@renzrollon/interlock 1.1.1 → 1.2.1

package/lib/run.mjs

@@ -22,15 +22,26 @@
 // through `ctx.deps` rather than being written a second time here.
 
 import { createHash } from 'node:crypto'
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import { dirname, join, resolve } from 'node:path'
 
-import { LIMITS, EFFORT } from './limits.mjs'
+import { LIMITS, EFFORT, RUNTIME } from './limits.mjs'
 import { spawnPrefix } from './host.mjs'
 import { PLUGIN_ROOT } from './doctor.mjs'
 import { RED_SECTION_MARKER, inspectChange, planCoverage, tickTasks } from './artifacts.mjs'
 import { FINGERPRINT_PATH, computeFingerprint, resolvePlanReuse, writeFingerprint } from './plan-fingerprint.mjs'
 import { clearStage } from './ship-stage.mjs'
+import { readModelRouting, runtimeSlotsOf, WORKFLOW_MAX_CONCURRENT_RANGE } from './host/claude-env.mjs'
+import { modelMatches } from './host/model-map.mjs'
+import { readAgentUsage } from './agent-usage.mjs'
+import { resolveStateHome } from './state-home.mjs'
+import {
+  formatInterruptedBanner,
+  formatUnreadableNote,
+  isUnspoken,
+  markSpoken,
+  readInterruptedNotes
+} from './interrupted.mjs'
 import { appendRunLogEvent, checkRunLog } from './run-log.mjs'
 import { appendOutcome, observedFromReceipt } from './outcomes.mjs'
 import { readPredictedPaths, readTouchedPaths } from './run-paths.mjs'
@@ -45,7 +56,7 @@ import {
 import { detectUnarchived } from './drift.mjs'
 import { projectSlug } from './project-slug.mjs'
 import { composeCloseMessage, postNtfy, readNotifyConfig } from './notify.mjs'
-import { SKIP_REASONS, planVerification, judgeVerification } from './verify.mjs'
+import { BANNERS as VERIFY_BANNERS, SKIP_REASONS, foldCheckTimings, planVerification, judgeVerification } from './verify.mjs'
 import { resolveReview, readReviewPolicy } from './review-core.mjs'
 import { writeReviewMetrics } from './metrics.mjs'
 import { planRemediation } from './remediate.mjs'
@@ -59,6 +70,7 @@ import {
   createRunState,
   laneEffort,
   laneLabel,
+  laneTitle,
   laneModel,
   nextStep,
   planWaves,
@@ -112,6 +124,15 @@ export const REPLAN_PATH = join(WORK_DIR, 'replan.json')
 // the agent reports about itself (design D2).
 export const FINDINGS_PATH = join(WORK_DIR, 'findings.json')
 export const VERDICTS_PATH = join(WORK_DIR, 'verdicts.json')
+// The exact bytes the last `run` subcommand printed. The Workflow host's relay
+// is a model retyping stdout, and when its copy does not parse, this is the
+// only record of what the CLI actually said — the halt names it rather than
+// leaving the reader to dig the relay out of a transcript.
+export const LAST_STEP_PATH = join(WORK_DIR, 'last-step.json')
+// One line per `interlock verify exec`: the planned check it ran, its exit code
+// and how long it took, measured by the CLI around the command itself. `run
+// judge` folds these into the inter-wave verify budget and clears the file.
+export const VERIFY_TIMINGS_PATH = join(WORK_DIR, 'verify-timings.jsonl')
 
 /** The first line of every briefing file: what it is, whose it is, and its hash. */
 export const BRIEFING_HEADER = (label, sha) =>
@@ -169,6 +190,12 @@ export const ASSUMED_CAPABILITIES = Object.freeze({
   // manifest written before this key existed reads `false` here, which is the
   // honest answer — that run measured no cache figures either.
   cacheAccounting: false,
+  // Merge default only. A Workflow run does not keep it: `interlock run start
+  // --host workflow` replaces it with the `claude --help` probe before the
+  // manifest is written. A runner manifest written before the key existed also
+  // reads `flag` here, although that run applied no effort at all. Nothing
+  // reads the key from an old manifest — a receipt without the field is null.
+  effort: 'flag',
   billing: 'claude-subscription-programmatic'
 })
 
@@ -257,9 +284,9 @@ export function newManifest({ change, flags, host, hostCapabilities }) {
     // so a driver that skips or repeats a step is told which call was expected
     // rather than silently advancing the state machine twice.
     lastThen: null,
-    // The shared-tree HEAD captured when an isolated batch was dispatched, held
-    // across the driver round trip so `record-batch` folds against the base the
-    // lanes actually forked from. The emitted step carries it for the driver;
+    // The shared-tree snapshot captured when an isolated batch was dispatched
+    // (HEAD itself on a clean tree), held across the driver round trip so
+    // `record-batch` folds against the base the lanes actually forked from. The emitted step carries it for the driver;
     // this is where the CLI reads it back, because the driver returns only
     // results and the wave state has no such field.
     mergeBase: null,
@@ -299,7 +326,14 @@ export function newManifest({ change, flags, host, hostCapabilities }) {
     handoff: null,
     // The autonomy-ladder record `run close` wrote, from the CLI's own
     // surviving-blocker count (design D6). Storage only; nothing prints a level.
-    autonomy: null
+    autonomy: null,
+    // Every briefed spawn this run dispatched once it had an id — wave, label,
+    // kind, routed model and briefing sha — which is the table `run close` joins
+    // the recorder's sidecar against (ship/agent-results).
+    dispatched: [],
+    // The runner lanes whose host recorded a session, for the resume card's
+    // `claude --resume` lines. Empty on the Workflow host, which has none.
+    laneSessions: []
   }
 }
 
@@ -377,6 +411,62 @@ export function hostId(manifest) {
   return typeof host === 'string' && host ? host : null
 }
 
+/**
+ * The fields of a step the Workflow host's interpreter reads, and no others.
+ *
+ * On that host a step reaches `workflows/ship.js` through a relay — a model that
+ * runs the command and RETYPES its stdout into a result field. A 23 KB step was
+ * retyped with a duplicated key run and two dropped brackets, did not parse, and
+ * halted a healthy run at wave 6. Nearly all of those bytes were things the
+ * interpreter never reads: each spawn's inline `prompt` (the worker is handed
+ * `promptPath` and `promptSha256` instead), and the carried wave state —
+ * `remainingBatches`, `previousHandoffs`, `changed` — which the next `run`
+ * subcommand reads back from `state.json`, never from the step.
+ *
+ * A whitelist rather than a list of what to drop, so a field added to the step
+ * later cannot quietly grow the relay again. The other direction — the
+ * interpreter starting to read a field this drops — is pinned by a scan of
+ * ship.js in test/workflows.test.mjs.
+ */
+export const RELAY_STEP_FIELDS = Object.freeze([
+  'schema',
+  'action',
+  'then',
+  'spawns',
+  'banners',
+  'change',
+  'wave',
+  'reason',
+  // The control-plane ping model `run start` decided (design D3). The driver
+  // sets its relay pings' model from this field and from nothing else.
+  'pingModel'
+])
+
+/**
+ * The step as the run's host should receive it.
+ *
+ * Branches on the host id for the reason `hostSessionId` does: "stdout is
+ * copied by a model" is a property of the Workflow runtime alone — the runner
+ * refuses that id and reads stdout as a process. Every other host, and a run
+ * that named none, gets the whole step: `bin/interlock-run` sends `prompt`
+ * inline and needs it.
+ */
+export function relayStep(manifest, step) {
+  if (hostId(manifest) !== WORKFLOW_HOST || !step || typeof step !== 'object') return step
+  const out = {}
+  for (const field of RELAY_STEP_FIELDS) {
+    if (step[field] !== undefined) out[field] = step[field]
+  }
+  if (Array.isArray(step.spawns)) {
+    out.spawns = step.spawns.map(s => {
+      if (!s || typeof s !== 'object') return s
+      const { prompt, ...rest } = s
+      return rest
+    })
+  }
+  return out
+}
+
 // --- the step budget (design D9) --------------------------------------------
 
 /**
@@ -583,6 +673,313 @@ export function summarizeUsage(manifest) {
   }
 }
 
+// --- what the host observed about each agent (ship/agent-results) -----------
+//
+// Two hosts, two channels, one set of verdicts. On a runner the adapter reads
+// each lane's `claude -p` envelope and its session transcript and forwards a
+// host record beside the result (`--host-records`); on the Workflow host the
+// recorder hooks leave one sidecar file per agent, which the close joins to the
+// spawns this program dispatched. Either way the CLI decides here, in the words
+// below, and a driver decides none of it.
+
+/** The one wording both hosts print for a lane a different model ran (design D6). */
+export function modelSubstitutedBanner(label, routed, ran) {
+  return `MODEL SUBSTITUTED: ${label} routed ${routed}, ran ${ran.join(', ')}`
+}
+
+/** A lane the host ended with an error or a non-zero exit, named by what it reported. */
+export function laneStoppedBanner(label, how) {
+  return `LANE STOPPED BY HOST: ${label} ${how}`
+}
+
+/** A success with no structured result: the open vendor bug this adapter's configuration triggers. */
+export function schemaResultMissingBanner(label) {
+  return (
+    `SCHEMA RESULT MISSING (claude): ${label} — success without structured_output ` +
+    `(anthropics/claude-code#82258)`
+  )
+}
+
+/** The host denied tool calls inside a lane. A count the reader interprets, never a verdict. */
+export function toolsDeniedBanner(label, count, tools) {
+  return `TOOLS DENIED IN LANE: ${label} ${count}${tools.length ? ` (${tools.join(', ')})` : ''}`
+}
+
+/**
+ * Whether a spawn ran on a model other than the one it was routed to (design D6).
+ *
+ * The matcher compares; what it is fed decides what a mismatch MEANS, and the
+ * two observations do not mean the same thing. `servedModels` is turn-scoped —
+ * the model of every assistant turn the agent itself took, read from its own
+ * transcript — so ANY unmatched id is a model the plan did not choose, a
+ * fallback that served one turn included. `sessionModels` is session-scoped —
+ * the `claude -p` envelope's per-model breakdown, which also lists the host's
+ * internal calls (every captured envelope carried a haiku entry the session was
+ * not routed to) — so there only a session the routed model NEVER served is
+ * established. The strongest observation present decides; neither, or no
+ * routed model, decides nothing.
+ *
+ * The only caller of `modelMatches`; called from the runner's record path and
+ * the Workflow close, and nowhere else (`test/spine/host-adapters.test.mjs`).
+ *
+ * @param {string|null|undefined} routed
+ * @param {{servedModels?: string[]|null, sessionModels?: string[]|null}} [observed]
+ * @returns {{substituted: boolean|null, scope: 'turns'|'session'|null, ran: string[]}}
+ */
+export function modelSubstitution(routed, { servedModels, sessionModels } = {}) {
+  const want = typeof routed === 'string' ? routed.trim() : ''
+  const ids = value => (Array.isArray(value) ? value.filter(m => typeof m === 'string' && m.trim()) : [])
+  const served = ids(servedModels)
+  const session = ids(sessionModels)
+  if (!want) return { substituted: null, scope: null, ran: [] }
+  if (served.length) {
+    return { substituted: served.some(m => modelMatches(want, m) === false), scope: 'turns', ran: served }
+  }
+  if (session.length) {
+    return { substituted: !session.some(m => modelMatches(want, m) === true), scope: 'session', ran: session }
+  }
+  return { substituted: null, scope: null, ran: [] }
+}
+
+/** The most recent spawn this run dispatched under a label, or null. */
+function dispatchedSpawn(manifest, label) {
+  const list = Array.isArray(manifest.dispatched) ? manifest.dispatched : []
+  for (let i = list.length - 1; i >= 0; i--) if (list[i] && list[i].label === label) return list[i]
+  return null
+}
+
+/** The receipt's runner counts, created on the first host record and never before. */
+function agentCounts(manifest) {
+  if (!manifest.agentCounts || typeof manifest.agentCounts !== 'object') {
+    manifest.agentCounts = { lanesStoppedByHost: 0, schemaResultsMissing: 0, toolsDeniedInLanes: 0, modelSubstitutions: 0 }
+  }
+  return manifest.agentCounts
+}
+
+/**
+ * Every record path's bookkeeping for the spawns it received: the usage the
+ * results carry, as before, and — on a runner — what the host observed about
+ * each one (design D9).
+ *
+ * For each host record it raises the lane banners, stores the lane's session for
+ * the resume card, increments the receipt's counts, and appends one
+ * `agent-result` to the trajectory. That append is the trajectory's fatal class:
+ * the failure is returned for the caller to halt on BEFORE anything is ticked.
+ * A step with no host records — a Workflow run, a host that sent none — raises
+ * nothing and counts nothing: absence stays unknown.
+ *
+ * @returns {{failure: string|null}}
+ */
+function recordSpawnObservations(ctx, manifest, { results, hostRecords, wave = null } = {}) {
+  recordUsage(manifest, results, wave)
+  const records = Array.isArray(hostRecords) ? hostRecords.filter(r => r && typeof r === 'object') : []
+  if (!records.length) return { failure: null }
+  const counts = agentCounts(manifest)
+  if (!Array.isArray(manifest.laneSessions)) manifest.laneSessions = []
+  if (!Array.isArray(manifest.banners)) manifest.banners = []
+  let failure = null
+
+  for (const record of records) {
+    const label = typeof record.label === 'string' && record.label ? record.label : 'agent'
+    const subtype = typeof record.subtype === 'string' && record.subtype ? record.subtype : null
+    const exitCode = Number.isInteger(record.exitCode) ? record.exitCode : null
+    const stopped = record.isError === true || record.timedOut === true || (exitCode !== null && exitCode !== 0)
+
+    let outcome = 'returned'
+    if (stopped) {
+      const how =
+        subtype && subtype !== 'success'
+          ? subtype
+          : record.timedOut === true
+            ? 'timed out'
+            : exitCode !== null && exitCode !== 0
+              ? `exit ${exitCode}`
+              : subtype || 'error'
+      manifest.banners.push(laneStoppedBanner(label, how))
+      counts.lanesStoppedByHost++
+      outcome = `stopped by the host (${how})`
+    }
+    if (record.resultMissing === true) {
+      manifest.banners.push(schemaResultMissingBanner(label))
+      counts.schemaResultsMissing++
+      if (!stopped) outcome = 'returned no structured result'
+    }
+    const denials = record.permissionDenials && typeof record.permissionDenials === 'object' ? record.permissionDenials : null
+    const denied = denials && Number.isInteger(denials.count) ? denials.count : null
+    if (denied !== null && denied > 0) {
+      const tools = [...new Set((Array.isArray(denials.tools) ? denials.tools : []).filter(t => typeof t === 'string' && t))]
+      manifest.banners.push(toolsDeniedBanner(label, denied, tools))
+      counts.toolsDeniedInLanes++
+    }
+    const verdict = modelSubstitution(record.modelRouted, record)
+    if (verdict.substituted === true) {
+      manifest.banners.push(modelSubstitutedBanner(label, record.modelRouted.trim(), verdict.ran))
+      counts.modelSubstitutions++
+    }
+    if (typeof record.sessionId === 'string' && record.sessionId) {
+      manifest.laneSessions.push({ label, sessionId: record.sessionId, outcome })
+    }
+
+    if (!manifest.runId) continue
+    const spawned = dispatchedSpawn(manifest, label)
+    const written = appendRunLogEvent(stateHomeOf(ctx, manifest), {
+      runId: manifest.runId,
+      change: manifest.change,
+      type: 'agent-result',
+      label,
+      kind: spawned ? spawned.kind : undefined,
+      source: 'envelope',
+      subtype: record.subtype,
+      isError: record.isError,
+      terminalReason: record.terminalReason,
+      errors: record.errors,
+      permissionDenials: record.permissionDenials,
+      sessionId: record.sessionId,
+      numTurns: record.numTurns,
+      modelRouted: record.modelRouted,
+      servedModels: record.servedModels,
+      sessionModels: record.sessionModels,
+      modelScope: verdict.scope,
+      substituted: verdict.substituted,
+      resultMissing: record.resultMissing,
+      usage: record.usage,
+      hostCostUsd: record.hostCostUsd
+    })
+    if (!written.written) {
+      ctx.warn(`agent-result not recorded: ${written.reason}`)
+      if (!failure) failure = `${label}: ${written.reason}`
+    }
+  }
+  return { failure }
+}
+
+/** One wave's or the run's cache figures, summed over joined agents, unknown-contagious. */
+function sumJoinedCache(agents) {
+  let read = 0
+  let tiers = { ephemeral_5m: 0, ephemeral_1h: 0 }
+  let total = 0
+  for (const agent of agents) {
+    const usage = agent.usage
+    read = read === null || !Number.isFinite(usage.cacheReadInputTokens) ? null : read + usage.cacheReadInputTokens
+    const creation = usage.cacheCreationInputTokens
+    const split =
+      creation && Number.isFinite(creation.ephemeral_5m) && Number.isFinite(creation.ephemeral_1h)
+        ? creation
+        : null
+    const known = split ? split.ephemeral_5m + split.ephemeral_1h : creation && Number.isFinite(creation.total) ? creation.total : null
+    total = total === null || known === null ? null : total + known
+    // One agent recorded only a total: the wave's split is unknown, its total is not.
+    tiers = tiers === null || !split ? null : { ephemeral_5m: tiers.ephemeral_5m + split.ephemeral_5m, ephemeral_1h: tiers.ephemeral_1h + split.ephemeral_1h }
+  }
+  return {
+    cacheReadInputTokens: read,
+    cacheCreationInputTokens: tiers !== null ? tiers : total !== null ? { total } : null
+  }
+}
+
+/**
+ * Join what the recorder hooks wrote for this run to the spawns it dispatched
+ * (design D5), by the briefing sha256 every bootstrap carries.
+ *
+ * The denominator is the briefed spawns dispatched once the run had an id: the
+ * recorder writes nothing without one, so a spawn dispatched before it (the
+ * planner) could never join, and counting it would make every run partial. A
+ * spawn that did not join, or joined a transcript with no usage, makes its
+ * wave's figures unknown. A recorded agent nobody dispatched — a relay ping,
+ * which carries no briefing, or any other workflow the matcher admitted — is
+ * counted apart and attributed nowhere.
+ */
+function joinAgentUsage(root, manifest) {
+  const read = manifest.runId
+    ? readAgentUsage(root, manifest.runId)
+    : { present: false, agents: [], permissions: [], unreadable: [] }
+  const briefed = (Array.isArray(manifest.dispatched) ? manifest.dispatched : []).filter(
+    d => d && typeof d.sha === 'string' && d.sha
+  )
+  const pool = new Map()
+  for (const agent of read.agents) {
+    const key = typeof agent.briefingSha === 'string' && agent.briefingSha ? agent.briefingSha : null
+    if (!key) continue
+    if (!pool.has(key)) pool.set(key, [])
+    pool.get(key).push(agent)
+  }
+
+  const joined = []
+  const waves = new Map()
+  let unrecorded = 0
+  for (const spawned of briefed) {
+    const candidates = pool.get(spawned.sha) || []
+    const agent = candidates.shift() || null
+    const usable = Boolean(agent && agent.usage && typeof agent.usage === 'object')
+    if (!usable) unrecorded++
+    if (agent) joined.push({ spawned, agent })
+    const wave = Number.isInteger(spawned.wave) ? spawned.wave : null
+    if (!waves.has(wave)) waves.set(wave, { agents: [], complete: true })
+    const entry = waves.get(wave)
+    if (usable) entry.agents.push(agent)
+    else entry.complete = false
+  }
+  const leftover = [...pool.values()].flat().length
+  const noKey = read.agents.filter(a => !(typeof a.briefingSha === 'string' && a.briefingSha)).length
+
+  const cacheByWave = new Map()
+  for (const [wave, entry] of waves) {
+    cacheByWave.set(
+      wave,
+      entry.complete ? sumJoinedCache(entry.agents) : { cacheReadInputTokens: null, cacheCreationInputTokens: null }
+    )
+  }
+  const complete = read.present && briefed.length > 0 && unrecorded === 0
+  return {
+    present: read.present,
+    // Read before the close refines it: only a host that declared it cannot
+    // account for cache has its figures supplied by the hooks.
+    cacheFromHooks: hostCapability(manifest, 'cacheAccounting') === false,
+    briefed: briefed.length,
+    unrecorded,
+    complete,
+    joined,
+    cacheByWave,
+    runCache: complete
+      ? sumJoinedCache(joined.map(j => j.agent))
+      : { cacheReadInputTokens: null, cacheCreationInputTokens: null },
+    unjoined: { noKey, unknownKey: leftover },
+    permissions: read.permissions,
+    unreadable: read.unreadable
+  }
+}
+
+// --- the state home (ship/state-home) ----------------------------------------
+//
+// Corpora — the trajectory, the outcome line, the metrics, the resume card, the
+// interrupted notes, the autonomy ledger — go to the state home, which is the
+// main checkout when the run is in a linked worktree; per-run working state —
+// this manifest, the wave state, briefings, spill, the marker, the sidecar —
+// stays in `ctx.root`. `run start` resolves the home once and records it; every
+// later subcommand reads it back from here and never resolves again.
+
+/** Where this run's corpora are written: the recorded home, or the root for a manifest without one. */
+export function stateHomeOf(ctx, manifest) {
+  return manifest && typeof manifest.stateHome === 'string' && manifest.stateHome ? manifest.stateHome : ctx.root
+}
+
+/** The test profile and the graph, located root-first then home (design D16). */
+export const TEST_PROFILE_PATH = join('.claude', 'testing', 'profile.json')
+export const GRAPH_FILE_PATH = join('.claude', 'graph', 'graph.json')
+
+/** The graph line raised at start when neither the root nor the home has one. */
+export const GRAPH_UNAVAILABLE_BANNER =
+  'GRAPH UNAVAILABLE: never built — implementer and reviewer agents fall back to grep and will be slower'
+
+/** Root first, then the home, never written: the inputs a worktree run reads through. */
+function locateInput(root, home, relative) {
+  const atRoot = resolve(root, relative)
+  if (existsSync(atRoot)) return { path: atRoot, source: 'root' }
+  const atHome = resolve(home, relative)
+  if (resolve(home) !== resolve(root) && existsSync(atHome)) return { path: atHome, source: 'state-home' }
+  return { path: null, source: 'none' }
+}
+
 // --- briefings (design D2) --------------------------------------------------
 
 // --- lane worktrees (design D7) ---------------------------------------------
@@ -631,8 +1028,9 @@ export function briefingHash(text) {
  * The Workflow host cannot hold a briefing — it has no filesystem, and asking a
  * ping to copy several kilobytes into a result field would breach the published
  * result-field cap — so it spawns the worker with a fixed bootstrap naming this
- * path and requires the hash back. The ACP host reads `prompt` and sends it
- * inline. One file serves both.
+ * path and requires the hash back — and never sees `prompt` at all, since
+ * `relayStep` drops it from what that host's relay copies. The runner hosts
+ * read `prompt` and send it inline. One file serves both.
  */
 export function writeBriefing(root, label, text) {
   const promptSha256 = briefingHash(text)
@@ -656,9 +1054,12 @@ const AUTONOMY_LINE =
   'guessing at product intent.'
 
 /** One agent a step asks for. */
-function spawn(root, { label, kind, model, effort, schema, prompt, isolation, worktree }) {
+function spawn(root, { label, title, kind, model, effort, schema, prompt, isolation, worktree }) {
   return {
     label,
+    // What a person sees the agent as. `label` stays the key every record joins
+    // on; a spawn with nothing to add is shown under its label.
+    title: title || label,
     kind,
     model: model || null,
     effort: effort === undefined ? null : effort,
@@ -786,6 +1187,7 @@ export function decorate(ctx, step, manifest, extra = {}) {
     const spawns = lanes.map(lane =>
       spawn(root, {
         label: laneLabel(lane),
+        title: laneTitle(lane),
         kind: 'implementer',
         model: laneModel(lane),
         effort: laneEffort(lane),
@@ -809,13 +1211,19 @@ export function decorate(ctx, step, manifest, extra = {}) {
           })
       })
     )
-    // The shared tree's HEAD before this batch's lanes fork off — read now, not
-    // after, so nothing else lands on the shared tree between the reading and
-    // the fold. Only under isolation; unset, a batch runs byte-for-byte as it
-    // did before worktree isolation existed.
+    // The base this batch's lanes fork from: a snapshot of the shared tree as it
+    // stands — tracked edits and every untracked file the ignore rules let
+    // through — so it includes every earlier fold of this run. Not HEAD: the
+    // ship commit is the run's last step, so HEAD never moves while batches
+    // fold, and a lane forked from it edits a copy that lacks them; its
+    // whole-file fold would then revert the earlier batch with exit 0. A clean
+    // tree snapshots to HEAD itself. Captured now, not after, so nothing lands
+    // on the shared tree between the capture and the fold. Only under
+    // isolation; unset, a batch runs byte-for-byte as it did before worktree
+    // isolation existed.
     let mergeBase = null
     if (isolate) {
-      mergeBase = ctx.deps.headCommit(root)
+      mergeBase = ctx.deps.snapshotTree(root, change)
       if (!mergeBase) {
         return haltStep(
           'could not capture the shared-tree base commit before an isolated batch — merge-lanes ' +
@@ -826,8 +1234,8 @@ export function decorate(ctx, step, manifest, extra = {}) {
       // Onto the manifest as well as onto the step. The step goes to the driver
       // and the driver returns only results; `record-batch` reads a pure
       // wave-state step that carries no such field, so without this the fold
-      // would re-read HEAD *after* the lanes ran — a different commit whenever
-      // anything else landed on the shared tree in between.
+      // would re-read HEAD *after* the lanes ran — never the snapshot they
+      // forked from.
       manifest.mergeBase = mergeBase
     }
     return makeStep({
@@ -859,6 +1267,7 @@ export function decorate(ctx, step, manifest, extra = {}) {
           label: `replan-${manifest.steps}`,
           kind: 'ping',
           model: 'haiku',
+          // effort-routing: "Control-plane and prose spawns SHALL inherit the host's effort".
           effort: null,
           schema: REPLAN_SCHEMA,
           prompt: assembleReplanPrompt({ change, replanPath: REPLAN_PATH })
@@ -912,7 +1321,7 @@ export function finalVerifyStep(ctx, manifest, carried = {}) {
 function verifyStep(ctx, manifest, { context, label, changed, carried, action = 'verify' }) {
   const { root } = ctx
   const interWave = context === 'inter-wave'
-  const profile = readProfile(root)
+  const profile = readProfile(root, manifest)
   const opts = { context, changed }
   if (context === 'final') {
     opts.e2e = manifest.flags.skipE2e !== true
@@ -927,6 +1336,9 @@ function verifyStep(ctx, manifest, { context, label, changed, carried, action =
   }
   const plan = planVerification(profile, opts)
   writeWork(root, `vplan-${context}.json`, plan)
+  // A timing left by an earlier checkpoint is not this one's, and the judge
+  // cannot tell them apart — so the slate is cleared where the checks are named.
+  clearVerifyTimings(root)
 
   if (!plan.steps.length) {
     // A spent budget is the reason, not whichever kind happens to sit first in
@@ -963,7 +1375,7 @@ function verifyStep(ctx, manifest, { context, label, changed, carried, action =
         label,
         kind: 'verify',
         model: null,
-        effort: null,
+        effort: EFFORT.verify,
         schema: VERIFY_RESULT_SCHEMA,
         prompt:
           (context === 'final'
@@ -1189,7 +1601,7 @@ function adjudicateReview(ctx, manifest) {
   writeWork(root, 'review.json', result)
 
   const banners = []
-  const metrics = writeReviewMetrics(root, { change: manifest.change, counts: result.counts })
+  const metrics = writeReviewMetrics(stateHomeOf(ctx, manifest), { change: manifest.change, counts: result.counts })
   if (!metrics.written) {
     banners.push(`REVIEW METRICS NOT WRITTEN: ${metrics.reason}`)
   }
@@ -1205,15 +1617,18 @@ function adjudicateReview(ctx, manifest) {
  * round one: a fixing round, or straight to final verification when nothing
  * survived to fix.
  */
-export function runReviewed(ctx, { results }) {
+export function runReviewed(ctx, { results, hostRecords }) {
   const { root } = ctx
   const manifest = readManifest(root)
-  if (!manifest) return noManifest()
+  if (!manifest) return noManifest(ctx)
   const capped = countStep(root, manifest)
   if (capped) return recordThen(root, manifest, capped)
 
   // Outside the waves, but not outside the run's spend (design D9).
-  recordUsage(manifest, results)
+  const observed = recordSpawnObservations(ctx, manifest, { results, hostRecords })
+  if (observed.failure) {
+    return finishStep(ctx, manifest, trajectoryHaltStep('agent-result', observed.failure))
+  }
 
   const { result, banners } = adjudicateReview(ctx, manifest)
   banners.push(...stageMarkerBanners(results))
@@ -1281,15 +1696,18 @@ export function runReviewed(ctx, { results }) {
  * the fix budget on it (moved from `workflows/ship.js`'s retired
  * `remediationBudget`) — only the verdict round itself may halt.
  */
-export function runRemediated(ctx, { round, results }) {
+export function runRemediated(ctx, { round, results, hostRecords }) {
   const { root } = ctx
   const manifest = readManifest(root)
-  if (!manifest) return noManifest()
+  if (!manifest) return noManifest(ctx)
   const capped = countStep(root, manifest)
   if (capped) return recordThen(root, manifest, capped)
 
   // Outside the waves, but not outside the run's spend (design D9).
-  recordUsage(manifest, results)
+  const observed = recordSpawnObservations(ctx, manifest, { results, hostRecords })
+  if (observed.failure) {
+    return finishStep(ctx, manifest, trajectoryHaltStep('agent-result', observed.failure))
+  }
 
   const roundCap = LIMITS.remediationRounds
   const completedRound = Number.isInteger(round) ? round : null
@@ -1364,9 +1782,15 @@ export function runRemediated(ctx, { round, results }) {
 
 // --- small file helpers -----------------------------------------------------
 
-function readProfile(root) {
+function readProfile(root, manifest) {
+  // The path `run start` located, root first and the state home second (design
+  // D16), so a worktree run reads the main checkout's profile without copying
+  // it. A manifest written before the field existed reads the root, as before.
+  const recorded = manifest && Object.prototype.hasOwnProperty.call(manifest, 'testProfilePath')
+  const path = recorded ? manifest.testProfilePath : join(root, TEST_PROFILE_PATH)
+  if (typeof path !== 'string' || !path) return null
   try {
-    return JSON.parse(readFileSync(join(root, '.claude', 'testing', 'profile.json'), 'utf8'))
+    return JSON.parse(readFileSync(path, 'utf8'))
   } catch {
     // No profile is not a degradation to report here — `planVerification` says
     // so itself, in the skip reasons it returns.
@@ -1374,6 +1798,39 @@ function readProfile(root) {
   }
 }
 
+/**
+ * The timings `interlock verify exec` appended since the last clear. An
+ * unreadable line is skipped rather than fatal: a timing is a budget input, and
+ * a kind left without one is charged the round trip, with a banner saying so.
+ */
+function readVerifyTimings(root) {
+  let raw
+  try {
+    raw = readFileSync(join(root, VERIFY_TIMINGS_PATH), 'utf8')
+  } catch {
+    return []
+  }
+  const out = []
+  for (const line of raw.split('\n')) {
+    if (!line.trim()) continue
+    try {
+      out.push(JSON.parse(line))
+    } catch {
+      // skipped — see above
+    }
+  }
+  return out
+}
+
+function clearVerifyTimings(root) {
+  try {
+    rmSync(join(root, VERIFY_TIMINGS_PATH), { force: true })
+  } catch {
+    // Nothing to clear, or nothing clearable: the worst case is a stale timing
+    // charged to the next checkpoint, which only ever makes the budget tighter.
+  }
+}
+
 function writeWork(root, name, value) {
   const path = join(root, WORK_DIR, name)
   mkdirSync(dirname(path), { recursive: true })
@@ -1454,7 +1911,7 @@ function logSpawns(ctx, manifest, step) {
   let failure = null
   for (const s of step.spawns || []) {
     if (s.kind === 'implementer') continue // logged by wave-state, at the lane
-    const written = appendRunLogEvent(ctx.root, {
+    const written = appendRunLogEvent(stateHomeOf(ctx, manifest), {
       runId: manifest.runId || undefined,
       change: manifest.change,
       type: 'agent-spawn',
@@ -1474,7 +1931,7 @@ function logSpawns(ctx, manifest, step) {
 
 function logCliExit(ctx, manifest, command, exitCode) {
   if (!manifest.runId) return null
-  const written = appendRunLogEvent(ctx.root, {
+  const written = appendRunLogEvent(stateHomeOf(ctx, manifest), {
     runId: manifest.runId,
     change: manifest.change,
     type: 'cli-exit',
@@ -1521,6 +1978,37 @@ function waveAppendReason(outcome) {
 /** Same, for `logAgentSpawns` — it returns a boolean and reports its reason to stderr. */
 const LANE_SPAWN_APPEND_FAILED = 'an implementer lane spawn did not land'
 
+/**
+ * Log the implementer lanes a wave-state step dispatches — this batch's, and
+ * only this batch's — at the moment the program names them.
+ *
+ * Every site that turns a wave-state step into a run step calls this, because
+ * every one of them can emit a batch. Two used to, and they logged the WHOLE
+ * wave at its first batch: a run that halted before a later batch left spawn
+ * events for agents that never ran, while a wave entered through `run judge`
+ * or `run replan` left none for the agents that did. The `run` program emits
+ * one step per batch, so the batch is the unit.
+ *
+ * Returns false only when the append failed, read with `=== false` as every
+ * caller already does — a stub that reports nothing is not a failure.
+ */
+function logLaneSpawns(ctx, manifest, state, step, source) {
+  // Consulted even for a step that dispatches nothing — with no lanes, which it
+  // logs as nothing. Whether a step owes the trajectory a line is the writer's
+  // question, and a site that skipped the call for some actions would be one
+  // more place the answer could drift.
+  const dispatching = step && (step.action === 'run-batch' || step.action === 'test-wave')
+  return (
+    ctx.deps.logAgentSpawns(stateHomeOf(ctx, manifest), {
+      state,
+      change: manifest.change,
+      step,
+      lanes: dispatching ? lanesOf(step) : [],
+      source
+    }) !== false
+  )
+}
+
 /** The shared tree's HEAD. Never throws: an unreadable base is null, never a guess. */
 function headCommit(ctx) {
   return ctx.deps.headCommit(ctx.root)
@@ -1711,6 +2199,110 @@ export function laneOutcomes(lane, result) {
 
 // --- run start (design D4, D2) ----------------------------------------------
 
+/**
+ * What the Workflow host's environment means for this run (design D1, D5).
+ *
+ * `interlock run start --host workflow` reads the model-routing variables from
+ * its own environment, the way `hostSessionId` reads the session, and learns the
+ * host version from `claude --version`; `bin/interlock` builds the observation
+ * and this decides from it, once. The driver forwards what is decided and reads
+ * none of these variables itself — `workflows/ship.js` used to, and raised
+ * `MODEL ROUTING OVERRIDDEN` for a variable that, from 2.1.251, sets only the
+ * default subagent model.
+ *
+ * Pure. The version-aware reading itself is `readModelRouting`, shared with the
+ * doctor's advice row so the two cannot read one environment two ways.
+ *
+ * @param {object} observation  from `observeClaudeEnv`
+ * @returns {{banners: string[], notes: string[], pingModel: string|null,
+ *   modelSelect: 'forced'|null, slots: object}}
+ */
+export function decideHostEnvironment(observation) {
+  const o = observation && typeof observation === 'object' ? observation : {}
+  const routing = readModelRouting(o)
+  const banners = []
+  const notes = []
+  const unknown = routing.versionKnown ? '' : ' (host version unknown)'
+
+  if (routing.forceEffective) {
+    banners.push(
+      `MODEL ROUTING OVERRIDDEN: CLAUDE_CODE_SUBAGENT_MODEL_FORCE=${o.subagentModelForce} — every agent runs on ` +
+        `one model (${o.subagentModel || "the host's default"}), so the per-tier assignment in the plan is not ` +
+        `in effect${unknown}`
+    )
+  }
+  if (routing.forceInert) {
+    notes.push(
+      `MODEL ROUTING NOTE: CLAUDE_CODE_SUBAGENT_MODEL_FORCE=${o.subagentModelForce} has no effect on Claude Code ` +
+        `${routing.version}, which predates it; CLAUDE_CODE_SUBAGENT_MODEL is read as on any host of that version`
+    )
+  }
+  if (routing.plainDefaultOnly) {
+    notes.push(
+      `MODEL ROUTING NOTE: CLAUDE_CODE_SUBAGENT_MODEL=${o.subagentModel} sets only the default subagent model on ` +
+        `Claude Code ${routing.version}; the model each spawn names takes precedence`
+    )
+  }
+  if (routing.plainOverrides) {
+    banners.push(
+      `MODEL ROUTING OVERRIDDEN: CLAUDE_CODE_SUBAGENT_MODEL=${o.subagentModel} — every agent runs on that model, ` +
+        `so the per-tier assignment in the plan is not in effect${unknown}`
+    )
+  }
+
+  // The control-plane pings ask for haiku only when nothing overrides it and
+  // the account can reach it. An override already decides every agent's model;
+  // a Bedrock account often cannot reach haiku, and a failed ping halts the loop.
+  let pingModel = 'haiku'
+  if (routing.forceEffective || routing.plainOverrides) {
+    pingModel = null
+  } else if (Array.isArray(o.bedrock) && o.bedrock.length) {
+    pingModel = null
+    notes.push(
+      `PING MODEL INHERITED: a Bedrock variable is set (${o.bedrock.join(', ')}), so control-plane pings run on ` +
+        'the session model'
+    )
+  }
+
+  const slots = { ...runtimeSlotsOf(o), vendorDefault: RUNTIME.maxConcurrentAgents }
+  if (slots.invalid !== undefined) {
+    notes.push(
+      `RUNTIME SLOTS OVERRIDE IGNORED: CLAUDE_CODE_WORKFLOW_MAX_CONCURRENT_AGENTS=${slots.invalid} is not an ` +
+        `integer from ${WORKFLOW_MAX_CONCURRENT_RANGE.min} to ${WORKFLOW_MAX_CONCURRENT_RANGE.max}, so this run ` +
+        "reads it as unset; how the runtime reads it is not observed"
+    )
+  }
+
+  return { banners, notes, pingModel, modelSelect: routing.forceEffective ? 'forced' : null, slots }
+}
+
+/**
+ * Speak every interrupted-run note not yet spoken (design D7), whatever change
+ * it names, and mark each spoken. Run start is the moment: the reader is about
+ * to spend agents, and the run that was interrupted has no other record of how
+ * it ended. Nothing here moves an exit code — the note is outcome-class.
+ *
+ * @returns {string[]} the banners to carry on the start step
+ */
+function speakInterruptedNotes(root, manifest) {
+  const { notes, unreadable } = readInterruptedNotes(root)
+  const banners = []
+  for (const note of notes) {
+    if (!isUnspoken(note)) continue
+    const banner = formatInterruptedBanner(note)
+    banners.push(banner)
+    manifest.banners.push(banner)
+    const marked = markSpoken(root, note.runId)
+    if (!marked.marked) {
+      manifest.notes.push(
+        `INTERRUPTED NOTE NOT MARKED: ${note.file}: ${marked.reason} — it will be spoken again at the next run start`
+      )
+    }
+  }
+  for (const entry of unreadable) manifest.notes.push(formatUnreadableNote(entry))
+  return banners
+}
+
 /**
  * Begin a run: write the manifest, validate the change, and either adopt a
  * reusable plan or ask for a classification.
@@ -1723,13 +2315,132 @@ export function laneOutcomes(lane, result) {
  * run; wrongly reusing would run the wrong plan.
  *
  * @param {{root: string, deps: object, warn: (m: string) => void}} ctx
- * @param {{change: string, flags: object, host?: string, hostCapabilities?: object}} input
+ * @param {{change: string, flags: object, host?: string, hostCapabilities?: object, hostEnv?: object, stateHome?: object}} input
+ *   `hostEnv` is the Workflow host's observed environment (`observeClaudeEnv`),
+ *   passed by `bin/interlock` on that host only. `stateHome` is the state home
+ *   `bin/interlock` resolved for this root (`resolveStateHome`, the explicit
+ *   `--state-home` applied); resolved here when absent.
  */
-export function runStart(ctx, { change, flags, host, hostCapabilities }) {
+export function runStart(ctx, { change, flags, host, hostCapabilities, hostEnv, stateHome }) {
   const { root } = ctx
   const manifest = newManifest({ change, flags, host, hostCapabilities })
+  // Where this run's corpora go, decided once and recorded (ship/state-home):
+  // every later subcommand reads it back off the manifest and never resolves
+  // again, so one run uses one home even if git state changes under it.
+  const home = settleStateHome(ctx, manifest, stateHome)
+  // What the Workflow host's environment means for this run, decided once here
+  // and forwarded by the driver (design D2). Only that host's run start passes
+  // an observation: a runner's lanes are `claude -p` processes whose top-level
+  // model is `--model`, which the subagent-model variables do not govern.
+  const carried = { banners: [] }
+  if (hostEnv && typeof hostEnv === 'object') {
+    const decided = decideHostEnvironment(hostEnv)
+    manifest.banners.push(...decided.banners)
+    manifest.notes.push(...decided.notes)
+    manifest.pingModel = decided.pingModel
+    manifest.runtimeSlots = decided.slots
+    manifest.hostEnv = hostEnv
+    // The same downward-only refinement the effort probe performs. A caller that
+    // declared its own model selection keeps it.
+    const declared = hostCapabilities && typeof hostCapabilities === 'object' && 'modelSelect' in hostCapabilities
+    if (decided.modelSelect === 'forced' && manifest.host && !declared) manifest.host.modelSelect = 'forced'
+    carried.banners.push(...decided.banners)
+    carried.pingModel = decided.pingModel
+  }
+  // Said at the start rather than discovered at the first fold. The run still
+  // proceeds: on a clean tree with `worktree.baseRef: head`, the first isolated
+  // batch forks from HEAD, which is the snapshot, and folds.
+  if (manifest.flags.isolateWaves === true && hostCapability(manifest, 'worktree') === 'runtime') {
+    manifest.banners.push(ISOLATION_BASE_BANNER)
+  }
+  carried.banners.push(...home.banners)
   writeManifest(root, manifest)
+  carried.banners.push(...speakInterruptedNotes(stateHomeOf(ctx, manifest), manifest))
+
+  return carryStart(startSteps(ctx, manifest, change), carried)
+}
+
+/**
+ * Record the state home, the surface, and where the two inputs a worktree run
+ * reads through were found (design D14, D16). Returns the banners for the start
+ * step; they are on `manifest.banners` as well, so the close carries them.
+ *
+ * Every input is located root first, then home: a worktree that built its own
+ * graph or reconfigured its own profile uses its own, and nothing is ever copied
+ * or written into the main checkout. One banner per input at most — the
+ * read-through, the absence, or nothing — and the absences are the lines the
+ * Workflow driver used to raise from its own `test -f`, which no longer exists:
+ * two probes of one file in two places is how a driver and the CLI disagree.
+ */
+function settleStateHome(ctx, manifest, given) {
+  const root = resolve(ctx.root)
+  const resolution =
+    given && typeof given === 'object' && typeof given.home === 'string' && given.home
+      ? given
+      : resolveStateHome(root)
+  const home = resolve(resolution.home)
+  manifest.stateHome = home
+  manifest.surface = typeof resolution.surface === 'string' ? resolution.surface : 'unknown'
+  manifest.stateHomeReason = typeof resolution.reason === 'string' ? resolution.reason : null
+  // How it was decided — the resolver, an explicit setting, a lane worktree or the
+  // fallback — so a reader that takes the home off this manifest names it right.
+  manifest.stateHomeFrom = typeof resolution.resolvedFrom === 'string' ? resolution.resolvedFrom : null
+
+  const banners = []
+  if (manifest.surface === 'unknown' && manifest.stateHomeReason) {
+    banners.push(`STATE HOME UNRESOLVED: ${manifest.stateHomeReason}`)
+  }
+  if (home !== root) {
+    manifest.notes.push(
+      resolution.resolvedFrom === 'explicit'
+        ? `CORPORA IN STATE HOME: ${home} — set by --state-home or INTERLOCK_STATE_HOME; the trajectory, ` +
+            `outcome line, metrics and resume card of this run are written there, not in ${root}`
+        : `CORPORA IN MAIN CHECKOUT: ${home} — the trajectory, outcome line, metrics and resume card of ` +
+            `this run are written there, not in this worktree`
+    )
+  }
+
+  const profile = locateInput(root, home, TEST_PROFILE_PATH)
+  manifest.testProfilePath = profile.path
+  manifest.testProfileSource = profile.source
+  if (profile.source === 'state-home') banners.push(`TEST PROFILE FROM MAIN CHECKOUT: ${profile.path}`)
+  else if (profile.source === 'none') banners.push(VERIFY_BANNERS.noProfile)
+
+  const graph = locateInput(root, home, GRAPH_FILE_PATH)
+  manifest.graphPath = graph.path
+  manifest.graphSource = graph.source
+  if (graph.source === 'state-home') {
+    banners.push(
+      `GRAPH FROM MAIN CHECKOUT: ${graph.path} — it may be stale for this worktree; a lane without a ` +
+        `graph falls back to grep`
+    )
+  } else if (graph.source === 'none') {
+    banners.push(GRAPH_UNAVAILABLE_BANNER)
+  }
 
+  manifest.banners.push(...banners)
+  return { home, banners }
+}
+
+/**
+ * Put what run start decided onto whichever step it returns — a classify, a
+ * reused plan's first batch, a close with nothing left, or a halt. The manifest
+ * already holds the banners; the step carries them so the driver reports them
+ * from the first step on, and carries the ping model so the driver can set it.
+ */
+function carryStart(step, { banners, pingModel }) {
+  if (!step || typeof step !== 'object') return step
+  if (banners.length) {
+    const rest = (Array.isArray(step.banners) ? step.banners : []).filter(b => !banners.includes(b))
+    step.banners = [...banners, ...rest]
+  }
+  if (pingModel !== undefined) step.pingModel = pingModel
+  return step
+}
+
+/** Every path out of run start, after the manifest exists. */
+function startSteps(ctx, manifest, change) {
+  const { root } = ctx
   const capped = countStep(root, manifest)
   if (capped) return recordThen(root, manifest, capped)
 
@@ -1791,6 +2502,7 @@ export function runStart(ctx, { change, flags, host, hostCapabilities }) {
         label: 'plan-waves',
         kind: 'planner',
         model: null,
+        // effort-routing: "Control-plane and prose spawns SHALL inherit the host's effort".
         effort: null,
         schema: PLANNER_SCHEMA,
         prompt: assemblePlannerPrompt({ change, classifiedPath: CLASSIFIED_PATH })
@@ -1817,8 +2529,15 @@ function adoptPlan(ctx, manifest, plan) {
   }
   writeState(root, state)
   manifest.runId = typeof state.runId === 'string' ? state.runId : null
-
-  const started = appendRunLogEvent(root, {
+  // On the manifest as well as on the trajectory, so the SessionEnd recorder
+  // compares the ending session against one small file (design D7). Absent on a
+  // host with no session, which never matches, so that recorder writes nothing.
+  const sessionId = hostSessionId(manifest, ctx.env)
+  if (sessionId) manifest.sessionId = sessionId
+  const slotsBanner = runtimeSlotsBanner(manifest, state)
+  if (slotsBanner) manifest.banners.push(slotsBanner)
+
+  const started = appendRunLogEvent(stateHomeOf(ctx, manifest), {
     runId: manifest.runId || undefined,
     change: manifest.change,
     type: 'run-start',
@@ -1828,14 +2547,20 @@ function adoptPlan(ctx, manifest, plan) {
     // `undefined`, not a placeholder: a host with no session records absent, and
     // the run is unaffected either way — nothing downstream reads this to decide
     // anything, and `run-log check` does not require it.
-    sessionId: hostSessionId(manifest, ctx.env) || undefined
+    sessionId: sessionId || undefined,
+    // Where this run ran and where its corpora went (ship/state-home). `cwd` is
+    // what lets a reader in the main checkout find a worktree run's spill and
+    // marker; a manifest written before these existed records none.
+    surface: manifest.surface || undefined,
+    stateHome: manifest.stateHome || undefined,
+    cwd: resolve(root)
   })
   if (!started.written) {
     ctx.warn(`run-start not recorded: ${started.reason}`)
     return trajectoryHaltStep('run-start', started.reason)
   }
 
-  const created = ctx.deps.logWaveMutation(root, {
+  const created = ctx.deps.logWaveMutation(stateHomeOf(ctx, manifest), {
     source: 'create',
     change: manifest.change,
     state
@@ -1849,11 +2574,43 @@ function adoptPlan(ctx, manifest, plan) {
   // the lane, by wave-state). Its verdict is read for the same reason every
   // other append's is: `wave-state next` exits 1 on this exact boolean, and the
   // live path owes the trajectory the same fatality.
-  if (ctx.deps.logAgentSpawns(root, { state, change: manifest.change, step, source: 'next' }) === false) {
+  if (!logLaneSpawns(ctx, manifest, state, step, 'next')) {
     ctx.warn('an implementer agent-spawn was not recorded on run start')
     return trajectoryHaltStep('agent-spawn', LANE_SPAWN_APPEND_FAILED)
   }
-  return decorate(ctx, step, manifest)
+  const first = decorate(ctx, step, manifest)
+  if (slotsBanner && first && typeof first === 'object') {
+    first.banners = [...(Array.isArray(first.banners) ? first.banners : []), slotsBanner]
+  }
+  return first
+}
+
+/**
+ * `WAVE WIDER THAN RUNTIME SLOTS`, or null (design D5).
+ *
+ * Raised only against an override the operator set: the vendor's own default is
+ * reduced on small machines by an amount it does not publish, and inventing one
+ * would be a threshold in prose. The plan is never resized — it is published
+ * policy, and the runtime queues the extra lanes — so this only says that lanes
+ * will wait, where they would otherwise wait without a word.
+ */
+function runtimeSlotsBanner(manifest, state) {
+  const slots = manifest && manifest.runtimeSlots
+  if (!slots || slots.source !== 'env' || !Number.isInteger(slots.observed)) return null
+  const waves = state && Array.isArray(state.waves) ? state.waves : []
+  let widest = 0
+  for (const wave of waves) {
+    for (const batch of Array.isArray(wave && wave.batches) ? wave.batches : []) {
+      if (Array.isArray(batch) && batch.length > widest) widest = batch.length
+    }
+  }
+  if (widest <= slots.observed) return null
+  const queued = widest - slots.observed
+  return (
+    `WAVE WIDER THAN RUNTIME SLOTS: the widest batch has ${widest} lanes and ` +
+    `CLAUDE_CODE_WORKFLOW_MAX_CONCURRENT_AGENTS=${slots.observed} — ${queued} lane${queued === 1 ? '' : 's'} ` +
+    `queue${queued === 1 ? 's' : ''} for a slot; the plan is not resized`
+  )
 }
 
 // --- run classified (design D7) ---------------------------------------------
@@ -1937,7 +2694,7 @@ export function resolveRedWave({ tddMode, redSection, tasks }) {
 export function runClassified(ctx, { classifiedPath }) {
   const { root } = ctx
   const manifest = readManifest(root)
-  if (!manifest) return noManifest()
+  if (!manifest) return noManifest(ctx)
   const capped = countStep(root, manifest)
   if (capped) return recordThen(root, manifest, capped)
 
@@ -2034,6 +2791,42 @@ export function runClassified(ctx, { classifiedPath }) {
 
 // --- run record-batch (design D5) -------------------------------------------
 
+// A runtime-worktree host forks each isolated lane from `worktree.baseRef`,
+// which a plugin can neither read nor set — so the lane's base is whatever that
+// names, not the run's snapshot. Bannered at `run start`, named at the halt.
+const ISOLATION_BASE_BANNER =
+  'ISOLATION BASE NOT CONTROLLED (workflow): the runtime forks lane worktrees from worktree.baseRef, ' +
+  "not from the run's snapshot — an isolated batch whose lanes did not fork from the snapshot halts " +
+  'with LANE BASE MISMATCH'
+const RUNTIME_BASE_HALT =
+  'the Workflow runtime chose this base through worktree.baseRef, which a plugin cannot set; ' +
+  '--isolate-waves on this host needs the follow-up change that creates lane worktrees from the CLI'
+
+/**
+ * The fold candidates whose worktree is not checked out at `base`.
+ *
+ * Read through git from each worktree, never from the lane's own report: that
+ * report is the thing being audited. A lane git cannot answer for is a mismatch
+ * only when it reported writes — a clean lane that changed nothing may have had
+ * its worktree removed by the runtime, and that is an empty-write lane, not a
+ * wrong base. A lane that named no worktree at all is left to `merge-lanes`,
+ * which already halts on it as unresolved.
+ *
+ * @returns {Array<{label: string, head: string|null}>}
+ */
+function laneBaseMismatches(ctx, candidates, base) {
+  const mismatched = []
+  for (const lane of candidates) {
+    if (!lane.worktreePath) continue
+    const head = ctx.deps.worktreeHead(lane.worktreePath)
+    if (head === base) continue
+    const wrote = Array.isArray(lane.reportedFiles) && lane.reportedFiles.length > 0
+    if (!head && !wrote) continue
+    mismatched.push({ label: lane.label, head })
+  }
+  return mismatched
+}
+
 /**
  * Fold, adjudicate, record and tick — one CLI call where the loop used to spend
  * three agent turns.
@@ -2042,10 +2835,10 @@ export function runClassified(ctx, { classifiedPath }) {
  * named rather than removed: folding a partial write from a lane that stopped
  * mid-way is exactly the silent-overwrite defect the merge policy refuses.
  */
-export function runRecordBatch(ctx, { results }) {
+export function runRecordBatch(ctx, { results, hostRecords }) {
   const { root } = ctx
   const manifest = readManifest(root)
-  if (!manifest) return noManifest()
+  if (!manifest) return noManifest(ctx)
   const capped = countStep(root, manifest)
   if (capped) return recordThen(root, manifest, capped)
 
@@ -2067,7 +2860,12 @@ export function runRecordBatch(ctx, { results }) {
   const isolate = manifest.flags.isolateWaves === true
   const driverWorktrees = isolate && hostCapability(manifest, 'worktree') === 'driver'
 
-  recordUsage(manifest, results, pending.wave)
+  // Before anything is folded or ticked: an `agent-result` that did not land
+  // is a gap in the trajectory, and this batch's ticks must not outrun it.
+  const observed = recordSpawnObservations(ctx, manifest, { results, hostRecords, wave: pending.wave })
+  if (observed.failure) {
+    return finishStep(ctx, manifest, trajectoryHaltStep('agent-result', observed.failure))
+  }
 
   lanes.forEach((lane, i) => {
     const outcomes = laneOutcomes(lane, results[i])
@@ -2116,7 +2914,8 @@ export function runRecordBatch(ctx, { results }) {
   }
 
   // Fold this batch's successful lanes back into the shared tree before moving
-  // on — the NEXT batch's merge base is read off this tree.
+  // on. The NEXT isolated batch snapshots this tree for its own base — that is
+  // how a later batch, and a later wave, sees every fold before it.
   if (isolate && laneFoldCandidates.length) {
     // The base the lanes actually forked from, captured at dispatch and carried
     // on the manifest across the driver round trip. `pending` is a pure
@@ -2132,6 +2931,27 @@ export function runRecordBatch(ctx, { results }) {
           `fold, so lane diffs are taken against the post-batch HEAD (${base || 'unreadable'})`
       )
     }
+    // Every lane's base, read from its own worktree before anything folds. A
+    // lane forked from anything else reports the difference between the two as
+    // its own write, and the whole-file fold silently reverts whatever that
+    // difference held — so a wrong base halts the batch, and no lane of it folds.
+    const mismatched = base ? laneBaseMismatches(ctx, laneFoldCandidates, base) : []
+    if (mismatched.length) {
+      const survivors = [
+        ...laneFoldCandidates.filter(l => l.worktreePath && existsSync(l.worktreePath)),
+        ...laneWorktreesPreserved
+      ]
+        .map(w => `${w.label}: ${w.worktreePath}`)
+        .join('; ')
+      return finishStep(ctx, manifest, haltStep(
+        'LANE BASE MISMATCH: ' +
+          mismatched.map(m => `${m.label} forked from ${m.head || '(unreadable)'}, expected ${base}`).join('; ') +
+          ` — no lane of wave ${pending.wave}'s batch was folded` +
+          (hostCapability(manifest, 'worktree') === 'runtime' ? ` — ${RUNTIME_BASE_HALT}` : '') +
+          ` — surviving worktrees: ${survivors || '(none)'}`,
+        { banners }
+      ))
+    }
     const merged = base ? ctx.deps.runMergeLanes(root, laneFoldCandidates, base) : null
     if (Array.isArray(merged && merged.cleanupWarnings) && merged.cleanupWarnings.length) {
       banners.push(
@@ -2176,7 +2996,7 @@ export function runRecordBatch(ctx, { results }) {
     changedPaths: ctx.deps.observedChangedPaths(root)
   })
   writeState(root, after)
-  const recorded = ctx.deps.logWaveMutation(root, {
+  const recorded = ctx.deps.logWaveMutation(stateHomeOf(ctx, manifest), {
     source: 'record-batch',
     change: manifest.change,
     state: after
@@ -2198,13 +3018,7 @@ export function runRecordBatch(ctx, { results }) {
   // Before the tick and before the commit, exactly like the wave-action above:
   // a batch whose implementer spawns went unrecorded is a batch nobody can
   // attribute, and `emitRecordedState` already exits 1 on this same boolean.
-  const laneSpawnsLogged = ctx.deps.logAgentSpawns(root, {
-    state: after,
-    change: manifest.change,
-    step: nextRaw,
-    source: 'record-batch'
-  })
-  if (laneSpawnsLogged === false) {
+  if (!logLaneSpawns(ctx, manifest, after, nextRaw, 'record-batch')) {
     ctx.warn('an implementer agent-spawn was not recorded on record-batch')
     manifest.banners.push(...banners)
     return finishStep(
@@ -2267,15 +3081,18 @@ export function runRecordBatch(ctx, { results }) {
  * reports exit codes and counts; whether the run may continue is not its
  * question, and both drivers used to let it answer.
  */
-export function runJudge(ctx, { context, results }) {
+export function runJudge(ctx, { context, results, hostRecords }) {
   const { root } = ctx
   const manifest = readManifest(root)
-  if (!manifest) return noManifest()
+  if (!manifest) return noManifest(ctx)
   const capped = countStep(root, manifest)
   if (capped) return recordThen(root, manifest, capped)
 
   // Outside the waves, but not outside the run's spend (design D9).
-  recordUsage(manifest, results)
+  const observed = recordSpawnObservations(ctx, manifest, { results, hostRecords })
+  if (observed.failure) {
+    return finishStep(ctx, manifest, trajectoryHaltStep('agent-result', observed.failure))
+  }
 
   const state = readState(root)
   const plan = readJson(join(root, WORK_DIR, `vplan-${context}.json`))
@@ -2286,10 +3103,34 @@ export function runJudge(ctx, { context, results }) {
   // process — the next one — can see how long the agent between them took. An
   // unparseable or negative mark contributes nothing rather than a wrong number,
   // and the mark is cleared either way so it can never be counted twice.
+  //
+  // What is charged is the checks' own time, as `interlock verify exec` measured
+  // it around each command. The interval from dispatch to judgement is only the
+  // fallback: it also holds two relays and the verify agent's own turns, and
+  // charging those as verification spent the whole budget on the first
+  // checkpoint of a Workflow run and left every later one typecheck-only. The
+  // fallback is spoken, never silent.
+  const timings = readVerifyTimings(root)
+  clearVerifyTimings(root)
   if (manifest.verifyStartedAt) {
-    const spent = Date.now() - Date.parse(manifest.verifyStartedAt)
-    if (Number.isFinite(spent) && spent >= 0) {
-      manifest.verifyElapsedMs = (numberOrUndefined(manifest.verifyElapsedMs) || 0) + Math.round(spent)
+    const planned = plan && Array.isArray(plan.steps) ? plan.steps : []
+    const timed = foldCheckTimings(planned, timings)
+    const roundTrip = Date.now() - Date.parse(manifest.verifyStartedAt)
+    let charged = null
+    if (planned.length && !timed.missing.length) {
+      charged = timed.ms
+    } else if (Number.isFinite(roundTrip) && roundTrip >= 0) {
+      charged = Math.round(roundTrip)
+      if (planned.length) {
+        banners.push(
+          `VERIFY BUDGET CLOCKED BY ROUND TRIP: no \`interlock verify exec\` timing for ` +
+            `${timed.missing.join(', ')} — ${charged}ms of relay and agent time counted against ` +
+            `the inter-wave verify budget`
+        )
+      }
+    }
+    if (charged !== null) {
+      manifest.verifyElapsedMs = (numberOrUndefined(manifest.verifyElapsedMs) || 0) + charged
     }
     manifest.verifyStartedAt = null
   }
@@ -2360,7 +3201,7 @@ export function runJudge(ctx, { context, results }) {
         }
     const after = recordVerifyResult(state, record)
     writeState(root, after)
-    const verified = ctx.deps.logWaveMutation(root, {
+    const verified = ctx.deps.logWaveMutation(stateHomeOf(ctx, manifest), {
       source: 'record-verify',
       change: manifest.change,
       state: after
@@ -2375,6 +3216,11 @@ export function runJudge(ctx, { context, results }) {
         trajectoryHaltStep('wave-state record-verify', waveAppendReason(verified), { banners })
       )
     }
+    // The next wave's first batch is named here, so its lanes are logged here.
+    if (!logLaneSpawns(ctx, manifest, after, nextRaw, 'record-verify')) {
+      ctx.warn('an implementer agent-spawn was not recorded on record-verify')
+      return finishStep(ctx, manifest, trajectoryHaltStep('agent-spawn', LANE_SPAWN_APPEND_FAILED, { banners }))
+    }
     return finishStep(ctx, manifest, decorate(ctx, nextRaw, manifest, { banners }))
   }
 
@@ -2459,6 +3305,7 @@ function handoffStep(ctx, manifest, banners = []) {
         label: 'handoff',
         kind: 'handoff',
         model: null,
+        // effort-routing: "Control-plane and prose spawns SHALL inherit the host's effort".
         effort: null,
         schema: HANDOFF_RESULT_SCHEMA,
         prompt: assembleHandoffPrompt({
@@ -2495,6 +3342,7 @@ function commitStep(ctx, manifest, banners = []) {
         label: 'commit',
         kind: 'commit',
         model: null,
+        // effort-routing: "Control-plane and prose spawns SHALL inherit the host's effort".
         effort: null,
         schema: COMMIT_SCHEMA,
         prompt: assembleCommitPrompt({ change: manifest.change, stageIndex: ++manifest.stageIndex })
@@ -2511,15 +3359,18 @@ function commitStep(ctx, manifest, banners = []) {
  * with no handoff step never calls it: `run judge --context final` emits the
  * commit directly.
  */
-export function runCommit(ctx, { results }) {
+export function runCommit(ctx, { results, hostRecords }) {
   const { root } = ctx
   const manifest = readManifest(root)
-  if (!manifest) return noManifest()
+  if (!manifest) return noManifest(ctx)
   const capped = countStep(root, manifest)
   if (capped) return recordThen(root, manifest, capped)
 
   // Outside the waves, but not outside the run's spend (design D9).
-  recordUsage(manifest, results)
+  const observed = recordSpawnObservations(ctx, manifest, { results, hostRecords })
+  if (observed.failure) {
+    return finishStep(ctx, manifest, trajectoryHaltStep('agent-result', observed.failure))
+  }
 
   const reported = results && results[0] && typeof results[0] === 'object' ? results[0] : null
   const count = value => (Number.isInteger(value) ? value : undefined)
@@ -2569,7 +3420,7 @@ function flattenVerifyResults(results) {
 export function runVerifyFinal(ctx) {
   const { root } = ctx
   const manifest = readManifest(root)
-  if (!manifest) return noManifest()
+  if (!manifest) return noManifest(ctx)
   const capped = countStep(root, manifest)
   if (capped) return recordThen(root, manifest, capped)
   return finishStep(ctx, manifest, finalVerifyStep(ctx, manifest))
@@ -2578,15 +3429,18 @@ export function runVerifyFinal(ctx) {
 // --- run replan -------------------------------------------------------------
 
 /** Apply a revision the replan step produced, or carry on with the next step. */
-export function runReplan(ctx, { results }) {
+export function runReplan(ctx, { results, hostRecords }) {
   const { root } = ctx
   const manifest = readManifest(root)
-  if (!manifest) return noManifest()
+  if (!manifest) return noManifest(ctx)
   const capped = countStep(root, manifest)
   if (capped) return recordThen(root, manifest, capped)
 
   // Outside the waves, but not outside the run's spend (design D9).
-  recordUsage(manifest, results)
+  const observed = recordSpawnObservations(ctx, manifest, { results, hostRecords })
+  if (observed.failure) {
+    return finishStep(ctx, manifest, trajectoryHaltStep('agent-result', observed.failure))
+  }
 
   const state = readState(root)
   if (!state) return finishStep(ctx, manifest, haltStep('the run state could not be read'))
@@ -2596,7 +3450,12 @@ export function runReplan(ctx, { results }) {
   if (!revised || !Array.isArray(groups)) {
     // Nothing to revise is the ordinary outcome, and re-reading the state is
     // how the loop moves past a replan offer it declined.
-    return finishStep(ctx, manifest, decorate(ctx, nextStep(state), manifest))
+    const declined = nextStep(state)
+    if (!logLaneSpawns(ctx, manifest, state, declined, 'replan')) {
+      ctx.warn('an implementer agent-spawn was not recorded on replan')
+      return finishStep(ctx, manifest, trajectoryHaltStep('agent-spawn', LANE_SPAWN_APPEND_FAILED))
+    }
+    return finishStep(ctx, manifest, decorate(ctx, declined, manifest))
   }
 
   let after
@@ -2606,7 +3465,7 @@ export function runReplan(ctx, { results }) {
     return finishStep(ctx, manifest, haltStep(`replan rejected: ${(err && err.message) || String(err)}`))
   }
   writeState(root, after)
-  const replanned = ctx.deps.logWaveMutation(root, {
+  const replanned = ctx.deps.logWaveMutation(stateHomeOf(ctx, manifest), {
     source: 'replan',
     change: manifest.change,
     state: after
@@ -2616,6 +3475,10 @@ export function runReplan(ctx, { results }) {
     ctx.warn('the wave-state trajectory append failed on replan')
     return finishStep(ctx, manifest, trajectoryHaltStep('wave-state replan', waveAppendReason(replanned)))
   }
+  if (!logLaneSpawns(ctx, manifest, after, nextRaw, 'replan')) {
+    ctx.warn('an implementer agent-spawn was not recorded on replan')
+    return finishStep(ctx, manifest, trajectoryHaltStep('agent-spawn', LANE_SPAWN_APPEND_FAILED))
+  }
   return finishStep(ctx, manifest, decorate(ctx, nextRaw, manifest))
 }
 
@@ -2625,22 +3488,50 @@ export function runReplan(ctx, { results }) {
 export function runNext(ctx) {
   const { root } = ctx
   const manifest = readManifest(root)
-  if (!manifest) return noManifest()
+  if (!manifest) return noManifest(ctx)
   const capped = countStep(root, manifest)
   if (capped) return recordThen(root, manifest, capped)
   const state = readState(root)
   if (!state) return finishStep(ctx, manifest, haltStep('the run state could not be read'))
-  return finishStep(ctx, manifest, decorate(ctx, nextStep(state), manifest))
+  // A re-read that names a batch is a batch the driver will dispatch again, so
+  // those agents are spawns like any other.
+  const pending = nextStep(state)
+  if (!logLaneSpawns(ctx, manifest, state, pending, 'next')) {
+    ctx.warn('an implementer agent-spawn was not recorded on next')
+    return finishStep(ctx, manifest, trajectoryHaltStep('agent-spawn', LANE_SPAWN_APPEND_FAILED))
+  }
+  return finishStep(ctx, manifest, decorate(ctx, pending, manifest))
 }
 
 // --- helpers used by every subcommand ---------------------------------------
 
-function noManifest() {
+function noManifest(ctx) {
+  const elsewhere = manifestInStateHome(ctx.root)
+  if (elsewhere) {
+    return haltStep(
+      `no run manifest at ${elsewhere.here} — one exists at ${elsewhere.there}; if this session moved into ` +
+        `a worktree after run start, the run continues from there`
+    )
+  }
   return haltStep(
     `no run manifest at ${MANIFEST_PATH} — a run subcommand was reached without \`interlock run start\``
   )
 }
 
+/**
+ * A manifest the state home holds when this root holds none (design D18): a
+ * session that moved into a worktree after `run start` halts naming both, and
+ * one that did not sees today's message. Resolved here because there is no
+ * manifest to read a recorded home from.
+ */
+function manifestInStateHome(root) {
+  const here = resolve(root)
+  const { home } = resolveStateHome(here)
+  if (!home || resolve(home) === here) return null
+  const there = join(home, MANIFEST_PATH)
+  return existsSync(there) ? { here: join(here, MANIFEST_PATH), there } : null
+}
+
 /**
  * Persist what this step observed and record the continuation it names.
  *
@@ -2649,6 +3540,8 @@ function noManifest() {
  * process — each `run` subcommand is its own.
  */
 function finishStep(ctx, manifest, step) {
+  carryRaisedBanners(manifest, step)
+  recordDispatched(manifest, step)
   const failure = logSpawns(ctx, manifest, step)
   // An agent-spawn nobody recorded is a gap in the trajectory, and the step it
   // belongs to must not run. A step that was ALREADY halting keeps its own
@@ -2663,6 +3556,48 @@ function finishStep(ctx, manifest, step) {
   return recordThen(ctx.root, manifest, final)
 }
 
+/**
+ * Put on the step every banner the run raised since the last step carried one
+ * (draw-the-ship-run-live, design D1).
+ *
+ * A banner pushed onto `manifest.banners` reaches the close summary whatever
+ * happens; this makes sure it reaches a step as well, so a reader of the step
+ * stream (the ship meter) displays what the CLI named instead of discovering it
+ * at close. Derived from the same list the summary prints, in its order, and
+ * additive: a step's own banners stay first, nothing already carried is raised
+ * again. `bannersCarried` is how far into the list the steps have reached.
+ */
+function carryRaisedBanners(manifest, step) {
+  if (!step || typeof step !== 'object' || !Array.isArray(manifest.banners)) return
+  const from = Number.isInteger(manifest.bannersCarried) ? manifest.bannersCarried : 0
+  const raised = manifest.banners.slice(from)
+  manifest.bannersCarried = manifest.banners.length
+  const own = Array.isArray(step.banners) ? step.banners : []
+  const missing = raised.filter((b, i) => typeof b === 'string' && !own.includes(b) && raised.indexOf(b) === i)
+  if (missing.length) step.banners = [...own, ...missing]
+}
+
+/**
+ * The join table for the close (design D4): every spawn on the step, lane
+ * spawns included, with the sha its bootstrap carries. Only once the run has an
+ * id — the same rule `logSpawns` follows — because the recorder writes nothing
+ * for a spawn dispatched before one, so it could never join. Bounded by the
+ * published step cap times the batch width, so it needs no cap of its own.
+ */
+function recordDispatched(manifest, step) {
+  if (!manifest.runId || !step || !Array.isArray(step.spawns) || !step.spawns.length) return
+  if (!Array.isArray(manifest.dispatched)) manifest.dispatched = []
+  for (const s of step.spawns) {
+    manifest.dispatched.push({
+      wave: Number.isInteger(step.wave) ? step.wave : null,
+      label: s.label,
+      kind: s.kind,
+      model: s.model || null,
+      sha: typeof s.promptSha256 === 'string' ? s.promptSha256 : null
+    })
+  }
+}
+
 // --- run close (design D10) -------------------------------------------------
 
 /**
@@ -2679,7 +3614,15 @@ function finishStep(ctx, manifest, step) {
  */
 export async function runClose(
   ctx,
-  { results = [], halt = null, hostBanners = [], hostObserved = null, notify = false, env = process.env } = {}
+  {
+    results = [],
+    halt = null,
+    hostBanners = [],
+    hostObserved = null,
+    hostRecords = [],
+    notify = false,
+    env = process.env
+  } = {}
 ) {
   const { root } = ctx
   const absRoot = resolve(root)
@@ -2697,10 +3640,14 @@ export async function runClose(
     // The change name is unknown here — there is no manifest to read it from —
     // so the message carries the headline and the absent run id alone.
     const push = await attemptPush(notify, env, { headline, change: null, runId: null })
+    // Where a record would have gone, so the reader can look there (ship/close-summary).
+    const home = resolve(resolveStateHome(absRoot).home)
+    const elsewhere = home !== absRoot && existsSync(join(home, MANIFEST_PATH)) ? join(home, MANIFEST_PATH) : null
     const rows = [
       '  run: none — the run halted before a plan was adopted',
       `  project: ${slug}`,
-      `  cwd: ${absRoot}`
+      `  cwd: ${absRoot}`,
+      ...(home !== absRoot ? [`  state home: ${home}`] : [])
     ]
     if (push && push.sent !== undefined) {
       rows.push(push.sent ? '  push: sent (ntfy)' : `  push: failed — ${push.reason}`)
@@ -2714,13 +3661,19 @@ export async function runClose(
       banners: Array.isArray(hostBanners) ? hostBanners : [],
       summary:
         `${headline}\n\n` +
-        `There is no run manifest at ${MANIFEST_PATH}, so nothing was recorded for this run.\n` +
+        (elsewhere
+          ? `There is no run manifest at ${join(absRoot, MANIFEST_PATH)} — one exists at ${elsewhere}; if ` +
+            `this session moved into a worktree after run start, the run continues from there.\n`
+          : `There is no run manifest at ${MANIFEST_PATH}, so nothing was recorded for this run.\n`) +
         rows.join('\n')
     }
   }
 
   const haltReason = typeof halt === 'string' && halt.trim() ? halt.trim() : manifest.halted || null
   if (haltReason) manifest.halted = haltReason
+  // Corpora go to the home `run start` recorded; the manifest, the state and the
+  // sidecar stay in the root (ship/state-home).
+  const home = stateHomeOf(ctx, manifest)
 
   // The commit result, when the close is the continuation of a commit step.
   const committed = results && results[0] && typeof results[0] === 'object' ? results[0] : null
@@ -2754,6 +3707,16 @@ export async function runClose(
   // any, because the runtime's counter sees turns this process never does.
   const counted = summarizeUsage(manifest)
   const hostSpend = Array.isArray(observed.spend) && observed.spend.length ? observed.spend : null
+
+  // What the recorder hooks wrote for this run, joined to the spawns this program
+  // dispatched (ship/agent-results). Decided here, before the summary and the
+  // degradation block are assembled, so its banners reach both.
+  const joined = joinAgentUsage(root, manifest)
+  const closeObserved = observeJoinedAgents(manifest, joined)
+  // The committer's host record, on a runner: the commit step's continuation is
+  // this close, so its lane is observed here. Usage is left as it was — the close
+  // has never counted the committer's results — and only the host's record is read.
+  const committerObserved = recordSpawnObservations(ctx, manifest, { results: [], hostRecords })
   const hostTotal =
     typeof observed.outputTokens === 'number' || observed.outputTokens === null
       ? observed.outputTokens
@@ -2789,7 +3752,8 @@ export async function runClose(
   if (
     hostCacheRead === undefined &&
     hostCacheCreation === undefined &&
-    hostCapability(manifest, 'cacheAccounting') === false
+    hostCapability(manifest, 'cacheAccounting') === false &&
+    closeObserved.usable === 0
   ) {
     manifest.notes.push(
       `CACHE ACCOUNTING NOT REPORTED: the ${hostId(manifest) || 'run'} host's runtime exposes no ` +
@@ -2798,13 +3762,23 @@ export async function runClose(
     )
   }
 
+  const useJoin = joined.present && joined.cacheFromHooks && joined.briefed > 0
   const summary = {
     waves: manifest.waves || [],
     spend: hostSpend || counted.spend,
     outputTokens: hostTotal !== undefined ? hostTotal : counted.outputTokens,
-    cacheReadInputTokens: hostCacheRead !== undefined ? hostCacheRead : counted.cacheReadInputTokens,
+    cacheReadInputTokens:
+      hostCacheRead !== undefined
+        ? hostCacheRead
+        : useJoin
+          ? joined.runCache.cacheReadInputTokens
+          : counted.cacheReadInputTokens,
     cacheCreationInputTokens:
-      hostCacheCreation !== undefined ? hostCacheCreation : counted.cacheCreationInputTokens,
+      hostCacheCreation !== undefined
+        ? hostCacheCreation
+        : useJoin
+          ? joined.runCache.cacheCreationInputTokens
+          : counted.cacheCreationInputTokens,
     review: tail.review,
     remediation: tail.remediation,
     remediationRounds: tail.remediationRounds,
@@ -2817,6 +3791,8 @@ export async function runClose(
     commitSkipped: manifest.commitSkipped === true,
     paths: readPathSets(root, manifest)
   }
+  // The join's per-wave cache figures, where the host observed none (design D5).
+  if (useJoin) summary.spend = fillJoinedCache(summary.spend, joined.cacheByWave)
 
   const degradations = degradationLines({
     banners: manifest.banners || [],
@@ -2880,19 +3856,36 @@ export async function runClose(
       ? fingerprint.hash
       : undefined
 
+  // The six observation counts: absent when the run saw no host record and no
+  // sidecar, a measured zero otherwise (design D8).
+  const runnerCounts = manifest.agentCounts && typeof manifest.agentCounts === 'object' ? manifest.agentCounts : null
+  const observedAny = Boolean(runnerCounts) || joined.present
+  const count = (value = 0) => (observedAny ? value : undefined)
   const receipt = buildReceipt({
     change: manifest.change,
     summary,
     degradations,
     planFingerprint,
     leftoverTaskIds,
+    lanesStoppedByHost: count(runnerCounts ? runnerCounts.lanesStoppedByHost : 0),
+    schemaResultsMissing: count(runnerCounts ? runnerCounts.schemaResultsMissing : 0),
+    toolsDeniedInLanes: count(runnerCounts ? runnerCounts.toolsDeniedInLanes : 0),
+    modelSubstitutions: count((runnerCounts ? runnerCounts.modelSubstitutions : 0) + closeObserved.substitutions),
+    permissionPrompts: count(closeObserved.permissionPrompts),
+    autoModeDenials: count(closeObserved.autoModeDenials),
+    surface: manifest.surface,
+    stateHome: manifest.stateHome,
     host: manifest.host
       ? {
           id: hostId(manifest),
           billing: hostCapability(manifest, 'billing'),
           hooks: hostCapability(manifest, 'hooks'),
           usage: hostCapability(manifest, 'usage'),
-          cacheAccounting: hostCapability(manifest, 'cacheAccounting')
+          cacheAccounting: hostCapability(manifest, 'cacheAccounting'),
+          // The manifest's own field, never `hostCapability`: that falls back to
+          // the assumed `flag`, and a run that recorded nothing would then read
+          // as one whose effort was applied.
+          effort: manifest.host.effort === undefined ? null : manifest.host.effort
         }
       : undefined
   })
@@ -2903,8 +3896,24 @@ export async function runClose(
   // degradation and a non-zero exit, exactly what an unreconstructable run gets
   // below. Silence would leave a run that reads complete and cannot be replayed.
   let trajectoryComplete = true
+  if (committerObserved.failure) {
+    trajectoryComplete = false
+    degradations.push(`TRAJECTORY APPEND FAILED: agent-result ${committerObserved.failure}`)
+  }
   if (manifest.runId) {
-    const written = appendRunLogEvent(root, {
+    // One `agent-result` per joined agent, before the receipt: the same fatal
+    // class as every other append here (ship/agent-results).
+    for (const entry of closeObserved.results) {
+      const result = appendRunLogEvent(home, { runId: manifest.runId, change: manifest.change, ...entry })
+      if (!result.written) {
+        ctx.warn(`agent-result not recorded: ${result.reason}`)
+        trajectoryComplete = false
+        degradations.push(`TRAJECTORY APPEND FAILED: agent-result ${entry.label}: ${result.reason}`)
+        break
+      }
+    }
+
+    const written = appendRunLogEvent(home, {
       ...receipt,
       runId: manifest.runId,
       change: manifest.change
@@ -2915,7 +3924,7 @@ export async function runClose(
       degradations.push(`TRAJECTORY APPEND FAILED: run-receipt: ${written.reason}`)
     }
 
-    const terminal = appendRunLogEvent(root, {
+    const terminal = appendRunLogEvent(home, {
       runId: manifest.runId,
       change: manifest.change,
       type: haltReason ? 'run-halt' : 'run-complete',
@@ -2931,7 +3940,7 @@ export async function runClose(
 
   // The outcome corpus. Its own write failure is reported and never touches the
   // exit code: losing a corpus line must not fail the run that produced it.
-  const outcome = appendOutcome(root, {
+  const outcome = appendOutcome(home, {
     change: manifest.change,
     mode: manifest.flags.mode || 'checkpoint',
     observed: observedFromReceipt(receipt)
@@ -2943,7 +3952,7 @@ export async function runClose(
   // this repository deliberately keeps different per corpus.
   let reconstructable = true
   if (manifest.runId) {
-    const check = checkRunLog(root, manifest.runId)
+    const check = checkRunLog(home, manifest.runId)
     reconstructable = check.ok !== false
     if (!reconstructable) {
       degradations.push(
@@ -2965,7 +3974,7 @@ export async function runClose(
   if (manifest.flags.strict === true && manifest.review) {
     const blockers = survivingBlockers(manifest)
     try {
-      recordAutonomy('review-code', { blockers }, { root })
+      recordAutonomy('review-code', { blockers }, { root: home })
       manifest.autonomy = { path: 'review-code', blockers }
     } catch (err) {
       degradations.push(
@@ -2989,7 +3998,7 @@ export async function runClose(
   // was hand-edited, cannot change what a later run does.
   let resumeCard = null
   if (haltReason) {
-    const written = writeResumeCard(root, {
+    const written = writeResumeCard(home, {
       change: manifest.change,
       runId: manifest.runId,
       halted: haltReason,
@@ -2999,7 +4008,9 @@ export async function runClose(
       waves: manifest.waves || [],
       degradations,
       projectSlug: slug,
-      cwd: absRoot
+      cwd: absRoot,
+      stateHome: home,
+      laneSessions: Array.isArray(manifest.laneSessions) ? manifest.laneSessions : []
     })
     if (written.written) resumeCard = written.path
     else degradations.push(`RESUME CARD NOT WRITTEN: ${written.reason}`)
@@ -3023,6 +4034,7 @@ export async function runClose(
       degradations,
       runId: manifest.runId,
       root: absRoot,
+      stateHome: home,
       projectSlug: slug,
       push,
       unarchived,
@@ -3031,6 +4043,87 @@ export async function runClose(
   }
 }
 
+/**
+ * Turn the close's join into what a reader sees (ship/agent-results): the
+ * partial and unjoined lines, the observed `hook` refinement, the permission
+ * counts, a model substitution per joined spawn, and the `agent-result` records
+ * the close appends before the receipt. Banners land on `manifest.banners`,
+ * notes on `manifest.notes`, before the summary is assembled from them.
+ */
+function observeJoinedAgents(manifest, joined) {
+  const out = { usable: 0, substitutions: 0, permissionPrompts: 0, autoModeDenials: 0, results: [] }
+  for (const entry of joined.unreadable) {
+    manifest.notes.push(`AGENT USAGE UNREADABLE: ${entry.file}: ${entry.reason}`)
+  }
+  if (!joined.present) return out
+
+  out.usable = joined.joined.filter(j => j.agent.usage && typeof j.agent.usage === 'object').length
+  // The cache half is the hooks standing in for a host that declared it cannot
+  // report: on a host that reports its own figures (the runner), a lane is a
+  // top-level session no subagent hook ever sees, and a sidecar holding only a
+  // permission file must not read as every lane unrecorded.
+  if (joined.cacheFromHooks && joined.briefed > 0 && joined.unrecorded > 0) {
+    manifest.banners.push(`CACHE ACCOUNTING PARTIAL: ${joined.unrecorded} of ${joined.briefed} agents unrecorded`)
+  }
+  const unjoined = joined.unjoined.noKey + joined.unjoined.unknownKey
+  if (unjoined > 0) {
+    manifest.notes.push(
+      `AGENT USAGE UNJOINED: ${unjoined} recorded agents matched no dispatched spawn ` +
+        `(${joined.unjoined.noKey} without a briefing key, ${joined.unjoined.unknownKey} with a key no spawn dispatched)`
+    )
+  }
+  // Observed only, and only from a declared `false`: no adapter declares `hook`,
+  // and a partial join keeps what the host declared.
+  if (joined.cacheFromHooks && joined.complete && manifest.host && typeof manifest.host === 'object') {
+    manifest.host.cacheAccounting = 'hook'
+  }
+
+  for (const { spawned, agent } of joined.joined) {
+    const verdict = modelSubstitution(spawned.model, { servedModels: agent.models })
+    if (verdict.substituted === true) {
+      manifest.banners.push(modelSubstitutedBanner(spawned.label, spawned.model, verdict.ran))
+      out.substitutions++
+    }
+    out.results.push({
+      type: 'agent-result',
+      label: spawned.label,
+      kind: spawned.kind,
+      agentId: agent.agentId,
+      source: 'transcript',
+      numTurns: agent.turns,
+      modelRouted: spawned.model || undefined,
+      servedModels: agent.models,
+      modelScope: verdict.scope,
+      substituted: verdict.substituted,
+      usage: agent.usage
+    })
+  }
+
+  const requests = joined.permissions.filter(p => p && p.kind === 'request')
+  const denials = joined.permissions.filter(p => p && p.kind === 'denied')
+  out.permissionPrompts = requests.length
+  out.autoModeDenials = denials.length
+  if (requests.length) manifest.banners.push(`PERMISSION PROMPTS DURING RUN: ${requests.length}`)
+  if (denials.length) {
+    const tools = [...new Set(denials.map(p => p.tool).filter(t => typeof t === 'string' && t))]
+    manifest.banners.push(`AUTO MODE DENIED ${denials.length} TOOL CALLS${tools.length ? ` (${tools.join(', ')})` : ''}`)
+  }
+  return out
+}
+
+/**
+ * The spend rows with the join's cache figures where the host observed none
+ * (design D5's precedence: the host's own figure, then the join, then what the
+ * results carried). A wave the join could not complete is recorded unknown.
+ */
+function fillJoinedCache(rows, cacheByWave) {
+  return rows.map(row => {
+    if (!row || !Number.isInteger(row.wave) || !cacheByWave.has(row.wave)) return row
+    if (Number.isFinite(row.cacheReadInputTokens)) return row
+    return { ...row, ...cacheByWave.get(row.wave) }
+  })
+}
+
 /**
  * Attempt the close's push, or decide not to. Returns what `formatRunSummary`
  * takes as its `push` input: `null` when no push was attempted at all, or