reproduced tree.) Every hunk they add carries a greppable marker:
+ 
+ ```sh
+@@ -488,6 +489,39 @@ Touches: `index.ts`, `config.ts`, `sync.ts`, `qcr-leaf.ts`, `qcr-shim.ts`
+ (new), `qcr-hooks.ts` (new), `shared/pending-queue.mjs` and `.d.mts`, `NOTICE`,
+ this README.
+ 
++### 0014 — one turn sync in flight per session (`[QCR PATCH 13]`)
++
++The `turn_end` hook runs under a deadline (`qcr-hooks.ts`), and a deadline
++that passes returns without cancelling the hook's work. Upstream's
++`syncBranch` then ran on in the background, and under a slow server the next
++turn started a second sync from the same watermark — which only advances once
++a whole sync has finished. One process sent the same messages to one OV
++session several times at once; the server takes a tree lock per session
++append, so they queued on it, timed out client-side (and were queued for
++replay), and the health probes queued behind them. On the bot it was measured
++at up to five appends in flight to one session from its one worker.
++
++`SyncManager.syncBranch` now runs one sync at a time. A turn that ends while
++one runs queues its branch, in memory and in order; the running sync then
++sends each queued branch in turn, so the process sends nothing twice and
++nothing at once, and a later turn (a branch switch included) never overwrites
++an earlier one. Upstream's watermark is a count of entries, so a queued branch
++as long as the one before it would read as sent; what was sent is now
++remembered by pi's entry ids, and only entries without ids fall back to the
++count. The offline queue on disk is
++not used for this: it is shared by every worker, it collapses identical
++payloads and replays by write time, all of which would reorder or drop turns.
++
++A bot worker disposes its session without `session_shutdown`, so the queued
++turns must go out before the prompt resolves: `agent_end` awaits
++`SyncManager.drain()`, and its deadline in `qcr-hooks.ts` is raised from 1 s
++to turn_end's 30 s. With nothing queued, `drain()` settles at once; with a
++slow server the prompt can resolve up to 30 s later than before. Turns still
++queued when that deadline passes are lost with the worker, as a running sync
++was before this patch; the pi transcript keeps them.
++
++Touches: `sync.ts`, `index.ts`, `qcr-hooks.ts`, `NOTICE`, this README.
++
+ ## Rebasing onto a newer upstream
+ 
+ ```sh
+diff --git a/extensions/vendor/openviking-pi/index.ts b/extensions/vendor/openviking-pi/index.ts
+index 8bdc65d9..1b60eeee 100644
+--- a/extensions/vendor/openviking-pi/index.ts
++++ b/extensions/vendor/openviking-pi/index.ts
+@@ -405,6 +405,10 @@ async function register(pi: ExtensionAPI, cfg: OpenVikingConfig): Promise<void>
+   // --- agent_end ---
+   pi.on("agent_end", guard("agent_end", async (_event, _ctx) => {
+     recall.invalidate();
++    // [QCR PATCH 13] The turns queued behind a slow sync go out before the
++    // prompt resolves, under this hook's deadline: a worker disposes its
++    // session without session_shutdown, so this is the last chance.
++    await sync.drain();
+   }));
+ 
+   // ================================================================
+diff --git a/extensions/vendor/openviking-pi/qcr-hooks.ts b/extensions/vendor/openviking-pi/qcr-hooks.ts
+index 8979e729..89d8281c 100644
+--- a/extensions/vendor/openviking-pi/qcr-hooks.ts
++++ b/extensions/vendor/openviking-pi/qcr-hooks.ts
+@@ -32,7 +32,9 @@ export const HOOK_TIMEOUT_MS: Readonly<Record<HookName, number>> = {
+   tool_call: 2_000,
+   turn_end: 30_000,
+   session_shutdown: 5_000,
+-  agent_end: 1_000,
++  // [QCR PATCH 13] agent_end drains the turn syncs queued behind a slow one,
++  // so it gets turn_end's deadline; with nothing queued it returns at once.
++  agent_end: 30_000,
+   command: 15_000,
+ };
+ 
+diff --git a/extensions/vendor/openviking-pi/sync.ts b/extensions/vendor/openviking-pi/sync.ts
+index 037d6306..ddfe651e 100644
+--- a/extensions/vendor/openviking-pi/sync.ts
++++ b/extensions/vendor/openviking-pi/sync.ts
+@@ -38,6 +38,14 @@ export class SyncManager {
+   private syncedEntryCount = 0;
+   private queue: PendingQueueConfig;
+   private debugLog: (message: string) => void;
++  // [QCR PATCH 13] One turn sync in flight per session. A turn that ends
++  // while one runs queues its branch here, in order; the running sync sends
++  // each in turn. `idle` settles when the queue is empty again.
++  private syncing = false;
++  private waiting: any[][] = [];
++  private idle: Promise<void> = Promise.resolve();
++  // [QCR PATCH 13] The ids of the entries already sent (see syncOnce).
++  private sentIds = new Set<string>();
+ 
+   constructor(client: OVClient, config: OVConfig, opts: SyncOptions = {}) {
+     this.client = client;
+@@ -52,6 +60,7 @@ export class SyncManager {
+   restoreWatermark(n: number): void {
+     const next = Math.max(0, Math.floor(Number(n) || 0));
+     this.syncedEntryCount = next;
++    this.sentIds.clear(); // [QCR PATCH 13] the next sync re-seeds from `next`
+   }
+ 
+   /**
+@@ -110,8 +119,54 @@ export class SyncManager {
+     return countUndeliveredForSession(pending, this.ovSessionId) === 0;
+   }
+ 
++  /**
++   * [QCR PATCH 13] The turn_end hook's deadline returns without cancelling
++   * this sync, so under a slow server the next turn used to start a second one
++   * from the same watermark: the same messages went to one session several
++   * times at once and queued on its lock. Now one sync runs at a time. A turn
++   * that ends while it runs queues its branch, and the running sync sends the
++   * queued branches one after another, each from the watermark the one before
++   * it left: nothing is sent twice or at once, and no turn is overwritten by a
++   * later one. `drain()` (awaited at agent_end) waits for the queue to empty.
++   */
+   async syncBranch(branch: any[]): Promise<SyncBranchResult> {
+     if (!this.ovSessionId) return { added: 0, tokens: 0, allDelivered: true };
++    if (this.syncing) {
++      this.waiting.push(branch);
++      return { added: 0, tokens: 0, allDelivered: false };
++    }
++    this.syncing = true;
++    let done!: () => void;
++    this.idle = new Promise<void>((resolve) => (done = resolve));
++    try {
++      const total = await this.syncOnce(branch);
++      for (let next = this.waiting.shift(); next; next = this.waiting.shift()) {
++        const r = await this.syncOnce(next);
++        total.added += r.added;
++        total.tokens += r.tokens;
++        total.allDelivered = total.allDelivered && r.allDelivered;
++      }
++      return total;
++    } finally {
++      this.syncing = false;
++      done();
++    }
++  }
++
++  /** [QCR PATCH 13] Settles once no sync runs and no turn waits for one. */
++  drain(): Promise<void> {
++    return this.idle;
++  }
++
++  private async syncOnce(branch: any[]): Promise<SyncBranchResult> {
++    // [QCR PATCH 13] A queued branch can be as long as the one sent before it
++    // and share none of its entries (a branch switch), so a length watermark
++    // would count its entries as sent. pi gives every entry an id: what was
++    // sent is remembered by id. The watermark below stays for entries without.
++    const ids = branch.map((entry) => entry?.id);
++    if (branch.length > 0 && ids.every((id) => typeof id === "string")) {
++      return this.syncById(branch, ids);
++    }
+ 
+     const extracted = extractBranchCapturePayloads(branch, this.syncedEntryCount, this.config);
+     if (extracted.resetWatermark) this.syncedEntryCount = 0;
+@@ -135,6 +190,31 @@ export class SyncManager {
+     return { added, tokens, allDelivered };
+   }
+ 
++  /** [QCR PATCH 13] Sends each entry of `branch` not sent before, in order. */
++  private async syncById(branch: any[], ids: string[]): Promise<SyncBranchResult> {
++    // A restored watermark counts the branch's first entries as sent.
++    if (this.sentIds.size === 0) {
++      for (const id of ids.slice(0, this.syncedEntryCount)) this.sentIds.add(id);
++    }
++    let added = 0;
++    let tokens = 0;
++    let allDelivered = true;
++    for (const [i, entry] of branch.entries()) {
++      const id = ids[i]!;
++      if (this.sentIds.has(id)) continue;
++      for (const payload of extractBranchCapturePayloads([entry], 0, this.config).payloads) {
++        const result = await this.addPayload(payload);
++        if (!result.accepted) return { added, tokens, allDelivered };
++        added++;
++        tokens += estimatePayloadTokens(payload);
++        allDelivered = allDelivered && result.delivered;
++      }
++      this.sentIds.add(id);
++    }
++    this.syncedEntryCount = branch.length;
++    return { added, tokens, allDelivered };
++  }
++
+   async addPayload(payload: any): Promise<AddPayloadResult> {
+     if (!this.ovSessionId) return { accepted: false, delivered: false };
+     const ok = await this.client.addMessagePayload(this.ovSessionId, payload);

package/extensions/vendor/openviking-pi/qcr-hooks.ts

@@ -32,7 +32,9 @@ export const HOOK_TIMEOUT_MS: Readonly<Record<HookName, number>> = {
   tool_call: 2_000,
   turn_end: 30_000,
   session_shutdown: 5_000,
-  agent_end: 1_000,
+  // [QCR PATCH 13] agent_end drains the turn syncs queued behind a slow one,
+  // so it gets turn_end's deadline; with nothing queued it returns at once.
+  agent_end: 30_000,
   command: 15_000,
 };
 

package/extensions/vendor/openviking-pi/sync.ts

@@ -38,6 +38,14 @@ export class SyncManager {
   private syncedEntryCount = 0;
   private queue: PendingQueueConfig;
   private debugLog: (message: string) => void;
+  // [QCR PATCH 13] One turn sync in flight per session. A turn that ends
+  // while one runs queues its branch here, in order; the running sync sends
+  // each in turn. `idle` settles when the queue is empty again.
+  private syncing = false;
+  private waiting: any[][] = [];
+  private idle: Promise<void> = Promise.resolve();
+  // [QCR PATCH 13] The ids of the entries already sent (see syncOnce).
+  private sentIds = new Set<string>();
 
   constructor(client: OVClient, config: OVConfig, opts: SyncOptions = {}) {
     this.client = client;
@@ -52,6 +60,7 @@ export class SyncManager {
   restoreWatermark(n: number): void {
     const next = Math.max(0, Math.floor(Number(n) || 0));
     this.syncedEntryCount = next;
+    this.sentIds.clear(); // [QCR PATCH 13] the next sync re-seeds from `next`
   }
 
   /**
@@ -110,8 +119,54 @@ export class SyncManager {
     return countUndeliveredForSession(pending, this.ovSessionId) === 0;
   }
 
+  /**
+   * [QCR PATCH 13] The turn_end hook's deadline returns without cancelling
+   * this sync, so under a slow server the next turn used to start a second one
+   * from the same watermark: the same messages went to one session several
+   * times at once and queued on its lock. Now one sync runs at a time. A turn
+   * that ends while it runs queues its branch, and the running sync sends the
+   * queued branches one after another, each from the watermark the one before
+   * it left: nothing is sent twice or at once, and no turn is overwritten by a
+   * later one. `drain()` (awaited at agent_end) waits for the queue to empty.
+   */
   async syncBranch(branch: any[]): Promise<SyncBranchResult> {
     if (!this.ovSessionId) return { added: 0, tokens: 0, allDelivered: true };
+    if (this.syncing) {
+      this.waiting.push(branch);
+      return { added: 0, tokens: 0, allDelivered: false };
+    }
+    this.syncing = true;
+    let done!: () => void;
+    this.idle = new Promise<void>((resolve) => (done = resolve));
+    try {
+      const total = await this.syncOnce(branch);
+      for (let next = this.waiting.shift(); next; next = this.waiting.shift()) {
+        const r = await this.syncOnce(next);
+        total.added += r.added;
+        total.tokens += r.tokens;
+        total.allDelivered = total.allDelivered && r.allDelivered;
+      }
+      return total;
+    } finally {
+      this.syncing = false;
+      done();
+    }
+  }
+
+  /** [QCR PATCH 13] Settles once no sync runs and no turn waits for one. */
+  drain(): Promise<void> {
+    return this.idle;
+  }
+
+  private async syncOnce(branch: any[]): Promise<SyncBranchResult> {
+    // [QCR PATCH 13] A queued branch can be as long as the one sent before it
+    // and share none of its entries (a branch switch), so a length watermark
+    // would count its entries as sent. pi gives every entry an id: what was
+    // sent is remembered by id. The watermark below stays for entries without.
+    const ids = branch.map((entry) => entry?.id);
+    if (branch.length > 0 && ids.every((id) => typeof id === "string")) {
+      return this.syncById(branch, ids);
+    }
 
     const extracted = extractBranchCapturePayloads(branch, this.syncedEntryCount, this.config);
     if (extracted.resetWatermark) this.syncedEntryCount = 0;
@@ -135,6 +190,31 @@ export class SyncManager {
     return { added, tokens, allDelivered };
   }
 
+  /** [QCR PATCH 13] Sends each entry of `branch` not sent before, in order. */
+  private async syncById(branch: any[], ids: string[]): Promise<SyncBranchResult> {
+    // A restored watermark counts the branch's first entries as sent.
+    if (this.sentIds.size === 0) {
+      for (const id of ids.slice(0, this.syncedEntryCount)) this.sentIds.add(id);
+    }
+    let added = 0;
+    let tokens = 0;
+    let allDelivered = true;
+    for (const [i, entry] of branch.entries()) {
+      const id = ids[i]!;
+      if (this.sentIds.has(id)) continue;
+      for (const payload of extractBranchCapturePayloads([entry], 0, this.config).payloads) {
+        const result = await this.addPayload(payload);
+        if (!result.accepted) return { added, tokens, allDelivered };
+        added++;
+        tokens += estimatePayloadTokens(payload);
+        allDelivered = allDelivered && result.delivered;
+      }
+      this.sentIds.add(id);
+    }
+    this.syncedEntryCount = branch.length;
+    return { added, tokens, allDelivered };
+  }
+
   async addPayload(payload: any): Promise<AddPayloadResult> {
     if (!this.ovSessionId) return { accepted: false, delivered: false };
     const ok = await this.client.addMessagePayload(this.ovSessionId, payload);

package/extensions/vendor/openviking-pi/upstream.json

@@ -43,6 +43,7 @@
     "0010-typed-lessons.patch",
     "0011-review-session-memory-boundary.patch",
     "0012-typecheck-against-the-real-pi.patch",
-    "0013-createopenviking-factory.patch"
+    "0013-createopenviking-factory.patch",
+    "0014-one-turn-sync-in-flight.patch"
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quickchatai/quickreview",
-  "version": "1.3.1",
+  "version": "1.3.2",
   "private": false,
   "//private": "The root is the published `qcr` CLI: the whole app (TUI, daemon, companion, every verb), installed with npm, pnpm or bun. It depends on the pi plugin (packages/pi-plugin) at its exact version and on pi at the exact pins below. Publishing is a release step of its own, never part of a build.",
   "description": "A 24/7 AI code reviewer for GitHub: a deterministic daemon driving pi review sessions, with an operator TUI and a local qcr review",
@@ -115,7 +115,7 @@
   },
   "dependencies": {
     "@earendil-works/pi-ai": "1.4.0",
-    "@quickchatai/pi-quickreview": "1.3.1",
+    "@quickchatai/pi-quickreview": "1.3.2",
     "@earendil-works/pi-coding-agent": "1.4.0",
     "better-sqlite3": "13.0.3",
     "smol-toml": "1.9.1"

package/src/cli.ts

@@ -531,6 +531,8 @@ function drainHolderLine(snapshot: StatusSnapshot): string {
 /** What lifts the drain that stands. A snapshot with no hold marker comes from
  * a daemon that does not report holds: whether its boot lifts it is unknown. */
 function drainLiftLine(snapshot: StatusSnapshot): string {
+  if (snapshot.draining_reason && snapshot.draining_until && snapshot.draining_hold !== true)
+    return `lifts itself at ${snapshot.draining_until} and retries; qcr drain off to lift now`;
   if (snapshot.draining_hold === true || snapshot.draining_reason)
     return "only qcr drain off lifts it — no boot does";
   if (snapshot.draining_hold === undefined)

package/src/daemon.ts

@@ -954,8 +954,10 @@ export function createDaemon(deps: DaemonDeps = {}): Daemon {
       } else if (bootFirstPass && standing.draining && standing.reason !== null) {
         // A drain a system set for a reason (the worker crash-loop breaker,
         // `worker_failures`) is not a deploy window: a restart does not clear what
-        // made it. Only an explicit `drain off` does.
-        log(`drain stands — held for ${standing.reason}; only an explicit drain off lifts it`);
+        // made it. It lapses at its own expiry, or an explicit `drain off` lifts it.
+        log(
+          `drain stands — held for ${standing.reason}; ${standing.expires_at ? `it lifts itself at ${standing.expires_at}, or` : "only"} an explicit drain off lifts it`,
+        );
       } else if (bootFirstPass && report.errors.length === 0 && standing.draining) {
         // The operator's lift: this is the deploy flow's drain completing, so
         // it clears whatever hold stands — a session's included.
@@ -983,8 +985,10 @@ export function createDaemon(deps: DaemonDeps = {}): Daemon {
   const pump = async (): Promise<void> => {
     await guard("dispatch", async () => {
       // Session levers that lapsed since the last tick leave the ledger here;
-      // the readers below already treat them as gone.
-      sweepExpiredLevers(store, (line) => log(line));
+      // the readers below already treat them as gone. A drain that lapsed (a
+      // session's, or the worker breaker's healing itself) dropped thread
+      // replies as any drain does: sweep them as a lift would.
+      if (sweepExpiredLevers(store, (line) => log(line)).drain) threadDecisions.requestSweep();
       const orders = await dispatchOnce({
         cfg,
         store,

package/src/ledgercheck.ts

@@ -11,8 +11,14 @@
 // its ledger — no review work, no posting, no verdict file. A second stale
 // detection for the same round never nudges again: it logs
 // `ledger_stale_unresolved`, the grade that wakes the overseer (the session
-// ignored its one nudge). The once-mark is persisted BEFORE the inject, so
-// even a crashed inject can never turn into a nudge loop.
+// ignored its one nudge), once per nudge key; later checks at the same key
+// are a quiet `ledger_stale_repeat` event. The once-mark is persisted BEFORE
+// the inject, so even a crashed inject can never turn into a nudge loop.
+//
+// A recheck uphold (round-less) updates the ledger only "if the delta settled
+// or re-opened a finding" (prompts/round-recheck.md), so on that path a header
+// naming the head the PR was last reviewed at, or a head a recheck upheld
+// since, is fresh too.
 import { readFileSync } from "node:fs";
 import type { StateStore } from "./state.js";
 import { wakeOrHold } from "./wakes.js";
@@ -36,15 +42,32 @@ export function classifyLedger(
   content: string | null,
   pr: number,
   headSha: string,
+  alsoFresh: readonly string[] = [],
 ): LedgerFreshness {
   if (content === null) return "missing";
   const match = LEDGER_HEADER_RE.exec(content);
   if (!match) return "unparseable";
   if (Number(match[1]) !== pr) return "wrong_pr";
   const written = (match[2] as string).toLowerCase();
-  const head = headSha.toLowerCase();
-  const fresh = written === head || (written.length >= MIN_SHA_PREFIX && head.startsWith(written));
-  return fresh ? "fresh" : "stale_sha";
+  const names = (sha: string): boolean => {
+    const head = sha.toLowerCase();
+    return written === head || (written.length >= MIN_SHA_PREFIX && head.startsWith(written));
+  };
+  return names(headSha) || alsoFresh.some(names) ? "fresh" : "stale_sha";
+}
+
+/** The heads a recheck uphold may find in the header besides its own: the head
+ * of the PR's last verdicted round and every head a recheck upheld since. */
+export function upheldLedgerHeads(store: StateStore, pr: number): string[] {
+  const reviewed = store
+    .roundsFor(pr)
+    .filter((r) => r.verdict !== null)
+    .sort((a, b) => b.round_no - a.round_no)[0];
+  const since = reviewed ? (reviewed.finished_at ?? reviewed.started_at) : null;
+  return [
+    ...(reviewed?.head_sha ? [reviewed.head_sha] : []),
+    ...store.recheckUpheldHeads(pr, since),
+  ];
 }
 
 /** The re-nudge wake. Explicitly bookkeeping-only: the rewrite arrives
@@ -99,7 +122,12 @@ export async function enforceLedgerFreshness(
   } catch {
     content = null;
   }
-  const freshness = classifyLedger(content, pr, headSha);
+  const freshness = classifyLedger(
+    content,
+    pr,
+    headSha,
+    roundNo === null ? upheldLedgerHeads(store, pr) : [],
+  );
   if (freshness === "fresh") return "fresh";
 
   const detail = `ledger ${freshness} at ${path}: expected header "LEDGER PR #${pr} @ ${headSha}"`;
@@ -140,9 +168,17 @@ export async function enforceLedgerFreshness(
   if (store.ledgerNudgeSent(pr, key)) {
     // Still stale AFTER the re-nudge: the session ignored its one nudge —
     // this grade WAKES the overseer (the severity map in src/anomalies.ts), first-detection
-    // "ledger_stale" stays quiet (the nudge itself is the response).
-    store.logAnomaly("ledger_stale_unresolved", pr, roundNo, detail);
-    store.logEvent("ledger_stale_repeat", pr, { round_no: roundNo, head_sha: headSha, freshness });
+    // "ledger_stale" stays quiet (the nudge itself is the response). Raised
+    // once per key: a later check at the same key has no new nudge to give,
+    // so it is the quiet repeat event alone.
+    if (!store.ledgerRepeatSeen(pr, key))
+      store.logAnomaly("ledger_stale_unresolved", pr, roundNo, detail);
+    store.logEvent("ledger_stale_repeat", pr, {
+      key,
+      round_no: roundNo,
+      head_sha: headSha,
+      freshness,
+    });
     return "already_nudged";
   }
   store.logAnomaly("ledger_stale", pr, roundNo, detail);

package/src/session-command-supervisor.ts

@@ -4,7 +4,11 @@
 // scheduler. Delivery remains inject-bridge-owned; round recovery remains the
 // VerdictWatcher's existing self-requeue path. The supervisor only classifies
 // finite start/finish obligations from durable command state + JSONL receipts.
-import { roundStageDeadlines } from "@quickchatai/pi-quickreview/src/round-stage-deadlines.js";
+import {
+  discoveryRowsOf,
+  roundStageAllowanceMin,
+  roundStageDeadlines,
+} from "@quickchatai/pi-quickreview/src/round-stage-deadlines.js";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import {
@@ -639,13 +643,15 @@ export class SessionCommandSupervisor {
     const now = this.now().getTime();
     const minute = 60_000;
     const sweepOwed = round.sweep_owed === 1;
+    const discoveryRows = discoveryRowsOf(round);
     const passesMaxMin =
       (this.deps.cfg.daemon.round_passes_max_min ?? DEFAULT_ROUND_PASSES_MAX_MIN) +
-      (sweepOwed ? this.sweepExtraMin() : 0);
+      roundStageAllowanceMin({ sweepOwed, sweepExtraMin: this.sweepExtraMin(), discoveryRows });
     const deadlines = roundStageDeadlines(
       started,
       resolveRoundStageBounds(this.deps.cfg.daemon),
       sweepOwed,
+      discoveryRows,
     );
     const firstPassAt = deadlines.first_pass_start;
     const passesAt = deadlines.passes_complete;
@@ -657,9 +663,10 @@ export class SessionCommandSupervisor {
 
     // The extension's generic subagent milestone is descriptive only. The
     // finite gate opens solely when exact correlated progress names one of the
-    // authoritative planned DISCOVERY lenses — validator-first, an added lens
-    // or a foreign tool cannot buy a later failure class.
-    const fanoutAgents = plannedFanoutAgents(progress, planned);
+    // DISCOVERY lenses the daemon dispatched — the planned ones or the round's
+    // optional rows. Validator-first, a lens added through the add protocol or
+    // a foreign tool cannot buy a later failure class.
+    const fanoutAgents = plannedFanoutAgents(progress, [...planned, ...optionalRowLenses(round)]);
     const plannedFanout = fanoutAgents.length > 0;
     if (plannedFanout) {
       const firstStarted = fanoutAgents.map((agent) => agent.started_at!).sort()[0]!;
@@ -838,8 +845,9 @@ export class SessionCommandSupervisor {
   }
 
   /** The command's fixed running cap in minutes: the configured bound, plus
-   * the sweep allowance when it carries a round whose pre-approval sweep is
-   * owed. Derived from the round ROW, never from progress. */
+   * the round's stage allowance (the pre-approval sweep's when it is owed, or
+   * a large plan's, whichever is larger). Derived from the round ROW, never
+   * from progress. */
   private runningMaxMin(command: SessionCommandRow, round?: RoundRow): number {
     const base =
       this.deps.cfg.daemon.session_command_running_max_min ??
@@ -848,7 +856,15 @@ export class SessionCommandSupervisor {
     const row =
       round ??
       this.deps.store.roundsFor(command.pr).find((item) => item.round_no === command.round_no);
-    return row?.sweep_owed === 1 ? base + this.sweepExtraMin() : base;
+    if (!row) return base;
+    return (
+      base +
+      roundStageAllowanceMin({
+        sweepOwed: row.sweep_owed === 1,
+        sweepExtraMin: this.sweepExtraMin(),
+        discoveryRows: discoveryRowsOf(row),
+      })
+    );
   }
 
   /** The fixed running deadline (epoch ms) of a command whose run began at
@@ -1123,6 +1139,23 @@ function firstExecutionPerLens(
   return first;
 }
 
+/** The lenses of the optional rows the daemon dispatched with the round (the
+ * addable record's `optional` entries); a lens offered for the add protocol
+ * is not one. */
+function optionalRowLenses(round: RoundRow): string[] {
+  if (!round.addable_passes) return [];
+  try {
+    const rows: unknown = JSON.parse(round.addable_passes);
+    if (!Array.isArray(rows)) return [];
+    return rows
+      .filter((row) => (row as { optional?: unknown } | null)?.optional === true)
+      .map((row) => (row as { lens?: unknown }).lens)
+      .filter((lens): lens is string => typeof lens === "string");
+  } catch {
+    return [];
+  }
+}
+
 /** Plan rows per lens name from the round's recorded `pass_plan`; empty when
  * it is absent or unreadable (every lens then owes one execution). */
 function plannedRowCounts(round: RoundRow): Map<string, number> {