@tokenfactory/acc-runner 0.25.1 → 0.27.0

package/dist/task-runner.js

@@ -1,1766 +0,0 @@
-/**
- * Task execution path. Called by watch.ts when a task_assigned broadcast
- * lands on the runner channel.
- *
- * 1. Transition task → running (RPC).
- * 2. fetch_task_for_runner to get the task + adjacent agent/model/runner.
- * 3. Render the prompt, ensure repo is fresh, branch is checked out.
- * 4. Spawn `claude --print` with the prompt on stdin; pipe stdout/stderr
- *    to acc.append_task_event so the History tab updates live.
- * 5. On success, push the branch and open a PR via `gh`.
- * 6. On failure, transition → failed and emit an error task_event.
- *
- * Cancellation: watch.ts holds a reference to the running child via the
- * returned controller and SIGTERMs it on task_cancelled.
- */
-import fs from "node:fs";
-import { existsSync, unlinkSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { join } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import { execa } from "execa";
-import { withAnthropicAuth } from "./anthropic-auth.js";
-import { loadProfile as defaultLoadProfile } from "./config.js";
-import { normalizeUsage, parseClaudeJson, priceUsdCents, toCliAlias, } from "./cost-pricing.js";
-import { classifyClaudeExit, extractResetTime, isGitProvisionContention, } from "./failure-classifier.js";
-import { startTaskGithubBudget, endTaskGithubBudget, } from "./github-client.js";
-import { git as defaultGit } from "./git.js";
-import { gh as defaultGh } from "./gh.js";
-import { writeMcpConfig as defaultWriteMcpConfig, } from "./mcp-spawn.js";
-import { postRunnerStateMessage as defaultPostRunnerStateMessage, } from "./messaging.js";
-import { branchForTask, prTitleForTask, renderTaskPrompt, } from "./prompt.js";
-import { acquireTaskLock as defaultAcquireTaskLock, TaskLockHeldError, } from "./runtime/locks.js";
-import { prepareTaskWorktree as defaultPrepareTaskWorktree, } from "./runtime/worktree.js";
-// v0.21 T-66-1: serialize the per-task worktree-provisioning critical section
-// against the shared clone so concurrent tasks can't collide on git's
-// repo-global locks (the T-65-2 race).
-import { withProvisionLock } from "./runtime/provision-mutex.js";
-import { parseConflictMeta, resolveConflict, MAX_CONFLICT_ATTEMPTS, } from "./runtime/conflict-resolver.js";
-import { parseReworkMeta, renderReworkPrompt, fetchPrHeadRef as defaultFetchPrHeadRef, } from "./runtime/rework.js";
-import { assertResolutionIntegrity, isConflictResolutionTask, summariseFailures, } from "./runtime/resolution-integrity.js";
-const LOG_BATCH_BYTES = 4 * 1024;
-/**
- * v0.6.0 REG-296: build the argv for `claude --print`. Splitting this
- * out keeps the model-passthrough logic unit-testable without spawning
- * a real subprocess. modelId is forwarded as `--model <id>` when
- * non-empty (whitespace counts as empty); otherwise omitted so claude
- * uses the operator's default model.
- */
-export function buildClaudeArgs(modelId) {
-    const args = ["--print", "--dangerously-skip-permissions", "--output-format=json"];
-    const trimmed = (modelId ?? "").trim();
-    if (trimmed)
-        args.push("--model", trimmed);
-    return args;
-}
-function defaultSpawnClaude(cwd, modelId) {
-    // --dangerously-skip-permissions: bypass claude's per-edit approval
-    // prompts. The runner is non-interactive (no TTY for human approval)
-    // and the permission boundary is enforced one level up — see the
-    // "Runner sandbox" section in packages/acc-runner/README.md.
-    // --output-format=json: emit a structured object so we can parse the
-    // usage block for cost tracking. parseClaudeJson falls back to plain
-    // text when older claude versions emit markdown directly.
-    // --model: forwarded when the task pins a model (REG-296).
-    // v0.74-B: withAnthropicAuth forwards ANTHROPIC_API_KEY (trimmed) when set
-    // so claude authenticates via the API account (no per-session cap) instead
-    // of the operator's interactive OAuth session. claude has no --api-key flag;
-    // the env var is the only auth channel. See src/anthropic-auth.ts.
-    return execa("claude", buildClaudeArgs(modelId), {
-        cwd,
-        stdin: "pipe",
-        stdout: "pipe",
-        stderr: "pipe",
-        reject: false,
-        env: withAnthropicAuth(process.env),
-    });
-}
-async function defaultCheckoutBase(repoPath, baseBranch) {
-    // Plain `git checkout <branch>` (not `-B`) so the integration
-    // branch's existing ref is honored. With -B we'd reset the
-    // integration branch to current HEAD, which is the exact bug
-    // REG-301 was filed for in reverse — destructive instead of stale.
-    await execa("git", ["checkout", baseBranch], { cwd: repoPath, env: process.env });
-}
-/**
- * v0.6.0 REG-295: expand `~/...` paths against $HOME so a task can
- * carry `repo_path_hint = "~/work/foo"` from a row populated on a
- * different machine. Absolute and relative paths pass through.
- */
-export function expandHomePath(p) {
-    if (p === "~")
-        return os.homedir();
-    if (p.startsWith("~/"))
-        return path.join(os.homedir(), p.slice(2));
-    return p;
-}
-/**
- * v0.63 T-63-1: default claude health probe. A silent instant-empty exit is
- * ambiguous — it can be a broken host OR a momentarily-unavailable claude.
- * `claude --version` is a cheap, deterministic answer to "is the binary/host
- * actually broken?": if it returns 0 the host is fine (the exit was
- * transient → claude_unavailable, retry), and any spawn failure / non-zero
- * exit / timeout means the binary or its dynamic deps are genuinely broken
- * (→ env_broken, quarantine). Short timeout so a probe never wedges the run.
- */
-async function defaultHealthProbe() {
-    try {
-        const res = await execa("claude", ["--version"], {
-            reject: false,
-            timeout: 5_000,
-            env: process.env,
-        });
-        if (res.exitCode === 0) {
-            return { ok: true, detail: (res.stdout || "").trim().slice(0, 200) || "claude --version ok" };
-        }
-        return {
-            ok: false,
-            detail: `claude --version exited ${res.exitCode ?? "signal"}: ${(res.stderr || "").trim().slice(0, 200)}`,
-        };
-    }
-    catch (err) {
-        return { ok: false, detail: `claude --version spawn failed: ${err.message}` };
-    }
-}
-const DEFAULT_CLAUDE_UNAVAILABLE_KNOBS = {
-    windowMs: 15 * 60_000,
-    alertThreshold: 5,
-    backoffBaseMs: 30_000,
-    backoffMaxMs: 15 * 60_000,
-};
-// Process-level state. runTask() is a fresh closure per task, but the module
-// is loaded once, so consecutive task runs in the same `acc-runner watch`
-// process share this — the only place a cross-task streak can live without
-// touching watch.ts (out of this track's file scope). A clean (exit-0) claude
-// run resets it: claude has recovered.
-let claudeUnavailableKnobs = { ...DEFAULT_CLAUDE_UNAVAILABLE_KNOBS };
-let claudeUnavailableHits = [];
-let claudeUnavailableStreak = 0;
-/** v0.63 T-63-1: override the silent-unavailability knobs (used by tests). */
-export function configureClaudeUnavailable(partial) {
-    claudeUnavailableKnobs = { ...claudeUnavailableKnobs, ...partial };
-}
-/** v0.63 T-63-1: reset both the streak and the knobs (used by tests). */
-export function resetClaudeUnavailableState() {
-    claudeUnavailableHits = [];
-    claudeUnavailableStreak = 0;
-    claudeUnavailableKnobs = { ...DEFAULT_CLAUDE_UNAVAILABLE_KNOBS };
-}
-/**
- * v0.63 T-63-1: record one silent instant-empty exit and compute the response
- * (exponential backoff + whether the sustained-streak INFRA alert trips).
- * Exported so the watch process and the unit suite share one definition.
- */
-export function recordClaudeUnavailable(now) {
-    claudeUnavailableStreak += 1;
-    claudeUnavailableHits.push(now);
-    const cutoff = now - claudeUnavailableKnobs.windowMs;
-    claudeUnavailableHits = claudeUnavailableHits.filter((t) => t >= cutoff);
-    const windowCount = claudeUnavailableHits.length;
-    const alert = windowCount >= claudeUnavailableKnobs.alertThreshold;
-    const expo = claudeUnavailableKnobs.backoffBaseMs * 2 ** (claudeUnavailableStreak - 1);
-    const backoffMs = Math.min(expo, claudeUnavailableKnobs.backoffMaxMs);
-    return {
-        streak: claudeUnavailableStreak,
-        windowCount,
-        alert,
-        backoffMs,
-        resumeAt: new Date(now + backoffMs).toISOString(),
-    };
-}
-/** v0.63 T-63-1: a clean claude run proves the binary recovered — reset. */
-function clearClaudeUnavailableStreak() {
-    claudeUnavailableStreak = 0;
-    claudeUnavailableHits = [];
-}
-// v0.37-A HEAD-LOCK-GUARD: git worktree add/remove/prune can leave stale
-// .git/HEAD.lock or .git/index.lock behind. The virtiofs boundary keeps
-// the sandbox from clearing them, but the host runner process can. Call
-// this against the parent repo's path (the dir containing .git/) before
-// any worktree op.
-function clearGitLocks(repoRoot) {
-    for (const name of ["HEAD.lock", "index.lock"]) {
-        const p = join(repoRoot, ".git", name);
-        try {
-            if (existsSync(p)) {
-                unlinkSync(p);
-                process.stderr.write("[runner] cleared stale lock: " + p + "\n");
-            }
-        }
-        catch { /* noop */ }
-    }
-}
-async function appendEvent(supabase, taskId, kind, payload) {
-    const { error } = await supabase.rpc("append_task_event", {
-        p_task_id: taskId,
-        p_kind: kind,
-        p_payload: payload,
-    });
-    if (error) {
-        // Logging failures shouldn't crash the run — print to local stderr.
-        process.stderr.write(`[acc-runner] append_task_event failed: ${error.message}\n`);
-    }
-}
-async function streamToEvents(stream, supabase, taskId, streamName) {
-    let captured = "";
-    let pending = "";
-    const flush = async () => {
-        if (!pending)
-            return;
-        const text = pending;
-        pending = "";
-        captured += text;
-        await appendEvent(supabase, taskId, "log", { stream: streamName, text });
-    };
-    for await (const raw of stream) {
-        const text = typeof raw === "string" ? raw : raw.toString("utf8");
-        pending += text;
-        if (pending.length >= LOG_BATCH_BYTES)
-            await flush();
-    }
-    await flush();
-    return captured;
-}
-/**
- * Pull the structured report block from claude's stdout. Recognises
- * both `--output-format=json` (extracts .result) and plain text. Falls
- * back to the entire stdout (capped) if no `## Summary` heading is
- * present — that way the PR body still tells the reviewer what happened.
- */
-export function extractReportFromOutput(stdout) {
-    const parsed = parseClaudeJson(stdout);
-    const text = parsed?.result ?? stdout;
-    const idx = text.indexOf("## Summary");
-    if (idx === -1) {
-        const trimmed = text.trim();
-        if (!trimmed)
-            return "_(no report emitted)_";
-        return trimmed.slice(-8000);
-    }
-    return text.slice(idx).trim().slice(0, 16000);
-}
-/**
- * v0.35-B: extract the PR number from a `gh pr create` URL. Returns null
- * when the URL doesn't carry a `/pull/<int>` segment so the caller can
- * fall back to the webhook-driven path. GitHub URLs encode PR ids as the
- * last path segment; anchors and query strings are tolerated.
- */
-export function parsePrNumber(url) {
-    if (!url)
-        return null;
-    const m = url.match(/\/pull\/(\d+)(?:[/?#]|$)/);
-    if (!m)
-        return null;
-    const n = parseInt(m[1], 10);
-    return Number.isFinite(n) && n > 0 ? n : null;
-}
-/**
- * v0.35-B: write `pr_number` onto acc.tasks AND transition running →
- * needs-review in one RPC. Best-effort: a missing function (Track A
- * migration not yet applied) OR any error logs to stderr and returns
- * false so the caller falls back to the webhook-driven done path
- * (running → done via the matrix widened in 0156). The RPC contract is
- * `acc.set_task_pr(p_task_id text, p_pr_number int, p_pr_html_url text)`.
- */
-async function setTaskPr(supabase, taskId, prUrl) {
-    const prNumber = parsePrNumber(prUrl);
-    if (prNumber === null)
-        return false;
-    const { error } = await supabase.rpc("set_task_pr", {
-        p_task_id: taskId,
-        p_pr_number: prNumber,
-        p_pr_html_url: prUrl,
-    });
-    if (error) {
-        process.stderr.write(`[acc-runner] set_task_pr(${taskId}, ${prNumber}) failed: ${error.message} ` +
-            `— falling back to webhook-driven running→done path\n`);
-        return false;
-    }
-    return true;
-}
-/**
- * v0.53 T-53-4: emit a `task.first_commit` activity event the first time a
- * task's worktree produces a commit on its branch (the SLO funnel signal
- * for "coding actually started"). Additive — the runner protocol message
- * shapes are unchanged; this rides the existing `log_activity` RPC path.
- *
- * Best-effort and exactly-once per task run: it sits on the single
- * post-success, pre-push code path. A repo with no firstCommit support
- * (a GitRunner stub without the method) or a branch with no commits ahead
- * of the base simply emits nothing. Failures log to stderr and never block
- * the push.
- */
-async function emitFirstCommit(supabase, git, taskId, workdir, baseRef, branch) {
-    try {
-        const first = await git.firstCommit?.(workdir, baseRef, branch);
-        if (!first)
-            return;
-        const { error } = await supabase.rpc("log_activity", {
-            p_verb: "task.first_commit",
-            p_target_id: taskId,
-            p_target_type: "task",
-            p_payload: {
-                task_id: taskId,
-                branch,
-                sha: first.sha,
-                ts: first.ts || null,
-            },
-        });
-        if (error) {
-            process.stderr.write(`[acc-runner] task.first_commit log_activity(${taskId}) failed: ${error.message}\n`);
-        }
-    }
-    catch (err) {
-        process.stderr.write(`[acc-runner] task.first_commit emit failed: ${err.message}\n`);
-    }
-}
-/**
- * Build a cost event from claude's stdout. Always returns a payload
- * (zero-cost when usage isn't parseable) so the cap-tracking surface
- * stays consistent: one cost_events row per attempt.
- */
-export function buildCostEvent(taskId, stdout, fallbackModel, runnerId) {
-    const parsed = parseClaudeJson(stdout);
-    const model = parsed?.model ?? fallbackModel ?? "unknown";
-    const usage = normalizeUsage(parsed?.usage);
-    return {
-        task_id: taskId,
-        model,
-        usd_cents: priceUsdCents(model, usage),
-        runner_id: runnerId ?? null,
-        ...usage,
-    };
-}
-/**
- * v0.14-MESSAGING-RUNTIME-WIRE — dynamic-import the prelude module
- * referenced by a runner profile and return its default-exported string.
- *
- * The prelude path in the profile JSON (e.g. `./src/profiles/developer-
- * prompt.ts`) is interpreted from the runner package root — the parent
- * of the runner-profiles dir where the JSON lives. In source/dev the
- * .ts file is importable via tsx; in the npm-published artifact only
- * `dist/` ships, so we map `src/*.ts` → `dist/*.js` when the .ts target
- * doesn't exist. Returns empty string when no prelude is configured or
- * the import resolves to a non-string default (v0.13 byte-identical).
- *
- * Exported so tests can stub the resolution + import seam via the
- * `loadPromptPrelude` dep on RunTaskDeps — vitest's Vite-backed
- * transform pipeline does not handle dynamic imports of arbitrary file
- * URLs in the jsdom environment, so the production path is exercised
- * by the runner's own unit suite (node env) rather than by the
- * top-level integration test.
- */
-export async function loadPromptPrelude(profile) {
-    if (!profile.promptPrelude || profile.promptPrelude.length === 0)
-        return "";
-    // Runner-profiles dir lives at <pkg-root>/runner-profiles/. Resolve
-    // the prelude path from the package root so a JSON like
-    // `./src/profiles/developer-prompt.ts` lands on a real file.
-    const profilesRoot = process.env.ACC_RUNNER_PROFILES_DIR?.trim() ||
-        path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "runner-profiles");
-    const pkgRoot = path.resolve(profilesRoot, "..");
-    let resolved = path.resolve(pkgRoot, profile.promptPrelude);
-    // Production map: the published package ships dist/ only.
-    if (!fs.existsSync(resolved)) {
-        const distMapped = resolved
-            .replace(/([/\\])src\1/, "$1dist$1")
-            .replace(/\.ts$/, ".js");
-        if (fs.existsSync(distMapped))
-            resolved = distMapped;
-    }
-    const mod = (await import(/* @vite-ignore */ pathToFileURL(resolved).href));
-    const def = mod.default;
-    return typeof def === "string" ? def : "";
-}
-async function defaultPostCostEvent(supabase, event) {
-    const { error } = await supabase.rpc("record_cost_event", {
-        p_task_id: event.task_id,
-        p_model: event.model,
-        p_input_tokens: event.input_tokens,
-        p_output_tokens: event.output_tokens,
-        p_cache_read_tokens: event.cache_read_tokens,
-        p_cache_write_tokens: event.cache_write_tokens,
-        p_usd_cents: event.usd_cents,
-        p_runner_id: event.runner_id ?? null,
-    });
-    if (error)
-        throw new Error(error.message);
-}
-/**
- * v0.48 T-48-5: conflict_resolution task path.
- *
- * Called when the fetched task has type='conflict_resolution'. Does not
- * spawn Claude — resolves conflicts via GitHub API and transitions directly.
- * Runs inside the existing claim/lock/signal infrastructure of runTask.
- */
-async function runConflictResolutionPath(taskId, task, deps, postState_, appendEventFn) {
-    await postState_("planning", "info", {
-        runner_id: deps.session.runnerId,
-        task_type: "conflict_resolution",
-    });
-    const meta = parseConflictMeta(task.description, {
-        pr_number: task.pr_number,
-        repo: task.repo,
-        integration_branch: task.integration_branch,
-    });
-    if (!meta || !meta.repo) {
-        const msg = "conflict_resolution task missing PR metadata (pr_number + repo in description or task fields)";
-        await appendEventFn("error", { phase: "conflict_resolution", error: msg });
-        await deps.supabase.rpc("transition_task", {
-            p_task_id: taskId,
-            p_new_status: "failed",
-        });
-        return { taskId, status: "failed", phase: "fetch", error: msg };
-    }
-    await postState_("coding", "info", {
-        runner_id: deps.session.runnerId,
-        pr_number: meta.pr_number,
-        repo: meta.repo,
-    });
-    const conflictDeps = {
-        supabase: deps.supabase,
-        ...deps.conflictResolutionDeps,
-    };
-    const outcome = await resolveConflict(meta, conflictDeps);
-    await appendEventFn("conflict_resolution_attempt", {
-        action: outcome.action,
-        reason: outcome.reason ?? null,
-        pr_number: meta.pr_number,
-        repo: meta.repo,
-        files_resolved: outcome.files_resolved ?? [],
-        files_skipped: outcome.files_skipped ?? [],
-        max_attempts: MAX_CONFLICT_ATTEMPTS,
-    });
-    if (outcome.action === "resolved") {
-        await postState_("done", "info", {
-            runner_id: deps.session.runnerId,
-            pr_number: meta.pr_number,
-            resolution: "resolved",
-        });
-        await deps.supabase.rpc("transition_task", {
-            p_task_id: taskId,
-            p_new_status: "done",
-        });
-        // Best-effort activity log
-        try {
-            await deps.supabase.rpc("log_activity", {
-                p_verb: "conflict.resolved",
-                p_target_id: String(meta.pr_number),
-                p_payload: {
-                    task_id: taskId,
-                    repo: meta.repo,
-                    files: outcome.files_resolved ?? [],
-                    reason: outcome.reason,
-                },
-                p_target_type: "pr",
-            });
-        }
-        catch { /* best-effort */ }
-        return { taskId, status: "ok", exitCode: 0 };
-    }
-    if (outcome.action === "policy_disabled") {
-        // detect-and-skip: transition to done, no escalation
-        await postState_("done", "info", {
-            runner_id: deps.session.runnerId,
-            skipped_reason: "conflict_policy.enabled=false",
-        });
-        await deps.supabase.rpc("transition_task", {
-            p_task_id: taskId,
-            p_new_status: "done",
-        });
-        return { taskId, status: "ok", exitCode: 0 };
-    }
-    if (outcome.action === "escalated") {
-        // max attempts reached — escalate to operator
-        const escalationMsg = outcome.reason ?? "conflict_unresolvable after max attempts";
-        await postState_("blocked", "error_context", {
-            task_id: taskId,
-            phase: "conflict_resolution",
-            error_class: "conflict_unresolvable",
-            pr_number: meta.pr_number,
-            repo: meta.repo,
-            stderr_tail: escalationMsg,
-        });
-        try {
-            await deps.supabase.rpc("log_activity", {
-                p_verb: "conflict.escalated",
-                p_target_id: String(meta.pr_number),
-                p_payload: {
-                    task_id: taskId,
-                    repo: meta.repo,
-                    reason: escalationMsg,
-                    prior_attempts: MAX_CONFLICT_ATTEMPTS,
-                },
-                p_target_type: "pr",
-            });
-        }
-        catch { /* best-effort */ }
-        // Transition to done (not failed) so Sweep C doesn't create another task.
-        // The escalation signal is on the message bus + activity log.
-        await deps.supabase.rpc("transition_task", {
-            p_task_id: taskId,
-            p_new_status: "done",
-        });
-        return { taskId, status: "ok", exitCode: 0 };
-    }
-    // outcome.action === "unresolvable" — transition to failed so Sweep C can retry.
-    const failMsg = outcome.reason ?? "conflict not automatically resolvable";
-    await postState_("blocked", "error_context", {
-        task_id: taskId,
-        phase: "conflict_resolution",
-        error_class: "conflict_unresolvable_single",
-        pr_number: meta.pr_number,
-        stderr_tail: failMsg,
-    });
-    await deps.supabase.rpc("transition_task", {
-        p_task_id: taskId,
-        p_new_status: "failed",
-    });
-    return {
-        taskId,
-        status: "failed",
-        phase: "claude_exit",
-        error: failMsg,
-    };
-}
-export function runTask(taskId, deps) {
-    const git = deps.git ?? defaultGit;
-    const gh = deps.gh ?? defaultGh;
-    const spawnClaude = deps.spawnClaude ?? defaultSpawnClaude;
-    const checkoutBase = deps.checkoutBase ?? defaultCheckoutBase;
-    const acquireLock = deps.acquireLock ?? defaultAcquireTaskLock;
-    const prepareWorktree = deps.prepareWorktree ?? defaultPrepareTaskWorktree;
-    const postCostEvent = deps.postCostEvent ?? ((event) => defaultPostCostEvent(deps.supabase, event));
-    const postState = deps.postRunnerStateMessage ??
-        ((args) => defaultPostRunnerStateMessage(deps.supabase, args));
-    const loadProfile = deps.loadProfile ?? defaultLoadProfile;
-    const loadPromptPreludeFn = deps.loadPromptPrelude ?? loadPromptPrelude;
-    const healthProbe = deps.healthProbe ?? defaultHealthProbe;
-    // Silence the unused-binding lint for `checkoutBase` — v0.11-F supersedes
-    // the v0.6.0 REG-301 pre-spawn `git checkout <baseBranch>` with the
-    // worktree's `add -B <branch> <path> <baseBranch>` start-point semantics,
-    // but the dep is still accepted for back-compat with test fixtures that
-    // inject a mock. Drop in v0.7.
-    void checkoutBase;
-    let child = null;
-    let cancelled = false;
-    // v0.14-MESSAGING-RUNTIME-WIRE: convenience wrapper that scopes every
-    // bus message to this task + this runner. Best-effort: an underlying
-    // RPC failure is logged inside defaultPostRunnerStateMessage and never
-    // bubbles out, so this wrapper does not need its own try/catch.
-    const postState_ = async (state, protocol, payload) => {
-        await postState({
-            task_id: taskId,
-            sender_id: deps.session.runnerId,
-            state,
-            protocol,
-            payload,
-        });
-    };
-    // v0.6.1 (v0.11-D): release lock rows on every terminal exit path
-    // below the claim. Best-effort — a release failure logs to stderr
-    // but does not change the outcome the runner reports to the caller.
-    // Calling release without first calling claim is a no-op at the
-    // RPC level, so wiring this into both pre-claim and post-claim
-    // returns would be safe; we only call it from post-claim returns
-    // to keep the code path obvious to a reader.
-    const releaseLocks = async () => {
-        const { error } = await deps.supabase.rpc("release_task_locks", {
-            p_task_id: taskId,
-        });
-        if (error) {
-            process.stderr.write(`[acc-runner] release_task_locks(${taskId}) failed: ${error.message}\n`);
-        }
-    };
-    // v0.12-RESUME — periodic signal loop. After the claim succeeds we
-    // bump acc.tasks.last_runner_signal_at every signalIntervalMs ms so
-    // the v0.12 /5m sweep distinguishes "runner alive, work in flight"
-    // from "runner crashed, task stuck at running". Self-rescheduling
-    // setTimeout (not setInterval) so a slow RPC doesn't queue up
-    // overlapping firings; the loop stops as soon as `signalStopped`
-    // flips in the outer try/finally below.
-    const DEFAULT_SIGNAL_MS = 30_000;
-    const signalIntervalMs = deps.signalIntervalMs ?? DEFAULT_SIGNAL_MS;
-    let signalTimer = null;
-    let signalStopped = false;
-    // v0.68 (T-68-1): bound the signal RPC. supabase-js fetch has no default
-    // timeout, so a single hung connection would freeze the self-rescheduling
-    // chain below — last_runner_signal_at stops advancing while the runner
-    // heartbeat keeps going, and the stale-running sweep reclaims a live task
-    // mid-run (the signal-stale zombie symptom). Racing a timeout guarantees
-    // the chain always advances to the next tick even when one call stalls.
-    const SIGNAL_RPC_TIMEOUT_MS = 10_000;
-    const updateSignal = async () => {
-        let timer;
-        try {
-            const timeout = new Promise((_, reject) => {
-                timer = setTimeout(() => reject(new Error(`update_task_signal timed out after ${SIGNAL_RPC_TIMEOUT_MS}ms`)), SIGNAL_RPC_TIMEOUT_MS);
-                if (timer.unref)
-                    timer.unref();
-            });
-            const result = (await Promise.race([
-                deps.supabase.rpc("update_task_signal", { p_task_id: taskId }),
-                timeout,
-            ]));
-            const error = result?.error ?? null;
-            if (error) {
-                // Best-effort: a missed signal just means the sweep might pull
-                // the task back if enough of them stack up. Log and continue.
-                process.stderr.write(`[acc-runner] update_task_signal(${taskId}) failed: ${error.message}\n`);
-            }
-        }
-        catch (err) {
-            process.stderr.write(`[acc-runner] update_task_signal(${taskId}) ${err.message}\n`);
-        }
-        finally {
-            if (timer)
-                clearTimeout(timer);
-        }
-    };
-    const scheduleSignal = () => {
-        if (signalStopped)
-            return;
-        signalTimer = setTimeout(async () => {
-            if (signalStopped)
-                return;
-            try {
-                await updateSignal();
-            }
-            catch { /* logged inside */ }
-            scheduleSignal();
-        }, signalIntervalMs);
-        // Detach so an in-flight signal timer doesn't keep the process
-        // alive past `watch.ts` shutdown. The outer finally clears it
-        // anyway; this is belt-and-suspenders for stray timers.
-        if (signalTimer.unref)
-            signalTimer.unref();
-    };
-    const stopSignalLoop = () => {
-        signalStopped = true;
-        if (signalTimer) {
-            clearTimeout(signalTimer);
-            signalTimer = null;
-        }
-    };
-    const promise = (async () => {
-        // 1. Atomic claim + transition to running. v0.11-D: replaces the
-        //    pre-v0.6.1 raw transition_task('running') call. The RPC
-        //    row-locks acc.tasks FOR UPDATE, checks file-path overlap
-        //    against other running tasks' locks, INSERTs a lock row +
-        //    transitions to running in one transaction. On overlap or
-        //    same-task race the task stays queued for another runner.
-        const claim = await deps.supabase.rpc("claim_task_with_locks", {
-            p_task_id: taskId,
-            p_runner_id: deps.session.runnerId,
-        });
-        if (claim.error) {
-            const msg = claim.error.message;
-            // Includes 22023 (invalid_task_transition surfaced through the
-            // nested acc.transition_task call) — task may already be past
-            // 'running' (e.g. needs-review). Log and bail rather than crash.
-            await appendEvent(deps.supabase, taskId, "error", {
-                phase: "claim_locks",
-                error: msg,
-            });
-            return { taskId, status: "failed", phase: "claim_locks", error: msg };
-        }
-        const claimResult = (claim.data ?? {});
-        if (claimResult.ok !== true) {
-            const conflicts = Array.isArray(claimResult.conflicts) ? claimResult.conflicts : [];
-            await appendEvent(deps.supabase, taskId, "log", {
-                phase: "claim_locks",
-                stream: "stderr",
-                conflicts,
-                message: `file-lock conflict — other tasks hold overlapping paths: ${conflicts.join(", ")}`,
-                runner_id: deps.session.runnerId,
-            });
-            const reason = `file-lock conflict with: ${conflicts.join(", ") || "(unknown)"}`;
-            return {
-                taskId,
-                status: "failed",
-                phase: "claim_locks",
-                error: reason,
-            };
-        }
-        // v0.6.1 (v0.11-D): every exit path below the successful claim
-        // must release the lock row so the same paths free up for the
-        // next runner. try/finally captures returns AND uncaught throws
-        // alike — strictly stronger than explicit pre-return release at
-        // each of the seven completion sites, and the runner CLI never
-        // recovers from a thrown error inside runTask, so the lock
-        // would otherwise leak until a future sweep job clears it.
-        try {
-            // v0.53 T-53-4: arm the per-task-execution GitHub soft budget. Any
-            // direct REST call routed through github-client.githubFetch during
-            // this task is counted against DEFAULT_TASK_GITHUB_BUDGET and fails
-            // clean (retryable infra, never quarantine) once spent. NOTE: the
-            // runner's current GitHub access is entirely via the `gh` CLI
-            // (gh.ts, conflict-resolver, rework, reviewer) — those separate
-            // processes are out of scope and remain UNBUDGETED here. Disarmed in
-            // the finally so out-of-task callers (doctor) run unbudgeted.
-            startTaskGithubBudget();
-            // v0.12-RESUME: prime the signal column immediately on claim so
-            // the sweep window resets from "now" and the first periodic tick
-            // (after signalIntervalMs) refreshes it. Without this prime, a
-            // task whose run takes < signalIntervalMs from claim to first
-            // tick could race the sweep on borderline updated_at values.
-            // Placed inside the outer try so an unexpected throw from the
-            // RPC still runs the finally (stop loop, release locks).
-            await updateSignal();
-            scheduleSignal();
-            // v0.14-MESSAGING-RUNTIME-WIRE: first bus event — runner has the
-            // claim, will now fetch + spawn. planner subscribes via /messages.
-            await postState_("planning", "info", { runner_id: deps.session.runnerId });
-            // 2. Fetch task + adjacent rows.
-            const fetched = await deps.supabase.rpc("fetch_task_for_runner", {
-                p_task_id: taskId,
-            });
-            if (fetched.error || !fetched.data) {
-                const msg = fetched.error?.message ?? "fetch_task_for_runner returned no data";
-                await appendEvent(deps.supabase, taskId, "error", { phase: "fetch", error: msg });
-                await postState_("blocked", "error_context", {
-                    task_id: taskId,
-                    phase: "plan",
-                    error_class: "fetch_task_failed",
-                    stderr_tail: msg,
-                });
-                await deps.supabase.rpc("transition_task", {
-                    p_task_id: taskId,
-                    p_new_status: "failed",
-                });
-                return { taskId, status: "failed", phase: "fetch", error: msg };
-            }
-            const result = fetched.data;
-            const { task } = result;
-            // v0.48 T-48-5: conflict_resolution tasks bypass Claude Code entirely.
-            // The runner resolves conflicts on the real base∩head file set via the
-            // GitHub API, pushes the resolution, and transitions the task to done
-            // (or escalates after MAX_CONFLICT_ATTEMPTS failed attempts).
-            if (task.type === "conflict_resolution") {
-                return await runConflictResolutionPath(taskId, task, deps, postState_, appendEvent.bind(null, deps.supabase, taskId));
-            }
-            // v0.51 T-51-1: rework tasks run the normal Claude session, but against
-            // the PR's EXISTING head branch — the worktree forks from
-            // origin/<branch> instead of the integration branch, the prompt carries
-            // the reviewer's verdict + comments, and the push goes back to the same
-            // branch (same PR; no new PR is opened).
-            let reworkMeta = null;
-            if (task.type === "rework") {
-                reworkMeta = parseReworkMeta(task.description, {
-                    pr_number: task.pr_number,
-                    repo: task.repo,
-                    branch: task.branch,
-                });
-                if (!reworkMeta) {
-                    const msg = "rework task missing PR metadata (acc-rework sentinel or pr_number + repo on task row)";
-                    await appendEvent(deps.supabase, taskId, "error", { phase: "rework", error: msg });
-                    await postState_("blocked", "error_context", {
-                        task_id: taskId,
-                        phase: "plan",
-                        error_class: "rework_meta_missing",
-                        stderr_tail: msg,
-                    });
-                    await deps.supabase.rpc("transition_task", {
-                        p_task_id: taskId,
-                        p_new_status: "failed",
-                    });
-                    return { taskId, status: "failed", phase: "fetch", error: msg };
-                }
-                if (!reworkMeta.branch) {
-                    try {
-                        reworkMeta.branch = await (deps.fetchPrHeadRef ?? defaultFetchPrHeadRef)(reworkMeta.repo, reworkMeta.pr_number);
-                    }
-                    catch { /* handled by the empty-branch check below */ }
-                    if (!reworkMeta.branch) {
-                        const msg = `rework task could not resolve head branch for PR #${reworkMeta.pr_number}`;
-                        await appendEvent(deps.supabase, taskId, "error", { phase: "rework", error: msg });
-                        await deps.supabase.rpc("transition_task", {
-                            p_task_id: taskId,
-                            p_new_status: "failed",
-                        });
-                        return { taskId, status: "failed", phase: "fetch", error: msg };
-                    }
-                }
-            }
-            const branch = reworkMeta
-                ? reworkMeta.branch
-                : branchForTask(task.id, task.title, task.branch);
-            // REG-295: per-task repo overrides — task row trumps config so one
-            // runner can service tasks across multiple repos. Env-backed config
-            // remains the fallback for tasks that don't carry a hint yet.
-            const repoPath = task.repo_path_hint?.trim()
-                ? expandHomePath(task.repo_path_hint.trim())
-                : deps.cfg.repoPath;
-            const targetRepo = task.repo?.trim() || deps.cfg.targetRepo;
-            // REG-301: branch base comes from task → cfg → main. cfg.integrationBranch
-            // already defaults to "acc/integration" so the third fallback only
-            // matters when an operator zeroed it out via env.
-            const integrationBranch = task.integration_branch?.trim() || deps.cfg.integrationBranch || "main";
-            // v0.51 T-51-1: rework prompts replace the "open a PR" protocol header
-            // with "update the existing PR's branch" + the reviewer's verdict.
-            const renderedPrompt = reworkMeta
-                ? renderReworkPrompt({ task, meta: reworkMeta, branch })
-                : renderTaskPrompt({
-                    task,
-                    agent: result.agent,
-                    model: result.model,
-                    integrationBranch,
-                    targetRepo,
-                });
-            // v0.14-MESSAGING-RUNTIME-WIRE: profile-driven prompt prelude.
-            // When loadProfile() returns null OR the profile has no prelude
-            // OR the prelude module's default export is the empty string,
-            // `prompt` is byte-identical to the v0.13 `renderedPrompt`.
-            const activeProfile = loadProfile();
-            let prelude = "";
-            if (activeProfile && activeProfile.promptPrelude) {
-                try {
-                    prelude = await loadPromptPreludeFn(activeProfile);
-                }
-                catch (err) {
-                    // A broken prelude module should not block the task — log and
-                    // fall through to v0.13 behavior. The operator surfaces this
-                    // via the per-task History stream so the misconfiguration is
-                    // discoverable without crashing the run.
-                    await appendEvent(deps.supabase, taskId, "error", {
-                        phase: "prelude",
-                        error: err.message,
-                        profile: activeProfile.name,
-                        prelude_path: activeProfile.promptPrelude,
-                    });
-                }
-            }
-            const prompt = prelude ? `${prelude}\n\n${renderedPrompt}` : renderedPrompt;
-            // v0.11-F: acquire the per-task PID lock before any worktree
-            // side-effect. Same-machine parallel runners that picked up the same
-            // task_id (e.g. two `acc-runner watch` processes seeing the same
-            // broadcast) race here; the second one bails on TaskLockHeldError.
-            let lock;
-            try {
-                lock = await acquireLock(taskId);
-            }
-            catch (err) {
-                if (err instanceof TaskLockHeldError) {
-                    await appendEvent(deps.supabase, taskId, "error", {
-                        phase: "worktree_lock",
-                        error: err.message,
-                        held_by_pid: err.heldByPid,
-                    });
-                    await deps.supabase.rpc("transition_task", {
-                        p_task_id: taskId,
-                        p_new_status: "failed",
-                    });
-                    return { taskId, status: "failed", phase: "worktree_lock", error: err.message };
-                }
-                throw err;
-            }
-            // Worktree gets assigned inside the git-prep block; cleanup in the
-            // outer finally handles both the success path and every early
-            // return that follows.
-            let worktree = null;
-            let workdir = repoPath;
-            // v0.19 T-64-1: the ref the task branch is actually forked from, set
-            // once the base is resolved below. Used as the `base..branch` range for
-            // the first-commit SLO so the signal stays accurate now that FRESH
-            // branches fork from origin/<integration> rather than the local ref.
-            let resolvedBaseRef = integrationBranch;
-            // v0.57 T-57-2: conflict-resolution integrity guardrail. For tasks whose
-            // job is to resolve a merge conflict (the Claude/worktree path that the
-            // mechanical resolver hands off to when it bails), re-verify the
-            // resolution from the runner's own vantage point before pushing —
-            // zero conflict markers, typecheck green, and no silently-dropped /
-            // regressed version bump. On failure the resolution is REJECTED (no
-            // push, not marked resolved) and the task fails with a diagnostic that
-            // names the offending assertion, so a broken merge is reworked rather
-            // than shipped. A no-op for every non-conflict task.
-            const runResolutionIntegrityGate = async () => {
-                if (!isConflictResolutionTask(task))
-                    return null;
-                const assertIntegrity = deps.assertResolutionIntegrity ?? assertResolutionIntegrity;
-                let result;
-                try {
-                    result = await assertIntegrity(workdir, {
-                        baseRef: integrationBranch,
-                        typecheckCmd: task.typecheck_cmd ?? undefined,
-                        // The #496 regression lived in the acc-runner package; also guard
-                        // the repo root. Each pair is skipped silently when its version is
-                        // unchanged or unreadable, so this never false-fails.
-                        versionTargets: [
-                            { packageJsonPath: "package.json", changelogPath: "CHANGELOG.md" },
-                            {
-                                packageJsonPath: "packages/acc-runner/package.json",
-                                changelogPath: "packages/acc-runner/CHANGELOG.md",
-                            },
-                        ],
-                    });
-                }
-                catch (err) {
-                    // A guardrail that itself crashed must fail closed: reject, never
-                    // wave a resolution through because the check errored.
-                    result = {
-                        ok: false,
-                        checked: [],
-                        failures: [
-                            {
-                                assertion: "typecheck",
-                                detail: `integrity check crashed: ${err.message?.slice(0, 200)}`,
-                            },
-                        ],
-                    };
-                }
-                if (result.ok) {
-                    await appendEvent(deps.supabase, taskId, "resolution_integrity_passed", {
-                        pr_number: task.pr_number ?? null,
-                        checked: result.checked,
-                    });
-                    return null;
-                }
-                const summary = summariseFailures(result.failures);
-                const detail = result.failures
-                    .map((f) => `${f.assertion}: ${f.detail}`)
-                    .join("\n");
-                await appendEvent(deps.supabase, taskId, "resolution_integrity_failed", {
-                    pr_number: task.pr_number ?? null,
-                    failed_assertions: result.failures.map((f) => f.assertion),
-                    files: result.failures.flatMap((f) => f.files ?? []),
-                    detail: detail.slice(-4000),
-                });
-                // Best-effort operator-facing activity event naming the failed assertion.
-                try {
-                    await deps.supabase.rpc("log_activity", {
-                        p_verb: "conflict.integrity_rejected",
-                        p_target_id: String(task.pr_number ?? taskId),
-                        p_payload: {
-                            task_id: taskId,
-                            repo: task.repo ?? null,
-                            failed_assertions: result.failures.map((f) => f.assertion),
-                        },
-                        p_target_type: task.pr_number ? "pr" : "task",
-                    });
-                }
-                catch {
-                    /* best-effort */
-                }
-                await postState_("blocked", "error_context", {
-                    task_id: taskId,
-                    phase: "review",
-                    error_class: "resolution_integrity_failed",
-                    stderr_tail: detail.slice(-4000),
-                });
-                // Reject: do NOT push, do NOT mark resolved. Fail the task so the
-                // resolution is reworked instead of merged broken.
-                await deps.supabase.rpc("transition_task", {
-                    p_task_id: taskId,
-                    p_new_status: "failed",
-                });
-                return {
-                    taskId,
-                    status: "failed",
-                    phase: "push",
-                    error: `conflict-resolution integrity guardrail rejected resolution (${summary})`,
-                };
-            };
-            try {
-                // 3. Repo prep. v0.11-F: fetch on the shared clone (worktree
-                // shares the object store) then provision an isolated worktree
-                // at ~/.cache/acc-runner/work/<task_id>/ forked from the
-                // integration branch. The redundant `git.checkout -B <branch>`
-                // is a no-op inside the new worktree — kept so the v0.6.0
-                // checkout seam stays observable in unit tests.
-                try {
-                    // v0.19 T-64-1: cut a FRESH task branch from the LATEST
-                    // integration tip, not a stale LOCAL ref. `git.fetch` runs
-                    // `fetch --prune --all`, which refreshes origin/<integrationBranch>;
-                    // the worktree below then forks from that remote-tracking ref
-                    // (mirroring the v0.51 rework path, which forks from
-                    // origin/<branch>). T-63-1's PR conflicted in package.json /
-                    // CHANGELOG / task-runner.ts precisely because a 13-commit-stale
-                    // LOCAL integration ref (base 5f627e7) was used as the branch base.
-                    //
-                    // ROBUST FETCH (acceptance): a fetch failure (offline / network)
-                    // must NOT abort the task. We fall back to the stale local ref,
-                    // log a warning + a `runner.stale_base_fallback` activity event so
-                    // the staleness is auditable, and continue. The fix never
-                    // force-pushes and is idempotent.
-                    // v0.21 T-66-1: serialize the git plumbing below (fetch + stale-lock
-                    // clear + worktree add/remove) against the shared clone. Two tasks
-                    // running concurrently would otherwise collide on git's repo-global
-                    // locks and the loser would die in this pre-Claude phase (T-65-2).
-                    // Only this critical section is held; the Claude run + push that
-                    // follow stay concurrent up to concurrencyLimit. Serializing here
-                    // also makes clearGitLocks safe — it can no longer delete a lock a
-                    // concurrent provision is actively holding.
-                    const provisionCloneKey = deps.cfg.worktreeRepoPath ?? repoPath;
-                    worktree = await withProvisionLock(provisionCloneKey, async () => {
-                        let staleBaseFallback = false;
-                        try {
-                            await git.fetch(repoPath);
-                        }
-                        catch (fetchErr) {
-                            staleBaseFallback = true;
-                            const detail = fetchErr.message;
-                            process.stderr.write(`[acc-runner] base fetch failed for ${taskId}; cutting ${branch} ` +
-                                `from stale local ${integrationBranch}: ${detail}\n`);
-                            await appendEvent(deps.supabase, taskId, "log", {
-                                phase: "git",
-                                stream: "stderr",
-                                event: "runner.stale_base_fallback",
-                                base: integrationBranch,
-                                branch,
-                                detail,
-                                runner_id: deps.session.runnerId,
-                            });
-                            // Best-effort audit trail on the runner timeline.
-                            try {
-                                await deps.supabase.rpc("log_activity", {
-                                    p_verb: "runner.stale_base_fallback",
-                                    p_target_id: deps.session.runnerId,
-                                    p_target_type: "runner",
-                                    p_payload: {
-                                        task_id: taskId,
-                                        base: integrationBranch,
-                                        branch,
-                                        detail,
-                                    },
-                                });
-                            }
-                            catch { /* best-effort */ }
-                        }
-                        // v0.37-A: clear any stale .git/HEAD.lock or index.lock left over
-                        // from a prior crashed run before `git worktree add` touches refs.
-                        // v0.21 T-66-1: safe under concurrency now — held inside the
-                        // provision lock, so it cannot stomp a peer's active lock.
-                        clearGitLocks(repoPath);
-                        // v0.51 T-51-1: rework tasks fork from the PR's remote head so
-                        // Claude sees the branch's current contents. v0.19 T-64-1: FRESH
-                        // tasks fork from the freshly-fetched origin tip
-                        // (origin/<integrationBranch>), or — only when the fetch failed —
-                        // the stale local ref. The crash-resume path inside
-                        // prepareTaskWorktree returns the existing partial branch untouched
-                        // regardless of this base (it never resets a resumed branch:
-                        // REG-301 / v0.12-RESUME), so a stale base here can never clobber
-                        // partially-committed work.
-                        const worktreeBaseBranch = reworkMeta
-                            ? `origin/${branch}`
-                            : staleBaseFallback
-                                ? integrationBranch
-                                : `origin/${integrationBranch}`;
-                        // Rework keeps its prior first-commit base (integration) so the SLO
-                        // measures the whole PR effort; FRESH tasks use their true fork point.
-                        resolvedBaseRef = reworkMeta ? integrationBranch : worktreeBaseBranch;
-                        return await prepareWorktree({
-                            repoPath,
-                            // v0.41-B: when an operator has configured a separate mirror
-                            // clone for worktree ops, prepareTaskWorktree runs add/remove/
-                            // prune against it; `git fetch` above still targets repoPath.
-                            // Undefined preserves v0.40 behaviour byte-for-byte.
-                            worktreeRepoPath: deps.cfg.worktreeRepoPath,
-                            taskId,
-                            branch,
-                            baseBranch: worktreeBaseBranch,
-                        });
-                    });
-                    workdir = worktree.path;
-                    // v0.12-RESUME: log resume-vs-fresh so an operator can audit
-                    // how often the resume path actually fires. `resumed: true`
-                    // means a prior runner crashed mid-task, the v0.12 sweep
-                    // returned the task to queued, and this runner picked it
-                    // back up with the prior worktree intact. Claude reads the
-                    // partially-committed state and continues; the spawn is the
-                    // same prompt either way (Claude is idempotent enough that
-                    // re-running on a partially-edited worktree converges on
-                    // the right final state).
-                    if (worktree.resumed) {
-                        await appendEvent(deps.supabase, taskId, "log", {
-                            phase: "git",
-                            stream: "stdout",
-                            event: "worktree.resumed",
-                            worktree_path: workdir,
-                            branch,
-                            runner_id: deps.session.runnerId,
-                        });
-                    }
-                    await git.checkout(workdir, branch);
-                }
-                catch (err) {
-                    const msg = err.message;
-                    // v0.21 T-66-1: a git REPO-GLOBAL LOCK collision during provisioning
-                    // (an external git process touched the clone while we held the
-                    // provision mutex) is TRANSIENT — requeue the task so it re-provisions
-                    // cleanly once the lock frees, instead of burning a terminal `failed`.
-                    // The in-process mutex already removes the runner-vs-runner case; this
-                    // covers the residual external-contention case.
-                    if (isGitProvisionContention(msg)) {
-                        await appendEvent(deps.supabase, taskId, "log", {
-                            phase: "git",
-                            stream: "stderr",
-                            event: "runner.git_provision_contention",
-                            error_class: "git_provision_contention",
-                            error: msg,
-                            branch,
-                            runner_id: deps.session.runnerId,
-                        });
-                        // running → queued: re-dispatch for a clean retry (matches the
-                        // stale-running sweep's lossless requeue; not a retry-budget burn).
-                        await deps.supabase.rpc("transition_task", {
-                            p_task_id: taskId,
-                            p_new_status: "queued",
-                        });
-                        return {
-                            taskId,
-                            status: "requeued",
-                            phase: "git",
-                            error: `git_provision_contention: ${msg}`,
-                        };
-                    }
-                    await appendEvent(deps.supabase, taskId, "error", {
-                        phase: "git",
-                        error: msg,
-                        base: integrationBranch,
-                        branch,
-                        repo_path: repoPath,
-                        worktree_path: worktree?.path ?? null,
-                    });
-                    await postState_("blocked", "error_context", {
-                        task_id: taskId,
-                        phase: "plan",
-                        error_class: "git_prep_failed",
-                        stderr_tail: msg,
-                    });
-                    await deps.supabase.rpc("transition_task", {
-                        p_task_id: taskId,
-                        p_new_status: "failed",
-                    });
-                    return { taskId, status: "failed", phase: "git", error: msg };
-                }
-                // 4. Spawn Claude.
-                if (cancelled) {
-                    return { taskId, status: "cancelled" };
-                }
-                // v0.32-A: idempotency guard. If the runner was killed mid-task and
-                // the sweep returned this task to 'queued', a prior run may have
-                // already pushed the branch and opened a PR. Re-running Claude Code
-                // would fail at `git push` (non-fast-forward). Check for an existing
-                // open PR before spawning and skip the coding step if one is found.
-                // v0.51 T-51-1: skipped for rework tasks — their PR exists by design;
-                // the whole point is to spawn Claude against it.
-                if (!reworkMeta) {
-                    const existingPrUrl = await gh.findOpenPR(workdir, branch);
-                    if (existingPrUrl) {
-                        await appendEvent(deps.supabase, taskId, "log", {
-                            phase: "coding",
-                            stream: "stdout",
-                            event: "retry.pr_exists",
-                            branch,
-                            pr_url: existingPrUrl,
-                            message: "open PR already exists for branch — skipping Claude Code spawn",
-                        });
-                        // v0.35-B: stamp pr_number + transition running→needs-review on
-                        // the recovered task. On any failure the webhook-driven flow
-                        // still moves running→done at merge time (matrix 0156).
-                        await setTaskPr(deps.supabase, taskId, existingPrUrl);
-                        await postState_("done", "info", {
-                            runner_id: deps.session.runnerId,
-                            pr_url: existingPrUrl,
-                            skipped_reason: "pr_already_open",
-                        });
-                        return { taskId, status: "ok", prUrl: existingPrUrl, exitCode: 0 };
-                    }
-                }
-                // v0.14-MESSAGING-RUNTIME-WIRE: worktree is ready, Claude is
-                // about to start the actual work. coding marks the transition
-                // into the long-running subprocess phase.
-                await postState_("coding", "info", {
-                    runner_id: deps.session.runnerId,
-                    branch,
-                    model: result.model?.id ?? null,
-                });
-                // 4a. Provision .mcp.json so Claude Code auto-discovers acc-mcp-server.
-                // Best-effort: a failed write must not block the task. The MCP server
-                // is a context source, not a critical dependency for v0.5-C1.
-                let mcpCleanup = null;
-                if (deps.session) {
-                    const writer = deps.writeMcpConfig ?? defaultWriteMcpConfig;
-                    try {
-                        mcpCleanup = await writer({
-                            cwd: workdir,
-                            taskId,
-                            runnerId: deps.session.runnerId,
-                            accessToken: deps.session.accessToken,
-                            publicUrl: deps.publicUrl ?? deps.cfg.publicUrl,
-                            supabaseUrl: deps.cfg.supabaseUrl,
-                            supabaseAnonKey: deps.cfg.supabaseAnonKey,
-                        });
-                    }
-                    catch (err) {
-                        // Don't echo the token even on failure.
-                        process.stderr.write(`[acc-runner] mcp .mcp.json write failed: ${err.message}\n`);
-                    }
-                }
-                // v0.12-MODEL-ALIAS (REG-303/304): translate the ACC model alias
-                // (`claude-sonnet-4`) into the wire form `claude --model` actually
-                // accepts (`sonnet` or `claude-sonnet-4-6`). Unknown ids pass
-                // through verbatim so a future model not yet in the embedded
-                // table still spawns.
-                //
-                // v0.53 T-53-4: one claude attempt — spawn, stream both pipes to the
-                // History tab, post a cost event (one row per attempt), and time the
-                // run so the classifier's fast-exit env_broken heuristic can fire.
-                const runClaudeOnce = async () => {
-                    const spawnedAt = Date.now();
-                    child = spawnClaude(workdir, toCliAlias(result.model?.id));
-                    if (child.stdin) {
-                        child.stdin.write(prompt);
-                        child.stdin.end();
-                    }
-                    const stdoutPromise = child.stdout
-                        ? streamToEvents(child.stdout, deps.supabase, taskId, "stdout")
-                        : Promise.resolve("");
-                    const stderrPromise = child.stderr
-                        ? streamToEvents(child.stderr, deps.supabase, taskId, "stderr")
-                        : Promise.resolve("");
-                    const [outcome, capturedStdout, capturedStderr] = await Promise.all([
-                        child,
-                        stdoutPromise,
-                        stderrPromise,
-                    ]);
-                    // One cost_events row per attempt so cap tracking captures success,
-                    // cancellation, retry, and non-zero exit alike. Best-effort: a
-                    // failed POST logs to stderr but never bubbles past the runner.
-                    {
-                        const event = buildCostEvent(taskId, capturedStdout, result.model?.id, result.runner?.id);
-                        try {
-                            await postCostEvent(event);
-                        }
-                        catch (err) {
-                            process.stderr.write(`[acc-runner] cost-event post failed: ${err.message}\n`);
-                        }
-                    }
-                    return {
-                        exitCode: outcome.exitCode,
-                        stdout: capturedStdout,
-                        stderr: capturedStderr,
-                        durationMs: Date.now() - spawnedAt,
-                    };
-                };
-                // v0.53 T-53-4 / v0.63 T-63-1: instant-empty tune. A lone instant-empty
-                // exit (the pd36 fast-exit fingerprint, now classified
-                // `claude_unavailable`) is too weak a signal to act on — v0.52 incident
-                // (d) quarantined a working machine on ONE 249ms empty exit. So when the
-                // FIRST exit is a *heuristic* claude_unavailable we log it and retry the
-                // spawn once; a single blip that the retry recovers stays silent. Only a
-                // CONFIRMED streak (two consecutive instant-empties) is acted on — and
-                // even then v0.63 routes it to pause + backoff + retry (NOT quarantine),
-                // gated by the health probe below. Definitive failures (dyld/OOM/exit
-                // 127, usage/auth patterns — classified.heuristic falsey) skip the retry
-                // and quarantine immediately, unchanged from v0.48.
-                let attempt = await runClaudeOnce();
-                const classifyIfFailed = (a) => a.exitCode === 0
-                    ? null
-                    : classifyClaudeExit(a.exitCode, a.stderr, a.stdout, a.durationMs);
-                let classified = classifyIfFailed(attempt);
-                let instantEmptyStreak = classified?.class === "claude_unavailable" && classified.heuristic ? 1 : 0;
-                if (instantEmptyStreak === 1 && !cancelled) {
-                    await appendEvent(deps.supabase, taskId, "log", {
-                        phase: "claude_exit",
-                        stream: "stderr",
-                        event: "claude_unavailable_blip",
-                        attempt: 1,
-                        duration_ms: attempt.durationMs,
-                        message: "instant empty claude exit — single blip, retrying task once before pausing",
-                    });
-                    attempt = await runClaudeOnce();
-                    classified = classifyIfFailed(attempt);
-                    if (classified?.class === "claude_unavailable" && classified.heuristic) {
-                        instantEmptyStreak = 2;
-                    }
-                }
-                // Restore .mcp.json as soon as Claude is done — its MCP subprocess
-                // tree comes down with it, so leaving our token-bearing config on
-                // disk a moment longer is pure exposure surface.
-                if (mcpCleanup) {
-                    try {
-                        await mcpCleanup.restore();
-                    }
-                    catch (err) {
-                        process.stderr.write(`[acc-runner] mcp .mcp.json restore failed: ${err.message}\n`);
-                    }
-                }
-                if (cancelled) {
-                    await appendEvent(deps.supabase, taskId, "cancelled", {
-                        exit_code: attempt.exitCode,
-                    });
-                    return { taskId, status: "cancelled", exitCode: attempt.exitCode };
-                }
-                if (attempt.exitCode !== 0) {
-                    // v0.48: classify the failure so the quarantine cause is consistent
-                    // across the event, the bus message, and the RunTaskOutcome. `let`
-                    // because v0.63's health probe can upgrade a claude_unavailable exit
-                    // to env_broken when the probe proves the host is genuinely broken.
-                    let cls = classified ??
-                        classifyClaudeExit(attempt.exitCode, attempt.stderr, attempt.stdout, attempt.durationMs);
-                    // v0.56 (T-56-1): capacity exhaustion is NOT a task failure. Do not
-                    // transition the task to 'failed' (that would dead-letter it and burn
-                    // the reviewer/automerge retry cap). Leave it 'running' with its
-                    // signal loop stopped (the outer finally does this) so the
-                    // stale-running sweep returns it to 'queued' with runner_id cleared —
-                    // a lossless requeue for any runner that still has capacity. Surface
-                    // the parsed reset time so watch.ts can pause until the window
-                    // reopens. The locks are released by the outer finally exactly as on
-                    // any other exit path.
-                    if (cls.class === "capacity_exhausted") {
-                        const resumeMs = extractResetTime(`${attempt.stderr}\n${attempt.stdout}`);
-                        const resumeAt = resumeMs !== null ? new Date(resumeMs).toISOString() : null;
-                        await appendEvent(deps.supabase, taskId, "capacity_paused", {
-                            phase: "claude_exit",
-                            exit_code: attempt.exitCode,
-                            exit_class: cls.class,
-                            resume_at: resumeAt,
-                            detail: cls.detail,
-                            runner_id: deps.session.runnerId,
-                        });
-                        return {
-                            taskId,
-                            status: "capacity_paused",
-                            phase: "claude_exit",
-                            exitCode: attempt.exitCode,
-                            error: cls.detail,
-                            capacity_exhausted: true,
-                            resume_at: resumeAt,
-                        };
-                    }
-                    // v0.63 (T-63-1): a bare silent instant-empty exit. Silence alone
-                    // cannot tell "broken host" from "claude momentarily unavailable", so
-                    // run an authoritative `claude --version` health probe as the
-                    // tiebreaker. Probe OK → the host is fine → treat exactly like
-                    // capacity_exhausted (pause + EXPONENTIAL backoff + retry; leave the
-                    // task 'running' for the stale-running sweep; NEVER quarantine, NEVER
-                    // burn the task/review retry caps). Probe FAILS → the binary/host is
-                    // genuinely broken → upgrade to env_broken and fall through to the
-                    // quarantine path (the pd36 contract, now gated by a real signal
-                    // rather than silence). A human INFRA alert fires only after a
-                    // SUSTAINED streak inside a rolling window, never on 2.
-                    if (cls.class === "claude_unavailable") {
-                        const probe = await healthProbe();
-                        await appendEvent(deps.supabase, taskId, "log", {
-                            phase: "claude_exit",
-                            stream: "stderr",
-                            event: "claude_health_probe",
-                            ok: probe.ok,
-                            detail: probe.detail,
-                            consecutive_instant_empty: instantEmptyStreak,
-                        });
-                        if (probe.ok) {
-                            const decision = recordClaudeUnavailable(Date.now());
-                            await appendEvent(deps.supabase, taskId, "claude_unavailable", {
-                                phase: "claude_exit",
-                                exit_code: attempt.exitCode,
-                                exit_class: cls.class,
-                                consecutive_instant_empty: instantEmptyStreak,
-                                duration_ms: attempt.durationMs,
-                                resume_at: decision.resumeAt,
-                                streak: decision.streak,
-                                window_count: decision.windowCount,
-                                detail: cls.detail,
-                                runner_id: deps.session.runnerId,
-                            });
-                            // Best-effort audit trail on the runner timeline.
-                            try {
-                                await deps.supabase.rpc("log_activity", {
-                                    p_verb: "runner.claude_unavailable",
-                                    p_target_id: deps.session.runnerId,
-                                    p_target_type: "runner",
-                                    p_payload: {
-                                        task_id: taskId,
-                                        streak: decision.streak,
-                                        window_count: decision.windowCount,
-                                        backoff_ms: decision.backoffMs,
-                                        resume_at: decision.resumeAt,
-                                        detail: cls.detail,
-                                    },
-                                });
-                            }
-                            catch { /* best-effort */ }
-                            // Escalate to a human only on a SUSTAINED streak — not a single
-                            // pause, not 2. Still NOT a quarantine: the runner stays online,
-                            // paused + retrying, while an operator investigates infra.
-                            if (decision.alert) {
-                                try {
-                                    await deps.supabase.rpc("log_activity", {
-                                        p_verb: "runner.claude_unavailable_infra",
-                                        p_target_id: deps.session.runnerId,
-                                        p_target_type: "runner",
-                                        p_payload: {
-                                            task_id: taskId,
-                                            window_count: decision.windowCount,
-                                            streak: decision.streak,
-                                            detail: cls.detail,
-                                        },
-                                    });
-                                }
-                                catch { /* best-effort */ }
-                                await postState_("blocked", "error_context", {
-                                    task_id: taskId,
-                                    phase: "code",
-                                    error_class: "claude_unavailable_sustained",
-                                    infra_alert: true,
-                                    window_count: decision.windowCount,
-                                    stderr_tail: cls.detail,
-                                });
-                            }
-                            return {
-                                taskId,
-                                status: "capacity_paused",
-                                phase: "claude_exit",
-                                exitCode: attempt.exitCode,
-                                error: `claude silently unavailable (instant-empty exit) — pausing ` +
-                                    `${Math.round(decision.backoffMs / 1000)}s then retrying, not quarantining`,
-                                claude_unavailable: true,
-                                resume_at: decision.resumeAt,
-                            };
-                        }
-                        // Probe failed — the host/binary really is broken. This IS an
-                        // env_broken; fall through to the quarantine path below.
-                        cls = {
-                            exitCode: attempt.exitCode,
-                            class: "env_broken",
-                            detail: `${cls.detail}; claude health probe failed: ${probe.detail}`,
-                        };
-                    }
-                    // v0.48 / v0.63: by this point claude_unavailable has either returned
-                    // (probe OK) or been rewritten to env_broken (probe failed), so any
-                    // non-task_error class is a genuine quarantine cause. consecutive
-                    // mirrors the instant-empty streak for an env_broken upgraded from the
-                    // heuristic (≥1), so quarantine.json still records 1 (definitive) vs 2
-                    // (heuristic-confirmed).
-                    const quarantineCause = cls.class !== "task_error" ? cls.class : undefined;
-                    const quarantineConsecutive = quarantineCause === "env_broken" ? Math.max(instantEmptyStreak, 1) : undefined;
-                    await appendEvent(deps.supabase, taskId, "error", {
-                        phase: "claude_exit",
-                        exit_code: attempt.exitCode,
-                        exit_class: cls.class,
-                        exit_class_heuristic: cls.heuristic === true,
-                        consecutive_instant_empty: instantEmptyStreak,
-                        quarantine: quarantineCause !== undefined,
-                        stderr_tail: attempt.stderr.slice(-2000),
-                    });
-                    await postState_("blocked", "error_context", {
-                        task_id: taskId,
-                        phase: "code",
-                        error_class: `claude_exit_${attempt.exitCode ?? "unknown"}`,
-                        // v0.48: include the classified failure class so the planner can
-                        // distinguish machine-level failures from task-level failures.
-                        exit_class: cls.class,
-                        // Recommended cap from MESSAGING_PROTOCOLS.md: last ~4 KB.
-                        stderr_tail: attempt.stderr.slice(-4000),
-                    });
-                    await deps.supabase.rpc("transition_task", {
-                        p_task_id: taskId,
-                        p_new_status: "failed",
-                    });
-                    return {
-                        taskId,
-                        status: "failed",
-                        phase: "claude_exit",
-                        exitCode: attempt.exitCode,
-                        error: attempt.stderr.slice(-200).trim() || cls.detail,
-                        quarantine_cause: quarantineCause,
-                        quarantine_consecutive: quarantineConsecutive,
-                    };
-                }
-                // Success: expose the final attempt's stdout under the name the
-                // downstream report/PR path expects.
-                const capturedStdout = attempt.stdout;
-                // v0.63 (T-63-1): a clean claude run proves the binary recovered — reset
-                // the silent-unavailability streak so the next blip restarts the backoff
-                // ladder from the base and the rolling INFRA-alert window starts fresh.
-                clearClaudeUnavailableStreak();
-                // v0.14-MESSAGING-RUNTIME-WIRE: Claude finished successfully.
-                // testing covers the post-exit window where the runner inspects
-                // the captured stdout (parses the report, builds the cost event)
-                // before publishing. reviewing is emitted just before opening
-                // the PR so a subscriber can pre-stage the review surface.
-                await postState_("testing", "info", {
-                    runner_id: deps.session.runnerId,
-                    exit_code: attempt.exitCode ?? 0,
-                });
-                // v0.51 T-51-1: rework completion path. Push the fixes to the SAME
-                // branch (same PR) — never open a new PR — then re-enqueue a review
-                // and flip the origin task back to needs-review so the existing
-                // automerge flow re-evaluates. No v0.32-A "PR exists" fallback on
-                // push failure here: a rework push that didn't land means the
-                // reviewer feedback was NOT addressed, so the task must fail.
-                if (reworkMeta) {
-                    // v0.57 T-57-2: gate conflict-resolution reworks before the push.
-                    const reworkIntegrity = await runResolutionIntegrityGate();
-                    if (reworkIntegrity)
-                        return reworkIntegrity;
-                    try {
-                        await git.push(workdir, branch);
-                    }
-                    catch (err) {
-                        const msg = err.message;
-                        await appendEvent(deps.supabase, taskId, "error", {
-                            phase: "push",
-                            error: msg,
-                            rework: true,
-                            pr_number: reworkMeta.pr_number,
-                        });
-                        await postState_("blocked", "error_context", {
-                            task_id: taskId,
-                            phase: "review",
-                            error_class: "rework_push_failed",
-                            stderr_tail: msg,
-                        });
-                        await deps.supabase.rpc("transition_task", {
-                            p_task_id: taskId,
-                            p_new_status: "failed",
-                        });
-                        return { taskId, status: "failed", phase: "push", error: msg };
-                    }
-                    // Order matters: request the fresh review BEFORE flipping the
-                    // origin task back to needs-review. The automerge cron acts on the
-                    // LATEST review_queue row — if the task re-entered candidacy while
-                    // the stale completed reject was still latest, the cron would
-                    // re-finalize that reject and burn a rework cycle without any
-                    // re-review. With the pending row in place first, the cron sees
-                    // review_pending and waits for the real verdict.
-                    if (reworkMeta.origin_task_id) {
-                        const requested = await deps.supabase.rpc("request_review", {
-                            p_task_id: reworkMeta.origin_task_id,
-                            p_pr_number: reworkMeta.pr_number,
-                        });
-                        if (requested.error) {
-                            process.stderr.write(`[acc-runner] rework request_review(${reworkMeta.origin_task_id}) failed: ` +
-                                `${requested.error.message}\n`);
-                        }
-                        const flipped = await deps.supabase.rpc("transition_task", {
-                            p_task_id: reworkMeta.origin_task_id,
-                            p_new_status: "needs-review",
-                        });
-                        if (flipped.error) {
-                            // Best-effort: requires migration 0172's widened matrix
-                            // (changes-requested → needs-review). On failure the pending
-                            // review row still completes via the runner reviewer; the
-                            // operator sees the origin task parked at changes-requested.
-                            process.stderr.write(`[acc-runner] rework transition(${reworkMeta.origin_task_id}→needs-review) failed: ` +
-                                `${flipped.error.message}\n`);
-                        }
-                    }
-                    else {
-                        await appendEvent(deps.supabase, taskId, "log", {
-                            phase: "rework",
-                            stream: "stderr",
-                            message: "rework meta has no origin_task_id — re-review not auto-triggered",
-                        });
-                    }
-                    await appendEvent(deps.supabase, taskId, "rework_pushed", {
-                        pr_number: reworkMeta.pr_number,
-                        repo: reworkMeta.repo,
-                        branch,
-                        cycle: reworkMeta.cycle,
-                        origin_task_id: reworkMeta.origin_task_id || null,
-                    });
-                    await postState_("done", "info", {
-                        runner_id: deps.session.runnerId,
-                        pr_number: reworkMeta.pr_number,
-                        rework: true,
-                    });
-                    await deps.supabase.rpc("transition_task", {
-                        p_task_id: taskId,
-                        p_new_status: "done",
-                    });
-                    return { taskId, status: "ok", exitCode: 0 };
-                }
-                // v0.53 T-53-4: the task's worktree now holds the agent's commits.
-                // Emit the first-commit SLO signal once, before push, so the funnel
-                // sees "coding started" independent of whether the push/PR succeeds.
-                await emitFirstCommit(deps.supabase, git, taskId, workdir, resolvedBaseRef, branch);
-                // v0.57 T-57-2: gate conflict-resolution tasks before the push so a
-                // broken merge never reaches a PR. No-op for every non-conflict task.
-                const integrityGate = await runResolutionIntegrityGate();
-                if (integrityGate)
-                    return integrityGate;
-                // 5. Push + open PR. Both run from the worktree so the operator's
-                // shared clone never has the task branch checked out.
-                let prUrl = "";
-                try {
-                    await git.push(workdir, branch);
-                }
-                catch (err) {
-                    const msg = err.message;
-                    // v0.32-A: before failing, check whether the branch was already
-                    // pushed by a prior run (non-fast-forward error on re-push). If
-                    // an open PR exists, the branch is already live — treat as success.
-                    const existingPrUrlOnPushFail = await gh.findOpenPR(workdir, branch).catch(() => null);
-                    if (existingPrUrlOnPushFail) {
-                        await appendEvent(deps.supabase, taskId, "log", {
-                            phase: "push",
-                            stream: "stdout",
-                            event: "retry.push_conflict_resolved",
-                            branch,
-                            pr_url: existingPrUrlOnPushFail,
-                            message: "push failed but open PR exists — treating as idempotent success",
-                        });
-                        prUrl = existingPrUrlOnPushFail;
-                        // Fall through to postState_("done") below.
-                    }
-                    else {
-                        await appendEvent(deps.supabase, taskId, "error", { phase: "push", error: msg });
-                        await postState_("blocked", "error_context", {
-                            task_id: taskId,
-                            phase: "review",
-                            error_class: "git_push_failed",
-                            stderr_tail: msg,
-                        });
-                        await deps.supabase.rpc("transition_task", {
-                            p_task_id: taskId,
-                            p_new_status: "failed",
-                        });
-                        return { taskId, status: "failed", phase: "push", error: msg };
-                    }
-                }
-                await postState_("reviewing", "info", {
-                    runner_id: deps.session.runnerId,
-                    branch,
-                });
-                try {
-                    const body = extractReportFromOutput(capturedStdout);
-                    const pr = await gh.openPR(workdir, {
-                        title: prTitleForTask(task.id, task.title),
-                        body,
-                        base: integrationBranch,
-                    });
-                    prUrl = pr.url;
-                }
-                catch (err) {
-                    const msg = err.message;
-                    // v0.8.2: gh pr create returns a non-zero exit when a PR already
-                    // exists for this branch (common on runner-crash + re-pick-up).
-                    // GitHub's error message embeds the existing PR URL. Extract it
-                    // and treat the outcome as a successful PR open so set_task_pr can
-                    // transition the task to needs-review rather than leaving it stuck.
-                    const prAlreadyExistsMatch = /already exists/i.test(msg) &&
-                        msg.match(/https:\/\/github\.com\/[^\s]+\/pull\/\d+/);
-                    if (prAlreadyExistsMatch) {
-                        prUrl = prAlreadyExistsMatch[0];
-                        try {
-                            await appendEvent(deps.supabase, taskId, "log", {
-                                phase: "pr_open",
-                                stream: "stdout",
-                                event: "retry.pr_create_already_exists",
-                                pr_url: prUrl,
-                                message: "gh pr create reported PR already exists — recovered URL from error message",
-                            });
-                        }
-                        catch (logErr) {
-                            process.stderr.write(`[acc-runner] pr_open log failed: ${logErr.message}\n`);
-                        }
-                    }
-                    else {
-                        // Best-effort log; don't transition to failed — the push succeeded
-                        // and the user can open a PR manually (webhook back-write picks
-                        // it up). Wrapped so a logging RPC failure can't block the
-                        // terminal status write below.
-                        try {
-                            await appendEvent(deps.supabase, taskId, "error", { phase: "pr_open", error: msg });
-                        }
-                        catch (logErr) {
-                            process.stderr.write(`[acc-runner] pr_open error log failed: ${logErr.message}\n`);
-                        }
-                    }
-                }
-                // v0.35-B: write pr_number + transition running→needs-review via
-                // acc.set_task_pr. Best-effort: a missing RPC (Track A migration
-                // not yet applied) OR any other error falls back to the
-                // webhook-driven running→done path (matrix 0156). Only attempted
-                // when a PR URL is in hand — the push-success / PR-open-failure
-                // branch above leaves prUrl empty and is handled exclusively by
-                // the webhook back-write.
-                if (prUrl) {
-                    await setTaskPr(deps.supabase, taskId, prUrl);
-                }
-                // v0.33-C: terminal status written before cleanup so a runner crash
-                // during cleanup doesn't leave the task non-terminal. Fires the
-                // 'done' bus event the instant a PR URL is confirmed (or null when
-                // the PR-open RPC failed but the push succeeded — the webhook
-                // back-write still finalises the task). v0.14-MESSAGING-RUNTIME-WIRE
-                // semantics: protocol='info' today; handoff requires a
-                // target_capability lookup the runner doesn't have yet. The 'done'
-                // bus state describes the runner's spawn lifecycle (PR opened,
-                // runner finished) and is independent of the task status — v0.35-B
-                // moves the task itself to needs-review via setTaskPr above.
-                await postState_("done", "info", {
-                    runner_id: deps.session.runnerId,
-                    pr_url: prUrl || null,
-                });
-                // v0.33-C: final event log is non-fatal — any throw here would
-                // skip the return statement and leave the worktree-cleanup finally
-                // running with the wrong outcome, but the terminal bus event above
-                // is already on the wire.
-                if (prUrl) {
-                    try {
-                        await appendEvent(deps.supabase, taskId, "pr-opened", { url: prUrl });
-                    }
-                    catch (logErr) {
-                        process.stderr.write(`[acc-runner] pr-opened event log failed: ${logErr.message}\n`);
-                    }
-                }
-                return { taskId, status: "ok", prUrl, exitCode: 0 };
-            }
-            finally {
-                // v0.11-F: tear down the per-task worktree and release the PID
-                // lock on every completion path (success, failure, cancellation,
-                // unexpected throw). Both legs are best-effort — leaking either
-                // resource is preferable to masking the original return value.
-                if (worktree) {
-                    // v0.37-A: clear any stale .git/HEAD.lock or index.lock so the
-                    // `git worktree remove` + `prune` inside cleanup() don't trip on
-                    // a leftover lock from the prior worktree add or claude run.
-                    clearGitLocks(repoPath);
-                    try {
-                        await worktree.cleanup();
-                    }
-                    catch (err) {
-                        process.stderr.write(`[acc-runner] worktree cleanup failed: ${err.message}\n`);
-                    }
-                }
-                try {
-                    await lock.release();
-                }
-                catch (err) {
-                    process.stderr.write(`[acc-runner] lock release failed: ${err.message}\n`);
-                }
-            }
-        }
-        finally {
-            // v0.12-RESUME: stop the periodic signal loop before releasing
-            // locks so a late-firing signal can't bump the column after the
-            // task transitions to a terminal status (the RPC is no-op on
-            // non-running rows anyway, but stopping early avoids the extra
-            // RPC round-trip).
-            stopSignalLoop();
-            // v0.53 T-53-4: disarm the per-task GitHub budget so any REST call
-            // made outside a task run is unbudgeted.
-            endTaskGithubBudget();
-            await releaseLocks();
-        }
-    })();
-    return {
-        taskId,
-        promise,
-        cancel() {
-            cancelled = true;
-            if (child && child.pid) {
-                try {
-                    child.kill("SIGTERM");
-                }
-                catch {
-                    // Already dead — ignore.
-                }
-            }
-        },
-    };
-}
-//# sourceMappingURL=task-runner.js.map