@tokenfactory/acc-runner 0.27.0 → 0.27.1

package/dist/watch.js

@@ -0,0 +1,1570 @@
+/**
+ * `acc-runner watch` — long-running command. Subscribes to broadcast
+ * tasks, dispatches them concurrently (v0.10+), heartbeats every 4s.
+ * v0.2.5 refreshes the access token on startup + every 30 min, and exits
+ * loudly after 5 consecutive heartbeat failures.
+ *
+ * v0.3 adds a 30s polling fallback: if a Realtime broadcast is dropped
+ * during a reconnect, the next poll pass picks the task up via the
+ * `acc.list_assigned_queued_tasks` RPC. A `seen` set keeps the poll
+ * and the broadcast from fighting over the same task_id.
+ *
+ * v0.6.2 (v0.12-REVIEW-LOCAL) listens for `review_assigned` on the same
+ * `runner:<id>` channel and dispatches to runtime/reviewer.ts. Reviews
+ * are independently tracked (separate `seenReviews` set).
+ *
+ * v0.10 (T-49-2): concurrent task dispatch. pump() now launches up to
+ * `concurrencyLimit` (default 2) tasks simultaneously. Each task runs in
+ * its own isolated git worktree so concurrent tasks never share files.
+ * `createTaskAsAdmin` in api/_lib/supabase-admin.ts is the sanctioned
+ * Manager seed path that feeds this dispatch loop.
+ *
+ * v0.12.0 (T-52-7): ephemeral-runner support. Sessions load through the
+ * token-provider abstraction (keychain by default — byte-identical desktop
+ * behaviour; ACC_RUNNER_TOKEN_MODE=env for containers). Env-token runners
+ * register an acc-eph-<random> identity on boot, and ACC_RUNNER_IDLE_TTL_MIN
+ * arms a clean self-termination after n minutes without work.
+ */
+import chalk from "chalk";
+import { loadConfig } from "./config.js";
+import { getTokenProvider } from "./token-provider.js";
+import { machineIdentity, detectInstalledModels, RUNNER_CAPS } from "./login.js";
+import { createRunnerClient } from "./supabase.js";
+import { runTask } from "./task-runner.js";
+import { runReview, } from "./runtime/reviewer.js";
+import { getQuarantine, setQuarantine, } from "./runtime/quarantine.js";
+import { acquireSingletonLock, singletonRunnerId, SingletonLockHeldError, } from "./runtime/singleton.js";
+import { getClaudeVersion, recordTaskClaudeVersion, } from "./runtime/version-drift.js";
+import { postRunnerStateMessage } from "./messaging.js";
+import { checkVersion, compareSemver } from "./version-check.js";
+import { PROTOCOL_VERSION } from "./types.js";
+import { PACKAGE_VERSION } from "./pkg-version.js";
+import { resolveAuthMode, describeAuthMode, authPrecedenceHint } from "./anthropic-auth.js";
+export class RefreshReuseDetectedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "RefreshReuseDetectedError";
+    }
+}
+const ONE_HOUR_MS = 60 * 60 * 1000;
+const REFRESH_CHECK_MS = 30 * 60 * 1000;
+// v0.12.0 (T-52-7): idle-TTL check cadence ceiling. The actual cadence is
+// min(IDLE_CHECK_MS, ttl) so a tiny test TTL still gets checked in time.
+const IDLE_CHECK_MS = 30_000;
+const HEARTBEAT_REFRESH_AFTER = 3;
+const HEARTBEAT_EXIT_AFTER = 5;
+const POLL_INTERVAL_MS = 30_000;
+// v0.30-B: widen the startup `pollSince` watermark so a task dispatched in
+// the minutes before `watch` started is still caught by the first poll.
+// The 30s window the previous code used was tighter than the gap between
+// dispatch and runner restart in real operator workflows.
+const STARTUP_POLL_LOOKBACK_MS = 5 * 60 * 1000;
+// v0.62 (T-62-1): cadence of the periodic full claim scan — the realtime-miss
+// safety net. The delta-poll's forward-only watermark can permanently skip a
+// task assigned with an `updated_at` at/behind the watermark whose realtime
+// `task_assigned` push was dropped (stale subscription). This full scan
+// (epoch watermark, every assigned+queued task for this runner) re-claims any
+// such task within one interval, so an alive-but-wedged runner self-recovers
+// instead of needing a manual restart. Knob: `claim_scan_interval_ms`.
+const DEFAULT_CLAIM_SCAN_INTERVAL_MS = 3 * 60 * 1000;
+// v0.73 (T-73-2, G-M): claim-loop watchdog. A task can sit assigned+queued for
+// this runner (acc.tasks.runner_id = me, status='queued') while the runner
+// heartbeats fine but never claims it — the channel looks healthy (so T-68-1's
+// auto-recovery never fires) but the claim path is wedged. CLAIM_WATCHDOG_STALE_MS
+// is how long a task may stay assigned-but-unclaimed (with a live heartbeat)
+// before the watchdog treats the claim path as wedged and forces the same
+// recovery a terminal channel status does. Default 90s — comfortably under the
+// server's 300s rescue grace, so we self-heal before the rescue churns rather
+// than waiting for a manual `pkill acc-runner watch`. CLAIM_WATCHDOG_CHECK_MS is
+// how often the watchdog re-evaluates; well under the threshold so detection +
+// recovery land inside the grace window. Knobs: tests override both for speed.
+const DEFAULT_CLAIM_WATCHDOG_STALE_MS = 90_000;
+const DEFAULT_CLAIM_WATCHDOG_CHECK_MS = 30_000;
+// v0.56 (T-56-1): capacity-aware pause. When claude reports a session/usage
+// limit (api_error_status 429) the runner pauses claiming tasks AND reviews
+// until the stated reset time. When no reset time is parseable, fall back to
+// this fixed backoff. Resume fires at the target + a small random jitter so a
+// fleet that all hit the limit on the same broadcast doesn't thunder back in
+// lockstep the instant the window reopens.
+const DEFAULT_CAPACITY_BACKOFF_MS = 30 * 60 * 1000;
+const DEFAULT_RESUME_JITTER_MS = 15_000;
+/**
+ * v0.6.0: exponential backoff between heartbeat attempts when the
+ * previous one failed. The dogfood loop fired a heartbeat every 4s
+ * even when the network was wedged, producing a wall of "fetch failed"
+ * stderr noise and reaching the EXIT_AFTER cap in 20s. Spreading
+ * attempts out gives flaky links time to recover before we tear down
+ * the watch process.
+ */
+const HEARTBEAT_BACKOFF_MS = [4_000, 8_000, 16_000, 32_000, 60_000];
+/**
+ * v0.6.0: classify the heartbeat RPC error so we (a) emit a useful
+ * stderr line for the operator and (b) only attempt a JWT refresh
+ * when the failure shape actually implies an auth problem. Refreshing
+ * on a transient network blip just burns the refresh-token rotation
+ * chain and surfaces a confusing "refresh failed" line on top of the
+ * real underlying network error.
+ */
+export function classifyHeartbeatError(err) {
+    if (!err)
+        return "unknown";
+    const msg = (err.message ?? "").toLowerCase();
+    const code = (err.code ?? "").toLowerCase();
+    if (code === "pgrst301" ||
+        code === "401" ||
+        code === "403" ||
+        msg.includes("jwt") ||
+        msg.includes("invalid token") ||
+        msg.includes("token has expired") ||
+        msg.includes("unauthorized") ||
+        msg.includes("forbidden")) {
+        return "auth";
+    }
+    if (msg.includes("enotfound") || msg.includes("getaddrinfo") || msg.includes("eai_again")) {
+        return "dns";
+    }
+    if (msg.includes("econnreset") || msg.includes("connection reset")) {
+        return "reset";
+    }
+    if (msg.includes("certificate") ||
+        msg.includes("self-signed") ||
+        msg.includes("self signed") ||
+        msg.includes("tls") ||
+        msg.includes("ssl")) {
+        return "tls";
+    }
+    if (msg.includes("etimedout") || msg.includes("timeout")) {
+        return "timeout";
+    }
+    if (msg.includes("fetch failed") ||
+        msg.includes("econnrefused") ||
+        msg.includes("network") ||
+        msg.includes("socket hang up")) {
+        return "network";
+    }
+    return "unknown";
+}
+/** Pick the next inter-heartbeat delay from the backoff ladder. Caller
+ *  passes the number of consecutive failures (1 → first retry). The
+ *  return is at least baseMs so a tighter operator-configured cadence
+ *  is never slowed by the backoff scheme. */
+export function nextHeartbeatDelayMs(consecutiveFailures, baseMs) {
+    if (consecutiveFailures <= 0)
+        return baseMs;
+    const idx = Math.min(consecutiveFailures - 1, HEARTBEAT_BACKOFF_MS.length - 1);
+    return Math.max(baseMs, HEARTBEAT_BACKOFF_MS[idx]);
+}
+/**
+ * v0.12.0 (T-52-7): resolve ACC_RUNNER_IDLE_TTL_MIN into ms. Returns null
+ * (TTL disabled) when unset; warns and returns null on junk so a typo'd
+ * env never strands a container in "never exits" mode silently.
+ */
+export function resolveIdleTtlMs(env = process.env) {
+    const raw = env.ACC_RUNNER_IDLE_TTL_MIN?.trim();
+    if (!raw)
+        return null;
+    const minutes = Number(raw);
+    if (!Number.isFinite(minutes) || minutes <= 0) {
+        process.stderr.write(`[acc-runner] ACC_RUNNER_IDLE_TTL_MIN=${JSON.stringify(raw)} is not a positive number; idle TTL disabled\n`);
+        return null;
+    }
+    return minutes * 60_000;
+}
+/** v0.12.0 (T-52-7): record work-related activity for the idle TTL clock. */
+function touchActivity(state) {
+    state.lastActivityMs = Date.now();
+}
+function expiresSoon(session, leadMs = ONE_HOUR_MS) {
+    const expires = Date.parse(session.access_expires_at);
+    if (!Number.isFinite(expires))
+        return true;
+    return expires < Date.now() + leadMs;
+}
+async function refreshAccessToken(cfg, session) {
+    const res = await fetch(`${cfg.publicUrl.replace(/\/+$/, "")}/api/runner/refresh`, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            "User-Agent": `acc-runner/${PROTOCOL_VERSION}`,
+        },
+        body: JSON.stringify({ refresh_token: session.refresh_token }),
+    });
+    if (res.status === 401) {
+        const body = (await res.json().catch(() => ({})));
+        if (body.error === "refresh_reuse_detected") {
+            throw new RefreshReuseDetectedError(body.hint ??
+                "refresh token reuse detected; keychain may be compromised. Run `acc-runner login` from a trusted machine.");
+        }
+        throw new Error(body.hint ?? "refresh token expired; run `acc-runner login`");
+    }
+    if (!res.ok) {
+        throw new Error(`refresh failed: ${res.status} ${await res.text()}`);
+    }
+    const body = (await res.json());
+    return {
+        ...session,
+        access_token: body.access_token,
+        access_expires_at: new Date(body.expires_at * 1000).toISOString(),
+        // v0.4-E: server rotates on every refresh. Persist the new refresh token
+        // so the next call doesn't replay the old one (which would now look like
+        // reuse and trip the chain-revocation path).
+        refresh_token: body.refresh_token ?? session.refresh_token,
+    };
+}
+// Centralised handler for the reuse-detected case. Loud red banner so the
+// operator notices immediately, then exit(1) — there's no safe recovery
+// from the watch loop, the keychain has to be reset by `acc-runner login`.
+function failOnReuse(err) {
+    process.stderr.write(chalk.red.bold("\n[acc-runner] CRITICAL: refresh-token reuse detected.\n"));
+    process.stderr.write(chalk.red(`${err.message}\n`));
+    process.stderr.write(chalk.red("If this machine is the legitimate owner, an attacker may have rotated your tokens.\n" +
+        "Rotate any other credentials that were on this box and run `acc-runner login` from a trusted machine.\n"));
+    process.exit(1);
+}
+// Single source of truth for "this task is new — push it into the runner
+// queue". Both the Realtime listener and the polling loop go through here.
+function enqueue(state, taskId, factory) {
+    if (state.seen.has(taskId))
+        return false;
+    // v0.10 T-49-2: check the running Map (replaces v0.9 state.current check).
+    if (state.running.has(taskId)) {
+        state.seen.add(taskId);
+        return false;
+    }
+    state.seen.add(taskId);
+    state.queue.push(taskId);
+    touchActivity(state);
+    void pump(state, factory);
+    return true;
+}
+// Single source of truth for "this review is new — push it into the review
+// queue". The Realtime listener AND the periodic review scan (v0.65 T-65-2)
+// both go through here; the shared `seenReviews` guard dedupes a review that
+// arrives on both paths. Returns true only when the review was actually
+// enqueued (new + well-formed), so the scan can count what it recovered.
+function enqueueReview(state, payload) {
+    const p = payload;
+    if (!p?.review_id || !p?.task_id || !p?.pr_number)
+        return false;
+    if (state.seenReviews.has(p.review_id))
+        return false;
+    state.seenReviews.add(p.review_id);
+    state.reviewQueue.push({
+        review_id: p.review_id,
+        task_id: p.task_id,
+        pr_number: p.pr_number,
+    });
+    touchActivity(state);
+    void pumpReviews(state);
+    return true;
+}
+function subscribeChannel(state, taskRunnerFactory) {
+    state.channel = state.supabase
+        .channel(`runner:${state.session.runner_id}`, {
+        config: { broadcast: { ack: false, self: false } },
+    })
+        .on("broadcast", { event: "task_assigned" }, ({ payload }) => {
+        const taskId = payload?.task_id;
+        if (taskId)
+            enqueue(state, taskId, taskRunnerFactory);
+    })
+        .on("broadcast", { event: "task_cancelled" }, ({ payload }) => {
+        const taskId = payload?.task_id;
+        if (!taskId)
+            return;
+        // v0.10 T-49-2: cancel from the running Map; fall back to queue removal.
+        const ctrl = state.running.get(taskId);
+        if (ctrl) {
+            ctrl.cancel();
+        }
+        else {
+            state.queue = state.queue.filter((t) => t !== taskId);
+        }
+        // Drop from seen so a re-queue (cancel → re-start) is honored on
+        // the next broadcast or poll.
+        state.seen.delete(taskId);
+    })
+        .on("broadcast", { event: "review_assigned" }, ({ payload }) => {
+        enqueueReview(state, payload);
+    })
+        .subscribe((status) => {
+        if (status === "SUBSCRIBED") {
+            // v0.68 (T-68-1): healthy subscribe — reset the resubscribe backoff.
+            state.resubscribeAttempts = 0;
+            console.log(chalk.green(`✓ Listening on runner:${state.session.runner_id}`));
+        }
+        else if (status === "CHANNEL_ERROR" ||
+            status === "TIMED_OUT" ||
+            status === "CLOSED") {
+            // v0.68 (T-68-1): the realtime channel dropped. Previously unhandled —
+            // which left the runner silently deaf to task_assigned / review_assigned
+            // broadcasts until token expiry or a manual restart (the stale-
+            // subscription root cause behind the repeated "task stuck in queued →
+            // swept to blocked" incidents). Recover it.
+            if (!state.stopped)
+                scheduleResubscribe(state, taskRunnerFactory, status);
+        }
+    });
+}
+// v0.68 (T-68-1): single-flight, backed-off recovery of a dropped realtime
+// channel. Like doRefresh's remove+resubscribe, but WITHOUT a token rotation
+// (the token is still valid; only the channel died) and driven by channel
+// status rather than token expiry. Backoff 1s→30s, reset to 0 on a healthy
+// SUBSCRIBED. After a fresh subscribe we run the poll + claim/review scans so
+// anything the dead channel missed is recovered at once rather than waiting
+// for the periodic 3-min scans.
+function scheduleResubscribe(state, factory, status) {
+    if (state.stopped || state.resubscribing || state.resubscribeTimer)
+        return;
+    const delay = Math.min(30_000, 1_000 * 2 ** Math.min(state.resubscribeAttempts, 5));
+    process.stderr.write(`[acc-runner] realtime channel ${status}; resubscribing in ${delay}ms ` +
+        `(attempt ${state.resubscribeAttempts + 1})\n`);
+    state.resubscribeTimer = setTimeout(() => {
+        state.resubscribeTimer = null;
+        void resubscribeChannel(state, factory);
+    }, delay);
+    if (state.resubscribeTimer.unref)
+        state.resubscribeTimer.unref();
+}
+export async function resubscribeChannel(state, factory) {
+    if (state.stopped || state.resubscribing)
+        return;
+    state.resubscribing = true;
+    state.resubscribeAttempts += 1;
+    try {
+        try {
+            await state.supabase.removeChannel(state.channel);
+        }
+        catch {
+            /* channel may already be torn down */
+        }
+        subscribeChannel(state, factory);
+        void reassertRunningClaims(state);
+        // Recover anything the dead channel missed during the gap. Best-effort;
+        // the `seen` / `seenReviews` guards dedupe against a late re-delivery.
+        void pollOnce(state, factory);
+        void claimScan(state, factory, "periodic");
+        void reviewScan(state, "periodic");
+    }
+    finally {
+        state.resubscribing = false;
+    }
+}
+// A reconnect-triggering network blip also stalls the per-task
+// update_task_signal loop, so last_runner_signal_at drifts stale and the 5-min
+// server sweep can reclaim a task this runner is actively executing. Bump the
+// signal for every in-flight claim the moment the channel is back. Best-effort.
+export async function reassertRunningClaims(state) {
+    const taskIds = [...state.running.keys()];
+    if (taskIds.length === 0)
+        return;
+    await Promise.allSettled(taskIds.map(async (taskId) => {
+        try {
+            const { error } = await state.supabase.rpc("update_task_signal", {
+                p_task_id: taskId,
+            });
+            if (error) {
+                process.stderr.write(`[acc-runner] reconnect re-assert update_task_signal(${taskId}) failed: ${error.message}\n`);
+            }
+        }
+        catch (err) {
+            process.stderr.write(`[acc-runner] reconnect re-assert update_task_signal(${taskId}) ${err.message}\n`);
+        }
+    }));
+}
+// Single-flight poll. The watermark advances only after a clean response so
+// a transient error doesn't permanently skip rows.
+async function pollOnce(state, factory) {
+    if (state.stopped || state.polling)
+        return;
+    state.polling = true;
+    try {
+        const { data, error } = await state.supabase.rpc("list_assigned_queued_tasks", {
+            p_runner_id: state.session.runner_id,
+            p_since: state.pollSince,
+        });
+        if (error) {
+            process.stderr.write(`[acc-runner] poll failed: ${error.message}\n`);
+            return;
+        }
+        const rows = (data ?? []);
+        let maxSeen = state.pollSince;
+        for (const row of rows) {
+            if (!row?.id)
+                continue;
+            // v0.62 (T-62-1): advance the forward-only watermark ONLY for rows we
+            // actually claimed this pass (enqueue returned true). Previously the
+            // watermark advanced to max(updated_at) over EVERY returned row,
+            // including no-ops (a task already seen/in-flight via realtime or a
+            // prior poll). A high-updated_at no-op could then drag the watermark
+            // past a still-queued task assigned with an older updated_at, so the
+            // next delta-poll (`> watermark`) silently dropped it — only a restart
+            // (one-shot startup scan) recovered it. Advancing solely on real claims
+            // keeps the watermark a conservative "newest task I claimed by polling"
+            // mark and stops the delta-poll losing still-queued work. The periodic
+            // full claim scan (claimScan) is the belt to this braces.
+            const claimed = enqueue(state, row.id, factory);
+            if (claimed && row.updated_at && row.updated_at > maxSeen) {
+                maxSeen = row.updated_at;
+            }
+        }
+        state.pollSince = maxSeen;
+    }
+    finally {
+        state.polling = false;
+    }
+}
+/**
+ * v0.62 (T-62-1): full claim scan — lists EVERY assigned+queued task for this
+ * runner with an epoch watermark (`1970-…Z`) and enqueues any the in-process
+ * `seen` guard hasn't already accounted for. Used two ways:
+ *
+ *   - once at startup (replaces the v0.34-B inline block), and
+ *   - on a periodic timer (`claim_scan_interval_ms`, default 3 min) as the
+ *     realtime-miss safety net: a runner that dropped a `task_assigned`
+ *     broadcast self-recovers within one interval instead of sitting next to
+ *     a free runner until a manual restart.
+ *
+ * Deliberately does NOT touch `state.pollSince` — the delta-poll keeps its own
+ * forward-only watermark. Idempotent: `enqueue`'s shared `seen`/`running`
+ * guards mean a task already taken by realtime or the delta-poll is a no-op
+ * here, so realtime + delta-poll + scan all seeing the same task still yields
+ * exactly one run. Single-flight via `claimScanning` so a slow RPC can't let
+ * two scans overlap.
+ */
+async function claimScan(state, factory, context) {
+    if (state.stopped || state.claimScanning)
+        return;
+    state.claimScanning = true;
+    try {
+        const { data, error } = await state.supabase.rpc("list_assigned_queued_tasks", {
+            p_runner_id: state.session.runner_id,
+            p_since: "1970-01-01T00:00:00.000Z",
+        });
+        if (error) {
+            process.stderr.write(`[acc-runner] ${context} claim scan failed: ${error.message}\n`);
+            return;
+        }
+        const rows = (data ?? []);
+        let enqueued = 0;
+        for (const row of rows) {
+            if (!row?.id)
+                continue;
+            if (enqueue(state, row.id, factory))
+                enqueued += 1;
+        }
+        if (context === "startup") {
+            console.log(`[acc-runner] startup claim scan: ${rows.length} task(s) found`);
+        }
+        else if (enqueued > 0) {
+            // Only chirp when the safety net actually caught something — a periodic
+            // scan that finds nothing is the steady state and must stay quiet.
+            console.log(`[acc-runner] periodic claim scan recovered ${enqueued} realtime-missed task(s)`);
+        }
+    }
+    catch (err) {
+        process.stderr.write(`[acc-runner] ${context} claim scan failed: ${err.message}\n`);
+    }
+    finally {
+        state.claimScanning = false;
+    }
+}
+/**
+ * v0.73 (T-73-2, G-M): claim-loop watchdog — the self-heal for an
+ * "assigned-but-unclaimed while heartbeating" strand.
+ *
+ * SYMPTOM (prod 2026-06-10): a runner heartbeated fine (status online, fresh
+ * heartbeat, idle) but never claimed a task the dispatcher had ASSIGNED to it
+ * (acc.tasks.runner_id = me, status='queued'). The server rescue sweep
+ * re-dispatched every ~6 min but the runner never claimed; only a manual
+ * `pkill acc-runner watch && acc-runner watch` cleared it. T-68-1's channel
+ * auto-recovery did NOT catch it — the channel looked healthy but the claim
+ * path was wedged.
+ *
+ * Mechanism: each tick lists the runner's own assigned+queued (= unclaimed)
+ * tasks via the same `list_assigned_queued_tasks` RPC the claim scan uses, and
+ * tracks per task id the first instant it was OBSERVED as
+ * assigned-to-me-but-not-claimed. A task that stays unclaimed past
+ * `claimWatchdogStaleMs` (default 90s — comfortably under the server's 300s
+ * rescue grace) WHILE heartbeats are succeeding means the claim path is wedged:
+ * trigger the SAME single-flight recovery a terminal channel status does
+ * (resubscribeChannel: removeChannel + subscribeChannel + pollOnce + claimScan
+ * + reviewScan), logged as `claim_watchdog_resubscribe`.
+ *
+ * Reset semantics: a task's observed-stale timer is dropped the moment it
+ * leaves the assigned+queued set (claimed → status moved off 'queued', or
+ * unassigned → runner_id cleared). A heartbeat failure clears ALL timers — a
+ * network/auth outage is a different failure with its own handling, and we must
+ * not carry a stale age across it into a false trigger when heartbeats recover.
+ *
+ * Single-flight: respects the existing resubscribe guard/backoff
+ * (`resubscribing` / `resubscribeTimer`) so concurrent staleness can't stack
+ * resubscribes, and resets the stale timers on trigger so a recovery that
+ * didn't help waits another full threshold before re-firing. Bounded and
+ * side-effect-safe: never throws out of the loop.
+ */
+async function claimWatchdogScan(state, factory) {
+    if (state.stopped || state.claimWatchdogChecking)
+        return;
+    state.claimWatchdogChecking = true;
+    try {
+        // Only treat "unclaimed" as wedged while heartbeats are healthy. A
+        // heartbeat failure means the network/auth path is down — the claim RPC
+        // would fail too, and the fix there is the heartbeat refresh/exit path, not
+        // a resubscribe. Clear the observed-stale timers so an age never spans an
+        // outage and falsely trips the watchdog the instant heartbeats recover.
+        if (state.heartbeatFailures > 0) {
+            state.claimWatchdogSince.clear();
+            return;
+        }
+        const { data, error } = await state.supabase.rpc("list_assigned_queued_tasks", {
+            p_runner_id: state.session.runner_id,
+            p_since: "1970-01-01T00:00:00.000Z",
+        });
+        if (error) {
+            process.stderr.write(`[acc-runner] claim watchdog scan failed: ${error.message}\n`);
+            return;
+        }
+        const rows = (data ?? []);
+        const now = Date.now();
+        const currentIds = new Set();
+        for (const row of rows) {
+            if (row?.id)
+                currentIds.add(row.id);
+        }
+        // Reset: drop timers for tasks no longer assigned+queued (claimed/unassigned).
+        for (const id of [...state.claimWatchdogSince.keys()]) {
+            if (!currentIds.has(id))
+                state.claimWatchdogSince.delete(id);
+        }
+        // Observe: stamp the first-seen instant for newly assigned-unclaimed tasks;
+        // collect any that have now been stale past the threshold.
+        const stale = [];
+        for (const id of currentIds) {
+            const since = state.claimWatchdogSince.get(id);
+            if (since === undefined) {
+                state.claimWatchdogSince.set(id, now);
+            }
+            else if (now - since >= state.claimWatchdogStaleMs) {
+                stale.push(id);
+            }
+        }
+        if (stale.length === 0)
+            return;
+        // Single-flight: never stack on a resubscribe already in flight or
+        // scheduled (the existing T-68-1 guard/backoff owns the recovery).
+        if (state.resubscribing || state.resubscribeTimer)
+            return;
+        process.stderr.write(`[acc-runner] claim_watchdog_resubscribe: task(s) ${stale.join(", ")} ` +
+            `assigned but unclaimed > ${state.claimWatchdogStaleMs}ms with a live ` +
+            `heartbeat; claim path looks wedged — forcing resubscribe + claim scan.\n`);
+        // Reset the stale timers so a recovery that didn't help waits another full
+        // threshold before re-triggering (backoff alongside the resubscribe guard).
+        for (const id of stale)
+            state.claimWatchdogSince.set(id, now);
+        void (async () => {
+            try {
+                await state.supabase.rpc("log_activity", {
+                    p_verb: "runner.claim_watchdog_resubscribe",
+                    p_target_id: state.session.runner_id,
+                    p_payload: {
+                        task_ids: stale,
+                        stale_ms: state.claimWatchdogStaleMs,
+                        version: PACKAGE_VERSION,
+                    },
+                    p_target_type: "runner",
+                });
+            }
+            catch { /* best-effort breadcrumb */ }
+        })();
+        void resubscribeChannel(state, factory);
+    }
+    catch (err) {
+        process.stderr.write(`[acc-runner] claim watchdog scan failed: ${err.message}\n`);
+    }
+    finally {
+        state.claimWatchdogChecking = false;
+    }
+}
+/**
+ * v0.65 (T-65-2): full review scan — the review twin of claimScan. Lists EVERY
+ * pending review assigned to this runner with an epoch watermark (`1970-…Z`)
+ * via `list_assigned_pending_reviews` and feeds each row into the existing
+ * `enqueueReview`, whose shared `seenReviews` guard dedupes a review the
+ * realtime `review_assigned` broadcast already delivered. Used two ways:
+ *
+ *   - once at startup (next to the startup claim scan), and
+ *   - on a periodic timer (`review_scan_interval_ms`, default 3 min) as the
+ *     realtime-miss safety net: a runner that dropped a `review_assigned`
+ *     broadcast recovers the review within one interval instead of letting it
+ *     strand in acc.review_queue (PR #544's review stranded 16h last cycle).
+ *
+ * Idempotent: `enqueueReview`'s `seenReviews` guard means a review already
+ * taken by realtime is a no-op here, so realtime + scan both seeing the same
+ * review still yields exactly one review run. Single-flight via
+ * `reviewScanning` so a slow RPC can't let two scans overlap. Skipped while
+ * paused for capacity — matching `pumpReviews`, the runner deliberately holds
+ * reviews until its session window reopens.
+ */
+async function reviewScan(state, context) {
+    if (state.stopped || state.reviewScanning)
+        return;
+    // v0.56 (T-56-1) parity with pumpReviews: don't claim reviews while paused
+    // for capacity. The scheduled resume re-drives the review pump.
+    if (state.pausedCapacity)
+        return;
+    state.reviewScanning = true;
+    try {
+        const { data, error } = await state.supabase.rpc("list_assigned_pending_reviews", {
+            p_runner_id: state.session.runner_id,
+            p_since: "1970-01-01T00:00:00.000Z",
+        });
+        if (error) {
+            process.stderr.write(`[acc-runner] ${context} review scan failed: ${error.message}\n`);
+            return;
+        }
+        const rows = (data ?? []);
+        let enqueued = 0;
+        for (const row of rows) {
+            if (enqueueReview(state, row))
+                enqueued += 1;
+        }
+        if (context === "startup") {
+            console.log(`[acc-runner] startup review scan: ${rows.length} pending review(s) found`);
+        }
+        else if (enqueued > 0) {
+            // Only chirp when the safety net actually caught something — a periodic
+            // scan that finds nothing is the steady state and must stay quiet.
+            console.log(`[acc-runner] periodic review scan recovered ${enqueued} realtime-missed review(s)`);
+        }
+    }
+    catch (err) {
+        process.stderr.write(`[acc-runner] ${context} review scan failed: ${err.message}\n`);
+    }
+    finally {
+        state.reviewScanning = false;
+    }
+}
+// Single-flight refresh. Recreates the Supabase client (so future RPC +
+// channel auth use the new JWT) and resubscribes the broadcast channel.
+async function doRefresh(state, taskRunnerFactory) {
+    // v0.12.0 (T-52-7): an env-token runner without ACC_RUNNER_REFRESH_TOKEN
+    // cannot rotate. Refusing here (instead of POSTing an empty token) keeps
+    // the failure mode a clear stderr line rather than a server-side 400.
+    if (!state.tokenProvider.canRefresh()) {
+        process.stderr.write("[acc-runner] token refresh unavailable (no refresh token in env); runner will exit when the access token expires\n");
+        return false;
+    }
+    if (state.refreshing)
+        return state.refreshing;
+    state.refreshing = (async () => {
+        try {
+            const updated = await refreshAccessToken(state.cfg, state.session);
+            state.session = updated;
+            await state.tokenProvider.save(updated);
+            try {
+                await state.supabase.removeChannel(state.channel);
+            }
+            catch {
+                /* channel may already be torn down */
+            }
+            state.supabase = createRunnerClient(state.cfg, state.session.access_token);
+            subscribeChannel(state, taskRunnerFactory);
+            return true;
+        }
+        catch (err) {
+            if (err instanceof RefreshReuseDetectedError)
+                failOnReuse(err);
+            process.stderr.write(`[acc-runner] refresh failed: ${err.message}\n`);
+            return false;
+        }
+        finally {
+            state.refreshing = null;
+        }
+    })();
+    return state.refreshing;
+}
+export async function watchCommand(options = {}) {
+    const cfg = loadConfig();
+    const exitFn = options.exit ?? ((code) => process.exit(code));
+    // v0.14.0 (T-54-2, GA-3): single-instance guard. Acquired BEFORE the
+    // session load + realtime connection so a duplicate exits immediately,
+    // before it can race the holder on worktree locks or git refs. A second
+    // runner for the same repo path is a hard error; a stale lock from a dead
+    // pid self-reclaims inside acquireSingletonLock.
+    const enforceSingleton = options.enforceSingleton ?? !options.taskRunnerFactory;
+    let singletonLock = null;
+    if (enforceSingleton) {
+        // v1.02-A: the lock is keyed by (repo path + ACC_RUNNER_ID). A second
+        // runner with a DISTINCT ACC_RUNNER_ID (and, by default, its own
+        // namespaced cache dir) acquires its own lock and coexists; only a true
+        // duplicate — same repo, same identity — is rejected here.
+        const runnerId = singletonRunnerId();
+        try {
+            singletonLock = await acquireSingletonLock(cfg.repoPath, process.pid, runnerId);
+        }
+        catch (err) {
+            if (err instanceof SingletonLockHeldError) {
+                process.stderr.write(chalk.red.bold("\n[acc-runner] ANOTHER RUNNER IS ALREADY ACTIVE.\n"));
+                process.stderr.write(chalk.red(`Repo path ${err.holder.repoPath} is served by pid ${err.holder.pid}` +
+                    (err.holder.runnerId ? ` as ${err.holder.runnerId}` : "") +
+                    ` (acc-runner v${err.holder.version}, since ${err.holder.acquiredAt}).\n` +
+                    "Refusing to start a second runner with the same identity for the " +
+                    "same repo — concurrent same-identity runners corrupt worktrees and " +
+                    "race git refs.\n"));
+                process.stderr.write(chalk.gray(`To stop the other runner:  kill ${err.holder.pid}\n` +
+                    `If it is already dead, remove ${err.lockFile} (or just retry — ` +
+                    "stale locks self-reclaim).\n" +
+                    "To run a SECOND runner on this host, give it a distinct " +
+                    "ACC_RUNNER_ID (its cache dir auto-isolates).\n"));
+                exitFn(1);
+                // exitFn is process.exit in production (never returns); in tests it
+                // is a stub, so re-throw to halt watchCommand cleanly.
+                throw err;
+            }
+            throw err;
+        }
+    }
+    const tokenProvider = getTokenProvider();
+    let session = await tokenProvider.load();
+    if (!session) {
+        process.stderr.write(tokenProvider.mode === "env"
+            ? "No session in env. Set ACC_RUNNER_ACCESS_TOKEN (token mode: env).\n"
+            : "Not logged in. Run `acc-runner login`.\n");
+        process.exit(1);
+    }
+    const v = await checkVersion(cfg.publicUrl);
+    if (!v.ok && v.reason === "outdated") {
+        throw new Error(`acc-runner is below the server's minimum version (${v.serverMin}). Run \`pnpm add -g @tokenfactory/acc-runner@latest\`.`);
+    }
+    // v0.31-B: warn when running behind current_version (above min but stale).
+    // Launchd daemon often runs an old binary silently; this surfaces it at
+    // startup before the first heartbeat so the operator can update promptly.
+    if (v.ok && v.serverCurrent && compareSemver(PACKAGE_VERSION, v.serverCurrent) < 0) {
+        process.stderr.write(`[acc-runner] WARNING: running v${PACKAGE_VERSION}, server current is v${v.serverCurrent}. ` +
+            `Run \`npm install -g @tokenfactory/acc-runner@latest\` then reload launchd.\n`);
+    }
+    // v0.74-B: surface how spawned claude sessions will authenticate. api-key
+    // (ANTHROPIC_API_KEY set) bills against the API account with no per-session
+    // cap; interactive-session falls back to the operator's OAuth login, which
+    // hits 429 session caps during long autonomous runs.
+    const authMode = resolveAuthMode();
+    console.log(chalk.gray(`Anthropic auth: ${describeAuthMode(authMode)}`));
+    // v0.76-A (GA-11): surface the API-key-vs-claude.ai-login precedence hint so
+    // a 429-on-a-key-configured-runner is diagnosable from the banner.
+    const authHint = authPrecedenceHint();
+    if (authHint)
+        console.log(chalk.gray(`Anthropic auth: ${authHint}`));
+    // Startup refresh: if the access token expires in less than an hour,
+    // grab a fresh one before opening the realtime connection.
+    // v0.12.0 (T-52-7): skipped when the provider has no refresh token —
+    // an env-token runner just runs out its 8h access token (the idle TTL
+    // normally exits it long before then).
+    if (tokenProvider.canRefresh() && expiresSoon(session)) {
+        try {
+            session = await refreshAccessToken(cfg, session);
+            await tokenProvider.save(session);
+        }
+        catch (err) {
+            if (err instanceof RefreshReuseDetectedError)
+                failOnReuse(err);
+            process.stderr.write(`Refresh failed; run \`acc-runner login\`. (${err.message})\n`);
+            process.exit(1);
+        }
+    }
+    // v0.12.0 (T-52-7): env-token (ephemeral) runners had no `login` flow, so
+    // nothing registered an acc.runners row yet. Register on boot under the
+    // acc-eph-<random> identity. register_runner may resolve to an existing
+    // row (same bound user + machine, e.g. a restarted container with a
+    // pinned hostname) — adopt whatever id it returns so the realtime
+    // channel, heartbeats, and polling all agree.
+    if (tokenProvider.mode === "env") {
+        const boot = createRunnerClient(cfg, session.access_token);
+        const models = await detectInstalledModels();
+        const { data: resolvedId, error: regErr } = await boot.rpc("register_runner", {
+            p_id: session.runner_id,
+            p_name: session.runner_id,
+            p_owner: session.email ?? session.user_id,
+            p_machine: machineIdentity(),
+            p_models: models,
+            p_caps: RUNNER_CAPS,
+            p_version: PACKAGE_VERSION,
+        });
+        if (regErr) {
+            process.stderr.write(`[acc-runner] ephemeral register_runner failed: ${regErr.message}\n`);
+            process.exit(1);
+        }
+        if (typeof resolvedId === "string" && resolvedId && resolvedId !== session.runner_id) {
+            session = { ...session, runner_id: resolvedId };
+        }
+        await tokenProvider.save(session);
+        console.log(chalk.green(`✓ Registered ephemeral runner: ${session.runner_id}`));
+    }
+    const taskRunnerFactory = options.taskRunnerFactory ?? runTask;
+    const heartbeatMs = options.heartbeatMs ?? 4_000;
+    const pollMs = options.pollMs ?? POLL_INTERVAL_MS;
+    const reviewerFactory = options.reviewerFactory ?? ((assignment, deps) => runReview(assignment, deps));
+    // v0.48: check for an existing quarantine file before opening the
+    // realtime connection. If quarantined, emit a loud warning — the
+    // runner will not claim tasks until `acc-runner quarantine clear` runs.
+    const startupQuarantine = await getQuarantine().catch(() => null);
+    if (startupQuarantine) {
+        process.stderr.write(chalk.red.bold(`[acc-runner] QUARANTINED (${startupQuarantine.cause}): ${startupQuarantine.detail}\n`));
+        process.stderr.write(chalk.red(`[acc-runner] Runner will NOT claim tasks. Resolve the issue then run ` +
+            `\`acc-runner quarantine clear\`.\n`));
+    }
+    // v0.12.0 (T-52-7): idle TTL — option override wins (tests), then env.
+    const idleTtlMs = options.idleTtlMs !== undefined ? options.idleTtlMs : resolveIdleTtlMs();
+    const state = {
+        cfg,
+        session,
+        tokenProvider,
+        supabase: createRunnerClient(cfg, session.access_token),
+        channel: undefined,
+        heartbeatTimer: undefined,
+        refreshTimer: undefined,
+        pollTimer: undefined,
+        claimScanTimer: undefined, // v0.62 (T-62-1)
+        claimScanIntervalMs: options.claimScanIntervalMs ?? DEFAULT_CLAIM_SCAN_INTERVAL_MS,
+        claimScanning: false,
+        reviewScanTimer: undefined, // v0.65 (T-65-2)
+        reviewScanIntervalMs: options.reviewScanIntervalMs ?? DEFAULT_CLAIM_SCAN_INTERVAL_MS,
+        reviewScanning: false,
+        // v0.73 (T-73-2, G-M): claim-loop watchdog.
+        claimWatchdogTimer: undefined,
+        claimWatchdogStaleMs: options.claimWatchdogStaleMs ?? DEFAULT_CLAIM_WATCHDOG_STALE_MS,
+        claimWatchdogSince: new Map(),
+        claimWatchdogChecking: false,
+        // v0.68 (T-68-1): realtime channel-health recovery state.
+        resubscribing: false,
+        resubscribeAttempts: 0,
+        resubscribeTimer: null,
+        // v0.10 T-49-2: concurrent running Map replaces v0.9 single `current`.
+        running: new Map(),
+        concurrencyLimit: options.concurrencyLimit ??
+            (() => {
+                // v1.02 (T-1780800001050101): ACC_RUNNER_CONCURRENCY env override.
+                // default 2; clamp to 1..50; fall back to 2 on NaN.
+                const parsed = Number.parseInt(process.env.ACC_RUNNER_CONCURRENCY ?? '', 10);
+                return Number.isNaN(parsed) ? 2 : Math.min(50, Math.max(1, parsed));
+            })(),
+        queue: [],
+        seen: new Set(),
+        pumping: false,
+        stopped: false,
+        heartbeatFailures: 0,
+        refreshing: null,
+        pollSince: new Date(Date.now() - STARTUP_POLL_LOOKBACK_MS).toISOString(),
+        polling: false,
+        reviewQueue: [],
+        seenReviews: new Set(),
+        reviewPumping: false,
+        runReview: reviewerFactory,
+        quarantined: startupQuarantine !== null,
+        authRetriedTasks: new Set(),
+        idleTtlMs,
+        lastActivityMs: Date.now(),
+        idleTimer: null,
+        idleExiting: false,
+        taskRunnerFactory,
+        pausedCapacity: false,
+        pausedUntil: null,
+        pauseTimer: null,
+        capacityProbe: false,
+        capacityBackoffMs: options.capacityBackoffMs ?? DEFAULT_CAPACITY_BACKOFF_MS,
+        resumeJitterMs: options.resumeJitterMs ?? DEFAULT_RESUME_JITTER_MS,
+        singletonLock,
+    };
+    subscribeChannel(state, taskRunnerFactory);
+    // v0.34-B / v0.62 (T-62-1): one-shot startup claim scan. The 5-minute
+    // pollSince watermark (v0.30-B) can miss a task dispatched (runner_id set)
+    // more than 5 minutes before the runner started whose realtime task_assigned
+    // event was lost during the restart window. claimScan() scans with an epoch
+    // watermark so any task currently assigned to this runner_id is enqueued
+    // regardless of dispatch age. Does NOT update state.pollSince — the ongoing
+    // poll loop keeps its 5-min watermark. The same routine runs periodically
+    // below as the realtime-miss safety net.
+    await claimScan(state, taskRunnerFactory, "startup");
+    // v0.65 (T-65-2): one-shot startup review scan, the review twin of the
+    // startup claim scan above. A `review_assigned` broadcast dropped during the
+    // restart window would otherwise strand the review in acc.review_queue until
+    // a manual restart; the epoch-watermark scan re-enqueues any pending review
+    // assigned to this runner regardless of when it was requested. enqueueReview's
+    // seenReviews guard keeps it idempotent against the realtime path.
+    await reviewScan(state, "startup");
+    // v0.30-B: fire an immediate poll right after subscribing so any task
+    // dispatched before the runner came online (where the fire-and-forget
+    // Realtime broadcast went to a dead channel) is picked up at startup
+    // instead of waiting `pollMs` for the first scheduled poll. Awaited so
+    // `state.polling` is back to false before the timer-driven polls and
+    // any caller-driven `pollOnce()` can run.
+    await pollOnce(state, taskRunnerFactory);
+    // v0.6.0: self-rescheduling setTimeout (not setInterval) so the
+    // backoff ladder in nextHeartbeatDelayMs actually pauses between
+    // attempts. setInterval would keep firing every heartbeatMs even
+    // while the link is down.
+    scheduleHeartbeat(state, taskRunnerFactory, heartbeatMs);
+    // v0.12.0 (T-52-7): no refresh timer when the provider can't rotate —
+    // doRefresh would just emit the same "unavailable" line every 30 min.
+    state.refreshTimer = setInterval(() => {
+        if (state.tokenProvider.canRefresh() && expiresSoon(state.session)) {
+            void doRefresh(state, taskRunnerFactory);
+        }
+    }, REFRESH_CHECK_MS);
+    state.pollTimer = setInterval(() => {
+        void pollOnce(state, taskRunnerFactory);
+    }, pollMs);
+    // v0.62 (T-62-1): periodic full claim scan — the realtime-miss safety net.
+    // Independent of the delta-poll watermark, so a task assigned with an
+    // updated_at at/behind the watermark (and whose task_assigned broadcast was
+    // dropped) is re-claimed within one interval rather than waiting for a
+    // manual restart. Single-flight inside claimScan(); enqueue's seen-guard
+    // keeps it from double-claiming work the realtime path or delta-poll took.
+    state.claimScanTimer = setInterval(() => {
+        void claimScan(state, taskRunnerFactory, "periodic");
+    }, state.claimScanIntervalMs);
+    // v0.65 (T-65-2): periodic full review scan — the realtime-miss safety net
+    // for reviews. Mirrors the claim-scan timer above: a `review_assigned`
+    // broadcast missed by a stale subscription is recovered within one interval
+    // instead of stranding in acc.review_queue. Single-flight inside
+    // reviewScan(); enqueueReview's seenReviews guard prevents double-claiming a
+    // review the realtime path already took.
+    state.reviewScanTimer = setInterval(() => {
+        void reviewScan(state, "periodic");
+    }, state.reviewScanIntervalMs);
+    // v0.73 (T-73-2, G-M): claim-loop watchdog timer. Independent of the claim
+    // scan (whose 3-min cadence is too coarse for a 90s threshold): it ages the
+    // runner's own assigned-but-unclaimed tasks and forces a resubscribe + claim
+    // scan when one stays unclaimed past the threshold while heartbeats succeed —
+    // the self-heal for the "online + heartbeating but never claims" strand that
+    // T-68-1's channel recovery can't see (healthy channel, wedged claim path).
+    const claimWatchdogCheckMs = options.claimWatchdogCheckMs ?? DEFAULT_CLAIM_WATCHDOG_CHECK_MS;
+    state.claimWatchdogTimer = setInterval(() => {
+        void claimWatchdogScan(state, taskRunnerFactory);
+    }, claimWatchdogCheckMs);
+    // v0.13-MULTI-RUNNER: refresh the runner's capability tags so an
+    // operator change to ACC_RUNNER_CAPABILITIES (or to ~/.config/acc-
+    // runner/config.json) takes effect on the next restart without
+    // requiring a full `acc-runner login` re-flow. Default-empty is the
+    // backward-compat path for 0.6.3 runners and matches any task with
+    // an empty required_capabilities array.
+    {
+        const { error: capsErr } = await state.supabase.rpc("set_runner_capabilities", {
+            p_id: state.session.runner_id,
+            p_capabilities: cfg.capabilities ?? [],
+        });
+        if (capsErr) {
+            // Non-fatal: a pre-0114 server (or an Old DB the runner is
+            // pointed at during local dev) will 404 this RPC. The watch
+            // loop continues so an operator on an older deploy isn't
+            // wedged by a missing function.
+            process.stderr.write(`[acc-runner] set_runner_capabilities failed (continuing): ${capsErr.message}\n`);
+        }
+    }
+    // Initial heartbeat fires immediately so the runner page reflects "online".
+    await state.supabase.rpc("heartbeat_runner", {
+        p_id: state.session.runner_id,
+        p_version: PACKAGE_VERSION,
+    });
+    console.log(chalk.gray(`Runner ${state.session.runner_id} is online. Ctrl-C to stop.`));
+    const stop = async () => {
+        if (state.stopped)
+            return;
+        state.stopped = true;
+        clearTimeout(state.heartbeatTimer);
+        clearInterval(state.refreshTimer);
+        clearInterval(state.pollTimer);
+        clearInterval(state.claimScanTimer); // v0.62 (T-62-1)
+        clearInterval(state.reviewScanTimer); // v0.65 (T-65-2)
+        clearInterval(state.claimWatchdogTimer); // v0.73 (T-73-2)
+        if (state.resubscribeTimer)
+            clearTimeout(state.resubscribeTimer); // v0.68 (T-68-1)
+        if (state.idleTimer)
+            clearInterval(state.idleTimer);
+        if (state.pauseTimer)
+            clearTimeout(state.pauseTimer); // v0.56 (T-56-1)
+        // v0.10 T-49-2: cancel every in-flight task (replaces v0.9 single cancel).
+        for (const ctrl of state.running.values()) {
+            ctrl.cancel();
+        }
+        try {
+            await state.supabase.removeChannel(state.channel);
+        }
+        catch { /* ignore */ }
+        // v0.12-RUNNER-HEALTH: log shutdown_intent BEFORE flipping status so
+        // the audit trail records the intent even if the status RPC fails.
+        // The 1-min runner-watchdog cron uses status='online'+stale heartbeat
+        // as its crash detector; this event gives operators a timestamped
+        // breadcrumb when investigating "why did this runner go offline?"
+        try {
+            await state.supabase.rpc("log_activity", {
+                p_verb: "runner.shutdown_intent",
+                p_target_id: state.session.runner_id,
+                p_payload: { version: PACKAGE_VERSION },
+                p_target_type: "runner",
+            });
+        }
+        catch { /* best-effort; network may already be gone */ }
+        try {
+            await state.supabase.rpc("set_runner_status", {
+                p_id: state.session.runner_id,
+                p_status: "offline",
+            });
+        }
+        catch { /* network may already be gone */ }
+        // v0.14.0 (T-54-2): release the single-instance lock last, so the slot
+        // is only freed once this runner has fully deregistered. SIGINT/SIGTERM
+        // and the idle-TTL exit all route through stop(), so all clean shutdown
+        // paths release it. A hard crash leaves a stale lock that the next
+        // start reclaims.
+        try {
+            await state.singletonLock?.release();
+        }
+        catch { /* best-effort */ }
+    };
+    // v0.12.0 (T-52-7): arm the idle-TTL timer. Desktop runners (no TTL env,
+    // no option) never reach this branch — zero behaviour change. Armed after
+    // `stop` exists so the exit sequence can reuse the one shutdown path.
+    if (state.idleTtlMs !== null && state.idleTtlMs > 0) {
+        const checkMs = options.idleCheckMs ?? Math.min(IDLE_CHECK_MS, state.idleTtlMs);
+        state.idleTimer = setInterval(() => {
+            void maybeIdleExit(state, stop, exitFn);
+        }, checkMs);
+        // Don't hold the event loop open for the idle check alone.
+        state.idleTimer.unref?.();
+        console.log(chalk.gray(`Idle TTL armed: exiting after ${Math.round(state.idleTtlMs / 60_000)} min without work.`));
+    }
+    if (!options.taskRunnerFactory) {
+        // v0.33-C: best-effort terminal status flush on runner shutdown. If
+        // launchd (or another OS-driven kill) sends SIGTERM while a task is
+        // mid-run, transition_task('failed') as a last resort so the task
+        // doesn't sit in 'running' until the 5-15 min sweep fires. SIGINT
+        // (Ctrl-C, operator-driven) skips the flush — the sweep is the right
+        // path there because the task should be retried as-is, not failed.
+        // SIGKILL / OOM can't be caught, so the sweep is still the real
+        // safety net; this just shrinks the window when the kill is catchable.
+        const onSignal = (signal) => {
+            void (async () => {
+                // v0.10 T-49-2: on SIGTERM, transition ALL in-flight tasks to
+                // failed (replaces v0.9 single-task transition). SIGINT (Ctrl-C)
+                // still skips the flush — the 5-min sweep handles that path.
+                if (signal === "SIGTERM" && state.running.size > 0) {
+                    await Promise.allSettled([...state.running.keys()].map(async (taskId) => {
+                        try {
+                            await state.supabase.rpc("transition_task", {
+                                p_task_id: taskId,
+                                p_new_status: "failed",
+                            });
+                        }
+                        catch { /* best-effort — sweep covers us if RPC can't get out */ }
+                    }));
+                }
+                await stop();
+                process.exit(0);
+            })();
+        };
+        process.once("SIGINT", () => onSignal("SIGINT"));
+        process.once("SIGTERM", () => onSignal("SIGTERM"));
+    }
+    return {
+        stop,
+        pollOnce: () => pollOnce(state, taskRunnerFactory),
+        claimScanOnce: () => claimScan(state, taskRunnerFactory, "periodic"), // v0.62 (T-62-1)
+        reviewScanOnce: () => reviewScan(state, "periodic"), // v0.65 (T-65-2)
+        claimWatchdogOnce: () => claimWatchdogScan(state, taskRunnerFactory), // v0.73 (T-73-2)
+        runningCount: () => state.running.size,
+    };
+}
+function scheduleHeartbeat(state, taskRunnerFactory, baseMs) {
+    if (state.stopped)
+        return;
+    const delay = nextHeartbeatDelayMs(state.heartbeatFailures, baseMs);
+    state.heartbeatTimer = setTimeout(() => {
+        void (async () => {
+            const { error } = await state.supabase.rpc("heartbeat_runner", {
+                p_id: state.session.runner_id,
+                p_version: PACKAGE_VERSION,
+            });
+            if (!error) {
+                state.heartbeatFailures = 0;
+            }
+            else {
+                state.heartbeatFailures += 1;
+                const kind = classifyHeartbeatError(error);
+                process.stderr.write(`[acc-runner] heartbeat failed (${kind}): ${error.message}\n`);
+                // v0.6.0 REG-294 sibling: only refresh on an auth-shaped error
+                // AND once we've crossed the consecutive-failure threshold. A
+                // single 401 on a flaky network shouldn't burn a refresh, and a
+                // DNS outage shouldn't trigger refresh at all.
+                if (state.heartbeatFailures >= HEARTBEAT_REFRESH_AFTER &&
+                    kind === "auth") {
+                    process.stderr.write("[acc-runner] auth-shaped heartbeat failure, attempting JWT refresh\n");
+                    void doRefresh(state, taskRunnerFactory);
+                }
+                if (state.heartbeatFailures >= HEARTBEAT_EXIT_AFTER) {
+                    process.stderr.write("[acc-runner] heartbeat dead, exiting\n");
+                    clearTimeout(state.heartbeatTimer);
+                    clearInterval(state.refreshTimer);
+                    clearInterval(state.pollTimer);
+                    clearInterval(state.claimScanTimer); // v0.62 (T-62-1)
+                    clearInterval(state.reviewScanTimer); // v0.65 (T-65-2)
+                    clearInterval(state.claimWatchdogTimer); // v0.73 (T-73-2)
+                    if (state.resubscribeTimer)
+                        clearTimeout(state.resubscribeTimer); // v0.68 (T-68-1)
+                    process.exit(1);
+                }
+            }
+            scheduleHeartbeat(state, taskRunnerFactory, baseMs);
+        })();
+    }, delay);
+}
+/**
+ * v0.12.0 (T-52-7): idle-TTL exit check. Fires from the idle timer; exits
+ * the process cleanly when the runner has had no queued or in-flight work
+ * (tasks OR reviews) for idleTtlMs. The exit sequence:
+ *
+ *   1. log_activity runner.idle_ttl_exit — the audit breadcrumb the
+ *      autoscale sweep and operators read ("why did acc-eph-x vanish?").
+ *   2. final heartbeat_runner — so the runners panel shows a fresh
+ *      timestamp right up to the clean exit (vs. a stale-heartbeat crash).
+ *   3. stop() — shutdown_intent + set_runner_status('offline'), the same
+ *      deregistration path `acc-runner logout` and SIGTERM use.
+ *   4. exit(0).
+ *
+ * In-flight work always wins: any running task, queued task, or queued
+ * review resets the decision to "not idle" — the TTL never kills a runner
+ * mid-task.
+ */
+async function maybeIdleExit(state, stop, exitFn) {
+    if (state.stopped || state.idleExiting || state.idleTtlMs === null)
+        return;
+    // v0.56 (T-56-1): a capacity pause is not idleness — the runner is
+    // deliberately waiting for its session window to reopen. Don't TTL-exit
+    // it out from under the scheduled resume.
+    if (state.pausedCapacity)
+        return;
+    if (state.running.size > 0 ||
+        state.queue.length > 0 ||
+        state.reviewQueue.length > 0 ||
+        state.reviewPumping) {
+        return;
+    }
+    const idleMs = Date.now() - state.lastActivityMs;
+    if (idleMs < state.idleTtlMs)
+        return;
+    state.idleExiting = true;
+    const idleMinutes = Math.round(idleMs / 60_000);
+    console.log(chalk.gray(`[acc-runner] idle TTL reached (${idleMinutes} min without work); exiting cleanly.`));
+    try {
+        await state.supabase.rpc("log_activity", {
+            p_verb: "runner.idle_ttl_exit",
+            p_target_id: state.session.runner_id,
+            p_payload: { idle_minutes: idleMinutes, version: PACKAGE_VERSION },
+            p_target_type: "runner",
+        });
+    }
+    catch { /* best-effort */ }
+    try {
+        await state.supabase.rpc("heartbeat_runner", {
+            p_id: state.session.runner_id,
+            p_version: PACKAGE_VERSION,
+        });
+    }
+    catch { /* best-effort */ }
+    await stop();
+    exitFn(0);
+}
+async function pumpReviews(state) {
+    if (state.reviewPumping)
+        return;
+    // v0.56 (T-56-1): don't claim reviews while paused for capacity, and hold
+    // reviews back during the single-probe window so the probe TASK confirms
+    // the session reopened before we spend more capacity on reviews.
+    if (state.pausedCapacity || state.capacityProbe)
+        return;
+    state.reviewPumping = true;
+    try {
+        while (!state.stopped &&
+            !state.pausedCapacity &&
+            !state.capacityProbe &&
+            state.reviewQueue.length > 0) {
+            const next = state.reviewQueue.shift();
+            if (!next)
+                continue;
+            try {
+                const outcome = await state.runReview(next, { supabase: state.supabase });
+                const tag = outcome.decision === "reviewer_error" ? chalk.red : chalk.gray;
+                console.log(tag(`[acc-runner] review ${next.review_id} task=${next.task_id} pr=${next.pr_number} decision=${outcome.decision} confidence=${outcome.confidence.toFixed(2)}`));
+                // v0.56 (T-56-1): a reviewer that hit the session/usage limit reports
+                // a DISTINCT outcome (reviewer_capacity, NOT reviewer_error) so the
+                // api side (T-56-2) can exclude it from automerge retry caps and
+                // re-dispatch the review. runReview has already submitted the
+                // reviewer_capacity row; here we pause the whole runner exactly as a
+                // capacity_exhausted task does.
+                if (outcome.decision === "reviewer_capacity") {
+                    enterCapacityPause(state, next.task_id, outcome.resume_at ?? null, `reviewer ${next.review_id} hit session/usage limit`);
+                    return;
+                }
+            }
+            catch (err) {
+                process.stderr.write(`[acc-runner] review ${next.review_id} crashed: ${err.message}\n`);
+            }
+            finally {
+                touchActivity(state); // v0.12.0 (T-52-7): idle clock restarts at review end
+            }
+        }
+    }
+    finally {
+        state.reviewPumping = false;
+    }
+}
+/**
+ * v0.48 / v0.49 T-49-6: enter quarantine after a machine-level failure.
+ *
+ * Extracted from pump()'s completion handler so both the immediate
+ * quarantine path and the auth_expired "refresh failed → quarantine"
+ * path share one implementation. Idempotent: a no-op once the runner is
+ * already quarantined, so concurrent machine-level failures don't fire
+ * duplicate audit events. Sets the in-memory flag synchronously (pump()
+ * reads it without an async hop) and best-effort persists + announces.
+ */
+function enterQuarantine(state, taskId, cause, detail, 
+// v0.53 T-53-4: how many consecutive instant-empty exits produced an
+// env_broken cause (1 = definitive, 2 = heuristic confirmed by the
+// retry). Persisted into quarantine.json's additive `consecutive` field.
+consecutive) {
+    if (state.quarantined)
+        return;
+    state.quarantined = true;
+    const qState = {
+        cause,
+        classifiedAt: new Date().toISOString(),
+        taskId,
+        detail,
+        ...(consecutive !== undefined ? { consecutive } : {}),
+    };
+    void setQuarantine(qState).catch((err) => {
+        process.stderr.write(`[acc-runner] setQuarantine failed: ${err.message}\n`);
+    });
+    process.stderr.write(chalk.red.bold(`[acc-runner] QUARANTINE: runner ${state.session.runner_id} quarantined ` +
+        `(${cause}) after task ${taskId} failed.\n`));
+    void postRunnerStateMessage(state.supabase, {
+        task_id: taskId,
+        sender_id: state.session.runner_id,
+        state: "blocked",
+        protocol: "error_context",
+        payload: {
+            capacity_alert: true,
+            quarantine_cause: cause,
+            runner_id: state.session.runner_id,
+            detail,
+        },
+        kind: "blocked",
+    }).catch((err) => {
+        process.stderr.write(`[acc-runner] capacity alert post failed: ${err.message}\n`);
+    });
+    void (async () => {
+        try {
+            await state.supabase.rpc("log_activity", {
+                p_verb: "runner.quarantine_enter",
+                p_target_id: state.session.runner_id,
+                p_payload: { cause, task_id: taskId, detail },
+                p_target_type: "runner",
+            });
+        }
+        catch { /* best-effort */ }
+    })();
+}
+/**
+ * v0.56 (T-56-1): enter a capacity pause.
+ *
+ * Triggered when a task OR a review reports capacity_exhausted (Claude
+ * account out of session/usage capacity). The runner:
+ *   - stops claiming tasks AND reviews (pump/pumpReviews bail on the flag);
+ *   - schedules an automatic resume at the stated reset time (or a default
+ *     backoff when none was parseable) plus a small jitter;
+ *   - keeps heartbeating so the board shows online-but-paused, and emits a
+ *     `runner.paused_capacity` activity event + a runner-level bus message
+ *     carrying `resume_at` so health/board surfaces can show WHY the fleet
+ *     is idle (heartbeat_runner's RPC shape is frozen, so the detail is
+ *     carried additively through these existing channels).
+ *
+ * Idempotent: a second capacity hit while already paused only ever pushes
+ * the resume later, never earlier, so a straggler task that 429s a moment
+ * after the first one can't shorten the wait.
+ */
+function enterCapacityPause(state, triggerTaskId, resumeAtIso, detail) {
+    const now = Date.now();
+    const parsed = resumeAtIso ? Date.parse(resumeAtIso) : NaN;
+    const resumeMs = Number.isFinite(parsed) && parsed > now ? parsed : now + state.capacityBackoffMs;
+    const source = Number.isFinite(parsed) && parsed > now ? "reset_time" : "default_backoff";
+    // Already paused: only extend the window, never shorten it.
+    if (state.pausedCapacity && state.pausedUntil !== null && resumeMs <= state.pausedUntil) {
+        return;
+    }
+    state.pausedCapacity = true;
+    state.pausedUntil = resumeMs;
+    if (state.pauseTimer) {
+        clearTimeout(state.pauseTimer);
+        state.pauseTimer = null;
+    }
+    const jitter = state.resumeJitterMs > 0 ? Math.floor(Math.random() * state.resumeJitterMs) : 0;
+    const delay = Math.max(0, resumeMs - now) + jitter;
+    const resumeAtFinal = new Date(now + delay).toISOString();
+    process.stderr.write(chalk.yellow(`[acc-runner] PAUSED (capacity): ${detail}. Not claiming tasks or reviews; ` +
+        `resuming at ${resumeAtFinal} (${source}).\n`));
+    void (async () => {
+        try {
+            await state.supabase.rpc("log_activity", {
+                p_verb: "runner.paused_capacity",
+                p_target_id: state.session.runner_id,
+                p_payload: {
+                    resume_at: resumeAtFinal,
+                    source,
+                    detail,
+                    version: PACKAGE_VERSION,
+                },
+                p_target_type: "runner",
+            });
+        }
+        catch { /* best-effort */ }
+    })();
+    // Runner-level bus message so operators see the paused status + reason on
+    // /messages even though heartbeat_runner itself can't carry a detail field.
+    // Anchored to the triggering task so the RPC can resolve the org scope
+    // (post_agent_message looks up org_id from acc.tasks for a non-null id).
+    void postRunnerStateMessage(state.supabase, {
+        task_id: triggerTaskId,
+        sender_id: state.session.runner_id,
+        state: "blocked",
+        protocol: "info",
+        payload: {
+            capacity_paused: true,
+            runner_id: state.session.runner_id,
+            resume_at: resumeAtFinal,
+            source,
+            detail,
+        },
+        kind: "blocked",
+    }).catch((err) => {
+        process.stderr.write(`[acc-runner] capacity pause bus post failed: ${err.message}\n`);
+    });
+    state.pauseTimer = setTimeout(() => {
+        void resumeFromCapacity(state);
+    }, delay);
+    state.pauseTimer.unref?.();
+}
+/**
+ * v0.56 (T-56-1): resume from a capacity pause.
+ *
+ * Clears the pause and arms the single-probe clamp: the runner claims at
+ * most ONE task to confirm the window actually reopened before resuming
+ * full task concurrency and reviews. If the probe itself 429s, the
+ * completion handler re-enters the pause; if it succeeds, the probe clamp
+ * clears and normal claiming resumes.
+ */
+async function resumeFromCapacity(state) {
+    if (state.stopped)
+        return;
+    state.pausedCapacity = false;
+    state.pausedUntil = null;
+    if (state.pauseTimer) {
+        clearTimeout(state.pauseTimer);
+        state.pauseTimer = null;
+    }
+    state.capacityProbe = true;
+    console.log(chalk.gray(`[acc-runner] capacity window reopened — resuming with a single probe task.`));
+    try {
+        await state.supabase.rpc("log_activity", {
+            p_verb: "runner.resume_capacity",
+            p_target_id: state.session.runner_id,
+            p_payload: { probe: true, version: PACKAGE_VERSION },
+            p_target_type: "runner",
+        });
+    }
+    catch { /* best-effort */ }
+    // Poll first (the stale-running sweep may have re-queued the released task
+    // to another runner; this picks up whatever is still assigned here), then
+    // pump — the probe clamp bounds it to one task.
+    await pollOnce(state, state.taskRunnerFactory);
+    void pump(state, state.taskRunnerFactory);
+}
+/**
+ * v0.10 T-49-2: concurrent task pump.
+ *
+ * Launches up to state.concurrencyLimit tasks in parallel. Each task
+ * gets its own isolated git worktree (prepareTaskWorktree in task-runner)
+ * so there is zero shared-file risk between concurrent runs. Database-side
+ * `claim_task_with_locks` provides a second guard: it rejects a claim when
+ * the task's file scope overlaps another in-flight task.
+ *
+ * Design: rather than `await`ing each task inside a while loop (v0.9
+ * serial behaviour), tasks are launched fire-and-forget. Each task's
+ * `.then()` handler removes it from `state.running` and re-fires pump()
+ * so newly freed capacity immediately picks up the next queued item.
+ * The `pumping` mutex prevents two concurrent pump() invocations from
+ * both launching into the same concurrencyLimit slot.
+ */
+async function pump(state, factory) {
+    if (state.pumping)
+        return;
+    state.pumping = true;
+    try {
+        // v0.48: check quarantine before claiming any task.
+        if (state.quarantined) {
+            process.stderr.write(`[acc-runner] QUARANTINED: runner ${state.session.runner_id} is not claiming tasks.\n` +
+                `[acc-runner] Fix the underlying issue then run \`acc-runner quarantine clear\`.\n`);
+            return;
+        }
+        // v0.56 (T-56-1): out of session/usage capacity — don't claim. Queued
+        // tasks stay queued; the scheduled resume re-drives pump().
+        if (state.pausedCapacity) {
+            return;
+        }
+        // v0.56 (T-56-1): during the post-resume probe window, claim exactly one
+        // task to confirm the session reopened before unleashing full concurrency.
+        const effectiveLimit = state.capacityProbe ? 1 : state.concurrencyLimit;
+        // Fill available concurrency slots from the queue.
+        while (!state.stopped &&
+            !state.quarantined &&
+            !state.pausedCapacity &&
+            state.queue.length > 0 &&
+            state.running.size < effectiveLimit) {
+            const next = state.queue.shift();
+            if (!next)
+                continue;
+            const ctrl = factory(next, {
+                supabase: state.supabase,
+                cfg: state.cfg,
+                session: {
+                    accessToken: state.session.access_token,
+                    runnerId: state.session.runner_id,
+                },
+                publicUrl: state.cfg.publicUrl,
+            });
+            state.running.set(next, ctrl);
+            // Detached completion handler. Runs AFTER pump() returns so the
+            // running Map slot is occupied by the time the while condition
+            // re-checks running.size on the next iteration.
+            void ctrl.promise
+                .then((outcome) => {
+                state.running.delete(next);
+                touchActivity(state); // v0.12.0 (T-52-7): idle clock restarts at task end
+                // v0.56 (T-56-1): capacity exhaustion pauses the WHOLE runner —
+                // never a task_error, never quarantine. The task was left 'running'
+                // for the stale-running sweep to requeue losslessly (runner_id
+                // cleared). Do not re-fire pump for new work; the scheduled resume
+                // does that with a single probe.
+                if (outcome.status === "capacity_paused" || outcome.capacity_exhausted) {
+                    enterCapacityPause(state, next, outcome.resume_at ?? null, outcome.error || "task hit session/usage limit");
+                    return;
+                }
+                // v0.21 T-66-1: a transient git-provision contention requeue. runTask
+                // already returned the task to 'queued' server-side for a clean
+                // retry — NOT a failure (no quarantine, no pause, no retry-budget
+                // burn). Fall through to the pump re-fire below so the runner stays
+                // healthy and the requeued task re-dispatches normally.
+                if (outcome.status === "requeued") {
+                    process.stderr.write(`[acc-runner] task ${next} requeued (transient): ${outcome.error ?? "git provision contention"}\n`);
+                }
+                // v0.14.0 (T-54-2, GA-6): record the claude CLI version at the last
+                // successful task so `doctor` can WARN when claude auto-updates
+                // under the runner. Best-effort and detached — never blocks pump.
+                if (outcome.status === "ok") {
+                    void getClaudeVersion()
+                        .then((v) => recordTaskClaudeVersion(v))
+                        .catch(() => {
+                        /* best-effort cache write */
+                    });
+                }
+                if (outcome.status === "failed") {
+                    const reason = outcome.error?.trim() ||
+                        (outcome.exitCode != null ? `exit ${outcome.exitCode}` : "unknown");
+                    process.stderr.write(`[acc-runner] task ${next} phase=${outcome.phase ?? "unknown"} failed: ${reason}\n`);
+                    // v0.48: machine-level failure → quarantine. Guard with
+                    // !state.quarantined so concurrent tasks don't fire duplicate
+                    // quarantine events when two machine-level failures land
+                    // simultaneously (both already in-flight; only the first to
+                    // resolve sets the flag and writes the audit trail).
+                    if (outcome.quarantine_cause && !state.quarantined) {
+                        const cause = outcome.quarantine_cause;
+                        // v0.49 T-49-6: a transient auth_expired (the access token
+                        // lapsed while the task ran) gets ONE JWT refresh before we
+                        // quarantine. If the refresh recovers, the runner stays
+                        // online and resumes claiming queued work; if it fails — or
+                        // this task already burned its one retry — we quarantine.
+                        // usage_limit / env_broken skip this path: a token refresh
+                        // can't fix a spent quota or a broken host.
+                        if (cause === "auth_expired" && !state.authRetriedTasks.has(next)) {
+                            state.authRetriedTasks.add(next);
+                            process.stderr.write(chalk.yellow(`[acc-runner] auth_expired after task ${next}; attempting one ` +
+                                `token refresh before quarantine.\n`));
+                            void doRefresh(state, factory).then((ok) => {
+                                if (ok) {
+                                    process.stderr.write(chalk.green(`[acc-runner] token refresh recovered auth after task ${next}; ` +
+                                        `staying online.\n`));
+                                    void (async () => {
+                                        try {
+                                            await state.supabase.rpc("log_activity", {
+                                                p_verb: "runner.auth_retry_recovered",
+                                                p_target_id: state.session.runner_id,
+                                                p_payload: { task_id: next, cause },
+                                                p_target_type: "runner",
+                                            });
+                                        }
+                                        catch { /* best-effort */ }
+                                    })();
+                                    // Resume claiming: the freed slot can pick up queued work
+                                    // now that the JWT is fresh.
+                                    void pump(state, factory);
+                                }
+                                else {
+                                    enterQuarantine(state, next, cause, reason, outcome.quarantine_consecutive);
+                                }
+                            });
+                            return;
+                        }
+                        enterQuarantine(state, next, cause, reason, outcome.quarantine_consecutive);
+                        // Quarantined — do not re-fire pump for new tasks.
+                        // Other in-flight tasks (still in state.running) complete
+                        // normally; we just stop accepting new work.
+                        return;
+                    }
+                }
+                // v0.56 (T-56-1): a non-capacity completion (ok, or a genuine
+                // task_error) proves the session window is open — clear the probe
+                // clamp and let reviews resume alongside full task concurrency.
+                if (state.capacityProbe) {
+                    state.capacityProbe = false;
+                    void pumpReviews(state);
+                }
+                // Task done (ok, failed without quarantine, or cancelled).
+                // Re-fire pump so the next queued task can claim the freed slot.
+                void pump(state, factory);
+            })
+                .catch((err) => {
+                state.running.delete(next);
+                touchActivity(state); // v0.12.0 (T-52-7): idle clock restarts at task end
+                process.stderr.write(`[acc-runner] task ${next} crashed: ${err.message}\n`);
+                // v0.56 (T-56-1): a crash is not a capacity signal — clear the probe
+                // clamp so the runner doesn't stay stuck at concurrency 1.
+                if (state.capacityProbe) {
+                    state.capacityProbe = false;
+                    void pumpReviews(state);
+                }
+                void pump(state, factory);
+            });
+        }
+        // v0.56 (T-56-1): the probe found nothing to test with (no queued task at
+        // resume) — clear the clamp and release any held reviews so an idle
+        // resume doesn't strand pending reviews behind a probe that never runs.
+        if (state.capacityProbe && state.running.size === 0 && state.queue.length === 0) {
+            state.capacityProbe = false;
+            void pumpReviews(state);
+        }
+    }
+    finally {
+        state.pumping = false;
+    }
+}
+//# sourceMappingURL=watch.js.map