@tokenfactory/acc-runner 0.44.1 → 0.44.3

package/dist/task-runner.js

@@ -15,25 +15,31 @@
  */
 import fs from "node:fs";
 import { existsSync, unlinkSync } from "node:fs";
+import { createHash } from "node:crypto";
 import os from "node:os";
 import path from "node:path";
 import { join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { execa } from "execa";
 import { canServeRepo, loadProfile as defaultLoadProfile, localRepoPathFor, resolveBaseBranch } from "./config.js";
-import { UNRESOLVED_MODEL, engineResultModel, isPlaceholderModel, normalizeUsage, priceUsdCents, toCliAlias, } from "./cost-pricing.js";
-import { extractResetTime, isCapacityExhausted, isGitProvisionContention, } from "./failure-classifier.js";
-import { getEngine } from "./engines/registry.js";
+import { UNRESOLVED_MODEL, engineResultModel, isPlaceholderModel, normalizeUsage, priceUsdCents, resolveSpawnModel, shouldLogPinRefusal, } from "./cost-pricing.js";
+import { extractResetTime, isGitProvisionContention, } from "./failure-classifier.js";
+import { getEngine, hasEngine } from "./engines/registry.js";
+import { safeText } from "./machine-capabilities/redact.js";
+import { openaiApiKey, openaiApiKeyFromKeychain, codexApiKeySpawnEnv } from "./provider-auth.js";
 import { startTaskGithubBudget, endTaskGithubBudget, isRetryableGithubError, } from "./github-client.js";
 import { git as defaultGit } from "./git.js";
 import { gh as defaultGh } from "./gh.js";
+import { guardPrOpen, prOpenSkippedPayload, PR_OPEN_SKIPPED_EVENT_KIND, } from "./pr-open-guard.js";
 import { composePrBody } from "./pr-body.js";
-import { writeMcpConfig as defaultWriteMcpConfig, } from "./mcp-spawn.js";
+import { evaluateLocAdvisory, locAdvisoryEventPayload, prependLocAdvisory, LOC_ADVISORY_EVENT_KIND } from "./loc-advisory.js";
+import { conformanceEnforceRequested, evaluateConformance, formatConformanceFindings, CONFORMANCE_BLOCK_REASON, CONFORMANCE_EVENT_KIND, } from "./conformance.js";
+import { writeMcpConfig as defaultWriteMcpConfig, readMcpConfig as defaultReadMcpConfig, } from "./mcp-spawn.js";
 import { postRunnerStateMessage as defaultPostRunnerStateMessage, } from "./messaging.js";
 import { branchForTask, prTitleForTask, renderTaskPrompt, } from "./prompt.js";
 import { buildMemoryContext } from "./memory-context.js";
 import { acquireTaskLock as defaultAcquireTaskLock, TaskLockHeldError, } from "./runtime/locks.js";
-import { prepareTaskWorktree as defaultPrepareTaskWorktree, } from "./runtime/worktree.js";
+import { prepareTaskWorktree as defaultPrepareTaskWorktree, WorktreeBranchTakenError, } from "./runtime/worktree.js";
 // v0.21 T-66-1: serialize the per-task worktree-provisioning critical section
 // against the shared clone so concurrent tasks can't collide on git's
 // repo-global locks (the T-65-2 race).
@@ -46,10 +52,14 @@ import { clonePathForRepo, ensureRepoClone, CloneFailedError, } from "./runtime/
 import { parseConflictMeta, resolveConflict, MAX_CONFLICT_ATTEMPTS, } from "./runtime/conflict-resolver.js";
 import { parseReworkMeta, renderReworkPrompt, reconcileReworkBranch as defaultReconcileReworkBranch, fetchPrHeadRef as defaultFetchPrHeadRef, } from "./runtime/rework.js";
 import { assertResolutionIntegrity, isConflictResolutionTask, summariseFailures, } from "./runtime/resolution-integrity.js";
-import { runPreprGate as defaultRunPreprGate, } from "./prepr-gate.js";
+import { depsMissingGateResult, depsStaleGateResult, gateFailureBlockReason, gateRunnerCrashResult, runPreprGate as defaultRunPreprGate, DEPS_MISSING_CLASSIFICATION, DEPS_STALE_CLASSIFICATION, GATE_TOOL_CRASHED_CLASSIFICATION, PREPR_GATE_FAILED_CLASSIFICATION, PREPR_GATES, } from "./prepr-gate.js";
 import { revalidateMigrationSeq as defaultRevalidateMigrationSeq, } from "./migration-seq-guard.js";
 import { commitGuardSkipRequested, gitConfigHooksEnv, installCommitGuardSync, } from "./commit-guard.js";
 import { readLiveAllowedGlobs } from "./locks/index.js";
+import { declaredLockPaths, planClaimLockLoss, } from "./locks/claim-lock-policy.js";
+import { resolveCredentialIdentity } from "./credential-identity.js";
+import { failureDiagnostics } from "./output-diagnostics.js";
+export const PREPR_GATE_MISSING_EVENT = "prepr_gate_missing";
 const LOG_BATCH_BYTES = 4 * 1024;
 // M2 (ENGINE-EXTRACT): the coding engine this runner drives. Wave 1 resolved
 // this to a single module-level `claude-code` constant — spawn, argv,
@@ -65,7 +75,28 @@ const LOG_BATCH_BYTES = 4 * 1024;
 // v0.6.0 REG-296: argv builder for `claude --print`, re-exported from the
 // claude-code engine so the historical import surface is preserved.
 export { buildClaudeArgs } from "./engines/claude-code.js";
-function defaultSpawnClaude(cwd, modelId, engineId) {
+/**
+ * PREPR-GATE-TIMEOUT-VISIBILITY-1: the structured, queryable fields a red gate
+ * contributes to its `error` / `rework_halt` record so a consumer never has to
+ * grep `stderr_tail`. For the `test` gate these name the offending test and,
+ * crucially, whether it TIMED OUT (`failure_kind`) vs asserted — the timeout
+ * vs assertion split the whole gate-triage rework depends on. A non-test gate
+ * (or a test gate whose output was unparseable) contributes nothing, so the
+ * record shape is unchanged for those.
+ */
+function gateFailureRecordFields(fail) {
+    if (fail.gate !== "test" || !fail.test)
+        return {};
+    return {
+        failure_kind: fail.test.timedOut ? "timeout" : "assertion",
+        timed_out: fail.test.timedOut,
+        failing_test: fail.test.primaryId,
+        failing_file: fail.test.file,
+        test_name: fail.test.name,
+        failing_tests: fail.test.failing,
+    };
+}
+function defaultSpawnClaude(cwd, modelId, engineId, codexApiKey = null) {
     // RR-4: install the commit-time mechanical guard into this
     // worktree and point the agent's git at it via an ephemeral core.hooksPath env
     // (never a config-file write). The agent then hits an actionable in-session
@@ -84,8 +115,51 @@ function defaultSpawnClaude(cwd, modelId, engineId) {
             baseEnv = undefined;
         }
     }
+    if (codexApiKey) {
+        // Forward the RESOLVED key explicitly (env OR keychain): the codex engine's
+        // withOpenAiAuth reads OPENAI_API_KEY off baseEnv, so a keychain-only key
+        // that never sits in process.env would otherwise not reach the child.
+        baseEnv = codexApiKeySpawnEnv(codexApiKey, { ...process.env, ...baseEnv });
+    }
     return getEngine(engineId).spawn({ cwd, modelId, baseEnv });
 }
+/**
+ * Read the legacy org fallback knobs without making dispatch depend on them.
+ *
+ * The read runs from the RUNNER process against `org_settings`. If the runner's
+ * Supabase client is not authorised to see org-wide settings (RLS), the query
+ * returns an `error` and fallback would resolve to OFF. That is a legitimate
+ * "no auto-fallback for this runner" outcome, but it must never be SILENT — an
+ * operator who configured `auto_fallback_on_rate_limit` needs to know their
+ * policy could not be read here rather than assume it is in force. So a read
+ * error (or a thrown client) emits an operator-visible stderr warning before
+ * returning disabled. A clean read with no row (policy genuinely unset) is the
+ * quiet, expected default and is NOT warned.
+ */
+export async function loadEngineFallbackPolicy(supabase) {
+    try {
+        const client = supabase;
+        const { data, error } = await client.from("org_settings")
+            .select("auto_fallback_on_rate_limit, default_fallback_model")
+            .maybeSingle();
+        if (error) {
+            const message = error?.message ?? String(error);
+            process.stderr.write(`[acc-runner] engine fallback policy read failed (org_settings): ${message}; ` +
+                `auto-fallback treated as OFF for this task — check that the runner's ` +
+                `Supabase role can read org_settings if you expect a fallback\n`);
+            return { enabled: false, engine: null };
+        }
+        const engine = typeof data?.default_fallback_model === "string"
+            ? data.default_fallback_model.trim().toLowerCase()
+            : "";
+        return { enabled: data?.auto_fallback_on_rate_limit === true, engine: engine || null };
+    }
+    catch (err) {
+        process.stderr.write(`[acc-runner] engine fallback policy read threw (org_settings): ` +
+            `${err.message}; auto-fallback treated as OFF for this task\n`);
+        return { enabled: false, engine: null };
+    }
+}
 async function defaultCheckoutBase(repoPath, baseBranch) {
     // Plain `git checkout <branch>` (not `-B`) so the integration
     // branch's existing ref is honored. With -B we'd reset the
@@ -107,6 +181,22 @@ export function expandHomePath(p) {
 }
 /** Opt-in the cold-parent per-worktree install fallback (default OFF). */
 export const WORKTREE_INSTALL_ENV = "ACC_RUNNER_WORKTREE_INSTALL";
+/**
+ * RUNNER-GATE-VISIBILITY-2: does this checkout actually NEED node_modules? Only
+ * a repo declaring a gate script (typecheck/lint/build/test) can be broken by a
+ * missing one — for a Go/Python clone every gate is `absent` and the pre-PR gate
+ * passes as a no-op, so without this guard the deps short-circuit would HALT
+ * repos over a dependency tree they never had.
+ */
+export async function repoNeedsNodeDeps(dir) {
+    try {
+        const pkg = JSON.parse(await fs.promises.readFile(path.join(dir, "package.json"), "utf8"));
+        return PREPR_GATES.some((g) => typeof pkg.scripts?.[g] === "string");
+    }
+    catch {
+        return false; // absent/unparseable package.json — nothing here needs deps
+    }
+}
 async function worktreePathExists(p) {
     try {
         await fs.promises.access(p);
@@ -195,7 +285,10 @@ export async function ensureWorktreeNodeModules(workdir, repoPath, opts = {}) {
     // A repo_path_hint that points AT the shared clone (no isolated worktree)
     // already has its deps — nothing to seed.
     if (path.resolve(workdir) === path.resolve(repoPath)) {
-        return { linked: [], installed: false, detail: "workdir==repoPath; deps already present" };
+        return {
+            linked: [], installed: false, depsMissing: false,
+            detail: "workdir==repoPath; deps already present",
+        };
     }
     const rootSrc = path.resolve(repoPath, "node_modules");
     const rootDst = path.join(workdir, "node_modules");
@@ -203,7 +296,10 @@ export async function ensureWorktreeNodeModules(workdir, repoPath, opts = {}) {
     if (!parentHasRoot) {
         // Cold parent (e.g. clone-on-demand) — nothing warm to seed from.
         if (await worktreePathExists(rootDst)) {
-            return { linked: [], installed: false, detail: "worktree already has node_modules" };
+            return {
+                linked: [], installed: false, depsMissing: false,
+                detail: "worktree already has node_modules",
+            };
         }
         const installEnabled = (() => {
             const v = env[WORKTREE_INSTALL_ENV]?.trim().toLowerCase();
@@ -214,16 +310,27 @@ export async function ensureWorktreeNodeModules(workdir, repoPath, opts = {}) {
                 `${WORKTREE_INSTALL_ENV} is off — cannot seed deps; the pre-PR gate may fail ` +
                 `on missing binaries. Install deps in the parent clone (recommended) or set ` +
                 `${WORKTREE_INSTALL_ENV}=1 for a per-worktree install.`);
-            return { linked: [], installed: false, detail: "cold parent; install fallback disabled" };
+            return {
+                linked: [], installed: false,
+                depsMissing: await repoNeedsNodeDeps(workdir),
+                detail: "cold parent; install fallback disabled",
+            };
         }
         const install = opts.install ?? defaultWorktreeInstall;
         try {
             await install(workdir);
-            return { linked: [], installed: true, detail: "pnpm install (cold parent — no warm cache)" };
+            return {
+                linked: [], installed: true, depsMissing: false,
+                detail: "pnpm install (cold parent — no warm cache)",
+            };
         }
         catch (err) {
             opts.onLog?.(`[acc-runner] worktree pnpm install failed: ${err.message} — gate may fail`);
-            return { linked: [], installed: false, detail: `install failed: ${err.message}` };
+            return {
+                linked: [], installed: false,
+                depsMissing: await repoNeedsNodeDeps(workdir),
+                detail: `install failed: ${err.message}`,
+            };
         }
     }
     const dirs = await resolveWorkspaceDirs(repoPath);
@@ -250,8 +357,71 @@ export async function ensureWorktreeNodeModules(workdir, repoPath, opts = {}) {
         detail: linked.length
             ? `seeded ${linked.length} node_modules symlink(s) from warm clone`
             : "worktree already provisioned; nothing to seed",
+        depsMissing: false,
     };
 }
+// WORKTREE-STALE-DEPS-1: seeding above assumes byte-identity with the parent
+// clone, but PA-1's rework merge runs AFTER the seed and can advance the
+// worktree's CODE past what the parent installed while the SYMLINKED
+// node_modules stay put. Re-verify post-merge, install in-place on drift.
+/** sha256 hex of a dir's pnpm-lock.yaml, or null when absent (never a false mismatch). */
+export async function lockfileIdentity(dir) {
+    try {
+        const buf = await fs.promises.readFile(path.join(dir, "pnpm-lock.yaml"));
+        return createHash("sha256").update(buf).digest("hex");
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Re-verify (and, if needed, repair) a worktree's seeded deps against its
+ * CURRENT lockfile — call AFTER any merge that could move it past what the
+ * parent last installed (today: PA-1's rework reconcile). Unlike the
+ * cold-parent fallback in `ensureWorktreeNodeModules`, this install is NOT
+ * gated behind `ACC_RUNNER_WORKTREE_INSTALL` — deps already exist here, so
+ * `--prefer-offline` is normally near-instant. Best-effort: never throws.
+ */
+export async function verifyWorktreeDepsFreshness(workdir, repoPath, opts = {}) {
+    if (path.resolve(workdir) === path.resolve(repoPath)) {
+        const hash = await lockfileIdentity(workdir);
+        return {
+            fresh: true, lockfileHash: hash, parentLockfileHash: hash,
+            installed: false, depsMissing: false,
+            detail: "workdir==repoPath; deps already present",
+        };
+    }
+    const [lockfileHash, parentLockfileHash] = await Promise.all([
+        lockfileIdentity(workdir),
+        lockfileIdentity(repoPath),
+    ]);
+    if (lockfileHash === parentLockfileHash) {
+        return {
+            fresh: true, lockfileHash, parentLockfileHash, installed: false, depsMissing: false,
+            detail: "lockfile identity unchanged since seed; symlinked deps still satisfy it",
+        };
+    }
+    const drift = `worktree pnpm-lock.yaml (${lockfileHash?.slice(0, 12) ?? "absent"}) no longer matches ` +
+        `the parent clone's (${parentLockfileHash?.slice(0, 12) ?? "absent"}) the seeded ` +
+        `node_modules were symlinked from`;
+    const install = opts.install ?? defaultWorktreeInstall;
+    try {
+        await install(workdir);
+        return {
+            fresh: true, lockfileHash, parentLockfileHash, installed: true, depsMissing: false,
+            detail: `${drift} — reinstalled in worktree`,
+        };
+    }
+    catch (err) {
+        const detail = `${drift} — reinstall failed: ${err.message}`;
+        opts.onLog?.(`[acc-runner] worktree deps freshness: ${detail}`);
+        return {
+            fresh: false, lockfileHash, parentLockfileHash, installed: false,
+            depsMissing: await repoNeedsNodeDeps(workdir),
+            detail,
+        };
+    }
+}
 /**
  * v0.63 T-63-1: default claude health probe. A silent instant-empty exit is
  * ambiguous — it can be a broken host OR a momentarily-unavailable claude.
@@ -270,6 +440,14 @@ export async function ensureWorktreeNodeModules(workdir, repoPath, opts = {}) {
  * window is left strictly alone; the runner just keeps waiting.
  */
 const STALE_LOCK_RECLAIM_MS = 15 * 60_000;
+/**
+ * CLAIM-LOCK-GLOB: process-local fallback for
+ * RunTaskDeps.claimLossState when the caller (watch.ts in production) supplies
+ * none — a single standalone runTask then still gets correct single-attempt
+ * back-off semantics. watch.ts owns the real per-runner map so attempts persist
+ * across re-dispatch and get cleared when the task leaves the queue.
+ */
+const moduleClaimLossState = new Map();
 /**
  * v0.41.4 default self-heal for a claim conflict: read the conflicting holder
  * tasks' liveness and release the locks of holders that are dead/stale — a
@@ -396,6 +574,47 @@ async function appendEvent(supabase, taskId, kind, payload) {
         process.stderr.write(`[acc-runner] append_task_event failed: ${error.message}\n`);
     }
 }
+function formatBranchReadinessError(files) {
+    const shown = files.length > 0 ? files.slice(0, 12).join(", ") : "(none)";
+    const suffix = files.length > 12 ? `, +${files.length - 12} more` : "";
+    return `no commits on branch, ${files.length} uncommitted changes: ${shown}${suffix}`;
+}
+async function diagnoseNoCommitBranch(git, workdir, baseRef, branch) {
+    const ahead = await git.aheadCount?.(workdir, baseRef, branch);
+    if (ahead == null || ahead > 0)
+        return null;
+    const files = await git.changedFiles?.(workdir) ?? [];
+    return { ahead, files };
+}
+async function ensureBranchReadyForPr(git, workdir, baseRef, branch, taskId) {
+    let files = await git.changedFiles?.(workdir) ?? [];
+    if (files.length > 0 && git.commitAll) {
+        try {
+            await git.commitAll(workdir, `chore(acc): commit runner work for ${taskId}`);
+        }
+        catch (err) {
+            return {
+                ok: false,
+                reason: `could not commit ${files.length} uncommitted changes: ${files.join(", ")}; ` +
+                    `${err.message}`,
+                files,
+            };
+        }
+        files = await git.changedFiles?.(workdir) ?? [];
+    }
+    const ahead = await git.aheadCount?.(workdir, baseRef, branch);
+    if (ahead != null && ahead < 1) {
+        return { ok: false, reason: formatBranchReadinessError(files), files };
+    }
+    if (files.length > 0) {
+        return {
+            ok: false,
+            reason: `branch has ${files.length} uncommitted changes: ${files.join(", ")}`,
+            files,
+        };
+    }
+    return { ok: true };
+}
 async function streamToEvents(stream, supabase, taskId, streamName) {
     let captured = "";
     let pending = "";
@@ -478,6 +697,15 @@ async function setTaskPr(supabase, taskId, prUrl) {
     }
     return true;
 }
+async function recordPreprGateMissing(supabase, taskId, payload) {
+    await appendEvent(supabase, taskId, "log", {
+        phase: "prepr_gate",
+        stream: "stderr",
+        event: PREPR_GATE_MISSING_EVENT,
+        gate_verdict: "missing",
+        ...payload,
+    });
+}
 /**
  * v0.53 T-53-4: emit a `task.first_commit` activity event the first time a
  * task's worktree produces a commit on its branch (the SLO funnel signal
@@ -492,7 +720,10 @@ async function setTaskPr(supabase, taskId, prUrl) {
  */
 async function emitFirstCommit(supabase, git, taskId, workdir, baseRef, branch) {
     try {
-        const first = await git.firstCommit?.(workdir, baseRef, branch);
+        // The worktree is on a DETACHED HEAD (no local `branch` ref exists), so
+        // range against HEAD; the shared branch name is still recorded in the
+        // payload below.
+        const first = await git.firstCommit?.(workdir, baseRef, "HEAD");
         if (!first)
             return;
         const { error } = await supabase.rpc("log_activity", {
@@ -755,14 +986,33 @@ export function runTask(taskId, deps) {
     const prepareWorktree = deps.prepareWorktree ?? defaultPrepareTaskWorktree;
     const provisionRepoClone = deps.provisionRepoClone ?? ensureRepoClone;
     const postCostEvent = deps.postCostEvent ?? ((event) => defaultPostCostEvent(deps.supabase, event));
+    const buildCostEventForRun = deps.buildCostEvent ?? buildCostEvent;
     const postState = deps.postRunnerStateMessage ??
         ((args) => defaultPostRunnerStateMessage(deps.supabase, args));
     const loadProfile = deps.loadProfile ?? defaultLoadProfile;
     const loadPromptPreludeFn = deps.loadPromptPrelude ?? loadPromptPrelude;
     // NS MM-2: same reason as `spawnClaude` above — `healthProbe`'s default
     // binds below, after the task (and its `engine`) is fetched.
-    const runPreprGate = deps.runPreprGate ??
+    const runPreprGateRaw = deps.runPreprGate ??
         ((workdir, baseRef) => defaultRunPreprGate(workdir, { baseRef }));
+    /**
+     * RUNNER-GATE-VISIBILITY-2: set to the parent clone path by the deps seeding
+     * below when the worktree was left without node_modules. The wrapper under it
+     * then fails the gate as `deps` — a distinct, actionable class — instead of
+     * letting `pnpm typecheck` die "tsc: command not found" and charging the task
+     * with a typecheck failure it did not cause. Short-circuits BEFORE any gate
+     * runs; running them would only burn minutes to reach the same conclusion.
+     */
+    let worktreeDepsMissing = null;
+    // WORKTREE-STALE-DEPS-1: set when a rework merge left the worktree's seeded
+    // deps stale and the remediation install couldn't fix it. Distinct from
+    // `worktreeDepsMissing` (nothing was ever seeded) so triage names the right fault.
+    let worktreeDepsStale = null;
+    const runPreprGate = async (workdir, baseRef) => worktreeDepsMissing !== null
+        ? depsMissingGateResult(worktreeDepsMissing)
+        : worktreeDepsStale !== null
+            ? depsStaleGateResult(worktreeDepsStale.repoPath, worktreeDepsStale.detail)
+            : runPreprGateRaw(workdir, baseRef);
     const reconcileRework = deps.reconcileReworkBranch ?? defaultReconcileReworkBranch;
     const revalidateSeq = deps.revalidateMigrationSeq ??
         ((workdir, opts) => defaultRevalidateMigrationSeq(workdir, opts));
@@ -772,6 +1022,12 @@ export function runTask(taskId, deps) {
         ((wd, repo) => ensureWorktreeNodeModules(wd, repo, {
             onLog: (line) => process.stderr.write(`${line}\n`),
         }));
+    // WORKTREE-STALE-DEPS-1: default re-verifies seeded deps against the
+    // worktree's CURRENT lockfile; logs via stderr so a doctor can see it.
+    const verifyDepsFreshness = deps.verifyWorktreeDepsFreshness ??
+        ((wd, repo) => verifyWorktreeDepsFreshness(wd, repo, {
+            onLog: (line) => process.stderr.write(`${line}\n`),
+        }));
     // Silence the unused-binding lint for `checkoutBase` — v0.11-F supersedes
     // the v0.6.0 REG-301 pre-spawn `git checkout <baseBranch>` with the
     // worktree's `add -B <branch> <path> <baseBranch>` start-point semantics,
@@ -793,6 +1049,45 @@ export function runTask(taskId, deps) {
             payload,
         });
     };
+    /**
+     * RUNNER-GATE-VISIBILITY-2: the ONE way this runner parks a task at `blocked`
+     * (the transient capacity-pause hop excepted — it is `blocked`→`queued` inside
+     * two awaits and already carries its own `capacity_paused:` reason).
+     *
+     * Live 2026-08-27: reworks blocked four times with `block_reason = null`, the
+     * only trace of WHY living in the runner's local log — invisible on the board.
+     * `acc.transition_task` has always stamped `acc.tasks.block_reason` and the
+     * `task.status_changed` activity payload from `p_reason`; the runner just
+     * never passed it. The `task.blocked` event next to it is the SECOND record:
+     * it survives even when the RPC REJECTS the edge (invalid transition, task
+     * already terminal) — exactly the case that previously left no trace at all.
+     *
+     * `reason` is a machine-readable token from the prepr-gate vocabulary
+     * (`deps-missing`, `prepr_gate_failed:<gate>`, `gate_tool_crashed:<gate>`) or
+     * a bare class like `rework_integration_conflict`; the class is everything
+     * before the first colon. Never throws — a HALT is already the bad path, and
+     * losing the audit line must not also lose the HALT.
+     */
+    const transitionBlocked = async (reason, context = {}) => {
+        const { error } = await deps.supabase.rpc("transition_task", {
+            p_task_id: taskId,
+            p_new_status: "blocked",
+            p_reason: reason,
+        });
+        if (error) {
+            process.stderr.write(`[acc-runner] transition_task(blocked, ${reason}) failed for ${taskId}: ` +
+                `${error.message}\n`);
+        }
+        await appendEvent(deps.supabase, taskId, "log", {
+            stream: "stderr",
+            event: "task.blocked",
+            error_class: reason.split(":")[0],
+            block_reason: reason,
+            transition_ok: !error,
+            runner_id: deps.session.runnerId,
+            ...context,
+        });
+    };
     // v0.6.1 (v0.11-D): release lock rows on every terminal exit path
     // below the claim. Best-effort — a release failure logs to stderr
     // but does not change the outcome the runner reports to the caller.
@@ -808,6 +1103,42 @@ export function runTask(taskId, deps) {
             process.stderr.write(`[acc-runner] release_task_locks(${taskId}) failed: ${error.message}\n`);
         }
     };
+    // RUNNER-CURRENT-TASK-DEAD-1: keep acc.runners.current_task_id tracking
+    // reality. The column is READ by 13 sites (idle-first reviewer routing,
+    // review assignment, lifecycle-reconcile's ownership gate, fleet-health "what
+    // is this runner doing", the ops-board join) but was WRITTEN by nothing — the
+    // only writer was runner-reconcile.ts, which CLEARS it — so every runner read
+    // as idle while executing. We SET it to this task on a successful claim and
+    // CLEAR it (guarded) on every post-claim exit via the outer finally, making
+    // runner-reconcile.ts the backstop it was meant to be rather than the only
+    // writer. This is a direct self-update, NOT an RPC: the runner's JWT `sub` is
+    // its bound_user_id (api/runner/mint-token.ts), so the `runners_heartbeat_update`
+    // RLS policy (bound_user_id = auth.uid()) authorises writing its own row;
+    // adding an RPC would need a migration this task forbids. Best-effort: a
+    // failed pointer write is logged but NEVER aborts or fails the task (parity
+    // with releaseLocks / updateSignal above).
+    const writeRunnerCurrentTask = async (value) => {
+        try {
+            let q = deps.supabase
+                .from("runners")
+                .update({ current_task_id: value })
+                .eq("id", deps.session.runnerId);
+            // Guard the CLEAR so a sibling task that claimed this runner after us
+            // (concurrency > 1) is not clobbered — its own finally clears its claim.
+            // The SET is unconditional: the newest claim wins the single-value column.
+            if (value === null)
+                q = q.eq("current_task_id", taskId);
+            const { error } = await q;
+            if (error) {
+                process.stderr.write(`[acc-runner] runners.current_task_id write (${value ?? "null"}) ` +
+                    `failed for ${taskId}: ${error.message}\n`);
+            }
+        }
+        catch (err) {
+            process.stderr.write(`[acc-runner] runners.current_task_id write (${value ?? "null"}) ` +
+                `threw for ${taskId}: ${err.message}\n`);
+        }
+    };
     // v0.12-RESUME — periodic signal loop. After the claim succeeds we
     // bump acc.tasks.last_runner_signal_at every signalIntervalMs ms so
     // the v0.12 /5m sweep distinguishes "runner alive, work in flight"
@@ -885,6 +1216,33 @@ export function runTask(taskId, deps) {
         //    against other running tasks' locks, INSERTs a lock row +
         //    transitions to running in one transaction. On overlap or
         //    same-task race the task stays queued for another runner.
+        //
+        // CLAIM-LOCK-GLOB: resolve this task's FILE-granular lock
+        // scope up front (AC1). declaredLockPaths keeps only concrete files from the
+        // live allowed[] — a broad directory glob is authorization scope, not lock
+        // scope, so it acquires no directory-wide lock. Migration 0353 mirrors this
+        // in SQL (acc._declared_lock_paths) so the DB overlap key is file-granular
+        // too; this read is a best-effort breadcrumb + input to the conflict
+        // back-off below and never fails the claim.
+        let claimLockScope = [];
+        try {
+            claimLockScope = declaredLockPaths(await readLiveAllowedGlobs(deps.supabase, taskId));
+        }
+        catch (err) {
+            process.stderr.write(`[acc-runner] claim-lock scope read for ${taskId} failed (continuing): ${err.message}\n`);
+        }
+        // AC2: an empty declared set (no concrete files — an authorization-scope-only
+        // glob task, or an empty allowed[]) holds NO file lock, so it never contends
+        // on files and never serializes behind a directory-sharing sibling.
+        await appendEvent(deps.supabase, taskId, "log", {
+            phase: "claim_locks",
+            stream: "stderr",
+            lock_paths: claimLockScope,
+            message: claimLockScope.length === 0
+                ? "no concrete file locks (authorization-scope-only globs); claim does not contend on files"
+                : `file-granular claim lock scope: ${claimLockScope.join(", ")}`,
+            runner_id: deps.session.runnerId,
+        });
         const claim = await deps.supabase.rpc("claim_task_with_locks", {
             p_task_id: taskId,
             p_runner_id: deps.session.runnerId,
@@ -943,22 +1301,88 @@ export function runTask(taskId, deps) {
             }
             if (claimResult.ok !== true) {
                 conflicts = Array.isArray(claimResult.conflicts) ? claimResult.conflicts : conflicts;
-                await appendEvent(deps.supabase, taskId, "log", {
-                    phase: "claim_locks",
-                    stream: "stderr",
-                    conflicts,
-                    message: `file-lock conflict — other tasks hold overlapping paths: ${conflicts.join(", ")}`,
-                    runner_id: deps.session.runnerId,
+                // Conflict set exactly [self] = the `same_task_different_runner`
+                // refusal (returns array[p_task_id]); file-overlap can never contain
+                // self. Evidence: docs/acc/RUNNER_CACHE_STATE.md.
+                const otherConflicts = conflicts.filter((c) => c && c !== taskId);
+                const selfConflictOnly = conflicts.includes(taskId) && otherConflicts.length === 0;
+                if (selfConflictOnly) {
+                    await appendEvent(deps.supabase, taskId, "log", {
+                        phase: "claim_locks",
+                        stream: "stderr",
+                        conflicts,
+                        // Says what actually happens: this attempt ends; the task is left
+                        // to the lock holder. This branch requeues nothing.
+                        message: `file-lock claim race - ${taskId} is already locked by another runner; abandoning this attempt and leaving the task to the lock holder`,
+                        runner_id: deps.session.runnerId,
+                    });
+                    // Greppable breadcrumb for the shape that has twice sent an
+                    // investigation to the wrong subsystem. Best-effort only.
+                    // `benign`/`released_own_locks` are the diagnostic trail this
+                    // documents: this is a same-task claim race (not a fault), and
+                    // the loser leaves without touching the holder's lock row.
+                    try {
+                        await deps.supabase.rpc("log_activity", {
+                            p_verb: "runner.claim_self_conflict_race",
+                            p_target_id: deps.session.runnerId,
+                            p_payload: {
+                                task_id: taskId,
+                                conflicts,
+                                cause: "same_task_different_runner",
+                                benign: true,
+                                released_own_locks: false,
+                            },
+                            p_target_type: "runner",
+                        });
+                    }
+                    catch { /* breadcrumb only */ }
+                    return {
+                        taskId,
+                        status: "failed",
+                        phase: "claim_locks",
+                        error: `file-lock claim race: ${taskId} already locked by another runner`,
+                    };
+                }
+                // CLAIM-LOCK-GLOB: a real file-overlap CONTENTION — a
+                // live task holds one of our concrete files. Advance the per-task
+                // claim-loss state so the retry loop backs off after
+                // CLAIM_LOCK_MAX_FAST_ATTEMPTS (AC3) and records exactly ONE conflict
+                // event per contention episode (AC4) instead of one per re-dispatch.
+                const lossState = deps.claimLossState ?? moduleClaimLossState;
+                const nowMs = (deps.now ?? Date.now)();
+                const decision = planClaimLockLoss(lossState.get(taskId), otherConflicts, nowMs);
+                lossState.set(taskId, {
+                    attempts: decision.attempts,
+                    eventRecorded: decision.eventRecorded,
+                    firstConflictAtMs: decision.firstConflictAtMs,
                 });
-                const reason = `file-lock conflict with: ${conflicts.join(", ") || "(unknown)"}`;
+                if (decision.event) {
+                    await appendEvent(deps.supabase, taskId, "log", {
+                        phase: decision.event.phase,
+                        stream: "stderr",
+                        // Raw conflict set preserved verbatim for the audit trail; the
+                        // human message below names only the OTHER holders.
+                        conflicts,
+                        lock_paths: claimLockScope,
+                        message: `file-lock conflict - other tasks hold overlapping paths: ${otherConflicts.join(", ")}`,
+                        runner_id: deps.session.runnerId,
+                    });
+                }
                 return {
                     taskId,
                     status: "failed",
                     phase: "claim_locks",
-                    error: reason,
+                    error: decision.event?.message
+                        ?? `file-lock conflict with: ${otherConflicts.join(", ") || "(unknown)"}`,
+                    claim_lock_attempts: decision.attempts,
+                    claim_lock_yield_until_ms: decision.yieldUntilMs,
                 };
             }
         }
+        // CLAIM-LOCK-GLOB: the claim landed — this task is no
+        // longer contending, so drop any accumulated claim-loss back-off state so a
+        // future re-dispatch starts fresh from attempt 1.
+        (deps.claimLossState ?? moduleClaimLossState).delete(taskId);
         // v0.6.1 (v0.11-D): every exit path below the successful claim
         // must release the lock row so the same paths free up for the
         // next runner. try/finally captures returns AND uncaught throws
@@ -1015,6 +1439,11 @@ export function runTask(taskId, deps) {
             // RPC still runs the finally (stop loop, release locks).
             await updateSignal();
             scheduleSignal();
+            // RUNNER-CURRENT-TASK-DEAD-1: now that the claim landed (tasks.runner_id is
+            // this runner and the task is 'running'), stamp the runner's own pointer so
+            // fleet health / reviewer routing see it as busy. Cleared unconditionally in
+            // the outer finally on every exit below.
+            await writeRunnerCurrentTask(taskId);
             // v0.14-MESSAGING-RUNTIME-WIRE: first bus event — runner has the
             // claim, will now fetch + spawn. planner subscribes via /messages.
             await postState_("planning", "info", { runner_id: deps.session.runnerId });
@@ -1046,12 +1475,41 @@ export function runTask(taskId, deps) {
             // pre-MM-1 row) resolves the same default Wave 1 always used, so this is
             // byte-identical for the all-claude-code fleet. Every spawn/parse/classify
             // call below drives THIS engine instead of a fixed module-level default.
-            const taskEngineId = task.engine ?? null;
-            const taskEngine = getEngine(taskEngineId);
+            let taskEngineId = task.engine ?? null;
+            // CAPS-ENGINES-STALE-KEYCHAIN-1 (AC12): guard the resolution — an engine the
+            // router pinned but this live process cannot resolve is a caps self-
+            // inconsistency. Drop it from caps (onUnknownAdvertisedEngine), emit the
+            // distinct signal, and requeue — never surface a repeatable reviewer_error.
+            let taskEngine;
+            try {
+                taskEngine = getEngine(taskEngineId);
+            }
+            catch (err) {
+                // AC12: an engine the router pinned but this process cannot resolve is a
+                // caps self-inconsistency. Drop it from caps (onUnknownAdvertisedEngine)
+                // and emit the distinct signal so a repeat routing is prevented — THEN
+                // re-throw, preserving upstream's unknown-engine guard (the task hard-fails
+                // and never reaches a CLI; see task-runner-engine-dispatch.test.ts).
+                // AC6: the event payload is redacted via safeText (CREDENTIAL_SHAPES).
+                const safeMsg = safeText(err.message, 300) ?? "unresolved engine";
+                const safeEngine = taskEngineId ? (safeText(taskEngineId, 80) ?? "<redacted>") : null;
+                if (taskEngineId) {
+                    await deps.onUnknownAdvertisedEngine?.(taskEngineId, err);
+                    await appendEvent(deps.supabase, taskId, "runner.engine_caps_self_inconsistent", {
+                        engine: safeEngine,
+                        error: safeMsg,
+                        runner_id: deps.session.runnerId,
+                    });
+                }
+                throw err;
+            }
+            // Upstream (CAPACITY-EXIT-ENGINE-BLIND / engine fallback): kept intact.
+            const fallbackPolicy = await loadEngineFallbackPolicy(deps.supabase);
+            let codexApiKey = null;
             // `spawnClaude`/`healthProbe` bind here (not in the sync prologue above)
             // because their defaults need `taskEngineId`, which isn't known until now.
             const spawnClaude = deps.spawnClaude ??
-                ((cwd, modelId) => defaultSpawnClaude(cwd, modelId, taskEngineId));
+                ((cwd, modelId) => defaultSpawnClaude(cwd, modelId, taskEngineId, codexApiKey));
             const healthProbe = deps.healthProbe ?? (() => defaultHealthProbe(taskEngineId));
             // LOCK-LIFECYCLE-WIRE: re-read the task's CURRENT file
             // scope from the live row so an operator who narrowed a QUEUED task between
@@ -1403,6 +1861,164 @@ export function runTask(taskId, deps) {
                     error: `conflict-resolution integrity guardrail rejected resolution (${summary})`,
                 };
             };
+            /**
+             * PREPR-GATE-CRASH-CLASS-1: route a gate whose TOOL CRASHED (see
+             * prepr-gate.ts `GATE_TOOL_CRASHED_CLASSIFICATION` for the 2026-08-28
+             * incident) as INFRA, never as a verdict on the diff. A crashed tool judged
+             * nothing, so: the task is NEVER transitioned to `failed`; an already-open
+             * PR is NEVER discarded (the task stays where the PR flow expects it —
+             * needs-review — and CI is the arbiter); otherwise it parks at `blocked`
+             * with block_reason `gate_tool_crashed:<gate>`, which is still fail-CLOSED
+             * because no PR is opened off a check that never ran.
+             */
+            const handleGateToolCrash = async (result, crash, rework) => {
+                // Advisory probe: a GitHub hiccup must never be what decides this, so an
+                // unreadable probe degrades to "no PR" — and that route is `blocked`,
+                // never `failed`, anyway.
+                let openPrUrl = null;
+                try {
+                    openPrUrl = await gh.findOpenPR(workdir, branch);
+                }
+                catch {
+                    openPrUrl = null;
+                }
+                const prNumber = reworkMeta?.pr_number ?? task.pr_number ?? null;
+                const summary = `pre-PR ${crash.gate} gate TOOL CRASHED (${crash.signature}, ` +
+                    `${crash.attempts} attempt(s)) — infra, not a verdict`;
+                await appendEvent(deps.supabase, taskId, "error", {
+                    phase: "prepr_gate",
+                    error_class: GATE_TOOL_CRASHED_CLASSIFICATION,
+                    failed_gate: crash.gate,
+                    exit_code: crash.exitCode,
+                    signal: crash.signal,
+                    crash_signature: crash.signature,
+                    attempts: crash.attempts,
+                    block_reason: crash.blockReason,
+                    gates_ran: result.ran,
+                    pr_url: openPrUrl,
+                    pr_number: prNumber,
+                    rework,
+                    reviewer_notice: crash.reviewerNotice,
+                    stderr_tail: crash.outputTail,
+                    runner_id: deps.session.runnerId,
+                });
+                // A fresh task whose PR is ALREADY open (an earlier attempt pushed it):
+                // CI is judging that exact head and a crashed local tool cannot overrule
+                // it. Re-stamp the PR (running → needs-review; a no-op refresh when the
+                // task is already needs-review) and hand it back to the PR flow. Rework
+                // is excluded on purpose: its fixes were NOT pushed, so flipping it to
+                // needs-review would re-review the identical head.
+                if (openPrUrl && !rework) {
+                    await setTaskPr(deps.supabase, taskId, openPrUrl);
+                    await postState_("done", "info", {
+                        runner_id: deps.session.runnerId,
+                        pr_url: openPrUrl,
+                        error_class: GATE_TOOL_CRASHED_CLASSIFICATION,
+                        failed_gate: crash.gate,
+                        skipped_reason: "gate_tool_crashed_pr_open",
+                    });
+                    return { taskId, status: "ok", prUrl: openPrUrl, exitCode: 0 };
+                }
+                await postState_("blocked", "error_context", {
+                    task_id: taskId,
+                    phase: "review",
+                    error_class: GATE_TOOL_CRASHED_CLASSIFICATION,
+                    failed_gate: crash.gate,
+                    block_reason: crash.blockReason,
+                    pr_number: prNumber,
+                    stderr_tail: crash.reviewerNotice,
+                });
+                // A park that cannot land leaves the task exactly as it is — still never
+                // `failed` — for the stale-running sweep / operator to pick up. RUNNER-
+                // GATE-VISIBILITY-2 routes it through the shared parker so the crash's
+                // OWN block_reason (built by prepr-gate.ts, never re-derived here) also
+                // lands on a `task.blocked` event.
+                await transitionBlocked(crash.blockReason, {
+                    phase: "prepr_gate",
+                    failed_gate: crash.gate,
+                    rework,
+                });
+                return {
+                    taskId,
+                    status: "failed",
+                    phase: "prepr_gate",
+                    exitCode: crash.exitCode,
+                    error: summary,
+                };
+            };
+            /**
+             * PREPR-CONFORMANCE-GATE-1: the mechanical pre-PR conformance pass, fired
+             * only when a finding was COMPUTED. DEFAULT is ADVISORY (record + OPEN the
+             * PR): a HARD-blocking check must be corpus-validated first, so until an
+             * operator opts in a false positive can never block a real PR. ENFORCE
+             * (opt-in) HARD-fails: fresh → `failed` with a REAL `error` task_event
+             * carrying the findings, so failed-task-triage re-dispatches them
+             * (classifyFixableFailure) under the bounded rework budget; rework → HALT
+             * `blocked` (board + bus agree). ACC_RUNNER_SKIP_CONFORMANCE=1 bypasses it.
+             */
+            const runConformanceGate = async (rework, capturedStdout) => {
+                const skip = (process.env.ACC_RUNNER_SKIP_CONFORMANCE ?? "").trim().toLowerCase();
+                if (["1", "true", "yes", "on"].includes(skip))
+                    return null;
+                // Same diff the PR-open path uses; one we cannot compute fails OPEN.
+                const diff = await git
+                    .diff?.(workdir, `origin/${integrationBranch}`, branch)
+                    .catch(() => undefined);
+                if (diff == null)
+                    return null;
+                const report = extractReportFromOutput(capturedStdout, taskEngineId);
+                let prBody = report;
+                try {
+                    prBody = composePrBody(report, diff, { acceptance: task.acceptance });
+                }
+                catch { /* raw report */ }
+                const result = evaluateConformance({
+                    diff, acceptance: task.acceptance, forbidden: task.forbidden, prBody,
+                });
+                if (result.ok)
+                    return null;
+                const feedback = formatConformanceFindings(result.findings);
+                const kinds = result.findings.map((f) => f.kind);
+                // ADVISORY (default): record + OPEN THE PR. No fail, no block.
+                if (!conformanceEnforceRequested(process.env)) {
+                    await appendEvent(deps.supabase, taskId, CONFORMANCE_EVENT_KIND, {
+                        phase: "conformance_gate", mode: "advisory",
+                        finding_kinds: kinds, findings: result.findings, rework, feedback,
+                        runner_id: deps.session.runnerId,
+                    });
+                    return null;
+                }
+                // ENFORCE: a REAL `error` task_event carries the findings (AC5) — its
+                // error_class/phase route failed-task-triage to a bounded auto-rework that
+                // feeds `stderr_tail` back as the retry (never a blind runner_drop retry).
+                await appendEvent(deps.supabase, taskId, "error", {
+                    phase: "conformance_gate",
+                    error_class: CONFORMANCE_BLOCK_REASON,
+                    block_reason: CONFORMANCE_BLOCK_REASON,
+                    finding_kinds: kinds, findings: result.findings, rework,
+                    stderr_tail: feedback,
+                    runner_id: deps.session.runnerId,
+                });
+                if (rework) {
+                    // HALT for an operator: board `blocked` AND bus `blocked` — they AGREE.
+                    await postState_("blocked", "error_context", {
+                        task_id: taskId, phase: "review",
+                        error_class: CONFORMANCE_BLOCK_REASON, block_reason: CONFORMANCE_BLOCK_REASON,
+                        stderr_tail: feedback,
+                    });
+                    await transitionBlocked(CONFORMANCE_BLOCK_REASON, { phase: "conformance_gate", rework: true });
+                }
+                else {
+                    // Fresh → board `failed` (triage owns it). No contradictory `blocked` bus
+                    // post — a task failing into triage is not parked-for-operator.
+                    await deps.supabase.rpc("transition_task", { p_task_id: taskId, p_new_status: "failed" });
+                }
+                return {
+                    taskId, status: "failed", phase: "conformance_gate", exitCode: 1,
+                    error: `pre-PR conformance failed (${CONFORMANCE_BLOCK_REASON}: ${kinds.join(", ")}) — ` +
+                        (rework ? "re-push withheld for operator review" : "PR not opened"),
+                };
+            };
             /**
              * MIG-SEQ-GUARD: last thing before `git push`, re-validate this branch's
              * NEW migration seq against a FRESHLY-FETCHED integration head. The seq was
@@ -1453,6 +2069,13 @@ export function runTask(taskId, deps) {
                     file: result.move.file,
                     new_file: result.move.newFile,
                     remote_max_seq: result.remoteMaxSeq ?? null,
+                    // AC4: the classification that decided this WAS the branch's own collision
+                    // to renumber (not an inherited migration — those are excluded, #2132).
+                    upstream_seq_collided: result.move.upstreamSeq,
+                    identical_modulo_seq: result.move.identicalModuloSeq,
+                    reachable_from_target: result.move.reachableFromTarget,
+                    // AC5: files rewritten OUTSIDE supabase/migrations/ (never silent).
+                    refs_rewritten_outside_migrations: result.move.refsRewrittenOutside,
                     message: result.detail,
                     renumber_output: result.move.output,
                     runner_id: deps.session.runnerId,
@@ -1500,9 +2123,9 @@ export function runTask(taskId, deps) {
                 // 3. Repo prep. v0.11-F: fetch on the shared clone (worktree
                 // shares the object store) then provision an isolated worktree
                 // at ~/.cache/acc-runner/work/<task_id>/ forked from the
-                // integration branch. The redundant `git.checkout -B <branch>`
-                // is a no-op inside the new worktree — kept so the v0.6.0
-                // checkout seam stays observable in unit tests.
+                // integration branch. WORKTREE-BRANCH-COLLISION: the worktree is
+                // checked out DETACHED (never on the task branch), so it reserves
+                // no branch and cannot collide with a sibling instance's clone.
                 try {
                     // v0.19 T-64-1: cut a FRESH task branch from the LATEST
                     // integration tip, not a stale LOCAL ref. `git.fetch` runs
@@ -1594,29 +2217,29 @@ export function runTask(taskId, deps) {
                             taskId,
                             branch,
                             baseBranch: worktreeBaseBranch,
+                            owner: {
+                                runnerId: deps.session.runnerId,
+                                pid: process.pid,
+                                startedAt: new Date().toISOString(),
+                            },
                         });
                     });
                     workdir = worktree.path;
-                    // v0.12-RESUME: log resume-vs-fresh so an operator can audit
-                    // how often the resume path actually fires. `resumed: true`
-                    // means a prior runner crashed mid-task, the v0.12 sweep
-                    // returned the task to queued, and this runner picked it
-                    // back up with the prior worktree intact. Claude reads the
-                    // partially-committed state and continues; the spawn is the
-                    // same prompt either way (Claude is idempotent enough that
-                    // re-running on a partially-edited worktree converges on
-                    // the right final state).
-                    if (worktree.resumed) {
-                        await appendEvent(deps.supabase, taskId, "log", {
-                            phase: "git",
-                            stream: "stdout",
-                            event: "worktree.resumed",
-                            worktree_path: workdir,
-                            branch,
-                            runner_id: deps.session.runnerId,
-                        });
-                    }
-                    await git.checkout(workdir, branch);
+                    // Log resume-vs-fresh, and record worktree_path on SUCCESS too (not
+                    // only on resume/failure) so a later-abandoned worktree is
+                    // discoverable for salvage by path.
+                    await appendEvent(deps.supabase, taskId, "log", {
+                        phase: "git",
+                        event: worktree.resumed ? "worktree.resumed" : "worktree.ready",
+                        worktree_path: workdir,
+                        branch,
+                        runner_id: deps.session.runnerId,
+                    });
+                    // WORKTREE-BRANCH-COLLISION: the worktree stays on a DETACHED HEAD for
+                    // its whole life so it never reserves the task branch in the shared
+                    // clone (checking the branch out here would re-introduce the exit-128
+                    // collision and re-poison the branch on abandonment). The branch is
+                    // materialized only at push time (git.push -> HEAD:refs/heads/<branch>).
                     // FU-9 (CHAT-RT): seed node_modules into the fresh worktree NOW — before
                     // Claude spawns AND before the pre-PR gate — so `pnpm typecheck` finds
                     // tsc/eslint/vite instead of dying "sh: tsc: command not found" (a fresh
@@ -1626,6 +2249,8 @@ export function runTask(taskId, deps) {
                     try {
                         const dep = await ensureWorktreeDeps(workdir, repoPath);
                         if (dep.linked.length > 0 || dep.installed) {
+                            // WORKTREE-STALE-DEPS-1 (AC3): the parent's lockfile identity — what the symlinked deps satisfy.
+                            const lockfileHash = await lockfileIdentity(repoPath);
                             await appendEvent(deps.supabase, taskId, "log", {
                                 phase: "git",
                                 stream: "stdout",
@@ -1633,6 +2258,25 @@ export function runTask(taskId, deps) {
                                 linked: dep.linked,
                                 installed: dep.installed,
                                 detail: dep.detail,
+                                lockfile_hash: lockfileHash,
+                                runner_id: deps.session.runnerId,
+                            });
+                        }
+                        else if (dep.depsMissing) {
+                            // RUNNER-GATE-VISIBILITY-2: arm the `deps` short-circuit NOW, while
+                            // we still know WHICH parent clone is cold, and record it here so
+                            // the operator sees the environment fault the moment it happens —
+                            // not only when the gate later HALTs, and never disguised as a
+                            // typecheck failure.
+                            worktreeDepsMissing = repoPath;
+                            await appendEvent(deps.supabase, taskId, "log", {
+                                phase: "git",
+                                stream: "stderr",
+                                event: "worktree.deps_missing",
+                                error_class: DEPS_MISSING_CLASSIFICATION,
+                                block_reason: DEPS_MISSING_CLASSIFICATION,
+                                repo_path: repoPath,
+                                detail: dep.detail,
                                 runner_id: deps.session.runnerId,
                             });
                         }
@@ -1643,6 +2287,26 @@ export function runTask(taskId, deps) {
                 }
                 catch (err) {
                     const msg = err.message;
+                    // WORKTREE-BRANCH-COLLISION-ACROSS-INSTANCES-1: the task branch is held
+                    // by a worktree in ANOTHER instance (or an abandoned worktree). TRANSIENT
+                    // infra, not a task failure: requeue (never dead-letter / rework-cycle /
+                    // retry-cap burn), mirroring the git_provision_contention exemption below.
+                    // The payload names the holder path + instance and our worktree path.
+                    if (err instanceof WorktreeBranchTakenError) {
+                        await appendEvent(deps.supabase, taskId, "log", {
+                            phase: "git",
+                            event: err.event,
+                            error_class: err.errorClass,
+                            error: msg,
+                            branch,
+                            holder_path: err.holderPath,
+                            holder_instance: err.holderInstance,
+                            worktree_path: err.worktreePath,
+                            runner_id: deps.session.runnerId,
+                        });
+                        await deps.supabase.rpc("transition_task", { p_task_id: taskId, p_new_status: "queued" });
+                        return { taskId, status: "requeued", phase: "git", error: `${err.errorClass}: ${msg}` };
+                    }
                     // v0.21 T-66-1: a git REPO-GLOBAL LOCK collision during provisioning
                     // (an external git process touched the clone while we held the
                     // provision mutex) is TRANSIENT — requeue the task so it re-provisions
@@ -1713,6 +2377,7 @@ export function runTask(taskId, deps) {
                         };
                     }
                     if (reconcile.status === "halt") {
+                        const blockReason = "rework_integration_conflict";
                         await appendEvent(deps.supabase, taskId, "rework_halt", {
                             phase: "reconcile",
                             pr_number: reworkMeta.pr_number,
@@ -1720,6 +2385,7 @@ export function runTask(taskId, deps) {
                             branch,
                             integration_ref: reconcile.integrationRef,
                             conflicted: reconcile.conflicted,
+                            block_reason: blockReason,
                             runner_id: deps.session.runnerId,
                         });
                         // HALT, NOT dead-letter: blocked → operator review, no re-review
@@ -1727,13 +2393,15 @@ export function runTask(taskId, deps) {
                         await postState_("blocked", "error_context", {
                             task_id: taskId,
                             phase: "plan",
-                            error_class: "rework_integration_conflict",
+                            error_class: blockReason,
+                            block_reason: blockReason,
                             stderr_tail: `rework branch conflicts with ${reconcile.integrationRef} — ` +
                                 `needs human merge: ${reconcile.conflicted.join(", ")}`,
                         });
-                        await deps.supabase.rpc("transition_task", {
-                            p_task_id: taskId,
-                            p_new_status: "blocked",
+                        await transitionBlocked(blockReason, {
+                            phase: "reconcile",
+                            integration_ref: reconcile.integrationRef,
+                            conflicted: reconcile.conflicted,
                         });
                         return {
                             taskId,
@@ -1751,6 +2419,39 @@ export function runTask(taskId, deps) {
                         auto_resolved: reconcile.autoResolved,
                         runner_id: deps.session.runnerId,
                     });
+                    // WORKTREE-STALE-DEPS-1: the merge above may have moved this branch's
+                    // lockfile past what the parent clone (and so the SYMLINKED deps
+                    // already seeded into this worktree) last installed. Re-verify and
+                    // repair before Claude/the gate see the worktree. Skipped on a no-op
+                    // merge ("already up to date") — nothing could have drifted.
+                    if (reconcile.merged) {
+                        try {
+                            const freshness = await verifyDepsFreshness(workdir, repoPath);
+                            // Distinct classification from `worktreeDepsMissing` — deps were
+                            // seeded here, they're just stale relative to the merged lockfile.
+                            if (!freshness.fresh)
+                                worktreeDepsStale = { repoPath, detail: freshness.detail };
+                            await appendEvent(deps.supabase, taskId, "log", {
+                                phase: "reconcile",
+                                stream: freshness.fresh ? "stdout" : "stderr",
+                                event: freshness.fresh ? "worktree.deps_ready" : "worktree.deps_stale",
+                                reverified: true,
+                                lockfile_hash: freshness.lockfileHash,
+                                parent_lockfile_hash: freshness.parentLockfileHash,
+                                installed: freshness.installed,
+                                detail: freshness.detail,
+                                ...(freshness.fresh ? {} : {
+                                    error_class: DEPS_STALE_CLASSIFICATION,
+                                    block_reason: DEPS_STALE_CLASSIFICATION,
+                                    repo_path: repoPath,
+                                }),
+                                runner_id: deps.session.runnerId,
+                            });
+                        }
+                        catch (freshErr) {
+                            process.stderr.write(`[acc-runner] verifyDepsFreshness(${taskId}) failed: ${freshErr.message}\n`);
+                        }
+                    }
                 }
                 // 4. Spawn Claude.
                 if (cancelled) {
@@ -1775,6 +2476,7 @@ export function runTask(taskId, deps) {
                         throw probeErr;
                     }
                     if (existingPrUrl) {
+                        const existingPrNumber = parsePrNumber(existingPrUrl);
                         await appendEvent(deps.supabase, taskId, "log", {
                             phase: "coding",
                             stream: "stdout",
@@ -1783,6 +2485,13 @@ export function runTask(taskId, deps) {
                             pr_url: existingPrUrl,
                             message: "open PR already exists for branch — skipping Claude Code spawn",
                         });
+                        await recordPreprGateMissing(deps.supabase, taskId, {
+                            branch,
+                            pr_number: existingPrNumber,
+                            pr_url: existingPrUrl,
+                            reason: "retry_pr_exists_before_spawn",
+                            runner_id: deps.session.runnerId,
+                        });
                         // v0.35-B: stamp pr_number + transition running→needs-review on
                         // the recovered task. On any failure the webhook-driven flow
                         // still moves running→done at merge time (matrix 0156).
@@ -1808,8 +2517,11 @@ export function runTask(taskId, deps) {
                 // is a context source, not a critical dependency for v0.5-C1.
                 let mcpCleanup = null;
                 if (deps.session) {
+                    const readMcpCfg = deps.readMcpConfig ?? defaultReadMcpConfig;
                     const writer = deps.writeMcpConfig ?? defaultWriteMcpConfig;
                     try {
+                        // Read through the seam, then hand the snapshot to the writer (single read).
+                        const existing = await readMcpCfg(workdir);
                         mcpCleanup = await writer({
                             cwd: workdir,
                             taskId,
@@ -1818,7 +2530,7 @@ export function runTask(taskId, deps) {
                             publicUrl: deps.publicUrl ?? deps.cfg.publicUrl,
                             supabaseUrl: deps.cfg.supabaseUrl,
                             supabaseAnonKey: deps.cfg.supabaseAnonKey,
-                        });
+                        }, { existing });
                     }
                     catch (err) {
                         // Don't echo the token even on failure.
@@ -1831,12 +2543,32 @@ export function runTask(taskId, deps) {
                 // through verbatim so a future model not yet in the embedded
                 // table still spawns.
                 //
+                // SEED-MODEL-REGISTRY-1 AC2 (b): resolveSpawnModel gates the translation. The whole
+                // acc.models row is in fetch_task_for_runner's to_jsonb(m) — FetchTaskResult
+                // under-declares it — so read cli_alias/enabled via a local widening (no migration).
+                const pinnedModel = result.model;
+                const spawnModel = resolveSpawnModel(pinnedModel);
+                //
                 // v0.53 T-53-4: one claude attempt — spawn, stream both pipes to the
                 // History tab, post a cost event (one row per attempt), and time the
                 // run so the classifier's fast-exit env_broken heuristic can fire.
+                let useRoutedModel = true;
+                let pinRefusalLogged = false;
                 const runClaudeOnce = async () => {
                     const spawnedAt = Date.now();
-                    child = spawnClaude(workdir, toCliAlias(result.model?.id));
+                    child = spawnClaude(workdir, useRoutedModel ? spawnModel.model : undefined);
+                    // Log the refused pin once, only on the routed path (shouldLogPinRefusal).
+                    if (shouldLogPinRefusal(useRoutedModel, spawnModel) && !pinRefusalLogged) {
+                        pinRefusalLogged = true;
+                        await appendEvent(deps.supabase, taskId, "log", {
+                            phase: "coding",
+                            stream: "stderr",
+                            event: "model.pin_refused",
+                            model_id: pinnedModel?.id ?? null,
+                            reason: spawnModel.refusedReason,
+                            runner_id: deps.session.runnerId,
+                        });
+                    }
                     if (child.stdin) {
                         child.stdin.write(prompt);
                         child.stdin.end();
@@ -1856,7 +2588,7 @@ export function runTask(taskId, deps) {
                     // cancellation, retry, and non-zero exit alike. Best-effort: a
                     // failed POST logs to stderr but never bubbles past the runner.
                     {
-                        const event = buildCostEvent(taskId, capturedStdout, result.model?.id, result.runner?.id, taskEngineId);
+                        const event = buildCostEventForRun(taskId, capturedStdout, result.model?.id, result.runner?.id, taskEngineId);
                         try {
                             await postCostEvent(event);
                         }
@@ -1897,11 +2629,13 @@ export function runTask(taskId, deps) {
                     if (a.exitCode !== 0) {
                         return taskEngine.classifyFailure(a.exitCode, a.stderr, a.stdout, a.durationMs);
                     }
-                    if (isCapacityExhausted(a.stdout, a.stderr)) {
+                    if (taskEngine.classifyZeroExit)
+                        return taskEngine.classifyZeroExit(a.stderr, a.stdout, a.durationMs);
+                    if (taskEngine.id !== "claude-code" && a.stderr.trim().length === 0 && a.stdout.trim().length === 0) {
                         return {
-                            exitCode: a.exitCode,
-                            class: "capacity_exhausted",
-                            detail: "Claude session/usage capacity reached (429) on a 0-exit envelope — runner will pause until reset",
+                            exitCode: 0,
+                            class: "unknown_fault",
+                            detail: `${taskEngine.id} exited 0 with no stdout/stderr and no result envelope`,
                         };
                     }
                     return null;
@@ -1923,6 +2657,81 @@ export function runTask(taskId, deps) {
                         instantEmptyStreak = 2;
                     }
                 }
+                // Codex subscription-first: retry the same task immediately on the
+                // metered API-key channel before pausing, quarantining, or burning a
+                // task retry. The engine env shaper strips the key on attempt one and
+                // forwards it only after this explicit preference flip.
+                if (classified?.class === "subscription_exhausted" &&
+                    taskEngine.id === "codex" &&
+                    !cancelled) {
+                    // Resolve the key from env OR the OS keychain (the runner's documented
+                    // credential store). The env-only gate silently skipped the spill for a
+                    // keychain-authed runner. Keychain read is awaited only here, after a
+                    // real codex cap-hit, never on the hot path.
+                    const spillKey = openaiApiKey() || (await openaiApiKeyFromKeychain());
+                    if (spillKey.length > 0) {
+                        await appendEvent(deps.supabase, taskId, "log", {
+                            phase: "codex_auth_spill",
+                            from: "subscription",
+                            to: "api-key",
+                            detail: classified.detail,
+                        });
+                        codexApiKey = spillKey;
+                        attempt = await runClaudeOnce();
+                        classified = classifyIfFailed(attempt);
+                    }
+                }
+                // The legacy Settings fields name the target a "model", but deployments
+                // store an engine id (notably "codex"). Honor that promise on a hard
+                // usage wall. `wantsFallback` is the POLICY decision (org opted in, a
+                // distinct target is configured, and we actually hit a usage wall);
+                // whether THIS runner can serve it is a separate check below, so a
+                // fleet-level gap surfaces loudly instead of collapsing into the policy
+                // gate and vanishing.
+                const fallbackId = fallbackPolicy.engine;
+                const wantsFallback = classified?.class === "usage_limit" &&
+                    fallbackPolicy.enabled &&
+                    !!fallbackId &&
+                    fallbackId !== taskEngine.id &&
+                    !cancelled;
+                if (wantsFallback && fallbackId && hasEngine(fallbackId)) {
+                    const from = taskEngine.id;
+                    taskEngineId = fallbackId;
+                    taskEngine = getEngine(fallbackId);
+                    codexApiKey = null;
+                    useRoutedModel = false;
+                    await appendEvent(deps.supabase, taskId, "log", {
+                        phase: "engine_fallback",
+                        from,
+                        to: fallbackId,
+                        reason: "usage_limit",
+                    });
+                    attempt = await runClaudeOnce();
+                    classified = classifyIfFailed(attempt);
+                }
+                else if (wantsFallback && fallbackId) {
+                    // The org configured a usage_limit fallback to an engine THIS runner
+                    // is not registered to serve (`hasEngine(fallbackId)` is false). A
+                    // single serving runner cannot see the whole fleet's capability, so it
+                    // cannot know whether some OTHER runner could serve `fallbackId` — that
+                    // cross-runner reroute is a scheduler concern (follow-up FLEET-FALLBACK
+                    // -REROUTE). What it MUST NOT do is drop the configured fallback in
+                    // silence: that is exactly how fleet-level unavailability hides. So we
+                    // surface it as a per-task warning on the timeline AND in the runner
+                    // log. Per-task emission means there is no global-by-verb dedup that a
+                    // later change to a different fallback engine or org could be
+                    // suppressed by — every task that hits an unservable fallback records
+                    // its own event, tagged with the specific target.
+                    await appendEvent(deps.supabase, taskId, "log", {
+                        phase: "engine_fallback_unservable",
+                        from: taskEngine.id,
+                        fallback: fallbackId,
+                        reason: "not_registered_on_runner",
+                    });
+                    process.stderr.write(`[acc-runner] engine fallback to "${fallbackId}" is configured but not ` +
+                        `registered on this runner (task ${taskId}); the ${taskEngine.id} ` +
+                        `usage_limit outcome stands — no other runner is auto-tried from here\n`);
+                }
                 // Restore .mcp.json as soon as Claude is done — its MCP subprocess
                 // tree comes down with it, so leaving our token-bearing config on
                 // disk a moment longer is pure exposure surface.
@@ -1944,7 +2753,7 @@ export function runTask(taskId, deps) {
                 // on an exit-0 capacity envelope (see classifyIfFailed) — the latter must
                 // NOT reach the success path. The capacity_exhausted branch below always
                 // returns, so no other exit-0 handling is affected.
-                if (attempt.exitCode !== 0 || classified?.class === "capacity_exhausted") {
+                if (attempt.exitCode !== 0 || classified !== null) {
                     // v0.48: classify the failure so the quarantine cause is consistent
                     // across the event, the bus message, and the RunTaskOutcome. `let`
                     // because v0.63's health probe can upgrade a claude_unavailable exit
@@ -1960,7 +2769,13 @@ export function runTask(taskId, deps) {
                     // cold-started re-run hits the SAME cap, and it loops — burning a
                     // little capacity per cold start and never committing (the EG-B
                     // reseed signature: runner online + current_task_id=null while the
-                    // task says running; 2 zombie recoveries, 0 commits).
+                    // task says running; 2 zombie recoveries, 0 commits). NB (RUNNER-
+                    // CURRENT-TASK-DEAD-1): that "current_task_id=null" is a HISTORICAL
+                    // symptom description, not a live signal read — nothing here reads the
+                    // column, and now that the outer finally clears it on this very path a
+                    // paused runner also stops advertising a stale claim. This is unrelated
+                    // to ci.sibling_reseed_intervention (a post-merge vis-reg baseline
+                    // reseed in sibling-reseed-sweep.ts that never touches current_task_id).
                     //
                     // Fix: CLEANLY REQUEUE NOW instead of waiting for the sweep. Get the
                     // task back to 'queued' via the runner-callable matrix route
@@ -1993,33 +2808,85 @@ export function runTask(taskId, deps) {
                         // reason for the audit trail. Errors are surfaced but never abort the
                         // pause: if the requeue can't land, the existing stale-running sweep
                         // is still the backstop (same as the v0.56 behaviour this replaces).
-                        const blockReason = `capacity_paused: session/usage cap reached mid-task; requeued${resumeAt ? ` until ${resumeAt}` : ""}`;
-                        const toBlocked = await deps.supabase.rpc("transition_task", {
-                            p_task_id: taskId,
-                            p_new_status: "blocked",
-                            p_reason: blockReason,
-                        });
-                        if (toBlocked.error) {
-                            process.stderr.write(`[acc-runner] FH-1a capacity requeue: running→blocked failed for ${taskId}: ` +
-                                `${toBlocked.error.message} — falling back to stale-running sweep\n`);
+                        const prLinkedTask = task;
+                        let linkedPrUrl = typeof prLinkedTask.pr_html_url === "string" && prLinkedTask.pr_html_url.trim().length > 0
+                            ? prLinkedTask.pr_html_url.trim()
+                            : null;
+                        let linkedPrNumber = typeof task.pr_number === "number" && Number.isFinite(task.pr_number)
+                            ? task.pr_number
+                            : parsePrNumber(linkedPrUrl);
+                        // The task snapshot was fetched at claim time, BEFORE the Claude
+                        // session ran. When the session opens a PR and THEN hits the capacity
+                        // cap, `task.pr_number`/`task.pr_html_url` are still the stale null from
+                        // that snapshot — the session-exits-after-PR-open shape the snapshot-only
+                        // check missed. So if the snapshot shows no linked PR, ask GitHub for an
+                        // open PR on the branch (the same probe the idempotency guard uses) to
+                        // catch a PR the session opened mid-flight. Best-effort: a probe failure
+                        // degrades to the snapshot-only view (the requeue path) and never aborts
+                        // the pause.
+                        if (linkedPrNumber === null) {
+                            try {
+                                const probedPrUrl = await gh.findOpenPR(workdir, branch);
+                                if (probedPrUrl) {
+                                    linkedPrUrl = probedPrUrl;
+                                    linkedPrNumber = parsePrNumber(probedPrUrl);
+                                }
+                            }
+                            catch (probeErr) {
+                                process.stderr.write(`[acc-runner] FH-1a capacity requeue: open-PR probe failed for ${taskId}: ` +
+                                    `${probeErr.message} — using task snapshot only\n`);
+                            }
+                        }
+                        let requeued = false;
+                        if (linkedPrNumber !== null) {
+                            await recordPreprGateMissing(deps.supabase, taskId, {
+                                branch,
+                                pr_number: linkedPrNumber,
+                                pr_url: linkedPrUrl,
+                                reason: "capacity_exit_after_pr_open",
+                                runner_id: deps.session.runnerId,
+                            });
+                            if (linkedPrUrl)
+                                await setTaskPr(deps.supabase, taskId, linkedPrUrl);
                         }
                         else {
-                            const toQueued = await deps.supabase.rpc("transition_task", {
+                            const blockReason = `capacity_paused: session/usage cap reached mid-task; requeued${resumeAt ? ` until ${resumeAt}` : ""}`;
+                            const toBlocked = await deps.supabase.rpc("transition_task", {
                                 p_task_id: taskId,
-                                p_new_status: "queued",
+                                p_new_status: "blocked",
+                                p_reason: blockReason,
                             });
-                            if (toQueued.error) {
-                                process.stderr.write(`[acc-runner] FH-1a capacity requeue: blocked→queued failed for ${taskId}: ` +
-                                    `${toQueued.error.message} — task left 'blocked', sweep/operator will recover\n`);
+                            if (toBlocked.error) {
+                                process.stderr.write(`[acc-runner] FH-1a capacity requeue: running→blocked failed for ${taskId}: ` +
+                                    `${toBlocked.error.message} — falling back to stale-running sweep\n`);
+                            }
+                            else {
+                                const toQueued = await deps.supabase.rpc("transition_task", {
+                                    p_task_id: taskId,
+                                    p_new_status: "queued",
+                                });
+                                if (toQueued.error) {
+                                    process.stderr.write(`[acc-runner] FH-1a capacity requeue: blocked→queued failed for ${taskId}: ` +
+                                        `${toQueued.error.message} — task left 'blocked', sweep/operator will recover\n`);
+                                }
+                                else {
+                                    requeued = true;
+                                }
                             }
                         }
                         await appendEvent(deps.supabase, taskId, "capacity_paused", {
                             phase: "claude_exit",
+                            engine: taskEngine.id,
                             exit_code: attempt.exitCode,
                             exit_class: cls.class,
                             resume_at: resumeAt,
-                            requeued: true,
+                            requeued,
+                            pr_number: linkedPrNumber,
+                            pr_url: linkedPrUrl,
+                            gate_verdict: linkedPrNumber !== null ? "missing" : undefined,
                             detail: cls.detail,
+                            stdout_tail: attempt.stdout.slice(-2000),
+                            stderr_tail: attempt.stderr.slice(-2000),
                             runner_id: deps.session.runnerId,
                         });
                         // FH-1a: task-scoped activity event carrying pausedUntil so board /
@@ -2034,8 +2901,14 @@ export function runTask(taskId, deps) {
                                 p_payload: {
                                     task_id: taskId,
                                     paused_until: resumeAt,
-                                    requeued: true,
+                                    requeued,
+                                    pr_number: linkedPrNumber,
+                                    pr_url: linkedPrUrl,
+                                    gate_verdict: linkedPrNumber !== null ? "missing" : undefined,
                                     detail: cls.detail,
+                                    engine: taskEngine.id,
+                                    stdout_tail: attempt.stdout.slice(-4000),
+                                    stderr_tail: attempt.stderr.slice(-4000),
                                     runner_id: deps.session.runnerId,
                                 },
                             });
@@ -2048,6 +2921,7 @@ export function runTask(taskId, deps) {
                             exitCode: attempt.exitCode,
                             error: cls.detail,
                             capacity_exhausted: true,
+                            engine: taskEngine.id,
                             resume_at: resumeAt,
                         };
                     }
@@ -2157,24 +3031,60 @@ export function runTask(taskId, deps) {
                     // (heuristic-confirmed).
                     const quarantineCause = cls.class !== "task_error" ? cls.class : undefined;
                     const quarantineConsecutive = quarantineCause === "env_broken" ? Math.max(instantEmptyStreak, 1) : undefined;
+                    // USAGE-LIMIT-INVISIBLE-1: a usage_limit quarantine still deserves a
+                    // fleet-visible capacity signal (watch.ts folds it into the account
+                    // window / fleet_pause below) — extract whatever reset hint the
+                    // provider gave us with the SAME parser capacity_exhausted uses, so a
+                    // resettable subscription window (the live 2026-08-30 incident: four
+                    // usage_limit exits with no capacity_paused signal anywhere) is not
+                    // silently discarded. `null` means no reset was found — an INDEFINITE
+                    // cap, never a guessed backoff (this class is not assumed recoverable
+                    // soon; see the class doc at the top of failure-classifier.ts).
+                    const usageLimitResumeMs = cls.class === "usage_limit"
+                        ? extractResetTime(`${attempt.stderr}\n${attempt.stdout}`)
+                        : null;
+                    const usageLimitResumeAt = usageLimitResumeMs !== null ? new Date(usageLimitResumeMs).toISOString() : null;
+                    const usageLimitIdentity = cls.class === "usage_limit"
+                        ? await (deps.credentialIdentity?.() ?? resolveCredentialIdentity())
+                        : null;
+                    const diagnostics = failureDiagnostics({
+                        exitCode: attempt.exitCode,
+                        stdout: attempt.stdout,
+                        stderr: attempt.stderr,
+                        detail: cls.detail,
+                        label: taskEngine.id,
+                    });
                     await appendEvent(deps.supabase, taskId, "error", {
                         phase: "claude_exit",
+                        engine: taskEngine.id,
                         exit_code: attempt.exitCode,
                         exit_class: cls.class,
                         exit_class_heuristic: cls.heuristic === true,
                         consecutive_instant_empty: instantEmptyStreak,
                         quarantine: quarantineCause !== undefined,
-                        stderr_tail: attempt.stderr.slice(-2000),
+                        reasons: diagnostics.reasons,
+                        stdout_tail: diagnostics.stdoutTail,
+                        stderr_tail: diagnostics.stderrTail,
+                        ...(cls.class === "usage_limit"
+                            ? {
+                                resume_at: usageLimitResumeAt,
+                                capacity_indefinite: usageLimitResumeAt === null,
+                                ...usageLimitIdentity,
+                            }
+                            : {}),
                     });
                     await postState_("blocked", "error_context", {
                         task_id: taskId,
                         phase: "code",
+                        engine: taskEngine.id,
                         error_class: `claude_exit_${attempt.exitCode ?? "unknown"}`,
                         // v0.48: include the classified failure class so the planner can
                         // distinguish machine-level failures from task-level failures.
                         exit_class: cls.class,
-                        // Recommended cap from MESSAGING_PROTOCOLS.md: last ~4 KB.
-                        stderr_tail: attempt.stderr.slice(-4000),
+                        reasons: diagnostics.reasons,
+                        stdout_tail: diagnostics.stdoutTail,
+                        stderr_tail: diagnostics.stderrTail,
+                        ...(usageLimitIdentity ?? {}),
                     });
                     await deps.supabase.rpc("transition_task", {
                         p_task_id: taskId,
@@ -2185,9 +3095,15 @@ export function runTask(taskId, deps) {
                         status: "failed",
                         phase: "claude_exit",
                         exitCode: attempt.exitCode,
-                        error: attempt.stderr.slice(-200).trim() || cls.detail,
+                        error: diagnostics.reasons[0] ?? cls.detail,
                         quarantine_cause: quarantineCause,
                         quarantine_consecutive: quarantineConsecutive,
+                        engine: taskEngine.id,
+                        // USAGE-LIMIT-INVISIBLE-1: carries the provider's stated reset (or
+                        // null for an indefinite cap) so watch.ts can fold a fleet-visible
+                        // capacity signal on top of the quarantine, instead of the account
+                        // exhaustion going unrecorded anywhere but this one task's log.
+                        ...(cls.class === "usage_limit" ? { resume_at: usageLimitResumeAt } : {}),
                     };
                 }
                 // Success: expose the final attempt's stdout under the name the
@@ -2222,28 +3138,41 @@ export function runTask(taskId, deps) {
                     // drift the agent couldn't fix re-fail at review/CI and burn the
                     // cycle). On failure HALT (blocked → operator review) instead of
                     // pushing — no review re-requested, no cycle consumed.
-                    const reworkGate = await runPreprGate(workdir, resolvedBaseRef).catch((err) => ({
-                        ok: false,
-                        skipped: false,
-                        ran: [],
-                        absent: [],
-                        failure: {
-                            gate: "typecheck",
-                            exitCode: null,
-                            outputTail: `pre-PR gate runner crashed: ${err.message?.slice(0, 400)}`,
-                        },
-                    }));
+                    // PREPR-GATE-CRASH-CLASS-1: a gate RUNNER that threw is the same infra
+                    // class as a gate TOOL that crashed — it judged nothing, so it parks
+                    // the task instead of charging the crash to the diff (still no push).
+                    const reworkGate = await runPreprGate(workdir, resolvedBaseRef).catch((err) => gateRunnerCrashResult(err));
+                    if (!reworkGate.skipped && reworkGate.crash) {
+                        return handleGateToolCrash(reworkGate, reworkGate.crash, true);
+                    }
                     if (!reworkGate.skipped && !reworkGate.ok && reworkGate.failure) {
                         const fail = reworkGate.failure;
+                        // RUNNER-GATE-VISIBILITY-2: `deps-missing` vs
+                        // `prepr_gate_failed:typecheck` is the whole point — the first is a
+                        // cold parent clone on THIS host, the second is the task's own code.
+                        // WORKTREE-STALE-DEPS-1: `deps-stale` is the sibling environment
+                        // fault (deps WERE seeded, the merge above left them stale) — kept
+                        // out of the generic `rework_gate_failed` bucket for the same reason.
+                        const blockReason = gateFailureBlockReason(fail.gate);
+                        const errorClass = fail.gate === "deps"
+                            ? DEPS_MISSING_CLASSIFICATION
+                            : fail.gate === "deps-stale"
+                                ? DEPS_STALE_CLASSIFICATION
+                                : "rework_gate_failed";
                         await appendEvent(deps.supabase, taskId, "rework_halt", {
                             phase: "prepr_gate",
                             pr_number: reworkMeta.pr_number,
                             repo: reworkMeta.repo,
                             branch,
-                            error_class: "rework_gate_failed",
+                            error_class: errorClass,
+                            block_reason: blockReason,
                             failed_gate: fail.gate,
                             exit_code: fail.exitCode,
                             gates_ran: reworkGate.ran,
+                            // PREPR-GATE-TIMEOUT-VISIBILITY-1: name the offending test + whether
+                            // it TIMED OUT, so a timeout halt is distinguishable from a genuine
+                            // assertion halt without hand-querying stderr_tail.
+                            ...gateFailureRecordFields(fail),
                             stderr_tail: fail.outputTail,
                             runner_id: deps.session.runnerId,
                         });
@@ -2253,22 +3182,31 @@ export function runTask(taskId, deps) {
                         await postState_("blocked", "error_context", {
                             task_id: taskId,
                             phase: "review",
-                            error_class: "rework_gate_failed",
+                            error_class: errorClass,
+                            block_reason: blockReason,
                             failed_gate: fail.gate,
                             stderr_tail: fail.outputTail,
                         });
-                        await deps.supabase.rpc("transition_task", {
-                            p_task_id: taskId,
-                            p_new_status: "blocked",
+                        await transitionBlocked(blockReason, {
+                            phase: "prepr_gate",
+                            failed_gate: fail.gate,
+                            rework: true,
                         });
                         return {
                             taskId,
                             status: "failed",
                             phase: "prepr_gate",
                             exitCode: fail.exitCode,
-                            error: `rework gate HALT: ${fail.gate} failed — re-push withheld for operator review`,
+                            error: `rework gate HALT: ${fail.gate} failed (${blockReason}) — ` +
+                                `re-push withheld for operator review`,
                         };
                     }
+                    // PREPR-CONFORMANCE-GATE-1: a rework re-requests a paid review, so the
+                    // pass runs here too — a rework that STILL blows the cap / touches a
+                    // forbidden path (the #2162 case) HALTs instead of spending a cycle.
+                    const reworkConformance = await runConformanceGate(true, capturedStdout);
+                    if (reworkConformance)
+                        return reworkConformance;
                     // RVU-5: rework completion requires an ADVANCED head. Compare the local
                     // HEAD to the reviewed head (origin/<branch> — what the reviewer last
                     // saw). When they match, the agent + reconcile produced NO new commit:
@@ -2407,19 +3345,13 @@ export function runTask(taskId, deps) {
                 // the runner: no PR is opened, the task fails with
                 // `error_class: prepr_gate_failed`, and the failing gate + output tail
                 // land on the History tab. Skippable via ACC_RUNNER_SKIP_PREPR=1.
-                const prepr = await runPreprGate(workdir, resolvedBaseRef).catch((err) => ({
-                    // A gate-runner that itself crashed must fail closed: do not wave a
-                    // PR through because the check errored.
-                    ok: false,
-                    skipped: false,
-                    ran: [],
-                    absent: [],
-                    failure: {
-                        gate: "typecheck",
-                        exitCode: null,
-                        outputTail: `pre-PR gate runner crashed: ${err.message?.slice(0, 400)}`,
-                    },
-                }));
+                // PREPR-GATE-CRASH-CLASS-1: a gate-runner that itself threw still fails
+                // CLOSED (`ok: false` — no PR is opened off a check that never ran), but
+                // it is reported as infra (`crash`), not as a verdict on the diff.
+                const prepr = await runPreprGate(workdir, resolvedBaseRef).catch((err) => gateRunnerCrashResult(err));
+                if (!prepr.skipped && prepr.crash) {
+                    return handleGateToolCrash(prepr, prepr.crash, false);
+                }
                 if (prepr.skipped) {
                     await appendEvent(deps.supabase, taskId, "log", {
                         phase: "prepr_gate",
@@ -2431,28 +3363,65 @@ export function runTask(taskId, deps) {
                 }
                 else if (!prepr.ok && prepr.failure) {
                     const fail = prepr.failure;
-                    const summary = `pre-PR ${fail.gate} gate failed (exit ${fail.exitCode ?? "signal"}) — PR not opened`;
+                    // RUNNER-GATE-VISIBILITY-2: a deps-less worktree is an ENVIRONMENT fault
+                    // on this host, not a verdict on the diff — `tsc` was never there to
+                    // run. It keeps its own class end-to-end so failed-task triage can never
+                    // auto-rework a task over a missing binary.
+                    const depsMissing = fail.gate === "deps";
+                    // WORKTREE-STALE-DEPS-1: sibling environment fault — deps WERE seeded,
+                    // a rework merge just left them stale — kept as its own class end-to-end
+                    // so triage never conflates "no environment" with "stale environment".
+                    const depsStale = fail.gate === "deps-stale";
+                    const envFault = depsMissing || depsStale;
+                    const blockReason = gateFailureBlockReason(fail.gate);
+                    const errorClass = depsMissing
+                        ? DEPS_MISSING_CLASSIFICATION
+                        : depsStale
+                            ? DEPS_STALE_CLASSIFICATION
+                            : PREPR_GATE_FAILED_CLASSIFICATION;
+                    const summary = depsMissing
+                        ? `pre-PR gate could not run: worktree has no node_modules (${blockReason}) — PR not opened`
+                        : depsStale
+                            ? `pre-PR gate could not run: worktree deps are stale vs the merged lockfile (${blockReason}) — PR not opened`
+                            : `pre-PR ${fail.gate} gate failed (${blockReason}, exit ${fail.exitCode ?? "signal"}) — PR not opened`;
                     await appendEvent(deps.supabase, taskId, "error", {
                         phase: "prepr_gate",
-                        error_class: "prepr_gate_failed",
+                        error_class: errorClass,
+                        block_reason: blockReason,
                         failed_gate: fail.gate,
                         exit_code: fail.exitCode,
                         gates_ran: prepr.ran,
                         gates_absent: prepr.absent,
+                        // PREPR-GATE-TIMEOUT-VISIBILITY-1: same structured timeout/assertion
+                        // fingerprint as the rework_halt path above.
+                        ...gateFailureRecordFields(fail),
                         stderr_tail: fail.outputTail,
                         runner_id: deps.session.runnerId,
                     });
                     await postState_("blocked", "error_context", {
                         task_id: taskId,
                         phase: "review",
-                        error_class: "prepr_gate_failed",
+                        error_class: errorClass,
+                        block_reason: blockReason,
                         failed_gate: fail.gate,
                         stderr_tail: fail.outputTail,
                     });
-                    await deps.supabase.rpc("transition_task", {
-                        p_task_id: taskId,
-                        p_new_status: "failed",
-                    });
+                    if (envFault) {
+                        // Park, never fail — same reasoning as a crashed gate tool
+                        // (PREPR-GATE-CRASH-CLASS-1): a check that never ran judged nothing.
+                        // Still fail-CLOSED: no push, no PR opened.
+                        await transitionBlocked(blockReason, {
+                            phase: "prepr_gate",
+                            failed_gate: fail.gate,
+                            rework: false,
+                        });
+                    }
+                    else {
+                        await deps.supabase.rpc("transition_task", {
+                            p_task_id: taskId,
+                            p_new_status: "failed",
+                        });
+                    }
                     return {
                         taskId,
                         status: "failed",
@@ -2471,11 +3440,44 @@ export function runTask(taskId, deps) {
                         runner_id: deps.session.runnerId,
                     });
                 }
+                // PREPR-CONFORMANCE-GATE-1: withhold the PR when a MECHANICAL card check
+                // fails, so a paid review is never spent on what a script already decided.
+                const conformance = await runConformanceGate(false, capturedStdout);
+                if (conformance)
+                    return conformance;
                 // MIG-SEQ-GUARD: the LAST thing before the push. It deliberately runs
                 // after the pre-PR gate rather than inside it — the gate's own MIGFIX-01
                 // renumber reads the fork-time worktree snapshot, and only a fresh fetch
                 // here can see a sibling that merged while the gate was running.
                 await runMigrationSeqGuard(false);
+                const ready = await ensureBranchReadyForPr(git, workdir, resolvedBaseRef, branch, taskId);
+                if (!ready.ok) {
+                    const readinessClass = /no commits on branch/.test(ready.reason)
+                        ? "pr_open_no_commits"
+                        : "pr_open_branch_not_ready";
+                    await appendEvent(deps.supabase, taskId, "error", {
+                        phase: "pr_open",
+                        error_class: readinessClass,
+                        error: ready.reason,
+                        branch,
+                        base_ref: resolvedBaseRef,
+                        uncommitted_files: ready.files,
+                        worktree_path: workdir,
+                        runner_id: deps.session.runnerId,
+                    });
+                    await postState_("blocked", "error_context", {
+                        task_id: taskId,
+                        phase: "review",
+                        error_class: readinessClass,
+                        stderr_tail: ready.reason,
+                        worktree_path: workdir,
+                    });
+                    await deps.supabase.rpc("transition_task", {
+                        p_task_id: taskId,
+                        p_new_status: "failed",
+                    });
+                    return { taskId, status: "failed", phase: "pr_open", error: ready.reason };
+                }
                 // 5. Push + open PR. Both run from the worktree so the operator's
                 // shared clone never has the task branch checked out.
                 let prUrl = "";
@@ -2530,6 +3532,31 @@ export function runTask(taskId, deps) {
                     runner_id: deps.session.runnerId,
                     branch,
                 });
+                // ORPHAN-PR-GUARD-1: probe HERE — after the push, immediately before the
+                // open — so a merge that landed mid-push is still seen. Own try/catch so a
+                // rate limit requeues the task instead of being read as "no PR exists".
+                let prOpenSkip = null;
+                try {
+                    const g = await guardPrOpen({
+                        supabase: deps.supabase, gh, repoPath: workdir, taskId, branch,
+                    });
+                    if (!g.proceed)
+                        prOpenSkip = g;
+                }
+                catch (guardErr) {
+                    const requeued = await requeueOnGithubRateLimit(guardErr, "pr_open_guard");
+                    if (requeued)
+                        return requeued;
+                }
+                if (prOpenSkip) {
+                    await appendEvent(deps.supabase, taskId, PR_OPEN_SKIPPED_EVENT_KIND, prOpenSkippedPayload(prOpenSkip, taskId, branch));
+                    // An OPEN twin is adoptable — link the task to it. A merged / terminal
+                    // skip leaves prUrl null: the task is already settled (or the
+                    // merged-task reconcile sweep settles it).
+                    if (prOpenSkip.adoptable && prOpenSkip.existingPrUrl) {
+                        prUrl = prOpenSkip.existingPrUrl;
+                    }
+                }
                 try {
                     const report = extractReportFromOutput(capturedStdout, taskEngineId);
                     // V96 (R4): generate the PR-body "Files changed" table FROM the actual
@@ -2539,24 +3566,50 @@ export function runTask(taskId, deps) {
                     // without git.diff), fall back to the raw report body rather than
                     // blocking the PR open.
                     let body = report;
+                    // LOC-ADVISORY-2B: measured off the SAME diff as the table, so the two
+                    // can never disagree. Null unless a ceiling is actually exceeded.
+                    let locAdvisory = null;
                     try {
-                        const diff = await git.diff?.(workdir, `origin/${integrationBranch}`, branch);
+                        // Detached worktree: diff HEAD (no local `branch` ref exists).
+                        const diff = await git.diff?.(workdir, `origin/${integrationBranch}`, "HEAD");
                         // RR-1: pass the task's acceptance criteria so composePrBody emits the
                         // machine-readable `Covers:` scope manifest (whole-task by default; the
                         // agent may declare a partial scope in its report).
-                        if (diff != null)
+                        if (diff != null) {
                             body = composePrBody(report, diff, { acceptance: task.acceptance });
+                            // LOC-ADVISORY-2B: split impl-vs-tests against the task's declared
+                            // `<= N LOC` ceilings (else the 300-impl house guideline) so an
+                            // overage is read at the TOP of the body, not discovered
+                            // mid-review. Informational — it never blocks the PR.
+                            locAdvisory = evaluateLocAdvisory(diff, task.acceptance);
+                            if (locAdvisory)
+                                body = prependLocAdvisory(body, locAdvisory);
+                        }
                     }
                     catch (composeErr) {
                         process.stderr.write(`[acc-runner] pr-body compose failed (using raw report): ` +
                             `${composeErr.message?.slice(0, 200)}\n`);
                     }
-                    const pr = await gh.openPR(workdir, {
-                        title: prTitleForTask(task.id, task.title),
-                        body,
-                        base: integrationBranch,
-                    });
-                    prUrl = pr.url;
+                    // Own try: a failed event RPC must cost neither the body section above
+                    // nor the PR itself.
+                    if (locAdvisory && !prOpenSkip) {
+                        try {
+                            await appendEvent(deps.supabase, taskId, LOC_ADVISORY_EVENT_KIND, locAdvisoryEventPayload(locAdvisory));
+                        }
+                        catch (evErr) {
+                            process.stderr.write(`[acc-runner] loc_advisory event failed: ` +
+                                `${evErr.message?.slice(0, 200)}\n`);
+                        }
+                    }
+                    // ORPHAN-PR-GUARD-1: the ONE gate on the open call.
+                    if (!prOpenSkip) {
+                        const pr = await gh.openPR(workdir, {
+                            title: prTitleForTask(task.id, task.title),
+                            body,
+                            base: integrationBranch,
+                        });
+                        prUrl = pr.url;
+                    }
                 }
                 catch (err) {
                     // V109: a GitHub rate limit / spent budget while opening the PR is
@@ -2594,12 +3647,45 @@ export function runTask(taskId, deps) {
                         // and the user can open a PR manually (webhook back-write picks
                         // it up). Wrapped so a logging RPC failure can't block the
                         // terminal status write below.
+                        let primary = msg;
+                        if (/no commits between/i.test(msg)) {
+                            try {
+                                const diagnosed = await diagnoseNoCommitBranch(git, workdir, resolvedBaseRef, branch);
+                                if (diagnosed?.ahead === 0)
+                                    primary = formatBranchReadinessError(diagnosed.files);
+                            }
+                            catch { /* keep gh's message */ }
+                        }
                         try {
-                            await appendEvent(deps.supabase, taskId, "error", { phase: "pr_open", error: msg });
+                            await appendEvent(deps.supabase, taskId, "error", {
+                                phase: "pr_open",
+                                error_class: /no commits on branch/.test(primary)
+                                    ? "pr_open_no_commits"
+                                    : "pr_open_failed",
+                                error: primary,
+                                gh_error: msg,
+                                branch,
+                                worktree_path: workdir,
+                                runner_id: deps.session.runnerId,
+                            });
                         }
                         catch (logErr) {
                             process.stderr.write(`[acc-runner] pr_open error log failed: ${logErr.message}\n`);
                         }
+                        if (/no commits on branch/.test(primary)) {
+                            await postState_("blocked", "error_context", {
+                                task_id: taskId,
+                                phase: "review",
+                                error_class: "pr_open_no_commits",
+                                stderr_tail: primary,
+                                worktree_path: workdir,
+                            });
+                            await deps.supabase.rpc("transition_task", {
+                                p_task_id: taskId,
+                                p_new_status: "failed",
+                            });
+                            return { taskId, status: "failed", phase: "pr_open", error: primary };
+                        }
                     }
                 }
                 // v0.35-B: write pr_number + transition running→needs-review via
@@ -2676,6 +3762,12 @@ export function runTask(taskId, deps) {
             // made outside a task run is unbudgeted.
             endTaskGithubBudget();
             await releaseLocks();
+            // RUNNER-CURRENT-TASK-DEAD-1: release the runner's task pointer on EVERY
+            // post-claim exit — success, failure, github requeue, the FH-1a capacity
+            // requeue (running→blocked→queued), cancellation, and uncaught throws all
+            // funnel through this finally. Guarded on the current value so a sibling
+            // task's newer claim on the same runner is preserved.
+            await writeRunnerCurrentTask(null);
         }
     })();
     return {