@runfusion/fusion 0.74.0-beta.1 → 0.74.0-beta.2

package/dist/child-process-worker.js

@@ -132897,6 +132897,23 @@ var init_worktrunk_installer = __esm({
 });
 
 // ../engine/src/active-session-registry.ts
+function acquireActiveSessionPath(registry3, path5, registration, options = {}) {
+  const existing = registry3.lookupByPath(path5);
+  if (!existing || existing.taskId === registration.taskId) {
+    registry3.registerPath(path5, registration);
+    return { action: "registered" };
+  }
+  const now = options.now?.() ?? Date.now();
+  const ageMs = now - existing.registeredAt;
+  const minIdleMs = options.minIdleMs ?? DEFAULT_SELF_OWNED_MIN_IDLE_MS;
+  const holderIsLive = options.holderLiveProbe?.(existing.taskId, path5) ?? true;
+  if (holderIsLive || ageMs < minIdleMs) {
+    return { action: "contended", holderTaskId: existing.taskId, holderKind: existing.kind, ageMs };
+  }
+  registry3.unregisterPath(path5);
+  registry3.registerPath(path5, registration);
+  return { action: "reclaimed-stale-foreign", holderTaskId: existing.taskId, ageMs };
+}
 function reconcileSelfOwnedActiveSessionForRemoval(registry3, worktreePath, requestingTaskId, liveBindingProbe, options = {}) {
   const record2 = registry3.lookupByPath(worktreePath);
   if (!record2) {
@@ -162576,6 +162593,12 @@ var init_usage_limit_detector = __esm({
 });
 
 // ../engine/src/transient-error-patterns.ts
+function isSessionContentionError(errorMessage) {
+  if (!errorMessage || typeof errorMessage !== "string") {
+    return false;
+  }
+  return SESSION_CONTENTION_PATTERNS.some((pattern) => pattern.test(errorMessage));
+}
 function isTransientError(errorMessage) {
   if (!errorMessage || typeof errorMessage !== "string") {
     return false;
@@ -162583,6 +162606,9 @@ function isTransientError(errorMessage) {
   if (isTransientAuthCredentialError(errorMessage)) {
     return true;
   }
+  if (isSessionContentionError(errorMessage)) {
+    return true;
+  }
   return TRANSIENT_ERROR_PATTERNS.some((pattern) => pattern.test(errorMessage));
 }
 function isTransientAuthCredentialError(errorMessage) {
@@ -162594,7 +162620,7 @@ function isTransientAuthCredentialError(errorMessage) {
   }
   return TRANSIENT_AUTH_CREDENTIAL_ROTATION_PATTERN.test(errorMessage);
 }
-var TRANSIENT_ERROR_PATTERNS, TRANSIENT_AUTH_CREDENTIAL_ROTATION_PATTERN, OPERATOR_ACTIONABLE_AUTH_EXCLUSION_PATTERN;
+var TRANSIENT_ERROR_PATTERNS, SESSION_CONTENTION_PATTERNS, TRANSIENT_AUTH_CREDENTIAL_ROTATION_PATTERN, OPERATOR_ACTIONABLE_AUTH_EXCLUSION_PATTERN;
 var init_transient_error_patterns = __esm({
   "../engine/src/transient-error-patterns.ts"() {
     "use strict";
@@ -162655,6 +162681,14 @@ var init_transient_error_patterns = __esm({
       /\bACP failed to start\b/i,
       /\bACP session has no live connection\b/i
     ];
+    SESSION_CONTENTION_PATTERNS = [
+      // ActiveSessionPathHeldByForeignTaskError (active-session-registry.ts)
+      /active-session path\s+\S+\s+is held by task\s+\S+/i,
+      // WorkspaceRepoAcquireBusyError (worktree-acquisition.ts)
+      /workspace sub-repo\s+\S+\s+acquisition is in progress for task\s+\S+/i,
+      // WorkspaceRepoLandBusyError (merger-ai.ts)
+      /workspace sub-repo\s+\S+\s+land is in progress for task\s+\S+/i
+    ];
     TRANSIENT_AUTH_CREDENTIAL_ROTATION_PATTERN = /"type":\s*"authentication_error"|invalid authentication credentials|token[_\s]?expired/i;
     OPERATOR_ACTIONABLE_AUTH_EXCLUSION_PATTERN = /oauth token does not meet scope|insufficient[_\s-]?scope|invalid[_\s-]?scope|invalid (?:api[_\s-]?key|x-api-key)|missing\s+(?:\S+\s+)?(?:api[_\s-]?)?key|revoked|suspend(?:ed)?|disabled|deactivated|subscription|account (?:is )?(?:locked|closed|inactive)|access denied/i;
   }
@@ -162663,6 +162697,9 @@ var init_transient_error_patterns = __esm({
 // ../engine/src/transient-error-detector.ts
 function isNonPlanDefectPlanReviewFailure(input) {
   if (input.verdict === "REVISE") return false;
+  if (input.failureValue?.trim().toLowerCase() === "session-contention-hold" || (input.errorMessage ? isSessionContentionError(input.errorMessage) : false)) {
+    return false;
+  }
   const failureValue = input.failureValue?.trim().toLowerCase();
   if (failureValue === "exception" || failureValue === "aborted") return true;
   const errorMessage = input.errorMessage?.trim();
@@ -191347,7 +191384,7 @@ function hasAdvancedPastPlanning(task) {
   if (task.column === "in-progress" || task.column === "in-review" || task.column === "done" || task.column === "archived") {
     return true;
   }
-  if (task.worktree != null) {
+  if (task.firstExecutionAt != null || task.executionStartedAt != null) {
     return true;
   }
   if (task.column === "triage") {
@@ -194544,6 +194581,7 @@ init_src2();
 // ../engine/src/workflow-graph-executor.ts
 init_src2();
 init_transient_error_detector();
+init_transient_error_patterns();
 
 // ../engine/src/required-workflow-artifacts.ts
 var REQUIRED_ARTIFACT_MISSING_PREFIX = "required-artifact-missing:";
@@ -195622,6 +195660,7 @@ function workflowNodeRequiresWorktree(node, { optionalGroupId, reviewerInlineFix
 // ../engine/src/workflow-graph-executor.ts
 var PLAN_REVIEW_PROVIDER_FAILURE_HOLD_VALUE = "plan-review-provider-failure-hold";
 var PLAN_REVIEW_LEASE_HELD_VALUE = "plan-review-lease-held";
+var SESSION_CONTENTION_HOLD_VALUE = "session-contention-hold";
 var WORKFLOW_INTERRUPTED_NODE_ID_CONTEXT_KEY = "workflow:interruptedNodeId";
 var WORKFLOW_INTERRUPTED_NODE_ABORT_KIND_CONTEXT_KEY = "workflow:interruptedNodeAbortKind";
 var WORKFLOW_OPTIONAL_GROUP_CONTEXT_KEY = "workflow:optionalGroupActive";
@@ -195991,6 +196030,15 @@ var WorkflowGraphExecutor = class {
         };
         context[`node:${node.id}:outcome`] = result2.outcome;
         if (result2.value !== void 0) context[`node:${node.id}:value`] = result2.value;
+        const sessionContentionFailure = stepStatus === "failed" && (verdictRaw === SESSION_CONTENTION_HOLD_VALUE || isSessionContentionError(stepOutput ?? stepNotes ?? ""));
+        if (sessionContentionFailure) {
+          this.deps.logTaskEntry?.(
+            `${logPrefix} ${groupName} is waiting on another task to release its session path \u2014 holding in place`
+          );
+          context[`node:${node.id}:outcome`] = "failure";
+          context[`node:${node.id}:value`] = SESSION_CONTENTION_HOLD_VALUE;
+          return { outcome: "failure", value: SESSION_CONTENTION_HOLD_VALUE };
+        }
         const nonPlanDefectPlanReviewFailure = node.id === PLAN_REVIEW_GROUP_ID && stepStatus === "failed" && (isRequiredArtifactReadFailedValue(verdictRaw) || isNonPlanDefectPlanReviewFailure({
           verdict,
           errorMessage: stepOutput ?? stepNotes,
@@ -196374,6 +196422,7 @@ var WorkflowGraphExecutor = class {
       } catch (error2) {
         if (signal?.aborted) return this.withEnginePauseAbortContext(node, { outcome: "failure", value: "aborted" });
         lastError = error2;
+        if (isSessionContentionError(error2 instanceof Error ? error2.message : String(error2))) break;
       }
     }
     if (signal?.aborted) {
@@ -196392,11 +196441,13 @@ var WorkflowGraphExecutor = class {
       }
       return degraded;
     }
+    const lastErrorText = lastError instanceof Error ? lastError.message : String(lastError);
     const failureResult = {
       outcome: "failure",
-      value: "exception",
+      // FNXC:SessionContention 2026-07-25-21:30: contention is a retryable hold, not an exception.
+      value: isSessionContentionError(lastErrorText) ? SESSION_CONTENTION_HOLD_VALUE : "exception",
       contextPatch: {
-        [`node:${node.id}:error`]: lastError instanceof Error ? lastError.message : String(lastError)
+        [`node:${node.id}:error`]: lastErrorText
       }
     };
     if (recordProgress && this.shouldRecordNodeProgress(node)) {
@@ -207212,6 +207263,7 @@ async function preserveWorktreeChanges(repoDir, worktreePath, taskId) {
     return null;
   }
 }
+var PRE_EXECUTION_WORKTREE_MAX_IDLE_MS = 30 * 24 * 60 * 60 * 1e3;
 var APPROVED_TRIAGE_RECOVERY_GRACE_MS = 6e4;
 var STARVED_REFINEMENT_RECOVERY_GRACE_MS = 10 * 6e4;
 var STARVED_PEER_PROGRESS_THRESHOLD = 3;
@@ -208970,6 +209022,8 @@ var SelfHealingManager = class _SelfHealingManager {
           { name: "reconcile-workspace-partial-lands", fn: () => this.reconcileWorkspacePartialLands() },
           { name: "reclaim-phantom-workspace-land-leases", fn: () => this.reclaimPhantomWorkspaceLandLeases() },
           { name: "reconcile-orphaned-workspace-worktrees", fn: () => this.reconcileOrphanedWorkspaceWorktrees() },
+          // FNXC:PlanningEvacuation 2026-07-25-23:00: reclaim worktrees acquired at planning time by cards that never executed.
+          { name: "reconcile-pre-execution-worktrees", fn: () => this.reconcilePreExecutionWorktrees() },
           { name: "recover-merged-review", fn: () => this.recoverMergedReviewTasks() },
           { name: "recover-already-merged-review", fn: () => this.recoverAlreadyMergedReviewTasks() },
           { name: "recover-post-done-noncontinuable-wedge", fn: () => this.recoverPostDoneNonContinuableWedge() },
@@ -213996,6 +214050,58 @@ var SelfHealingManager = class _SelfHealingManager {
       return 0;
     }
   }
+  /*
+    FNXC:PlanningEvacuation 2026-07-25-23:00 (pre-execution worktree sweep):
+    Planning acquires the task's own worktree, so cards that never reach execution would accumulate
+    worktrees on disk: withdrawn to an intake column, archived from a planner lane, or simply parked.
+    This sweep reclaims them.
+  
+    Candidates are addressed from task ROWS (never a directory walk — AGENTS.md forbids unbounded temp
+    scans): tasks holding `worktree` that sit in a non-executing column and carry no execution
+    timestamp. `todo` is deliberately EXCLUDED: a planned card waiting for a WIP slot legitimately
+    keeps its worktree, and churning it would just force a re-acquire minutes later. Every real safety
+    decision (live session, clean branch, execution evidence) belongs to
+    `TaskExecutor.releasePreExecutionWorktree`, so this sweep cannot diverge from the event-driven path
+    that runs on the move itself.
+    */
+  async reconcilePreExecutionWorktrees() {
+    try {
+      const release2 = this.options.releasePreExecutionWorktree;
+      if (!release2) return 0;
+      const settings = await this.store.getSettings();
+      if (settings.globalPause || settings.enginePaused) return 0;
+      const now = Date.now();
+      const parked = await this.store.listTasks({ slim: true });
+      const candidates = parked.filter((task) => {
+        if (!task.worktree || task.deletedAt) return false;
+        if (task.firstExecutionAt || task.executionStartedAt) return false;
+        if (task.column === "todo" || task.column === "in-progress" || task.column === "in-review" || task.column === "done") return false;
+        if (task.paused || task.userPaused) return false;
+        if (task.status != null) return false;
+        if (task.blockedBy || task.overlapBlockedBy || task.nextRecoveryAt) return false;
+        const lastTouchedMs = Math.max(
+          Date.parse(task.columnMovedAt ?? "") || 0,
+          Date.parse(task.updatedAt ?? "") || 0
+        );
+        if (!lastTouchedMs) return false;
+        return now - lastTouchedMs >= PRE_EXECUTION_WORKTREE_MAX_IDLE_MS;
+      });
+      if (candidates.length === 0) return 0;
+      let released = 0;
+      for (const task of candidates) {
+        try {
+          if (await release2(task.id, `parked pre-execution in '${task.column}'`)) released++;
+        } catch (err) {
+          log28.warn(`reconcilePreExecutionWorktrees: release failed for ${task.id}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
+      if (released > 0) log28.log(`reconcilePreExecutionWorktrees: released ${released} pre-execution worktree(s)`);
+      return released;
+    } catch (err) {
+      log28.error(`reconcilePreExecutionWorktrees sweep failed: ${err instanceof Error ? err.message : String(err)}`);
+      return 0;
+    }
+  }
   /*
   FNXC:Workspace 2026-06-22-09:30 (Phase D U1, KTD4 — per-repo worktree cleanup from STORED paths):
   For done/dead workspace tasks, remove each recorded per-repo worktree. The paths are ADDRESSABLE
@@ -218601,6 +218707,9 @@ var MAX_TASK_DONE_SESSION_RETRIES = 3;
 var MAX_TASK_DONE_REQUEUE_RETRIES = 3;
 var MAX_TRANSIENT_GRAPH_RESUME_RETRIES = 2;
 var TRANSIENT_GRAPH_RESUME_RETRY_BACKOFF_MS = process.env.VITEST || process.env.NODE_ENV === "test" ? 0 : 1e3;
+var MAX_SESSION_CONTENTION_HOLD_RETRIES = 10;
+var SESSION_CONTENTION_HOLD_BACKOFF_MS = process.env.VITEST || process.env.NODE_ENV === "test" ? 0 : 5e3;
+var SESSION_CONTENTION_HOLD_MAX_BACKOFF_MS = 6e4;
 var COMPLETED_TASK_WATCHDOG_MS = 6e4;
 var WORKFLOW_RERUN_WATCHDOG_MS = 15e3;
 var LOOP_COMPACTION_TIMEOUT_MS = 6e4;
@@ -219340,6 +219449,15 @@ var TaskExecutor = class _TaskExecutor {
             }
           })
         );
+      } else if ((from === "todo" || from === "triage") && to2 !== "in-progress" && to2 !== "in-review" && to2 !== "done") {
+        this.trackTaskDisposal(
+          task.id,
+          this.awaitAbortInFlightTaskWork(task.id, `task moved out of planning to ${to2}`, {
+            userCanceled: source === "user"
+          }).then(async () => {
+            await this.releasePreExecutionWorktree(task.id, `moved to ${to2}`);
+          })
+        );
       } else if (from === "in-progress") {
         if (this.workflowLifecycleMovesInFlight.has(task.id) && this.graphRouting.has(task.id)) {
           executorLog.log(
@@ -219929,15 +220047,63 @@ var TaskExecutor = class _TaskExecutor {
   getActiveWorktreePaths() consumers that cd into a path are unaffected; only the registry key changes.
   Non-workspace tasks (unique worktree path != rootDir) are returned unchanged.
   */
+  /*
+  FNXC:PlanReviewWorktree 2026-07-25-20:40 (concurrent root-rooted step sessions — single-repo collision):
+  The task-scoped key must apply to the shared repo root in EVERY project mode, not only workspace mode.
+  Read-only graph nodes that need no worktree (Plan Review is the canonical one — it reviews the
+  store-injected PROMPT.md, see FNXC:PlanReviewSpecInjection) run rooted at `this.rootDir`, and a todo
+  task has no worktree of its own. With the bare root as the registry key, two tasks reaching Plan Review
+  at the same time collided: the second failed with "active-session path <root> is held by task <other>;
+  task <self> may not overwrite it", which surfaced as a Plan Review provider failure, burned the
+  in-place retry budget against a hold that retrying can never clear, and left the task parked
+  (reported: FN-1398 holding /home/ubuntu/dev/freemap-svelte while FN-1403 planned).
+  Path-exclusivity on the shared root is not what keeps these sessions correct: write-capable nodes are
+  refused at the root outright (no-worktree-for-write-node above), real per-sub-repo exclusivity is the
+  workspace-repo-acquire lease, and every isPathActive consumer guards removable WORKTREE paths — the
+  root is never one. Liveness still works because the synthetic key stays in the registry under the task.
+  */
   sessionRegistryPath(taskId, worktreePath) {
-    if (this.workspaceConfig && worktreePath === this.rootDir) {
+    if (worktreePath === this.rootDir) {
       return `${worktreePath}#session:${taskId}`;
     }
     return worktreePath;
   }
+  /*
+  FNXC:SessionContention 2026-07-25-21:30 (contention prevention at the registration seam):
+  Every executor session registration goes through `acquireActiveSessionPath` instead of the raw
+  `registerPath`, so a LEAKED entry owned by a task with no live session surface in this process is
+  RECLAIMED rather than throwing at the newcomer. That closes the second contention class (a dead
+  holder can never release, so waiting on it is waiting forever). A genuinely live holder still throws
+  the typed error — that case is real serialization, and callers classify it as a retryable contention
+  hold (SESSION_CONTENTION_HOLD_VALUE), never as a provider/model failure.
+  The probe reports LIVE on any uncertainty: an unknown holder with a fresh entry is treated as live by
+  the staleness floor, so the reclaim only ever fires on proven-dead, aged entries.
+  */
+  acquireSessionRegistryPath(taskId, registryPath, kind, ownerKey) {
+    const outcome = acquireActiveSessionPath(activeSessionRegistry, registryPath, { taskId, kind, ownerKey }, {
+      holderLiveProbe: (holderTaskId) => this.hasLiveTaskSessionSurface(holderTaskId) || executingTaskLock.has(holderTaskId)
+    });
+    if (outcome.action === "contended") {
+      throw new ActiveSessionPathHeldByForeignTaskError(registryPath, outcome.holderTaskId, taskId);
+    }
+    if (outcome.action === "reclaimed-stale-foreign") {
+      executorLog.warn(
+        `${taskId}: reclaimed a stale active-session entry on ${registryPath} from dead task ${outcome.holderTaskId} (idle ${outcome.ageMs}ms)`
+      );
+      void this.store.recordRunAuditEvent?.({
+        taskId,
+        agentId: "executor",
+        runId: generateSyntheticRunId("session-path-reclaim", taskId),
+        domain: "database",
+        mutationType: "session:reclaim-stale-foreign-path",
+        target: taskId,
+        metadata: { taskId, holderTaskId: outcome.holderTaskId, kind, ageMs: outcome.ageMs }
+      })?.catch?.(() => void 0);
+    }
+  }
   setActiveSession(taskId, sessionState, worktreePath) {
     this.activeSessions.set(taskId, sessionState);
-    activeSessionRegistry.registerPath(this.sessionRegistryPath(taskId, worktreePath), { taskId, kind: "executor", ownerKey: taskId });
+    this.acquireSessionRegistryPath(taskId, this.sessionRegistryPath(taskId, worktreePath), "executor", taskId);
   }
   markGraphExecuteSelfRequeued(taskId) {
     if (this.graphRouting.has(taskId)) {
@@ -219955,7 +220121,7 @@ var TaskExecutor = class _TaskExecutor {
   setActiveStepExecutor(taskId, stepExecutor, worktreePath, seenSteeringIds = /* @__PURE__ */ new Set()) {
     this.activeStepExecutors.set(taskId, stepExecutor);
     this.activeStepExecutorSeenSteeringIds.set(taskId, seenSteeringIds);
-    activeSessionRegistry.registerPath(this.sessionRegistryPath(taskId, worktreePath), { taskId, kind: "step-session", ownerKey: `${taskId}#step-session` });
+    this.acquireSessionRegistryPath(taskId, this.sessionRegistryPath(taskId, worktreePath), "step-session", `${taskId}#step-session`);
   }
   deleteActiveStepExecutor(taskId, worktreePath) {
     this.activeStepExecutors.delete(taskId);
@@ -219969,7 +220135,7 @@ var TaskExecutor = class _TaskExecutor {
   setActiveWorkflowStepSession(taskId, session, worktreePath, seenSteeringIds = /* @__PURE__ */ new Set()) {
     this.activeWorkflowStepSessions.set(taskId, session);
     this.activeWorkflowStepSessionSeenSteeringIds.set(taskId, seenSteeringIds);
-    activeSessionRegistry.registerPath(this.sessionRegistryPath(taskId, worktreePath), { taskId, kind: "workflow-step", ownerKey: `${taskId}#workflow-step` });
+    this.acquireSessionRegistryPath(taskId, this.sessionRegistryPath(taskId, worktreePath), "workflow-step", `${taskId}#workflow-step`);
   }
   deleteActiveWorkflowStepSession(taskId, worktreePath) {
     this.activeWorkflowStepSessions.delete(taskId);
@@ -224288,6 +224454,87 @@ ${info.feedback}`, revisionKey),
       this.unregisterConfiguredCommandController(task.id, commandAbortController);
     }
   }
+  /*
+  FNXC:NodeWorktreeIsolation 2026-07-25-22:10 (planning acquires the task worktree):
+  Public seam for the planning/triage lane. Specification runs a CODING-tool session; pointing it at
+  the shared main checkout meant every planning agent had write tools in the operator's tree and every
+  concurrent planner shared one path. Acquire the task's own worktree up front and let the whole
+  lifecycle — planning, Plan Review, implementation, code review — reuse that single worktree.
+  Returns null (caller falls back to the root, unchanged behavior) when the project is a workspace, or
+  when acquisition fails: planning must never be blocked by a worktree problem.
+  */
+  /*
+  FNXC:PlanningEvacuation 2026-07-25-23:00 (pre-execution worktree release):
+  Planning now acquires a worktree, so a card that never reaches execution — withdrawn to Ideas,
+  archived from a planner lane, or parked pre-execution — would otherwise hold one forever. Release
+  it. Safety conditions, all required:
+   - the task never executed (`firstExecutionAt`/`executionStartedAt` unset): execution evidence means
+     the worktree may hold real work, and only the normal merge/archive lifecycle may remove it;
+   - no live session registered on the path (the same isPathActive guard the other sweeps use);
+   - the branch carries no commits beyond its base — planning writes its spec to the task store, not
+     the worktree, so a clean branch means there is genuinely nothing to lose.
+  Metadata (`worktree`/`branch`) is cleared with it, so a later promotion re-acquires cleanly.
+  Fail-soft throughout: a cleanup problem must never block the lifecycle move that triggered it.
+  */
+  async releasePreExecutionWorktree(taskId, reason) {
+    try {
+      const live = await this.store.getTask(taskId);
+      if (!live?.worktree) return false;
+      if (live.firstExecutionAt || live.executionStartedAt) return false;
+      if (activeSessionRegistry.isPathActive(live.worktree) || activeSessionRegistry.isPathActive(resolvePath3(live.worktree))) return false;
+      if (this.hasLiveTaskSessionSurface(taskId) || executingTaskLock.has(taskId)) return false;
+      if (existsSync65(live.worktree)) {
+        if (await this.preExecutionWorktreeHasWork(live.worktree)) {
+          executorLog.log(`${taskId}: keeping pre-execution worktree ${live.worktree} \u2014 it carries commits or uncommitted changes`);
+          return false;
+        }
+        const settings = await this.store.getSettings();
+        await removeWorktree({
+          rootDir: this.rootDir,
+          worktreePath: live.worktree,
+          settings,
+          taskId,
+          reason: RemovalReason.SelfHealingReclaim
+        });
+      }
+      this.activeWorktrees.get(taskId)?.delete(live.worktree);
+      await this.store.updateTask(taskId, { worktree: null, branch: null, baseCommitSha: null, sessionFile: null }, this.getRunContextFor(taskId));
+      await this.store.logEntry(taskId, `Released the pre-execution worktree (${reason}) \u2014 it will be re-acquired when planning or execution resumes`, void 0, this.getRunContextFor(taskId)).catch(() => void 0);
+      executorLog.log(`${taskId}: released pre-execution worktree ${live.worktree} (${reason})`);
+      return true;
+    } catch (error2) {
+      executorLog.warn(`${taskId}: could not release the pre-execution worktree: ${formatError(error2).message}`);
+      return false;
+    }
+  }
+  /** True when a pre-execution worktree holds commits past its base or any uncommitted change. */
+  async preExecutionWorktreeHasWork(worktreePath) {
+    try {
+      const { stdout: dirty } = await execFileAsync19("git", ["status", "--porcelain"], { cwd: worktreePath, timeout: 3e4 });
+      if (dirty.trim()) return true;
+      const { stdout: ahead } = await execFileAsync19("git", ["log", "--oneline", "@{upstream}..HEAD"], { cwd: worktreePath, timeout: 3e4 }).catch(async () => await execFileAsync19("git", ["log", "--oneline", "-1", "HEAD", "--not", "--remotes", "--branches=main", "--branches=master"], { cwd: worktreePath, timeout: 3e4 }));
+      return Boolean(ahead.trim());
+    } catch {
+      return true;
+    }
+  }
+  async ensureTaskWorktreeForPlanning(taskId) {
+    try {
+      if (this.workspaceConfig === void 0) {
+        this.workspaceConfig = await loadWorkspaceConfig(this.rootDir);
+      }
+      if (this.workspaceConfig && (this.workspaceConfig.repos.length ?? 0) > 0) return null;
+      const live = await this.store.getTask(taskId);
+      if (live.worktree && existsSync65(live.worktree)) return live.worktree;
+      const settings = await this.store.getSettings();
+      const acquisitionTask = live.worktree ? { ...live, worktree: void 0, sessionFile: void 0 } : live;
+      const acquired = await this.ensureGraphCustomNodeWorktree(acquisitionTask, settings, "planning");
+      return acquired.worktree || null;
+    } catch (error2) {
+      executorLog.warn(`${taskId}: could not acquire a planning worktree \u2014 planning falls back to the repo root: ${formatError(error2)}`);
+      return null;
+    }
+  }
   async prepareGraphNodeExecution(node, nodeTask, settings, requirement) {
     if (!requirement.requiresWorktree) return;
     const live = await this.store.getTask(nodeTask.id);
@@ -224414,22 +224661,29 @@ ${info.feedback}`, revisionKey),
       optionalGroupId,
       reviewerInlineFixes: settings.reviewerInlineFixes
     });
-    const executionTarget = writeCapable ? await this.store.getTask(live.id) : live;
-    if (writeCapable && !executionTarget.worktree && !this.workspaceConfig) {
-      return { outcome: "failure", value: "no-worktree-for-write-node" };
-    }
+    let executionTarget = writeCapable ? await this.store.getTask(live.id) : live;
     const nodeDisplayName = typeof cfg.name === "string" && cfg.name.trim() ? cfg.name.trim() : node.id;
     const isPlanReviewNode = node.id === "plan-review-step" || nodeDisplayName === "Plan Review" || optionalGroupId === "plan-review";
-    let worktreePath = executionTarget.worktree || this.rootDir;
-    if (isPlanReviewNode && !writeCapable && executionTarget.worktree && !existsSync65(executionTarget.worktree)) {
-      await this.store.logEntry(
-        live.id,
-        `Plan Review worktree ${executionTarget.worktree} is missing on disk \u2014 running the reviewer from the repo root (spec is store-injected)`,
-        void 0,
-        this.getRunContextFor(live.id)
-      );
-      worktreePath = this.rootDir;
+    if (!this.workspaceConfig) {
+      const recordedWorktreeMissing = Boolean(executionTarget.worktree) && !existsSync65(executionTarget.worktree);
+      const shouldAcquire = !executionTarget.worktree || recordedWorktreeMissing && isPlanReviewNode;
+      if (shouldAcquire) {
+        if (recordedWorktreeMissing) {
+          await this.store.logEntry(
+            live.id,
+            `Plan Review worktree ${executionTarget.worktree} is missing on disk \u2014 re-acquiring a task worktree instead of running in the shared checkout`,
+            void 0,
+            this.getRunContextFor(live.id)
+          );
+        }
+        const acquisitionTask = recordedWorktreeMissing ? { ...executionTarget, worktree: void 0, sessionFile: void 0 } : executionTarget;
+        executionTarget = await this.ensureGraphCustomNodeWorktree(acquisitionTask, settings, node.id);
+      }
+    }
+    if (writeCapable && !executionTarget.worktree && !this.workspaceConfig) {
+      return { outcome: "failure", value: "no-worktree-for-write-node" };
     }
+    const worktreePath = executionTarget.worktree || this.rootDir;
     let prompt = typeof cfg.prompt === "string" ? cfg.prompt : "";
     let modelProvider = typeof cfg.modelProvider === "string" && cfg.modelProvider.trim() ? cfg.modelProvider : void 0;
     let modelId = typeof cfg.modelId === "string" && cfg.modelId.trim() ? cfg.modelId : void 0;
@@ -224726,6 +224980,77 @@ ${prompt}`;
     const latestAction = live.log.at(-1)?.action;
     return latestAction === "Resumed after engine restart" || latestAction === "Resuming execution after unpause";
   }
+  /*
+  FNXC:SessionContention 2026-07-25-21:30:
+  Two ways in, because contention must never slip through to a park:
+   - the typed failure value the graph now publishes (SESSION_CONTENTION_HOLD_VALUE), and
+   - a message-shape fallback over the run's `:error` context patches, so contention arriving from a
+     path that has not been taught the typed value is still recognized.
+  */
+  graphFailureErrorTexts(result) {
+    if (!result.context) return [];
+    const texts = [];
+    for (const [key, value] of Object.entries(result.context)) {
+      if (key.endsWith(":error") && typeof value === "string" && value.trim()) texts.push(value);
+    }
+    return texts;
+  }
+  isSessionContentionGraphFailure(result) {
+    if (this.graphFailureValue(result) === SESSION_CONTENTION_HOLD_VALUE) return true;
+    return this.graphFailureErrorTexts(result).some((text2) => isSessionContentionError(text2));
+  }
+  /*
+  FNXC:SessionContention 2026-07-25-21:30 (self-recovering wait — the task is never parked):
+  Retry the graph in place on an exponential backoff while the holder finishes. The counter is
+  IN-MEMORY on purpose: it needs no schema change, and an engine restart resetting it is the desired
+  behavior (a restart also drops the in-process registry, so the contention is gone anyway).
+  When the ladder is exhausted the task is left cleanly dispatchable — status/error cleared, progress
+  untouched — so ordinary scheduling picks it up later with a fresh budget. There is no terminal branch
+  here by design: lease contention always ends (the holder finishes, or self-healing sweeps it), so
+  parking the task would only require a human to press Retry on a condition that fixed itself.
+  */
+  sessionContentionHoldAttempts = /* @__PURE__ */ new Map();
+  clearSessionContentionHold(taskId) {
+    this.sessionContentionHoldAttempts.delete(taskId);
+  }
+  async holdForSessionContention(task, live, result) {
+    const detail = this.graphFailureErrorTexts(result).find((text2) => isSessionContentionError(text2));
+    const priorAttempts = this.sessionContentionHoldAttempts.get(task.id) ?? 0;
+    const attempt = priorAttempts + 1;
+    if (attempt > MAX_SESSION_CONTENTION_HOLD_RETRIES) {
+      this.clearSessionContentionHold(task.id);
+      const message2 = `Still waiting on another task to release a shared session path after ${MAX_SESSION_CONTENTION_HOLD_RETRIES} attempts \u2014 leaving the task queued for normal re-dispatch (not a failure)${detail ? `: ${detail}` : ""}`;
+      executorLog.warn(`${task.id}: ${message2}`);
+      await this.store.logEntry(task.id, message2, void 0, this.getRunContextFor(task.id));
+      if (live.status != null || live.error != null) {
+        await this.store.updateTask(task.id, { status: null, error: null }, this.getRunContextFor(task.id));
+      }
+      return;
+    }
+    this.sessionContentionHoldAttempts.set(task.id, attempt);
+    const message = `Waiting on another task to release a shared session path \u2014 retrying in place (${attempt}/${MAX_SESSION_CONTENTION_HOLD_RETRIES})${detail ? `: ${detail}` : ""}`;
+    executorLog.warn(`${task.id}: ${message}`);
+    await this.store.logEntry(task.id, message, void 0, this.getRunContextFor(task.id));
+    if (live.status != null || live.error != null) {
+      await this.store.updateTask(task.id, { status: null, error: null }, this.getRunContextFor(task.id));
+    }
+    const delayMs = SESSION_CONTENTION_HOLD_BACKOFF_MS === 0 ? 0 : Math.min(SESSION_CONTENTION_HOLD_MAX_BACKOFF_MS, SESSION_CONTENTION_HOLD_BACKOFF_MS * 2 ** (attempt - 1));
+    const scheduleRetry = () => {
+      void (async () => {
+        try {
+          const resume = await this.store.getTask(task.id);
+          if (!resume || resume.deletedAt || resume.paused || resume.userPaused) {
+            this.clearSessionContentionHold(task.id);
+            return;
+          }
+          await this.execute(resume);
+        } catch (err) {
+          executorLog.error(`Failed session-contention retry for ${task.id}:`, err);
+        }
+      })();
+    };
+    setTimeout(scheduleRetry, delayMs).unref?.();
+  }
   graphFailureValue(result) {
     const failedNode = result.visitedNodeIds[result.visitedNodeIds.length - 1];
     if (!failedNode || !result.context) return void 0;
@@ -225317,6 +225642,11 @@ Graph value: ${failureValue}` : ""}`, budget.key),
         await this.persistTokenUsage(task.id);
         return;
       }
+      if (this.isSessionContentionGraphFailure(result)) {
+        await this.holdForSessionContention(task, live, result);
+        await this.persistTokenUsage(task.id);
+        return;
+      }
       if (await this.routeUnusableWorktreeGraphFailureToRecovery(task, live, result)) {
         await this.persistTokenUsage(task.id);
         return;
@@ -241523,6 +241853,33 @@ var TriageProcessor = class _TriageProcessor {
       if (this.processing.has(task.id) || this.hasLivePlanningWork(task.id)) return;
       this.requestImmediatePoll();
     };
+    this.taskEvacuatedFromPlanningHandler = (task) => {
+      if (!task?.id) return;
+      if (typeof task.column !== "string") return;
+      if (task.column === "todo" || task.column === "triage" || task.column === "in-progress") return;
+      if (this.activeSubagentSessions.has(task.id)) {
+        this.disposeSubagentsForTask(task.id, `task moved to ${task.column}`);
+      }
+      const session = this.activeSessions.get(task.id);
+      if (!session) return;
+      planLog.log(`task moved out of planning to '${task.column}' \u2014 terminating triage session for ${task.id}`);
+      this.pauseAborted.add(task.id);
+      this.options.stuckTaskDetector?.untrackTask(task.id);
+      const sessionWithAbort = session;
+      if (typeof sessionWithAbort.abort === "function") {
+        void sessionWithAbort.abort().catch((err) => {
+          planLog.warn(`Failed to abort triage session for ${task.id}: ${err}`);
+        });
+      }
+      this.recordTriageSessionTokenUsageSoon(task.id, session, { agentId: task.assignedAgentId ?? "triage" });
+      session.dispose();
+      this.activeSessions.delete(task.id);
+      if (task.status === "planning") {
+        void Promise.resolve(this.store.updateTask(task.id, { status: null })).catch((err) => {
+          planLog.warn(`${task.id}: failed to clear planning status after evacuation: ${err instanceof Error ? err.message : String(err)}`);
+        });
+      }
+    };
   }
   running = false;
   polling = false;
@@ -241581,6 +241938,8 @@ var TriageProcessor = class _TriageProcessor {
   taskPausedHandler;
   /** FNXC:CodingIdeasWorkflow 2026-07-25-11:20: store-event wake for planning-eligible columns. */
   taskColumnWakeHandler;
+  /** FNXC:PlanningEvacuation 2026-07-25-23:00: stops planning when a card leaves the planner lanes. */
+  taskEvacuatedFromPlanningHandler;
   _approvalRequestStore;
   /**
    * @param store — Task store instance (also used to listen for `settings:updated` events)
@@ -241689,6 +242048,9 @@ var TriageProcessor = class _TriageProcessor {
       this.store.on("task:updated", this.taskColumnWakeHandler);
       this.store.on("task:created", this.taskColumnWakeHandler);
     }
+    if (this.taskEvacuatedFromPlanningHandler && typeof this.store.on === "function") {
+      this.store.on("task:updated", this.taskEvacuatedFromPlanningHandler);
+    }
     this.clearStaleSpecifyingStatuses().catch((err) => {
       planLog.error("Failed to clear stale planning statuses:", err);
     });
@@ -241736,6 +242098,9 @@ var TriageProcessor = class _TriageProcessor {
       this.store.off("task:updated", this.taskColumnWakeHandler);
       this.store.off("task:created", this.taskColumnWakeHandler);
     }
+    if (this.taskEvacuatedFromPlanningHandler && typeof this.store.off === "function") {
+      this.store.off("task:updated", this.taskEvacuatedFromPlanningHandler);
+    }
     this.abortAndDisposeActiveSessions("engine stop");
     planLog.log("Processor stopped");
   }
@@ -242527,11 +242892,15 @@ You are ${assignedAgent.name}${assignedAgent.title?.trim() ? `, ${assignedAgent.
           planningModel.modelId,
           assignedAgent?.runtimeConfig
         ) : { provider: void 0, modelId: void 0 };
+        const planningCwd = await this.options.acquirePlanningWorktree?.(task.id).catch(() => null) || this.rootDir;
+        if (planningCwd !== this.rootDir) {
+          await this.store.logEntry(task.id, `Planning session running in task worktree ${planningCwd}`).catch(() => void 0);
+        }
         const { session } = await createResolvedAgentSession({
           sessionPurpose: "triage",
           runtimeHint: triageRuntimeHint,
           pluginRunner: this.options.pluginRunner,
-          cwd: this.rootDir,
+          cwd: planningCwd,
           systemPrompt: triageSystemPromptFinal,
           systemPromptLayers: triageLayers,
           tools: "coding",
@@ -244963,6 +245332,9 @@ var InProcessRuntime = class extends EventEmitter27 {
           usageLimitPauser: this.usageLimitPauser,
           agentStore: this.agentStore,
           pluginRunner: this.pluginRunner,
+          // FNXC:NodeWorktreeIsolation 2026-07-25-22:10: planning acquires (or reuses) the task's own
+          // worktree through the executor's acquisition path, so no lane runs in the shared checkout.
+          acquirePlanningWorktree: (taskId) => this.executor.ensureTaskWorktreeForPlanning(taskId),
           onSpecifyStart: (t) => {
             this.recordActivity();
             runtimeLog.log(`Specifying ${t.id}...`);
@@ -245051,6 +245423,8 @@ var InProcessRuntime = class extends EventEmitter27 {
         getExecutingTaskIds: () => this.executor?.getExecutingTaskIds() ?? /* @__PURE__ */ new Set(),
         clearPhantomExecutorBinding: (taskId, options) => this.executor?.clearPhantomExecutorBinding(taskId, options),
         listWorktreeHolders: () => this.executor?.listWorktreeHolders() ?? [],
+        // FNXC:PlanningEvacuation 2026-07-25-23:00: the executor owns the release safety conditions.
+        releasePreExecutionWorktree: (taskId, reason) => this.executor?.releasePreExecutionWorktree(taskId, reason) ?? Promise.resolve(false),
         recoverApprovedTriageTask: (task) => this.triageProcessor?.recoverApprovedTask(task) ?? Promise.resolve(false),
         getPlanningTaskIds: () => this.triageProcessor?.getPlanningTaskIds() ?? /* @__PURE__ */ new Set(),
         // FNXC:TaskTiming 2026-08-01-12:00: orphan planning recovery must defer