@telora/daemon 0.19.43 → 0.19.74

package/dist/focus-executor.js

@@ -27,72 +27,53 @@
  * When tracing a symbol imported from this file, check those modules first;
  * only the spawn choreography itself is implemented here.
  */
-import { spawn } from 'node:child_process';
 import { mkdirSync, existsSync } from 'node:fs';
-import { hostname } from 'node:os';
-import { createSession, updateSession, getActiveFocuses, } from './supabase.js';
-import { createWorktree, runGitSync, repoHasCommits } from './git.js';
-import { installReadOnlyAuditGuards } from './audit-hooks.js';
-import { getFocusWorktree, setFocusWorktree } from './focus-worktree-state.js';
-import { withRetry, productLabel, loadEnvConfig, ESCALATION_REASONS } from '@telora/daemon-core';
-import { createEscalation } from './queries/issues.js';
+import { updateSession, } from './supabase.js';
+import { productLabel } from '@telora/daemon-core';
 import { recordActivity } from './heartbeat.js';
-import { buildFocusTeamPrompt } from './focus-prompt-builder.js';
-import { buildRoleFrameworkPrompt, buildRemediationFramingSection, buildReviewOutcomeStampingSection, buildResumeDeltaMessage } from './team-prompt-base.js';
-import { getFocusDeliveries, getFocusIssues, getProductContextForFocus, getProductDeploymentProfileSnapshot, fetchFocusWorkflow } from './queries/focuses.js';
 import { applyRespawnGuard } from './focus-respawn-guard.js';
-import { buildLeveredSpawnEnvironment, fetchBackendEnvExtras } from './spawn-environment.js';
-import { wrapSpawnCommand, SandboxUnavailableError } from './spawn-sandbox.js';
-import { sanitizeGitSegment, resolveRef } from './git-utils.js';
-import { resolveResumeId, resolveLineageSpec } from './session-lineage.js';
-import { resolveTeamModel, resolveLocalModelRefPrecedence } from './model-resolution.js';
-import { recordFocusTeardown } from './spawn-cooldown.js';
-import { recordWorkerPid, removeWorkerPid } from './worker-pidfile.js';
-import { markSessionPersisted } from './telemetry-writer.js';
-import { consumePendingSpawnDirective, assembleDirectiveContentWithManifest, syncFocusPhase, isAgentlessDirective } from './directive-executor.js';
-import { resolveAssemblyRecipeWithManifest } from './assembly-engine.js';
-import { resolveFocusMilestoneContext } from './prd-focus-pushdown.js';
-import { insertAssemblyManifest } from './queries/context-assembly.js';
+import { sanitizeGitSegment, resolveRef } from './git/index.js';
+import { resolveResumeId } from './session-lineage.js';
 // Side-effect import: registers assembly resolvers with assembly-engine at module load. Required - do not remove.
 import './assembly-resolvers.js';
-import { isStatusAgentActionable, isStatusBlocking } from './stage-classifier.js';
-import { filterReviewFiledIssues } from './review-defect-detector.js';
-import { getActiveFocuses as fetchActiveFocusesForReviewState } from './queries/deliveries.js';
-import { getLocalModel, getLocalModelSecret } from './queries/local-models.js';
-import { codexSafeModelAlias, writeLocalModelCodexHome, TELORA_LOCAL_API_KEY_ENV, } from './cli/codex-provision.js';
-import { preflightLocalModelMcp } from './backends/codex/mcp-preflight.js';
-import { startCodexMcpProxy, shouldRouteLocalModelThroughProxy, } from './backends/codex/codex-mcp-proxy.js';
-import { detectHostCapability, ensureLoaded, resolveSafeLoadOptions, getStatus, decideSwap, hostRootFromBaseUrl, observeHostSwap, claimResidentHost, releaseHostByFocus, detectSingleHostModelConflict, shouldSurfaceHostConflictOnce, } from './host-control/index.js';
+import { releaseHostByFocus } from './host-control/index.js';
 // ── Imports from extracted modules ──────────────────────────────────────
-import { getActiveTeams, hasActiveTeam, deriveExecutionConfig, } from './focus-team-state.js';
+import { getActiveTeams, deriveExecutionConfig, } from './focus-team-state.js';
 // Import the spawn helpers from their defining module (NOT the spawner barrel):
 // the barrel re-exports spawnFocusTeam from THIS module via the spawn-team
 // shim, so importing the barrel here would close a static import cycle.
-import { setupTeamLogStreams, attachStreamHandlers, handleTeamProcessClose, } from './spawner/helpers.js';
-import { terminateTeam, } from './completion/index.js';
-import { handleCompletionEvent, } from './completion/index.js';
-import { getBackend, resolveBackend } from './backends/index.js';
+import { setupTeamLogStreams, } from './spawner/helpers.js';
+// Model-routing seam (extracted to ./spawn/model-routing.js). Imported here for
+// the two symbols spawnFocusTeam calls directly; the full moved surface is
+// re-exported below so external importers keep resolving it from this module.
+import { resolveSpawnModel, surfaceSingleHostModelConflict } from './spawn/model-routing.js';
+// Prompt-assembly seam (extracted to ./spawn/prompt-assembly.js). Imported here
+// for the symbols spawnFocusTeam calls directly; the full moved surface is
+// re-exported below so external importers keep resolving it from this module.
+import { buildFocusPromptContext, buildSpawnPrompt, buildSpawnMessage, resolveScopingSpawnResume, } from './spawn/prompt-assembly.js';
+// Worktree-session seam (extracted to ./spawn/worktree-session.js). Imported here
+// for the symbols spawnFocusTeam calls directly; the full moved surface is
+// re-exported below so external importers keep resolving it from this module.
+import { createInitialTeamState, resolveSpawnWorktree, createTeamSession, resolveReviewContext, resolveEngineForPass, } from './spawn/worktree-session.js';
+// Spawn-decision seam (extracted to ./spawn/spawn-decision.js). Imported here for
+// the symbols spawnFocusTeam calls directly; the full moved surface is re-exported
+// below so external importers keep resolving it from this module.
+import { fetchSpawnContext, resolveActionableDeliveries, resolveDirectiveOrFallback, } from './spawn/spawn-decision.js';
+// Process-spawn seam (extracted to ./spawn/process-spawn.js). Imported here for
+// spawnTeamProcess, which the orchestrator spawnFocusTeam calls directly; the
+// full moved surface is re-exported below so external importers (and tests) keep
+// resolving it from this module.
+import { spawnTeamProcess } from './spawn/process-spawn.js';
 // ── Re-exports for backward compatibility ───────────────────────────────
+export { selectLocalModelRef, codexHomeForSpawn, decideLocalModelRouting, shouldSwapForPass, resolveEffectiveModel, isClaudeModelId, selectPipelineModelForSpawn, selectDirectiveModelForSpawn, resolveLocalModelConfig, surfaceSingleHostModelConflict, resolveSpawnModel, buildAgentArgs, } from './spawn/model-routing.js';
+export { buildFocusPromptContext, buildSpawnPrompt, buildSpawnMessage, resolveScopingSpawnResume, findQueuedDeliveriesWithoutTaskIssues, buildQueuedDeliveryScopingMessage, } from './spawn/prompt-assembly.js';
+export { createInitialTeamState, resolveSpawnWorktree, createTeamSession, resolveReviewContext, resolveEngineForPass, } from './spawn/worktree-session.js';
+export { findActionableDeliveries, resolveActionableDeliveries, resolveDirectiveOrFallback, fetchSpawnContext, DEFAULT_LOOP_CONTEXT_RECIPE, } from './spawn/spawn-decision.js';
+export { gateLocalModelBackendSpawn, backendUnavailableSessionUpdate, spawnCrashIsolated, persistSpawnFailureAfterRunning, closeTeamProxyQuietly, spawnTeamProcess, governorDeniedSessionUpdate, sandboxUnavailableSessionUpdate, } from './spawn/process-spawn.js';
 export { getActiveTeams, hasActiveTeam, getActiveTeamCount, } from './focus-team-state.js';
 export { mergeFocusBranch, } from './focus-merge.js';
 export { handleTeamCompletion, advanceDeliveryStatuses, isStatusTerminal, isStatusAgentActionable, } from './completion/index.js';
 export { terminateTeam, waitForTeamExit, terminateAllTeams, detectDeactivatedFocuses, checkAndMergeCompletedDeliveries, } from './completion/index.js';
-/**
- * Default loop-context assembly recipe for a focus-team spawn.
- *
- * Composed once per spawn into the team prompt. `focus.endpoint_catalog`
- * is placed right after `focus.injections` so the exposed/consumed endpoint
- * catalog reads alongside the tree context -- surfacing cross-product
- * interrelations at scoping time (shift-left) so a dependency on another
- * product can be mapped into the reality tree as an externally-owned obstacle
- * rather than surfacing reactively as a blocked_by_external escalation.
- */
-export const DEFAULT_LOOP_CONTEXT_RECIPE = [
-    'loop.context',
-    'focus.injections',
-    'focus.endpoint_catalog',
-    'escalation.answers',
-];
 // ── Resource governor (optional, injected by FocusEngine) ─────────
 let governor = null;
 /** Inject the resource governor for global concurrency limiting. */
@@ -107,69 +88,6 @@ export function initGovernor(gov) {
 export function getGovernor() {
     return governor;
 }
-/**
- * Pre-spawn guard: rank-ordered walk that collects every agent-actionable
- * delivery into the spawn set.
- *
- * "Actionable" and "blocking" are independent properties of a status:
- *
- * - actionable = `isStatusAgentActionable(status)` -- queued | coding |
- *   verify_failed. Work the team can pick up.
- * - blocking   = `isStatusBlocking(status)` -- statuses that gate
- *   subsequent ranks (queued, coding, planning, paused).
- *
- * A delivery may be actionable and blocking (queued, coding -- the common
- * case), actionable and non-blocking (`verify_failed` -- has remediation
- * work from a review pass, but the next-ranked queued delivery should not
- * wait on it), or non-actionable and blocking (planning, paused -- gates
- * the queue and the team has nothing to do here).
- *
- * Walk semantics:
- * - Collect every actionable delivery into the spawn set.
- * - Stop the walk when we hit the first blocking-and-not-actionable status
- *   (planning, paused). Lower-ranked deliveries past this point are gated.
- * - Skip past non-blocking non-actionable statuses (done, cancelled, verify)
- *   without breaking the walk.
- *
- * Returns:
- * - 'planning' when the focus has zero deliveries (agent will scope them).
- * - 'execute' with the collected actionable deliveries.
- * - 'skip' when the walk found zero actionable deliveries.
- *
- * Why verify_failed must be in the spawn set: the auto-review loop
- * routes a delivery from `verify` -> `verify_failed` when the review
- * agent finds remediation work, clears `review_requested_at`, and emits a
- * `review_completed` loop trigger. The next poll re-derives phase from
- * `ACTIVE_STATUSES` (which includes verify_failed), so the focus is
- * eligible to spawn. If this guard then skips past `verify_failed`, no
- * team ever picks up the remediation issues and the loop dies after the
- * first pass. See delivery ac5c69f7.
- */
-export function findActionableDeliveries(deliveries, focusName) {
-    if (deliveries.length === 0) {
-        return { kind: 'planning' };
-    }
-    const actionable = [];
-    for (const d of deliveries) {
-        const status = d.executionStatus ?? '';
-        if (isStatusAgentActionable(status)) {
-            actionable.push(d);
-            continue;
-        }
-        if (isStatusBlocking(status)) {
-            console.log(`[focus-executor] Delivery "${d.name}" (rank ${d.priorityRank}) ` +
-                `is in "${status}" state -- blocking subsequent deliveries in focus "${focusName}"`);
-            break;
-        }
-        // non-blocking + non-actionable (done, cancelled, verify):
-        // skip past without gating
-    }
-    if (actionable.length === 0) {
-        console.log(`[focus-executor] No actionable deliveries for focus "${focusName}" -- skipping spawn`);
-        return { kind: 'skip' };
-    }
-    return { kind: 'execute', deliveries: actionable };
-}
 // ── Team spawning ────────────────────────────────────────────────────
 /**
  * Generate branch name for focus-level work.
@@ -180,599 +98,6 @@ export function generateFocusBranchName(role, focusName, focusId) {
     const sanitizedFocusName = sanitizeGitSegment(focusName);
     return `agent/${sanitizedRoleName}/${sanitizedFocusName}-${shortId}`;
 }
-/**
- * Resolve the isolated CODEX_HOME to set on a spawn, or undefined when none
- * applies. Pure + testable: only a codex-engine spawn against a product that
- * carries a provisioned codexHome gets the override; every other case (claude
- * engine, or a cloud product with no codexHome) returns undefined so the spawn
- * environment is byte-for-byte unchanged.
- */
-export function codexHomeForSpawn(engineId, config) {
-    return engineId === 'codex' && config.codexHome ? config.codexHome : undefined;
-}
-/**
- * Select the per-pass local model ref to resolve for this spawn, or null.
- *
- * Pure + testable. A ref applies ONLY to a codex-engine spawn. The ref resolves
- * under the unified Focus > Workflow > Default precedence (single-sourced in
- * model-resolution.resolveLocalModelRefPrecedence): the focus's per-pass
- * localModelOverride entry wins; absent that, the stage directive's localModel
- * is inherited; absent both, null (the pass runs on the engine's default model).
- * A claude engine or a blank ref returns null so the spawn keeps its
- * per-product / engine-default behavior unchanged.
- */
-export function selectLocalModelRef(engineId, pass, localModelOverride, stageDirectiveLocalModel) {
-    if (engineId !== 'codex')
-        return null;
-    return resolveLocalModelRefPrecedence(localModelOverride?.[pass], stageDirectiveLocalModel);
-}
-export function decideLocalModelRouting(ref, coords, apiKey) {
-    if (!ref)
-        return { kind: 'none' };
-    if (!coords)
-        return { kind: 'fallback' };
-    return { kind: 'route', coords, apiKey: apiKey?.trim() ? apiKey : null };
-}
-/**
- * Pure gate: should the daemon perform a host-control model swap before this
- * spawn? (Local model host control, D2.) True ONLY when routing resolved a local
- * model for this pass AND the host advertises the optional control capability.
- * A non-controllable host (today's behavior: the operator pre-loads the model in
- * the studio) yields false -> NO swap, spawn proceeds unchanged. A pass with no
- * routed local model (claude, no override) also yields false. Exported so the
- * load-or-skip decision is unit-testable with NO HTTP.
- */
-export function shouldSwapForPass(input) {
-    return input.routing.kind === 'route' && input.capability.controllable;
-}
-/**
- * Resolve the effective model id for a spawn, applying the single team-model
- * precedence (focus override -> stage directive -> CLI default) via
- * resolveTeamModel. This is the SAME helper used at stage respawn, so the two
- * paths can never diverge on ordering.
- *
- * The focus-override slot folds in the selected local-Codex model: when this
- * pass routes to a controllable Codex home, `codexModel` IS the focus's
- * explicit pick and must win exactly like a focus pipeline_config.model would.
- * `directiveModel` has already been filtered through
- * selectDirectiveModelForSpawn() (nulled when the backend cannot run it, or
- * when a focus override is present), so it only ever reaches here as a
- * legitimate stage fallback.
- *
- * Pure + testable. Used by spawnFocusTeam to produce effectivePipelineConfig.model.
- */
-export function resolveEffectiveModel(directiveModel, spawnCodexHome, codexModel, pipelineModel) {
-    const focusOverrideModel = (spawnCodexHome && codexModel ? codexModel : null) ?? pipelineModel ?? null;
-    return resolveTeamModel(focusOverrideModel, directiveModel);
-}
-/**
- * A cloud model id the Claude backend can run: the full claude-* ids
- * (claude-opus-4-8, claude-sonnet-4-6, ...) AND the bare aliases Claude Code
- * accepts (opus, sonnet, haiku, fable -- used across the daemon, e.g.
- * audit-phase's AUDIT_DEFAULT_MODEL='opus'). Anything else (gpt-5-codex,
- * gemma-4-12b, ...) is treated as not-Claude so it cannot reach the claude CLI.
- */
-const CLAUDE_MODEL_PREFIXES = ['claude', 'opus', 'sonnet', 'haiku', 'fable'];
-export function isClaudeModelId(model) {
-    if (typeof model !== 'string')
-        return false;
-    const normalized = model.trim().toLowerCase();
-    return CLAUDE_MODEL_PREFIXES.some((prefix) => normalized.startsWith(prefix));
-}
-/**
- * Select the pipeline model fallback to feed into resolveEffectiveModel().
- *
- * Hosted Codex runs through the user's Codex account. Some registry labels
- * exposed in the UI (for example gpt-5-codex) are not valid `codex exec
- * --model` values for every account, and passing them fails the run before the
- * agent starts. Local-model Codex still needs an explicit model, and Claude
- * keeps the existing pipeline model behavior.
- *
- * Engine-compat (the per-pass bleed guard): product_focuses.pipeline_config.model
- * is a SINGLE focus-wide value shared across passes, but each pass resolves its
- * own engine. A pass whose engine resolved to claude can only run a claude-family
- * model -- so a coding-pass codex model (e.g. gpt-5-codex) selected on the focus
- * must NOT bleed into a claude review pass. When it would, null it so the claude
- * backend picks its own default rather than receiving `--model gpt-5-codex` and
- * erroring out. (The symmetric codex case is handled above + by spawnCodexModel
- * routing; local-codex models reach the spawn via spawnCodexModel, not here.)
- */
-export function selectPipelineModelForSpawn(engineId, spawnCodexHome, pipelineModel) {
-    if (engineId === 'codex' && !spawnCodexHome)
-        return null;
-    if (engineId === 'claude' && !isClaudeModelId(pipelineModel))
-        return null;
-    return pipelineModel ?? null;
-}
-/**
- * Select whether a workflow directive's model may reach the backend.
- *
- * The focus pass selection is the source of truth for team launches. Stage
- * directives contribute prompt/context; their model field is only a legacy
- * fallback when the focus/pass has no selected model and the backend can run
- * that model. In particular, never pass a Claude directive model to Codex.
- */
-export function selectDirectiveModelForSpawn(engineId, directiveModel, focusSelectedModel) {
-    if (!directiveModel)
-        return null;
-    if (focusSelectedModel)
-        return null;
-    if (engineId === 'codex')
-        return null;
-    return directiveModel;
-}
-/**
- * Build CLI args for the team lead via the selected backend.
- *
- * Engine-specific flag construction lives in the backend; resume uses the
- * backend's dedicated resume-arg builder. Exported for the spawner barrel
- * surface (legacy ./team-spawner.js consumers).
- */
-export function buildAgentArgs(backend, config, worktreePath, pipelineConfig, resumeSessionId, allowedTools, readOnly) {
-    // allowedTools comes from the focus role's agent_roles.allowed_tools. The
-    // backend applies least-privilege scoping when non-empty; empty/absent =>
-    // engine default tool set (documented default policy).
-    const base = { config, worktreePath, model: pipelineConfig?.model ?? null, allowedTools, readOnly };
-    return resumeSessionId
-        ? backend.buildResumeArgs({ ...base, resumeSessionId })
-        : backend.buildSpawnArgs(base);
-}
-/**
- * Phase 1: fetch all spawn context (deliveries / issues / product-context /
- * deployment-profile / loop-context) in one Promise.all, then resolve the PRD
- * milestone push-down. Returns null when the context fetch rejects -- the
- * caller treats null as "tear down the freshly-inserted team and return"
- * (activeTeams.delete). The PRD push-down deliberately propagates on throw,
- * matching the pre-extraction behavior (it sits after the try/catch).
- *
- * Behavior-preserving extraction of the original inline block; the log lines,
- * the deployment-profile .catch fallback, the loop-context try/catch fallback,
- * and the manifest accumulation order are byte-identical.
- */
-export async function fetchSpawnContext(config, focusId, focusName) {
-    // Accumulates the assembly manifest (one entry per resolved source) across
-    // every recipe composed for this spawn, persisted after the session exists.
-    const assemblyManifest = [];
-    // Fetch all deliveries, issues, product context, deployment profile, and loop context
-    let deliveries;
-    let issues;
-    let productContextDocs;
-    let deploymentProfileSnapshot;
-    let loopContext;
-    try {
-        let loopContextResult;
-        [deliveries, issues, productContextDocs, deploymentProfileSnapshot, loopContextResult] = await Promise.all([
-            getFocusDeliveries(focusId),
-            getFocusIssues(focusId),
-            getProductContextForFocus(config.productId, focusId),
-            getProductDeploymentProfileSnapshot(config.productId).catch((err) => {
-                console.debug(`[focus-executor] Could not fetch deployment profile snapshot (non-fatal):`, err.message);
-                return null;
-            }),
-            (async () => {
-                try {
-                    const assemblyCtx = {
-                        focusId,
-                        deliveryIds: [],
-                        worktreePath: null,
-                        config,
-                        organizationId: config.organizationId,
-                        productId: config.productId,
-                    };
-                    return await resolveAssemblyRecipeWithManifest(DEFAULT_LOOP_CONTEXT_RECIPE, assemblyCtx);
-                }
-                catch (err) {
-                    console.debug(`[focus-executor] Could not fetch loop context (non-fatal):`, err.message);
-                    return { content: '', manifest: [] };
-                }
-            })(),
-        ]);
-        loopContext = loopContextResult.content;
-        assemblyManifest.push(...loopContextResult.manifest);
-    }
-    catch (err) {
-        console.error(`[focus-executor] Failed to fetch context for focus "${focusName}":`, err.message);
-        return null;
-    }
-    // PRD push-down: if this focus was armed by a PRD, resolve the parent PRD's
-    // prd.context (milestone goal/expansion/vision + frontier position) and carry
-    // it into the team prompt so the focus inherits coherent milestone intent.
-    // Context ONLY -- the steward persona is never pushed to a coder team. A focus
-    // not under a PRD yields '' and is unaffected (best-effort, never blocks spawn).
-    let prdMilestoneContext = '';
-    {
-        const milestoneCtx = {
-            focusId,
-            deliveryIds: [],
-            worktreePath: null,
-            config,
-            organizationId: config.organizationId,
-            productId: config.productId,
-        };
-        const milestoneResult = await resolveFocusMilestoneContext(focusId, milestoneCtx);
-        prdMilestoneContext = milestoneResult.content;
-        assemblyManifest.push(...milestoneResult.manifest);
-    }
-    return { deliveries, issues, productContextDocs, deploymentProfileSnapshot, loopContext, prdMilestoneContext, assemblyManifest };
-}
-/**
- * Phase 2: consume any pending spawn directive, enforce the rank-ordered
- * pre-spawn guard, and record known-delivery bookkeeping on the team state.
- *
- * Mutates `teamState` exactly as the original inline block did
- * (lastConsumedDirectiveHash, sessionType, planningPhase, knownDeliveryIds,
- * deliveryStageIds, mergedDeliveryIds) and emits the same log lines. Returns
- * 'skip' for the findActionableDeliveries skip case (the caller owns the
- * activeTeams.delete + return so the team-state map stays the orchestrator's
- * responsibility). Behavior byte-identical.
- */
-export function resolveActionableDeliveries(args) {
-    const { focusId, focusName, deliveries, issues, forceSpawn, teamState } = args;
-    // Check for pending spawn directive (e.g., review stage spawn).
-    // Record its content hash on team state so the spawn-guard in
-    // executeSpawnDirective can detect divergent directives within the 60s
-    // skip window.
-    const pendingDirective = consumePendingSpawnDirective(focusId);
-    if (pendingDirective) {
-        teamState.lastConsumedDirectiveHash = pendingDirective.contentHash;
-        teamState.sessionType = pendingDirective.sessionType;
-    }
-    // Pre-spawn guard: enforce rank-ordered execution.
-    // Skip when a pending spawn directive exists -- the directive has its own intent.
-    let actionableDeliveries = [];
-    let isPlanningSpawn = false;
-    if (pendingDirective) {
-        actionableDeliveries = deliveries.filter(d => isStatusAgentActionable(d.executionStatus ?? ''));
-    }
-    else if (forceSpawn) {
-        // Escalation answer re-arm: spawn to consume a pending answer even when no
-        // delivery is actionable. Carry whatever deliveries ARE actionable (usually
-        // none -- the focus exited because everything is verify/done); the
-        // escalation.answers resolver in the standard recipe injects the answer.
-        actionableDeliveries = deliveries.filter(d => isStatusAgentActionable(d.executionStatus ?? ''));
-        console.log(`[focus-executor] Focus "${focusName}" force-spawning to consume escalation answer ` +
-            `(${actionableDeliveries.length} actionable deliver${actionableDeliveries.length === 1 ? 'y' : 'ies'})`);
-    }
-    else {
-        const decision = findActionableDeliveries(deliveries, focusName);
-        if (decision.kind === 'skip') {
-            return { kind: 'skip' };
-        }
-        if (decision.kind === 'planning') {
-            isPlanningSpawn = true;
-            teamState.planningPhase = true;
-            console.log(`[focus-executor] Focus "${focusName}" has no deliveries -- spawning planning team`);
-        }
-        else {
-            actionableDeliveries = decision.deliveries;
-        }
-    }
-    // Track known deliveries, pre-populate already-completed ones.
-    // Empty deliveries (planning spawn) yields zero iterations: knownDeliveryIds
-    // stays empty until the wake-cycle refresh in handleCompletionEvent picks
-    // up MCP-written deliveries, at which point planningPhase is cleared.
-    for (const d of deliveries) {
-        teamState.knownDeliveryIds.add(d.id);
-        teamState.deliveryStageIds.set(d.id, d.currentWorkflowStageId);
-        if (!isStatusAgentActionable(d.executionStatus ?? '') && !isStatusBlocking(d.executionStatus ?? '')) {
-            teamState.mergedDeliveryIds.add(d.id);
-        }
-    }
-    if (isPlanningSpawn) {
-        console.log(`  Deliveries: 0 (planning required)`);
-    }
-    else {
-        console.log(`  Deliveries: ${deliveries.length} (${actionableDeliveries.length} queued)`);
-    }
-    console.log(`  Issues: ${issues.length}`);
-    return { kind: 'proceed', pendingDirective, actionableDeliveries, isPlanningSpawn };
-}
-/**
- * Phase A: resolve the team-lead directive body + spawn metadata (no prompt
- * yet). Priority: pending spawn directive > current-stage directive > legacy
- * full prompt. Pushes any assembled directive manifest entries onto the shared
- * `assemblyManifest` accumulator.
- *
- * Behavior-preserving extraction of the original inline Phase A block -- the
- * "Using pending spawn directive" / "Using stage directive" log lines, the
- * "LEGACY PROMPT FALLBACK" warning and every fallbackReason string, and the
- * directive-manifest accumulation are byte-identical.
- */
-export async function resolveDirectiveOrFallback(args) {
-    const { config, focusId, focusName, worktreePath, pendingDirective, assemblyManifest } = args;
-    let directiveBody = null; // appended after the role framework
-    let useLegacyFullPrompt = false; // legacy full prompt (no directive)
-    let directiveModel = null;
-    // Stage directive engine + local-model (Workflow layer of the unified
-    // precedence for those two axes); null when the stage pins neither.
-    let directiveEngine = null;
-    let directiveLocalModel = null;
-    // Focus override snapshotted on the pending directive (respawn path only).
-    let pendingFocusOverrideModel = null;
-    // Workflow stage active at spawn -- stamped onto telemetry as the .stage lever.
-    let spawnStageName = null;
-    // Lineage + continuity declared by whatever is firing this spawn (pending
-    // directive, current stage directive, or none). Resolved uniformly later
-    // (INJ-B). For a pending directive these are already resolved upstream, so
-    // resolveLineageSpec is idempotent.
-    let spawnDirectiveDeclared = null;
-    if (pendingDirective && pendingDirective.message.trim()) {
-        // Spawn directive from directive-executor (e.g., review stage transition)
-        directiveBody = pendingDirective.message;
-        directiveModel = pendingDirective.model;
-        directiveEngine = pendingDirective.engine ?? null;
-        directiveLocalModel = pendingDirective.localModel ?? null;
-        pendingFocusOverrideModel = pendingDirective.focusOverrideModel;
-        spawnStageName = pendingDirective.sessionType === 'review' ? 'reviewing' : null;
-        spawnDirectiveDeclared = { lineage: pendingDirective.lineage, continuity: pendingDirective.continuity };
-        console.log(`[focus-executor] Using pending spawn directive for "${focusName}" ` +
-            `(${pendingDirective.message.length} chars directive, model: ${directiveModel ?? 'default'})`);
-    }
-    else {
-        // Sync the focus's execution phase from its delivery aggregate, then
-        // assemble the matching stage directive. Every focus workflow stage is
-        // expected to carry an agent_directive (populated by migration
-        // 20260503140420_focus_phase_directives); the legacy hardcoded prompt
-        // path below is a safety net that should not fire under normal
-        // operation. When it does fire, the warning identifies which guard
-        // tripped so the gap can be fixed.
-        let stageDirectiveContent = null;
-        let stageDirectiveModel = null;
-        let fallbackReason = null;
-        try {
-            const activeFocuses = await getActiveFocuses(config.organizationId, config.productId);
-            const focusRecord = activeFocuses.find(s => s.focus_id === focusId);
-            const syncedStageId = focusRecord
-                ? await syncFocusPhase(focusRecord)
-                : null;
-            const workflow = await fetchFocusWorkflow(focusId);
-            const currentStage = syncedStageId
-                ? workflow.stages.find(s => s.id === syncedStageId)
-                : workflow.stages.find(s => s.is_initial);
-            if (!currentStage) {
-                fallbackReason = syncedStageId
-                    ? `no stage matching synced id ${syncedStageId.slice(0, 8)} in workflow`
-                    : 'no synced stage and no is_initial stage in workflow';
-            }
-            else if (!currentStage.agentDirective || isAgentlessDirective(currentStage.agentDirective)) {
-                // NULL directive OR an explicit agentless hold (execution: 'none') --
-                // treat identically: no stage directive drives the spawn, fall back to
-                // the legacy focus-team prompt. Parity keeps a deliberately-agentless
-                // stage from being handed to directive assembly.
-                spawnStageName = currentStage.name ?? null;
-                fallbackReason = currentStage.agentDirective
-                    ? `stage "${currentStage.name}" is an explicit agentless hold (execution=none)`
-                    : `stage "${currentStage.name}" has no agent_directive populated`;
-            }
-            else {
-                spawnStageName = currentStage.name ?? null;
-                // The current stage's directive declares its own lineage + continuity
-                // (INJ-B); resolved uniformly later.
-                spawnDirectiveDeclared = currentStage.agentDirective;
-                const { content: directiveContent, manifest: directiveManifest } = await assembleDirectiveContentWithManifest(config, focusId, currentStage.agentDirective, worktreePath);
-                if (directiveContent.trim()) {
-                    stageDirectiveContent = directiveContent;
-                    stageDirectiveModel = currentStage.agentDirective.model;
-                    // The stage is the Workflow layer for engine + local model too.
-                    directiveEngine = currentStage.agentDirective.engine ?? null;
-                    directiveLocalModel = currentStage.agentDirective.localModel ?? null;
-                    assemblyManifest.push(...directiveManifest);
-                }
-                else {
-                    fallbackReason = `assembly returned empty content for stage "${currentStage.name}"`;
-                }
-            }
-        }
-        catch (err) {
-            fallbackReason = `directive lookup threw: ${err.message}`;
-        }
-        if (stageDirectiveContent) {
-            directiveBody = stageDirectiveContent;
-            directiveModel = stageDirectiveModel;
-            console.log(`[focus-executor] Using stage directive for "${focusName}" (${stageDirectiveContent.length} chars)`);
-        }
-        else {
-            console.warn(`[focus-executor] LEGACY PROMPT FALLBACK for "${focusName}": ${fallbackReason ?? 'unknown reason'}`);
-            useLegacyFullPrompt = true;
-        }
-    }
-    return { directiveBody, directiveModel, directiveEngine, directiveLocalModel, pendingFocusOverrideModel, spawnStageName, spawnDirectiveDeclared, useLegacyFullPrompt };
-}
-/**
- * Phase C input: assemble the FocusTeamPromptContext threaded into both the
- * directive and legacy prompt builders. Pure factory -- byte-identical to the
- * original inline object literal; extracted so the orchestrator reads as ordered
- * phase calls rather than inlining the context shape.
- */
-export function buildFocusPromptContext(args) {
-    const { config, focusId, focusName, focusDescription, deliveries, issues, executionConfig, pipelineConfig, productContextDocs, deploymentProfileSnapshot, readOnly, loopContext, reviewFiledOpenCount, engineId, } = args;
-    return {
-        focusId,
-        focusName,
-        focusDescription,
-        organizationId: config.organizationId,
-        productId: config.productId,
-        deliveries,
-        issues,
-        executionConfig,
-        pipelineConfig,
-        productContextDocs,
-        deploymentProfileSnapshot,
-        readOnly,
-        loopContext,
-        reviewFiledOpenCount,
-        engineId,
-    };
-}
-/**
- * Phase C: compose the final team-lead message -- role framework + remediation
- * framing + directive body (or the legacy full focus prompt), then the PRD
- * milestone push-down appended last so it reaches BOTH prompt paths. Pure +
- * testable. Byte-identical to the original inline composition.
- */
-export function buildSpawnPrompt(args) {
-    const { role, promptContext, useLegacyFullPrompt, directiveBody, prdMilestoneContext, isReviewPass, agentSessionId } = args;
-    let prompt;
-    if (!useLegacyFullPrompt && directiveBody !== null) {
-        const framing = buildRemediationFramingSection(directiveBody).join('\n');
-        prompt = buildRoleFrameworkPrompt(role, promptContext)
-            + '\n\n'
-            + (framing ? framing + '\n' : '')
-            + directiveBody;
-    }
-    else {
-        prompt = buildFocusTeamPrompt(role, promptContext);
-    }
-    // Review passes carry a hard, terminal obligation to stamp an outcome
-    // (focus_review_complete -> approved | gaps_found). Appended after the
-    // directive body (and before the PRD push-down) so it reaches both the
-    // directive and legacy prompt paths; emitted for review spawns only.
-    if (isReviewPass) {
-        prompt += '\n\n' + buildReviewOutcomeStampingSection(agentSessionId).join('\n');
-    }
-    // Append PRD milestone context (push-down) so a PRD-armed focus team inherits
-    // the milestone's goal/expansion/vision + frontier position. Appended to the
-    // final prompt so it reaches BOTH the directive and legacy prompt paths; empty
-    // for any focus not armed by a PRD (no change to ordinary focus spawns).
-    if (prdMilestoneContext.trim()) {
-        prompt += '\n\n' + prdMilestoneContext;
-    }
-    return prompt;
-}
-/**
- * Phase: resolve the per-pass local-model routing for a codex spawn.
- *
- * Wraps the fetch (getLocalModel / getLocalModelSecret) + the pure decision
- * (selectLocalModelRef -> decideLocalModelRouting) and, on 'route', provisions
- * the per-model CODEX_HOME (writeLocalModelCodexHome) -- returning the codexHome
- * the caller points the spawn at. The key VALUE comes from Telora (D8), never a
- * host env var. Behavior byte-identical to the original inline block; only the
- * apply-side (session-terminal write on skip, env injection on route) stays in
- * the caller.
- */
-export async function resolveLocalModelConfig(args, deps = {}) {
-    const getModel = deps.getLocalModel ?? getLocalModel;
-    const getSecret = deps.getLocalModelSecret ?? getLocalModelSecret;
-    const writeCodexHome = deps.writeLocalModelCodexHome ?? writeLocalModelCodexHome;
-    const localModelRef = selectLocalModelRef(args.engineId, args.enginePass, args.localModelOverride, args.stageDirectiveLocalModel);
-    // getLocalModel + getLocalModelSecret (the DB calls) run only when a ref
-    // exists; decideLocalModelRouting is the pure decision over their results.
-    const coords = localModelRef ? await getModel(localModelRef) : null;
-    const apiKey = localModelRef ? await getSecret(localModelRef) : null;
-    const routing = decideLocalModelRouting(localModelRef, coords, apiKey);
-    switch (routing.kind) {
-        case 'none':
-            return { kind: 'none' };
-        case 'fallback':
-            return { kind: 'fallback', ref: localModelRef };
-        case 'route': {
-            const { codexHome } = writeCodexHome(routing.coords.id, {
-                baseUrl: routing.coords.baseUrl,
-                model: routing.coords.model,
-                wireApi: routing.coords.wireApi ?? undefined,
-                requiresApiKey: routing.apiKey !== null,
-            });
-            return {
-                kind: 'route',
-                codexHome,
-                codexModel: codexSafeModelAlias(routing.coords.model),
-                apiKey: routing.apiKey,
-                coords: routing.coords,
-            };
-        }
-    }
-}
-/**
- * Surface (do NOT silently swap) two DIFFERENT local models bound to the coding
- * vs review pass of one focus that share a single GPU host (#9). On a single
- * card the two bindings force an evict+load swap on every pass alternation and
- * fight over the GPU (the live incident: 0/56 routing attempts succeeded). The
- * daemon must make the conflict VISIBLE rather than thrash silently.
- *
- * Cheap early-out: only when the focus pins a local model for BOTH passes and
- * the two refs differ do we resolve coordinates (two getLocalModel reads) and run
- * the pure detector. A conflict (same host root, different served models) is
- * raised ONCE per focus per daemon run (shouldSurfaceHostConflictOnce) as a log
- * line + a single escalation -- never re-raised every poll. Returns whether a new
- * surfacing was raised this call. Best-effort: an escalation-create failure is
- * logged, never fatal to the spawn.
- */
-export async function surfaceSingleHostModelConflict(args, deps = {}) {
-    const getModel = deps.getLocalModel ?? getLocalModel;
-    const makeEscalation = deps.createEscalation ?? createEscalation;
-    const codingRef = args.localModelOverride?.coding?.trim() || null;
-    const reviewRef = args.localModelOverride?.review?.trim() || null;
-    // The conflict needs a distinct local model pinned on BOTH passes.
-    if (!codingRef || !reviewRef || codingRef === reviewRef)
-        return { surfaced: false };
-    const [codingCoords, reviewCoords] = await Promise.all([getModel(codingRef), getModel(reviewRef)]);
-    if (!codingCoords || !reviewCoords)
-        return { surfaced: false };
-    const bindings = [
-        { pass: 'coding', modelId: codingCoords.model, baseUrl: codingCoords.baseUrl },
-        { pass: 'review', modelId: reviewCoords.model, baseUrl: reviewCoords.baseUrl },
-    ];
-    const result = detectSingleHostModelConflict(bindings);
-    if (!result.conflict)
-        return { surfaced: false };
-    if (!shouldSurfaceHostConflictOnce(args.focusId))
-        return { surfaced: false };
-    const detail = `Focus "${args.focusName}" pins two different local models to one GPU host ` +
-        `(${result.root}): coding="${codingCoords.name}" (${codingCoords.model}) vs ` +
-        `review="${reviewCoords.name}" (${reviewCoords.model}). On a single GPU these force an ` +
-        `evict+load swap on every pass alternation and fight over the card. Pin both passes to the ` +
-        `same local model, or move one pass to a different host / a cloud engine.`;
-    console.warn(`[focus-executor] Host-control: ${detail}`);
-    try {
-        await makeEscalation({
-            organizationId: args.organizationId,
-            issueId: null,
-            reasonType: ESCALATION_REASONS.BLOCKED_BY_EXTERNAL,
-            description: detail,
-            whatWasTried: 'Detected at spawn that the coding and review passes resolve to different local models on the same GPU host.',
-            helpNeeded: 'Pin both passes to one local model, or route one pass to a separate host or a cloud engine, so the single GPU is not swapped on every pass.',
-            escalationKind: 'single_host_model_conflict',
-            ...(args.productId ? { productId: args.productId } : {}),
-            focusId: args.focusId,
-            metadata: {
-                host_root: result.root,
-                coding_model: codingCoords.model,
-                review_model: reviewCoords.model,
-            },
-        });
-    }
-    catch (err) {
-        console.warn(`[focus-executor] Failed to file single_host_model_conflict escalation for "${args.focusName}":`, err.message);
-    }
-    return { surfaced: true };
-}
-/**
- * The terminal session-update payload written when the resource governor denies a
- * slot for this spawn. Pure -- the caller adds `ended_at` and calls updateSession.
- * Exported so the governor-denied exit_category contract is unit-pinned (the
- * apply-side -- updateSession + governor.releaseSlot + activeTeams.delete -- stays
- * in spawnTeamProcess, exercised by spawn-path-unified.test.ts).
- */
-export function governorDeniedSessionUpdate() {
-    return {
-        status: 'failed',
-        exit_reason: 'Governor denied slot',
-        exit_category: 'governor_denied',
-    };
-}
-/**
- * The terminal session-update payload written when a required OS sandbox cannot
- * initialize and the spawn is refused (fail-closed). Pure -- the caller adds
- * `ended_at` and calls updateSession. Exported so the sandbox-unavailable
- * exit_category contract is unit-pinned.
- */
-export function sandboxUnavailableSessionUpdate(message) {
-    return {
-        status: 'failed',
-        exit_reason: message,
-        exit_category: 'sandbox_unavailable',
-    };
-}
 /**
  * Log the spawn header (focus / role / model / workers / branch, plus the
  * product line in multi-product mode). Side-effect-only; byte-identical to the
@@ -792,863 +117,6 @@ export function logSpawnHeader(args) {
         console.log(`  Repo: ${config.repoPath}`);
     }
 }
-/**
- * Build the initial FocusTeamState for a spawn. Pure factory -- no side effects;
- * the caller inserts it into the activeTeams map.
- */
-export function createInitialTeamState(args) {
-    const { focusId, focusName, role, config, executionConfig, pipelineConfig, branchName, readOnly } = args;
-    return {
-        focusId,
-        focusName,
-        roleId: role.id,
-        roleName: role.name,
-        organizationId: config.organizationId,
-        productId: config.productId,
-        executionConfig,
-        pipelineConfig,
-        startedAt: new Date(),
-        phase: 'initializing',
-        knownDeliveryIds: new Set(),
-        mergedDeliveryIds: new Set(),
-        planningPhase: false,
-        shutdownReason: null,
-        deliveryStageIds: new Map(),
-        leadSessionId: null,
-        leadPid: null,
-        leadStdin: null,
-        branchName,
-        worktreePath: null,
-        integrationBaseSha: null,
-        resolvingMergeConflict: false,
-        readOnly,
-        completionDetector: null,
-        claudeSessionId: null,
-        lastProgressSnapshot: null,
-        noProgressCycles: 0,
-        commitNudgeAttempts: 0,
-        lastConsumedDirectiveHash: null,
-        sessionType: 'coding',
-        lineage: 'coding',
-    };
-}
-/**
- * Phase: resolve the focus worktree to spawn into. Reuses the persistent
- * worktree (rebasing onto integration + re-asserting read-only guards) when one
- * exists, else creates one inline. Returns null when the spawn cannot proceed
- * (repo has no commits, or inline creation failed) -- owning its own teardown
- * (activeTeams.delete + recordFocusTeardown) so the caller just returns.
- * Behavior byte-identical to the original inline block.
- */
-export async function resolveSpawnWorktree(args) {
-    const { config, focusId, focusName, branchName, readOnly } = args;
-    const activeTeams = getActiveTeams();
-    // Reuse persistent focus worktree (created by ensureFocusWorktrees in poll loop)
-    const existingWorktree = getFocusWorktree(focusId);
-    if (existingWorktree) {
-        const worktreePath = existingWorktree.worktreePath;
-        // Rebase onto integration to pick up latest changes from other focuses
-        const rebaseResult = runGitSync(['rebase', config.integrationBranch], worktreePath);
-        if (!rebaseResult.success) {
-            runGitSync(['rebase', '--abort'], worktreePath);
-            console.warn(`[focus-executor] Rebase failed for "${focusName}", continuing with existing state`);
-        }
-        console.log(`  Worktree (reused): ${worktreePath}`);
-        // Re-assert read-only audit guards on the reused worktree. ensureFocusWorktrees
-        // installs them at provisioning time, but a read-only focus may reuse a
-        // persistent worktree across daemon restarts -- re-applying here (idempotent)
-        // guarantees the deny overlay + pre-commit hook are present before spawn.
-        if (readOnly) {
-            installReadOnlyAuditGuards(worktreePath);
-            console.log(`  Re-asserted read-only audit guards (reused worktree)`);
-        }
-        return worktreePath;
-    }
-    // Guard: can't create worktrees in a repo with no commits
-    if (!repoHasCommits(config.repoPath)) {
-        console.warn(`[focus-executor] Repository has no commits -- cannot create worktree for "${focusName}"`);
-        activeTeams.delete(focusId);
-        recordFocusTeardown(focusId);
-        return null;
-    }
-    // Fallback: worktree doesn't exist yet (race condition or first poll)
-    console.warn(`[focus-executor] No persistent worktree for "${focusName}", creating inline`);
-    try {
-        const worktreePath = await createWorktree(config, branchName);
-        setFocusWorktree(focusId, {
-            focusId,
-            focusName,
-            worktreePath,
-            branchName,
-            createdAt: new Date(),
-        });
-        console.log(`  Worktree (created inline): ${worktreePath}`);
-        // Install read-only audit guards (pre-commit hook + write-deny overlay)
-        if (readOnly) {
-            installReadOnlyAuditGuards(worktreePath);
-            console.log(`  Installed read-only audit guards (read-only mode)`);
-        }
-        return worktreePath;
-    }
-    catch (err) {
-        console.error(`[focus-executor] Failed to create worktree for focus "${focusName}":`, err instanceof Error ? err.message : String(err));
-        activeTeams.delete(focusId);
-        recordFocusTeardown(focusId);
-        return null;
-    }
-}
-/**
- * Phase: create the team-lead session row + register it with the telemetry
- * persistence gate, stamping its id onto the team state. Returns null when
- * createSession fails (owning its own activeTeams.delete teardown). The worktree
- * is focus-owned and persists even when session creation fails.
- *
- * `sessionType` is the AUTHORITATIVE lineage (resolved by resolveEngineForPass,
- * matching teamState.sessionType), so the (focus, lineage) pass this segment is
- * opened against is on the SAME lineage the segment carries -- never a stale
- * 'coding' default while the lineage actually resolved to 'review'.
- */
-export async function createTeamSession(args) {
-    const { config, role, focusId, focusName, branchName, sessionType, teamState } = args;
-    try {
-        const session = await createSession({
-            organizationId: config.organizationId,
-            roleId: role.id,
-            issueId: null,
-            focusId,
-            branchName,
-            sessionType,
-        });
-        teamState.leadSessionId = session.id;
-        // Confirm the session is durably persisted so its telemetry (tagged with
-        // telora.session_id = session.id at spawn) passes the writer's emission
-        // gate. Emission paths carrying an unpersisted id (e.g. the audit assessor's
-        // raw Claude session id) have that id nulled instead of FK-violating.
-        markSessionPersisted(session.id);
-        return session;
-    }
-    catch (err) {
-        console.error(`[focus-executor] Failed to create session for focus "${focusName}":`, err.message);
-        // Worktree is focus-owned and persists even if session creation fails
-        getActiveTeams().delete(focusId);
-        return null;
-    }
-}
-/**
- * Phase: best-effort review context. When the focus has a recorded
- * review_requested_at, count the open review-filed issues (the remediation
- * directive's working set) and carry the prior findings; also resolve the focus
- * description. A fetch failure leaves the count at zero (normal execution team).
- */
-export async function resolveReviewContext(args) {
-    const { config, focusId, focusName, issues } = args;
-    let reviewFiledOpenCount = 0;
-    let priorFindings = [];
-    let focusDescription = null;
-    try {
-        const activeFocuses = await fetchActiveFocusesForReviewState(config.organizationId, config.productId);
-        const current = activeFocuses.find(f => f.focus_id === focusId);
-        const reviewRequestedAt = current?.review_requested_at ?? null;
-        if (reviewRequestedAt) {
-            priorFindings = filterReviewFiledIssues(issues, reviewRequestedAt);
-            reviewFiledOpenCount = priorFindings.length;
-        }
-        focusDescription = current?.focus_description ?? null;
-    }
-    catch (err) {
-        console.debug(`[focus-executor] Could not compute review-filed open count for "${focusName}":`, err.message);
-    }
-    return { reviewFiledOpenCount, priorFindings, focusDescription };
-}
-/**
- * Phase B: resolve the session lineage (pass) and the engine backend for it,
- * stamping lineage + sessionType onto the team state. Returns the lineage spec,
- * the derived engine pass, the resolved engine, and the backend object.
- */
-export function resolveEngineForPass(args) {
-    const { spawnDirectiveDeclared, spawnStageName, engineOverride, stageDirectiveEngine, config, orgDefaultEngine, focusName, teamState } = args;
-    const spawnSpec = resolveLineageSpec({ declared: spawnDirectiveDeclared, stageName: spawnStageName });
-    teamState.lineage = spawnSpec.lineage;
-    teamState.sessionType = spawnSpec.lineage === 'review' ? 'review' : 'coding';
-    const enginePass = spawnSpec.lineage === 'review' ? 'review' : 'coding';
-    const resolvedEngine = resolveBackend({
-        focusOverride: engineOverride,
-        pass: enginePass,
-        stageOverride: stageDirectiveEngine,
-        productDefault: config.defaultCodingEngine,
-        orgDefault: orgDefaultEngine,
-    });
-    const backend = getBackend(resolvedEngine.engineId);
-    console.log(`[focus-executor] Engine for "${focusName}" pass=${enginePass}: ` +
-        `${resolvedEngine.engineId} (source: ${resolvedEngine.source})`);
-    return { spawnSpec, enginePass, resolvedEngine, backend };
-}
-/**
- * Phase: resolve the per-product CODEX_HOME default, apply per-pass local-model
- * routing (fallback / route), select the effective model, and build the CLI
- * args. Returns 'ready' with the args + the model/env bits the spawn needs.
- */
-export async function resolveSpawnModel(args) {
-    const { resolvedEngine, enginePass, localModelOverride, stageDirectiveLocalModel, config, directiveModel, pendingFocusOverrideModel, pipelineConfig, backend, worktreePath, resumeId, role, readOnly, focusName, focusId, } = args;
-    // Single source of truth for the focus override at this spawn: a respawn's
-    // snapshot wins over the live pipeline_config.model; otherwise the live config
-    // carries it. Both initial spawn and respawn funnel through resolveTeamModel
-    // below, so the precedence (focus override -> stage -> CLI) is identical.
-    const focusOverrideModel = pendingFocusOverrideModel ?? pipelineConfig?.model ?? null;
-    // Resolve the per-product isolated CODEX_HOME for this spawn (undefined for
-    // claude engines and cloud products with no provisioned codexHome -- those
-    // spawns are byte-for-byte unaffected).
-    let spawnCodexHome = codexHomeForSpawn(resolvedEngine.engineId, config);
-    let spawnCodexModel = config.codexModel;
-    let isLocalModelPass = false;
-    // Per-pass local model routing: if this codex pass selected a registered local
-    // model, resolve it to coordinates, provision a per-model CODEX_HOME, and route
-    // the spawn there -- overriding the per-product codexHome/codexModel for this
-    // pass only. Absent ref => the per-product default above is kept.
-    const localModelConfig = await resolveLocalModelConfig({
-        engineId: resolvedEngine.engineId,
-        enginePass,
-        localModelOverride,
-        stageDirectiveLocalModel,
-    });
-    // The Telora-resolved key VALUE injected into the spawn env (under the fixed
-    // TELORA_LOCAL_API_KEY name) for a routed local-model pass; null otherwise.
-    let spawnLocalModelKey = null;
-    if (localModelConfig.kind === 'fallback') {
-        console.warn(`[focus-executor] Focus "${focusName}" ${enginePass} pass selected local model ` +
-            `${(localModelConfig.ref ?? '').slice(0, 8)} but it is not in the registry; falling back to the ` +
-            `per-product default model.`);
-    }
-    else if (localModelConfig.kind === 'route') {
-        const { codexHome, codexModel, apiKey, coords } = localModelConfig;
-        spawnCodexHome = codexHome;
-        spawnCodexModel = codexModel;
-        spawnLocalModelKey = apiKey;
-        isLocalModelPass = true;
-        console.log(`[focus-executor] Routing "${focusName}" ${enginePass} pass to local model ` +
-            `"${coords.name}" (${coords.model} @ ${coords.baseUrl}); CODEX_HOME=${codexHome}, ` +
-            (apiKey
-                ? `key from Telora (env ${TELORA_LOCAL_API_KEY_ENV}).`
-                : 'unauthenticated endpoint.'));
-        // Host-control swap (D2): on a CONTROLLABLE host, load/unload the selected
-        // per-pass model around this pass -- a sequential single-GPU swap (one model
-        // resident at a time) so the coding-vs-review model runs end-to-end with NO
-        // manual studio swap. On a non-controllable host this is a no-op (today's
-        // behavior: the operator pre-loads the model). A swap FAILURE must NOT spawn
-        // against a not-yet-loaded model: skip this tick (the 30s poll re-attempts).
-        const capability = await detectHostCapability(coords.baseUrl, apiKey);
-        if (shouldSwapForPass({ routing: { kind: 'route', coords, apiKey }, capability })) {
-            const root = hostRootFromBaseUrl(coords.baseUrl);
-            // Fast inline path (#1): if the target is ALREADY resident + ready, spawn
-            // THIS tick -- no detour through the detached swap. A single bounded
-            // /v1/status read; org-prefix-tolerant via decideSwap/modelIdsMatch.
-            let alreadyResident = false;
-            try {
-                const status = await getStatus(coords.baseUrl, apiKey);
-                alreadyResident =
-                    decideSwap({
-                        current: { modelId: status.loadedModelId, ready: status.ready },
-                        target: coords.model,
-                    }).action === 'noop';
-            }
-            catch {
-                // Transient status-read failure -> fall through to the managed async
-                // swap, which retries the load + readiness off the poll-critical path.
-            }
-            if (alreadyResident) {
-                // Claim the per-host residency lock (#4) so a second focus on this host
-                // cannot start a swap that evicts our resident model mid-pass.
-                const claim = claimResidentHost({
-                    root,
-                    targetModel: coords.model,
-                    focusId,
-                    isFocusActive: (id) => hasActiveTeam(id),
-                });
-                if (claim.status === 'busy_other') {
-                    console.log(`[focus-executor] Host-control: host for "${coords.name}" is held by another ` +
-                        `focus's running pass; deferring "${focusName}" ${enginePass} pass to avoid eviction.`);
-                    return { kind: 'still_loading', coords, reason: 'host_busy_other_focus' };
-                }
-                console.log(`[focus-executor] Host-control: model "${coords.name}" (${coords.model}) already ` +
-                    `resident + ready for "${focusName}" ${enginePass} pass.`);
-            }
-            else {
-                // A load is needed. Run it OFF the serial poll loop via the swap manager
-                // (#3) so a cold load (up to the 180s budget) does not stall every other
-                // focus/product. The manager also enforces the per-host residency lock
-                // (#4): a second focus on this host defers rather than evicting an
-                // in-flight model. The load is detached -- never awaited here.
-                const loadTimeoutMs = loadEnvConfig().TELORA_HOST_CONTROL_LOAD_TIMEOUT_MS;
-                const observation = observeHostSwap({
-                    root,
-                    targetModel: coords.model,
-                    focusId,
-                    isFocusActive: (id) => hasActiveTeam(id),
-                    runLoad: async () => {
-                        // D3 sizing seam: hardware-aware safe context that RESERVES the
-                        // candidate model's weights before sizing the KV cache. The weights
-                        // size + native context come from the registry coordinates (the
-                        // local_models sizing-metadata columns); when unset the sizer
-                        // degrades safely (no reservation / ceiling clamp). FAIL-SAFE to the
-                        // fixed DEFAULT_MAX_SEQ_LENGTH when host hardware data is unavailable.
-                        const sizing = await resolveSafeLoadOptions(coords.baseUrl, coords.model, { modelSizeMb: coords.modelSizeMb, nativeContext: coords.nativeContext }, apiKey);
-                        if (sizing.source === 'fallback') {
-                            console.warn(`[focus-executor] Host-control sizing unavailable for "${coords.name}" ` +
-                                `(${coords.model}); falling back to the fixed default context ` +
-                                `${sizing.maxSeqLength}. Check the host's /api/system/hardware endpoint.`);
-                        }
-                        else {
-                            console.log(`[focus-executor] Host-control sizing for "${coords.name}" (${coords.model}): ` +
-                                `max_seq_length=${sizing.maxSeqLength}` +
-                                (sizing.cacheTypeKv ? `, cache_type_kv=${sizing.cacheTypeKv}` : '') +
-                                (sizing.quantRequired ? ' (quant-required, marginal headroom)' : '') +
-                                (sizing.marginal && !sizing.quantRequired ? ' (marginal headroom)' : '') + '.');
-                        }
-                        // Load-scoped POST timeout: a host that blocks /v1/load until the cold
-                        // load completes must not be cut by the generic 5s fetch timeout.
-                        await ensureLoaded(coords.baseUrl, coords.model, {
-                            maxSeqLength: sizing.maxSeqLength,
-                            loadTimeoutMs,
-                            ...(sizing.cacheTypeKv !== undefined ? { cacheTypeKv: sizing.cacheTypeKv } : {}),
-                        }, apiKey);
-                        console.log(`[focus-executor] Host-control: local model "${coords.name}" (${coords.model}) ` +
-                            `loaded + ready (off-loop swap complete).`);
-                    },
-                });
-                if (observation.status === 'loading') {
-                    console.log(`[focus-executor] Host-control: model "${coords.name}" (${coords.model}) is loading ` +
-                        `for "${focusName}" ${enginePass} pass; deferring spawn (load runs off the poll loop).`);
-                    return { kind: 'still_loading', coords, reason: 'model_loading' };
-                }
-                if (observation.status === 'busy_other') {
-                    console.log(`[focus-executor] Host-control: host for "${coords.name}" is held by another ` +
-                        `focus's running pass; deferring "${focusName}" ${enginePass} pass to avoid eviction.`);
-                    return { kind: 'still_loading', coords, reason: 'host_busy_other_focus' };
-                }
-                if (observation.status === 'failed') {
-                    console.error(`[focus-executor] Host-control swap to load "${coords.name}" (${coords.model}) for ` +
-                        `"${focusName}" ${enginePass} pass FAILED: ${observation.error}. Not spawning against ` +
-                        `an unloaded model; will re-attempt next poll.`);
-                    return { kind: 'skip_load', coords, dbMessage: observation.error };
-                }
-                // observation.status === 'ready' -- the detached load completed on a
-                // prior tick; the model is resident and residency is held. Proceed.
-                console.log(`[focus-executor] Host-control: model "${coords.name}" (${coords.model}) ready for ` +
-                    `"${focusName}" ${enginePass} pass (off-loop swap complete).`);
-            }
-        }
-    }
-    // Model selection: ONE precedence (focus override -> stage directive -> CLI),
-    // applied identically at initial spawn and at stage respawn. The engine-compat
-    // prefilters below null out an input the resolved backend cannot run; the
-    // surviving inputs funnel through resolveEffectiveModel -> resolveTeamModel.
-    const focusSelectedModel = selectPipelineModelForSpawn(resolvedEngine.engineId, spawnCodexHome, focusOverrideModel);
-    const effectiveDirectiveModel = selectDirectiveModelForSpawn(resolvedEngine.engineId, directiveModel, spawnCodexModel ?? focusSelectedModel);
-    const effectiveModel = resolveEffectiveModel(effectiveDirectiveModel, spawnCodexHome, spawnCodexModel, focusSelectedModel);
-    const effectivePipelineConfig = effectiveModel !== (pipelineConfig?.model ?? null)
-        ? { ...pipelineConfig, model: effectiveModel }
-        : pipelineConfig;
-    const args2 = buildAgentArgs(backend, config, worktreePath, effectivePipelineConfig, resumeId, role.allowed_tools, readOnly);
-    // Capability-driven (no operator flag): for a registered local-model route
-    // whose endpoint drops Codex's namespace tools (backendDropsNamespaceTools),
-    // insert a localhost translating proxy between Codex and the inference server
-    // so the OSS server still receives the Telora tool schemas. Started LAST --
-    // after every host-control early return -- so a deferred spawn never leaks a
-    // proxy. Points the provisioned CODEX_HOME's base_url at the proxy; the proxy
-    // forwards to the model's real coords.baseUrl. Non-local / native-Responses
-    // passes never route => mcpProxy stays null and the spawn is byte-identical.
-    let mcpProxy = null;
-    if (localModelConfig.kind === 'route' &&
-        shouldRouteLocalModelThroughProxy(isLocalModelPass, localModelConfig.coords)) {
-        const { coords, apiKey } = localModelConfig;
-        try {
-            mcpProxy = await startCodexMcpProxy({ upstreamBaseUrl: coords.baseUrl });
-            writeLocalModelCodexHome(coords.id, {
-                baseUrl: mcpProxy.url,
-                model: coords.model,
-                wireApi: coords.wireApi ?? undefined,
-                requiresApiKey: apiKey !== null,
-            });
-            console.log(`[focus-executor] Local-model MCP proxy engaged for "${coords.name}": ` +
-                `Codex base_url -> ${mcpProxy.url} -> upstream ${coords.baseUrl}.`);
-        }
-        catch (err) {
-            // Best-effort: a proxy that cannot start must not block the spawn; fall
-            // back to the direct (namespace-dropping) path. The fail-loud reception
-            // check only applies when a proxy is present.
-            console.warn(`[focus-executor] Local-model MCP proxy failed to start; spawning direct: ${err.message}`);
-            mcpProxy = null;
-        }
-    }
-    return { kind: 'ready', args: args2, effectiveModel, spawnCodexHome, spawnLocalModelKey, isLocalModelPass, mcpProxy };
-}
-/**
- * Phase: choose the stdin message. A fresh spawn sends the full composed prompt;
- * a resume sends an incremental delta (git diff + prior findings to verify) since
- * the resumed session already holds its role + accumulated context (INJ-D).
- *
- * The scoping case is the one exception that overrides the fresh-vs-resume split:
- * when a NON-read_only (executable) focus has queued deliveries carrying only
- * Context Group issues and zero Task/Bug issues, this returns the role framework
- * PLUS `buildQueuedDeliveryScopingMessage` REGARDLESS of resumeId. The caller pairs
- * this with `resolveScopingSpawnResume`, which forces the spawn fresh (resumeId
- * null) so the directive lands on a new session instead of no-opping a concluded
- * one. Because the fresh session holds no accumulated context, the role framework
- * (identity + Scoping Mandate + status-update rules) is prepended here; only the
- * audit/kickoff DIRECTIVE body carried in `prompt` is dropped, per AC. `readOnlyFocus`
- * focuses are discovery-only (audit-playbook origin): their CG-only deliveries are
- * INTENTIONALLY unscoped, so they are never driven into scoping here --
- * delivery-lifecycle terminalizes them instead.
- */
-export async function buildSpawnMessage(args) {
-    const { prompt, resumeId, readOnlyFocus, role, promptContext, spawnSpec, config, focusId, focusName, deliveries, issues, worktreePath, priorFindings } = args;
-    // Scoping directive takes priority over the fresh/resume split, but ONLY for
-    // executable (non-discovery) focuses. It is returned even when resumeId is
-    // null because the caller forces this spawn fresh for exactly this case.
-    if (!readOnlyFocus) {
-        const unscopedDeliveries = findQueuedDeliveriesWithoutTaskIssues(deliveries, issues);
-        if (unscopedDeliveries.length > 0) {
-            // Prepend the role framework (identity, Scoping Mandate, MANDATORY
-            // status-update rules, worker-management, escalation) so the FORCED-FRESH
-            // scoping session receives its operating contract -- the audit/kickoff
-            // DIRECTIVE body in `prompt` is the only part intentionally dropped, not the
-            // role framework. On a fresh session stdin is the sole first-turn message,
-            // so omitting the framework would leave the team lead with no identity.
-            const roleFramework = buildRoleFrameworkPrompt(role, promptContext);
-            const scopingDirective = buildQueuedDeliveryScopingMessage({
-                lineage: spawnSpec.lineage,
-                focusName,
-                deliveries: unscopedDeliveries,
-            });
-            const messageToSend = `${roleFramework}\n\n${scopingDirective}`;
-            console.log(`[focus-executor] Spawning fresh scoping session for "${focusName}" ` +
-                `-- role framework + explicit scoping directive for ${unscopedDeliveries.length} queued ` +
-                `zero-issue deliver${unscopedDeliveries.length === 1 ? 'y' : 'ies'} ` +
-                `(lineage ${spawnSpec.lineage}, ${messageToSend.length} chars)`);
-            return messageToSend;
-        }
-    }
-    if (!resumeId)
-        return prompt;
-    let gitDiff = '';
-    try {
-        const diffCtx = {
-            focusId,
-            deliveryIds: deliveries.map(d => d.id),
-            worktreePath,
-            config,
-            organizationId: config.organizationId,
-            productId: config.productId,
-        };
-        const { content } = await resolveAssemblyRecipeWithManifest(['git.diff_against_base'], diffCtx);
-        gitDiff = content;
-    }
-    catch (err) {
-        console.debug(`[focus-executor] Resume-delta diff assembly failed (non-fatal):`, err.message);
-    }
-    const messageToSend = buildResumeDeltaMessage({
-        lineage: spawnSpec.lineage,
-        focusName,
-        gitDiff,
-        priorFindings,
-    });
-    console.log(`[focus-executor] Resuming Claude session ${resumeId} for "${focusName}" ` +
-        `-- sending incremental delta (lineage ${spawnSpec.lineage}, ${messageToSend.length} chars, ` +
-        `${priorFindings.length} prior finding(s))`);
-    return messageToSend;
-}
-/**
- * Decide whether this spawn must be forced fresh to deliver a scoping directive,
- * and return the resume id the spawn should actually use.
- *
- * The wedge this closes: a queued delivery carrying only Context Group issues and
- * zero Task/Bug issues can never cross the queued->coding gate. The daemon
- * re-spawns the focus every poll, but the resume lands on a session that already
- * considers the audit "done" and no-ops in one turn. The fix is to force the
- * scoping spawn FRESH (resumeId null) so `buildQueuedDeliveryScopingMessage`
- * primes a new session as its first instruction rather than a resume-delta a
- * concluded session ignores.
- *
- * Only executable focuses are driven into scoping. A `readOnly` (discovery-only,
- * audit-playbook) focus's CG-only deliveries are intentionally unscoped, so this
- * never forces them fresh -- their resume id passes through unchanged and the
- * delivery reaches a terminal state via the reconciler's discovery-only path.
- *
- * Pure and exported so the fresh-spawn contract is unit-testable without a live
- * spawn.
- */
-export function resolveScopingSpawnResume(args) {
-    const { readOnly, deliveries, issues, resumeId } = args;
-    if (readOnly)
-        return { resumeId, isScopingSpawn: false };
-    const isScopingSpawn = findQueuedDeliveriesWithoutTaskIssues(deliveries, issues).length > 0;
-    return {
-        resumeId: isScopingSpawn ? null : resumeId,
-        isScopingSpawn,
-    };
-}
-export function findQueuedDeliveriesWithoutTaskIssues(deliveries, issues) {
-    const taskIssueCounts = new Map();
-    for (const issue of issues) {
-        if (issue.issueType !== 'Task' && issue.issueType !== 'Bug')
-            continue;
-        taskIssueCounts.set(issue.deliveryId, (taskIssueCounts.get(issue.deliveryId) ?? 0) + 1);
-    }
-    return deliveries.filter(delivery => (delivery.executionStatus ?? '') === 'queued' &&
-        (taskIssueCounts.get(delivery.id) ?? 0) === 0);
-}
-export function buildQueuedDeliveryScopingMessage(args) {
-    const deliverySections = args.deliveries
-        .slice()
-        .sort((a, b) => a.priorityRank - b.priorityRank)
-        .map((delivery, index) => [
-        `### ${index + 1}. ${delivery.name}`,
-        `- Delivery ID: ${delivery.id}`,
-        `- Priority rank: ${delivery.priorityRank}`,
-        '',
-        '**Description**',
-        delivery.description?.trim() || '(none)',
-        '',
-        '**Acceptance Criteria**',
-        delivery.acceptanceCriteria?.trim() || '(none)',
-        '',
-        '**Technical Context**',
-        delivery.techContext?.trim() || '(none)',
-    ].join('\n'))
-        .join('\n\n');
-    return [
-        `# Scoping Required for Newly Queued Deliveries`,
-        '',
-        `You are the team lead for lineage "${args.lineage}" on focus "${args.focusName}". This is a FRESH scoping turn (not an incremental coding-resume): the role framework above is your operating contract for it.`,
-        '',
-        `The focus has queued deliveries with zero Task/Bug issues. Decompose each delivery below into Task/Bug issues before doing code work. For each delivery, create agent-satisfiable issues from its acceptance criteria, then move at least one Task/Bug issue to In Progress. The daemon advances the delivery queued -> coding (single-writer reconciler) the moment a work issue is In Progress.`,
-        '',
-        `Do not acknowledge and stop after reading this message. The required output of this turn is scoped issues on every listed delivery, with issue statuses kept current via Telora.`,
-        '',
-        deliverySections,
-    ].join('\n');
-}
-/**
- * Local-model passes depend on a host CLI, so refuse the process launch when
- * the backend's existing availability probe says it cannot run. Cloud passes
- * retain their existing behavior because their authentication can be supplied
- * by the per-spawn environment after the host-level probe runs.
- */
-export async function gateLocalModelBackendSpawn(backend, config, isLocalModelPass, host = hostname()) {
-    if (!isLocalModelPass)
-        return { allowed: true };
-    const availability = await backend.probeAvailability(config);
-    if (availability.available)
-        return { allowed: true };
-    // A routed local model supplies its own provider key in the child env. The
-    // host probe cannot see that key yet, so only binary absence is terminal for
-    // this Codex path; host-auth absence is intentionally superseded.
-    if (backend.id === 'codex' && availability.detail?.includes('but not authenticated')) {
-        return { allowed: true };
-    }
-    const binaryMissing = backend.id === 'codex' && availability.detail?.includes('not found');
-    const prefix = binaryMissing
-        ? `Codex CLI not found on ${host} / not on PATH`
-        : `${backend.displayName} unavailable on ${host}`;
-    return {
-        allowed: false,
-        reason: availability.detail ? `${prefix}. ${availability.detail}` : prefix,
-    };
-}
-export function backendUnavailableSessionUpdate(reason, category = 'backend_unavailable') {
-    return {
-        status: 'failed',
-        exit_reason: reason,
-        exit_category: category,
-    };
-}
-/** Attach the error listener in the same synchronous stack frame as spawn(). */
-export function spawnCrashIsolated(command, args, options, onError, spawnFn = spawn) {
-    const proc = spawnFn(command, args, {
-        ...options,
-        // Own process group (setsid on POSIX): the team lead becomes its own
-        // group leader (pgid == lead pid). This is what makes the reap's
-        // group-first signal (spawner/lifecycle.signalWorker: kill(-pid)) actually
-        // reap the lead AND any host children it sub-spawns as one group -- without
-        // detachment the lead shares the daemon's group and kill(-leadPid) ESRCHs,
-        // falling back to the bare pid (lead only). We deliberately do NOT unref():
-        // the daemon must still observe the lead's 'close'/'exit' to drive
-        // completion + delivery advancement. On a hard daemon kill the CLI reaps
-        // these groups from the persisted worker pidfile (see daemon-process reap).
-        detached: true,
-        stdio: ['pipe', 'pipe', 'pipe'],
-    });
-    proc.on('error', onError);
-    // A failed exec can also tear down stdin with EPIPE after the process-level
-    // error/close. Consume that duplicate stream error; forward other stdin
-    // failures through the pass-scoped handler.
-    proc.stdin.on('error', (error) => {
-        if (error.code !== 'EPIPE')
-            onError(error);
-    });
-    return proc;
-}
-/** Ensure a terminal spawn failure is persisted after any in-flight running transition. */
-export async function persistSpawnFailureAfterRunning(runningTransition, persistFailure) {
-    if (runningTransition)
-        await runningTransition.catch(() => undefined);
-    await persistFailure();
-}
-/**
- * Final phase: build the levered spawn environment, persist the assembly
- * manifest, write the session lifecycle (starting -> running), acquire the
- * governor slot, wrap the command in the sandbox (fail-closed), spawn the
- * child, write its stdin, and attach the completion/close/error handlers.
- *
- * Owns ALL of its early-return cleanups so the team-state map and governor slot
- * never leak: governor-denied (exit_category 'governor_denied') and
- * sandbox-unavailable (exit_category 'sandbox_unavailable') both mark the
- * session terminal, release the governor slot where one was held, remove the
- * team from activeTeams, and return without spawning. Behavior byte-identical
- * to the original inline tail of spawnFocusTeam.
- */
-/**
- * Close a team's local-model translating proxy if one is engaged, and null it so
- * the call is idempotent across the multiple teardown paths. No-op for every
- * hosted/Claude/flag-off team (mcpProxy undefined/null).
- */
-export function closeTeamProxyQuietly(teamState) {
-    const proxy = teamState.mcpProxy;
-    if (!proxy)
-        return;
-    teamState.mcpProxy = null;
-    proxy.close().catch(() => undefined);
-}
-export async function spawnTeamProcess(spec) {
-    const { config, focusId, focusName, session, teamState, backend, args, messageToSend, logs, worktreePath, resumeId, assemblyManifest, spawnCodexHome, spawnLocalModelKey, isLocalModelPass, effectiveModel, pendingDirective, spawnStageName, params, } = spec;
-    const activeTeams = getActiveTeams();
-    // Two fail-closed gates for local-model passes, both refusing the spawn into a
-    // durable terminal session rather than launching a team that cannot work:
-    //   1. backend availability (host CLI present) -- 'backend_unavailable'
-    //   2. read-only MCP preflight (required Telora tools callable) -- 'mcp_preflight_failed'
-    // The preflight runs only after availability passes (no point probing MCP when
-    // the binary is missing). Cloud/claude passes short-circuit both gates.
-    const availabilityGate = await gateLocalModelBackendSpawn(backend, config, isLocalModelPass);
-    const spawnGate = !availabilityGate.allowed
-        ? { ...availabilityGate, category: 'backend_unavailable' }
-        : await preflightLocalModelMcp(config, isLocalModelPass);
-    if (!spawnGate.allowed) {
-        const reason = spawnGate.reason ?? `${backend.displayName} unavailable`;
-        const category = spawnGate.category ?? 'backend_unavailable';
-        console.error(`[focus-executor] Refusing spawn for "${focusName}" (${category}): ${reason}`);
-        await updateSession(session.id, {
-            ...backendUnavailableSessionUpdate(reason, category),
-            ended_at: new Date().toISOString(),
-        }).catch(updateErr => {
-            console.warn(`[focus-executor] Failed to update refused-spawn session:`, updateErr.message);
-        });
-        logs.stdoutLogStream.end();
-        logs.stderrStream.end();
-        logs.jsonlStream.end();
-        closeTeamProxyQuietly(teamState);
-        teamState.phase = 'terminated';
-        activeTeams.delete(focusId);
-        return;
-    }
-    // Tag spend with the lever: the team-lead spawn runs the focus's execute
-    // phase (review directives run the gate); the workflow stage is carried
-    // separately. The audit phase tags its own spawn elsewhere.
-    const spawnPhase = (pendingDirective?.sessionType ?? 'coding') === 'review' ? 'gate' : 'execute';
-    // Stage: prefer the resolved workflow-stage name; when the stage could not be
-    // resolved (legacy-prompt fallback, or a non-review directive that carried no
-    // stage), fall back to the phase-appropriate default so the lever is never
-    // dropped. 'reviewing' for the gate phase, 'coding' for execute.
-    const spawnStage = spawnStageName ?? (spawnPhase === 'gate' ? 'reviewing' : 'coding');
-    // Levered spawn: buildLeveredSpawnEnvironment requires phase + stage, so this
-    // path cannot regress to dropping the telemetry lever.
-    const spawnEnv = buildLeveredSpawnEnvironment(config, {
-        orgId: config.organizationId,
-        focusId,
-        sessionId: session.id,
-        phase: spawnPhase,
-        stage: spawnStage,
-    });
-    // Inject backend-specific org secrets (e.g. CODEX_API_KEY for the codex backend).
-    // Non-fatal: fetchBackendEnvExtras returns {} on any error, falling back to host creds.
-    Object.assign(spawnEnv, await fetchBackendEnvExtras(backend.id));
-    // Per-product local-model isolation: point this codex spawn at the product's
-    // provisioned CODEX_HOME (no-invisible-cascading -- the override is logged).
-    // Cloud/claude spawns leave CODEX_HOME unset (spawnCodexHome === undefined).
-    if (spawnCodexHome) {
-        spawnEnv.CODEX_HOME = spawnCodexHome;
-        console.log(`[focus-executor] CODEX_HOME set for "${focusName}" (product ${config.productId.slice(0, 8)}): ` +
-            `${spawnCodexHome}` +
-            (effectiveModel ? ` (model: ${effectiveModel})` : ''));
-    }
-    // Per-pass local-model bearer (D8): inject the Telora-resolved key VALUE into
-    // the spawn env under the fixed name codex's config.toml references (env_key).
-    // The value lives only in this child process env -- never on disk, never on the
-    // local_models row. Set only for a routed local-model pass; cloud/claude and
-    // non-local codex spawns leave it untouched.
-    if (spawnLocalModelKey) {
-        spawnEnv[TELORA_LOCAL_API_KEY_ENV] = spawnLocalModelKey;
-    }
-    // Persist the assembly manifest for this spawn (best-effort -- never blocks
-    // the spawn). One row per resolved source, attributed to org + session +
-    // focus, so injected context becomes a queryable lever on token spend.
-    void insertAssemblyManifest({
-        sessionId: session.id,
-        focusId,
-        deliveryId: null,
-        manifest: assemblyManifest,
-    });
-    // Update session to starting
-    await updateSession(session.id, {
-        status: 'starting',
-        started_at: new Date().toISOString(),
-        stdout_path: logs.stdoutPath,
-        stderr_path: logs.stderrPath,
-    });
-    // Acquire governor slot (if governor is configured)
-    if (governor) {
-        try {
-            await governor.acquireSlot('focus');
-        }
-        catch (err) {
-            console.warn(`[focus-executor] Governor denied slot for "${focusName}":`, err.message);
-            // Mark session as failed so it doesn't linger in `starting` status
-            await updateSession(session.id, {
-                ...governorDeniedSessionUpdate(),
-                ended_at: new Date().toISOString(),
-            }).catch(updateErr => {
-                console.warn(`[focus-executor] Failed to update session after governor denial:`, updateErr.message);
-            });
-            closeTeamProxyQuietly(teamState);
-            activeTeams.delete(focusId);
-            return;
-        }
-    }
-    // Wrap the spawn in the OS sandbox (D3). Default mode is 'off' (no change);
-    // an explicit sandbox.mode="bwrap" confines the agent's filesystem to its
-    // worktree + an explicit read-only allowlist. FAIL-CLOSED: if a required
-    // sandbox cannot initialize, refuse the spawn rather than run unconfined.
-    let spawnCommand;
-    let spawnArgs;
-    try {
-        const wrapped = wrapSpawnCommand(config, {
-            command: backend.resolveCommand(config),
-            args,
-            worktreePath,
-        });
-        spawnCommand = wrapped.command;
-        spawnArgs = wrapped.args;
-    }
-    catch (err) {
-        if (err instanceof SandboxUnavailableError) {
-            console.error(`[focus-executor] Refusing spawn for "${focusName}": ${err.message}`);
-            await updateSession(session.id, {
-                ...sandboxUnavailableSessionUpdate(err.message),
-                ended_at: new Date().toISOString(),
-            }).catch(updateErr => {
-                console.warn(`[focus-executor] Failed to update session after sandbox refusal:`, updateErr.message);
-            });
-            if (governor)
-                governor.releaseSlot('focus');
-            closeTeamProxyQuietly(teamState);
-            activeTeams.delete(focusId);
-            return;
-        }
-        throw err;
-    }
-    // Spawn the team lead process
-    let processErrorHandled = false;
-    let runningTransition = null;
-    let completionDetectorForError = null;
-    const handleProcessError = (err) => {
-        if (processErrorHandled)
-            return;
-        processErrorHandled = true;
-        console.error(`[focus-executor] Team lead for "${focusName}" error:`, err.message);
-        governor?.releaseSlot('focus');
-        const missingCliReason = err.code === 'ENOENT'
-            ? `${backend.displayName} not found on ${hostname()} / not on PATH: ${err.message}`
-            : `Process error: ${err.message}`;
-        void persistSpawnFailureAfterRunning(runningTransition, () => withRetry(() => updateSession(session.id, {
-            status: 'failed',
-            exit_reason: missingCliReason,
-            exit_category: err.code === 'ENOENT' ? 'backend_unavailable' : 'error',
-            ended_at: new Date().toISOString(),
-        }), { maxAttempts: 3, baseDelayMs: 1000, label: 'session-update-error' })).catch(updateErr => {
-            console.warn(`[focus-executor] Failed to update session after retries:`, updateErr.message);
-        });
-        completionDetectorForError?.destroy();
-        logs.stdoutLogStream.end();
-        logs.stderrStream.end();
-        logs.jsonlStream.end();
-        closeTeamProxyQuietly(teamState);
-        teamState.phase = 'terminated';
-        activeTeams.delete(focusId);
-    };
-    const proc = spawnCrashIsolated(spawnCommand, spawnArgs, {
-        cwd: worktreePath,
-        env: spawnEnv,
-    }, handleProcessError);
-    teamState.leadPid = proc.pid ?? null;
-    teamState.leadStdin = proc.stdin;
-    teamState.phase = 'executing';
-    // Persist the detached lead pid so a hard daemon kill (stop --force / timeout
-    // / external kill -9) can group-reap it from the pidfile -- the in-memory
-    // activeTeams map dies with the daemon. Auto-removed on the lead's exit.
-    if (typeof proc.pid === 'number') {
-        const leadPid = proc.pid;
-        recordWorkerPid(leadPid, focusName);
-        proc.once('close', () => removeWorkerPid(leadPid));
-        proc.once('error', () => removeWorkerPid(leadPid));
-    }
-    // Attach stream parser, completion detector, activity tracker, event handlers
-    const { completionDetector, activityTracker } = attachStreamHandlers({
-        proc, backend, teamState, focusId, focusName, sessionId: session.id, logs,
-    });
-    completionDetectorForError = completionDetector;
-    // Send the message via stdin: the full composed prompt on a fresh spawn, or
-    // the incremental delta when resuming a lineage (INJ-D). Engine-specific input
-    // encoding lives in the backend.
-    proc.stdin.write(backend.encodeInput(messageToSend));
-    if (backend.closeStdinAfterInput) {
-        proc.stdin.end();
-        teamState.leadStdin = null;
-    }
-    // Update session to running
-    runningTransition = updateSession(session.id, {
-        status: 'running',
-        pid: proc.pid,
-    });
-    await runningTransition;
-    console.log(`[focus-executor] Team lead spawned for "${focusName}" (PID: ${proc.pid}, session: ${session.id})`);
-    // Handle completion -- check for more work or terminate.
-    // No idle phase: if actionable work remains, send it immediately (mid-focus
-    // handoff). If all work is done, terminate. A fresh team is spawned if new
-    // deliveries arrive later (~$0.50-1.00 exploration cost, but clean context).
-    completionDetector.on('complete', (info) => {
-        console.log(`[focus-executor] Team lead for "${focusName}" completed work cycle: ` +
-            `${info.turnCount} turns, $${info.totalCostUsd.toFixed(4)}`);
-        handleCompletionEvent({ config, focusId, focusName, teamState, completionDetector, proc, completionInfo: info }).catch(err => {
-            console.warn(`[focus-executor] Failed to check delivery state for "${focusName}":`, err.message);
-            // Fallback: terminate to avoid idle money burn.
-            terminateTeam(focusId, 'handoff');
-        });
-    });
-    // Handle process exit
-    const spawnedAt = Date.now();
-    proc.on('close', (code, signal) => {
-        // Node emits close after a spawn error. The error path already persisted
-        // the terminal reason; do not let normal completion overwrite it.
-        if (processErrorHandled)
-            return;
-        handleTeamProcessClose({
-            code, signal, focusName, focusId, resumeId, spawnedAt,
-            teamState, sessionId: session.id, config, completionDetector,
-            activityTracker, logs, params, governor, spawnFocusTeam,
-        }).catch(err => {
-            console.error(`[focus-executor] handleTeamProcessClose failed for "${focusName}":`, err.message);
-        });
-    });
-}
 /**
  * Spawn a focus team to execute all deliveries in a focus.
  *
@@ -1732,6 +200,14 @@ export async function spawnFocusTeam(params) {
         spawnDirectiveDeclared, spawnStageName, engineOverride, stageDirectiveEngine: directiveEngine,
         config, orgDefaultEngine, focusName, teamState,
     });
+    // Pin the focus-branch tip THIS review pass is covering (spawn-tip), captured
+    // now (post-rebase, before any mid-review commits). Carried to completion so
+    // the coverage watermark is stamped from what the review actually saw, and so
+    // the auto-approve gate can detect mid-review drift (spawn-tip != exit-tip).
+    // Review lineage only; coding teams leave it null.
+    if (teamState.sessionType === 'review') {
+        teamState.reviewSpawnTip = resolveRef(worktreePath, branchName);
+    }
     // --- Phase: create the team-lead session. Opened AFTER Phase B so the
     // (focus, lineage) pass is resolved on the authoritative lineage
     // (teamState.sessionType), not a stale 'coding' default -- a 'review'-lineage
@@ -1865,7 +341,7 @@ export async function spawnFocusTeam(params) {
     await spawnTeamProcess({
         config, focusId, focusName, session, teamState, backend, args, messageToSend,
         logs, worktreePath, resumeId, assemblyManifest, spawnCodexHome, spawnLocalModelKey, isLocalModelPass,
-        effectiveModel, pendingDirective, spawnStageName, params,
+        effectiveModel, pendingDirective, spawnStageName, params, governor, spawnFocusTeam,
     });
 }
 //# sourceMappingURL=focus-executor.js.map