@twinsearth/w2m-dsh-plugin 1.2.6 → 1.2.7

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
               },
     "metadata":  {
                      "description":  "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-                     "version":  "1.2.6"
+                     "version":  "1.2.7"
                  },
     "plugins":  [
                     {
                         "name":  "w2m-fleet",
                         "source":  "./",
                         "description":  "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-                        "version":  "1.2.6",
+                        "version":  "1.2.7",
                         "author":  {
                                        "name":  "TwinsEarth"
                                    },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
     "name":  "w2m-fleet",
     "description":  "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-    "version":  "1.2.6",
+    "version":  "1.2.7",
     "author":  {
                    "name":  "TwinsEarth"
                },

package/CHANGELOG.md

@@ -7,6 +7,67 @@
 
 All notable changes to this project are documented here.
 
+## [1.2.7] — 2026-10-21
+
+**The scheduler enforces the graph, a wait survives a restart and a dropped stream, and a partial fleet can no longer call itself
+a complete reduce.**
+
+### Turns are a state machine on disk
+
+A question written with `action:'ask'` becomes a persisted turn (`ask_id`, deadline). `await` attaches to that record, so a process
+restart does not lose the question or turn a late answer into silence; a late answer is recorded as `answered_after_timeout`. The
+wait prefers the relay's event stream, re-subscribes when the stream drops, and polls only when streaming is unavailable. A reply
+now carries `reply_state: 'answered'|'refused'`, so a refusal is a state the waiter reads rather than wording it guesses.
+
+### Dependencies block dispatch, and release when their prerequisite settles
+
+A task with `depends_on` is not offered: its leases are `waiting`, which redelivery skips and the sweeper ignores. When every
+prerequisite is settled -- **by a result, an expiry or a refusal** -- `_releaseDependents` moves those leases to offers. The graph
+edges and `assignee` are written into the task ledger, because live testing showed a restarted relay losing them and keeping a
+waiting task waiting forever. `assignee` is enforced, not recorded: only that machine gets a lease, and an unknown assignee is
+refused by name. `GET /v1/tasks` now publishes a derived `status` (`waiting`/`active`/`done`/`failed`/`cancelled`) and
+`waiting_on`, so the board and the scheduler cannot disagree.
+
+### Dataflow: an expected shard count, and a reduce that refuses partial input
+
+`buildReducePlan` takes `expectedIndexTotal` from the task (`index_total`) and refuses `MISSING_SHARD` (with the missing indexes),
+`MAP_INDEX_MISSING` and `MAP_INDEX_OUT_OF_RANGE`; only machines that actually reported can claim a shard, so an expired lease no
+longer makes a partial run look complete. Two production gaps were found by live testing and closed with it:
+
+- **A large plain-command stdout was never a blob.** The blob path lived only in the pipeline loop, so a split/mapreduce map result
+  was always inline and a reduce plan could never see what it reduces. Any command output above the inline cap now uploads a blob
+  exactly as a pipeline stage does (best effort: a failed upload keeps the command successful and says why).
+- **The relay's own frame limit made the blob channel unusable.** `MAX_FRAME_BYTES` (64 KiB) equals the inline threshold, so every
+  blob was by construction larger than the frame cap and a real upload failed with `FRAME_TOO_LARGE` while the fake relay in tests
+  accepted it. Blob PUTs now get a bounded 1 MiB frame (`BLOB_FRAME_BYTES`); every JSON route keeps the 64 KiB cap.
+- The aggregate now publishes `blob_sha256`, `output_mode`, `stdout_head` and `stdout_bytes` per machine: `w2m_wait` used to read
+  `aggregate.detail.machines`, a shape the production `/v1/tasks` response never carries, so the reduce plan was unreachable
+  outside tests.
+
+### Verified
+
+Gate GREEN twice, 15 of 15: 2687 tests / 2673 pass / 0 fail / 14 skip in 130 files.
+
+Two-machine live runs on Windows (ToFuture) and jp-shared over the real relay:
+
+- **await over SSE**: Windows asks, jp-shared replies `reply_state:'refused'`; the wait returns `state=refused, via=stream`, and the
+  turn is settled on disk.
+- **dependency chain**: B with `depends_on: [A]` is `waiting`, A settles, B is released (observed `status=active` with offers).
+- **missing shard**: a split task with `index_total: 5` whose map results are blobs is refused as
+  `MISSING_SHARD {missing:[1,3,4], expectedIndexTotal:5}` with `dataflow_degraded: true` -- the first live exercise of the blob
+  channel end to end.
+
+Both live-testing defects above (release only on a result; graph edges missing from the ledger) were found by these runs and are
+covered by tests now.
+
+### Limits, stated
+
+- A pipeline task runs the whole chain per machine, so `index_total` stays 1 for it; blob map results come from plain commands above
+  the inline cap.
+- The blob transport frame is 1 MiB while the agent's dataflow hard cap is 16 MiB: a single artifact above 1 MiB fails its upload
+  explicitly (`BLOB_UPLOAD_FAILED`) rather than being split across frames.
+- The jp-shared agent was upgraded to this build; macmini runs 1.2.6 from its own checkout and needs a `git pull` + restart to get
+  the plain-command blob behaviour.
 ## [1.2.6] — 2026-10-20
 
 **Security surface: signatures, a permission matrix, and output that no longer carries secrets — plus the reliability the chat

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.2.6", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.2.7", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60

package/package.json

@@ -1,6 +1,6 @@
 {
     "name":  "@twinsearth/w2m-dsh-plugin",
-    "version":  "1.2.6",
+    "version":  "1.2.7",
     "description":  "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
     "type":  "module",
     "exports":  {

package/plugin.json

@@ -1,7 +1,7 @@
 {
     "$schema":  "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
     "name":  "twinsearth-w2m-dsh",
-    "version":  "1.2.6",
+    "version":  "1.2.7",
     "description":  "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 12 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
     "license":  "MIT",
     "keywords":  [

package/src/agent/agent.mjs

@@ -3215,6 +3215,28 @@ export function createAgent(options) {
         }
       }
 
+      /**
+       * v1.2.7: a plain command's large stdout is a stage artifact too.
+       *
+       * The blob path used to live only in the pipeline loop, so a split/mapreduce map result was always inlined and a
+       * reduce plan could never see the data it reduces -- the missing-shard check was unreachable from a real task. A
+       * command that prints more than the inline cap now uploads its stdout exactly as a stage does. Best effort here: a
+       * failed upload must not turn a successful command into a failure, so the envelope stays inline and says why.
+       */
+      if (isPipeline !== true && execution !== null && lastBlobSha256 === null) {
+        const plainPlan = planStageOutput({ machineId: identity.machine_id, stageIndex: 0, stdoutBytes: execution.stdout_bytes });
+        if (plainPlan.ok === true && plainPlan.mode === 'blob') {
+          if (execution.truncated_stdout === true && !warnings.includes('STDOUT_TRUNCATED')) warnings.push('STDOUT_TRUNCATED');
+          const uploaded = await putBlobBytes(execution.stdout_sha256, execution.stdout);
+          if (uploaded.ok === true) {
+            lastBlobSha256 = uploaded.sha256;
+          } else {
+            log('warn', offer.task_id + ': plain stdout blob upload failed', { code: uploaded.code });
+            warnings.push('BLOB_UPLOAD_FAILED');
+          }
+        }
+      }
+
       heartbeat.setPhase('finalizing', 90);
       if (execution === null) {
         // Nothing ran at all (a refused first stage, or a budget already spent). `execution` stays

package/src/plugin/task-graph.mjs

@@ -1,147 +1,153 @@
-/**
- * The dependency graph of a fleet's tasks, as pure functions.
- *
- * ## Why this is separate from the relay's own validation
- *
- * The relay refuses a graph it cannot store (unknown prerequisite, cycle, a self-edge), but that is one call at one moment.
- * A reader looking at a task board asks a different question: of the tasks I can see, which are READY, which are WAITING on
- * something that is still running, and which are BLOCKED because a prerequisite failed or was cancelled? That question
- * depends on the tasks' current states, so it is answered here, over whatever list the reader has.
- *
- * ## The rule that makes "blocked" honest
- *
- * A prerequisite that is missing from the visible list is treated as WAITING, never as ready: the list may be truncated by a
- * limit, and inferring "no dependency" from "not in this page" is how a board would show work as available that is not.
- */
-export const TASK_GRAPH_REFUSAL = Object.freeze({
-  UNKNOWN_NODE: 'GRAPH_UNKNOWN_NODE',
-  CYCLE: 'GRAPH_CYCLE',
-  BAD_NODE: 'GRAPH_BAD_NODE',
-});
-
-const DONE = new Set(['completed', 'done']);
-const FAILED = new Set(['failed', 'cancelled', 'refused']);
-// States that mean the task is already in flight. It is not 'ready': ready means work that can be STARTED.
-const ACTIVE = new Set(['running', 'queued', 'offered', 'preparing', 'finalizing']);
-
-/**
- * @param {{nodes?: Array<{task_id?: string, depends_on?: string[]}>}} input
- * @returns {{ok: true, nodes: Map<string, string[]>} | {ok: false, code: string, detail: object}}
- */
-export function buildGraph({ nodes = [] } = {}) {
-  if (!Array.isArray(nodes)) return { ok: false, code: TASK_GRAPH_REFUSAL.BAD_NODE, detail: {} };
-  const map = new Map();
-  for (const node of nodes) {
-    const id = typeof node?.task_id === 'string' && node.task_id !== '' ? node.task_id : null;
-    if (id === null) return { ok: false, code: TASK_GRAPH_REFUSAL.BAD_NODE, detail: { node } };
-    const deps = Array.isArray(node.depends_on) ? node.depends_on.filter((dep) => typeof dep === 'string' && dep !== '') : [];
-    map.set(id, deps);
-  }
-  return { ok: true, nodes: map };
-}
-
-/**
- * A stable topological order, or the cycle that prevents one.
- *
- * Ties are broken by id so the same graph renders in the same order on every machine -- a board that reshuffles between two
- * reads looks like it is changing.
- *
- * @param {Map<string, string[]>} graph
- * @returns {{ok: true, order: string[]} | {ok: false, code: string, detail: {cycle: string[]}}}
- */
-export function topoOrder(graph) {
-  const indegree = new Map();
-  const dependents = new Map();
-  for (const id of graph.keys()) {
-    indegree.set(id, 0);
-    dependents.set(id, []);
-  }
-  for (const [id, deps] of graph.entries()) {
-    for (const dep of deps) {
-      // A prerequisite OUTSIDE this page is not an edge in it. The relay refuses an unknown prerequisite when the task is
-      // created, so a missing one here means the reader's list is truncated -- and treating that as a broken graph would
-      // make an ordinary limited read report a cycle.
-      if (!graph.has(dep)) continue;
-      indegree.set(id, (indegree.get(id) ?? 0) + 1);
-      if (!dependents.has(dep)) dependents.set(dep, []);
-      dependents.get(dep).push(id);
-    }
-  }
-  const ready = [...indegree.entries()].filter(([, count]) => count === 0).map(([id]) => id).sort();
-  const order = [];
-  while (ready.length > 0) {
-    const id = ready.shift();
-    order.push(id);
-    for (const next of (dependents.get(id) ?? []).slice().sort()) {
-      indegree.set(next, indegree.get(next) - 1);
-      if (indegree.get(next) === 0) { ready.push(next); ready.sort(); }
-    }
-  }
-  if (order.length !== graph.size) {
-    const remaining = [...graph.keys()].filter((id) => !order.includes(id));
-    return { ok: false, code: TASK_GRAPH_REFUSAL.CYCLE, detail: { cycle: remaining } };
-  }
-  return { ok: true, order };
-}
-
-/**
- * Classify one task against the states of the tasks a reader can see.
- *
- * @param {{task_id: string, depends_on?: string[], status?: string, statuses?: Map<string, string>}} input
- * @returns {'ready'|'waiting'|'blocked'|'done'|'active'|'unknown'}
- */
-export function classifyTask({ task_id, depends_on = [], status = null, statuses = new Map() } = {}) {
-  if (typeof task_id !== 'string' || task_id === '') return 'unknown';
-  if (typeof status === 'string' && DONE.has(status)) return 'done';
-  if (typeof status === 'string' && FAILED.has(status)) return 'blocked';
-  let waiting = false;
-  for (const dep of depends_on) {
-    const depStatus = statuses.get(dep);
-    if (depStatus === undefined) { waiting = true; continue; }
-    if (FAILED.has(depStatus)) return 'blocked';
-    if (!DONE.has(depStatus)) waiting = true;
-  }
-  if (waiting) return 'waiting';
-  // In flight ONLY once its prerequisites are satisfied: a queued task behind a failed prerequisite is blocked, not active.
-  if (typeof status === 'string' && ACTIVE.has(status)) return 'active';
-  return 'ready';
-}
-
-/**
- * The whole board, in one pass: every visible task classified, and the readies in dependency order.
- *
- * @param {{tasks?: Array<{task_id?: string, depends_on?: string[], status?: string}>}} input
- * @returns {{ok: true, by_task: Record<string, string>, ready: string[], waiting: string[], blocked: string[], done: string[], active: string[], order: string[]} |
- *           {ok: false, code: string, detail: object}}
- */
-export function buildBoard({ tasks = [] } = {}) {
-  const built = buildGraph({ nodes: tasks });
-  if (built.ok !== true) return built;
-  const statuses = new Map();
-  for (const task of tasks) {
-    const id = typeof task?.task_id === 'string' ? task.task_id : null;
-    if (id !== null) statuses.set(id, typeof task?.status === 'string' ? task.status : 'unknown');
-  }
-  const byTask = {};
-  const buckets = { ready: [], waiting: [], blocked: [], done: [], active: [] };
-  for (const [id, deps] of built.nodes.entries()) {
-    const kind = classifyTask({ task_id: id, depends_on: deps, status: statuses.get(id), statuses });
-    byTask[id] = kind;
-    if (kind === 'done') buckets.done.push(id);
-    else if (kind === 'active') buckets.active.push(id);
-    else if (kind === 'blocked') buckets.blocked.push(id);
-    else if (kind === 'waiting') buckets.waiting.push(id);
-    else buckets.ready.push(id);
-  }
-  const order = topoOrder(built.nodes);
-  return {
-    ok: true,
-    by_task: byTask,
-    ready: buckets.ready.sort(),
-    waiting: buckets.waiting.sort(),
-    blocked: buckets.blocked.sort(),
-    done: buckets.done.sort(),
-    active: buckets.active.sort(),
-    order: order.ok === true ? order.order : [],
-  };
-}
+/**
+ * The dependency graph of a fleet's tasks, as pure functions.
+ *
+ * ## Why this is separate from the relay's own validation
+ *
+ * The relay refuses a graph it cannot store (unknown prerequisite, cycle, a self-edge), but that is one call at one moment.
+ * A reader looking at a task board asks a different question: of the tasks I can see, which are READY, which are WAITING on
+ * something that is still running, and which are BLOCKED because a prerequisite failed or was cancelled? That question
+ * depends on the tasks' current states, so it is answered here, over whatever list the reader has.
+ *
+ * ## The rule that makes "blocked" honest
+ *
+ * A prerequisite that is missing from the visible list is treated as WAITING, never as ready: the list may be truncated by a
+ * limit, and inferring "no dependency" from "not in this page" is how a board would show work as available that is not.
+ */
+export const TASK_GRAPH_REFUSAL = Object.freeze({
+  UNKNOWN_NODE: 'GRAPH_UNKNOWN_NODE',
+  CYCLE: 'GRAPH_CYCLE',
+  BAD_NODE: 'GRAPH_BAD_NODE',
+});
+
+const DONE = new Set(['completed', 'done']);
+const FAILED = new Set(['failed', 'cancelled', 'refused']);
+// States that mean the task is already in flight. It is not 'ready': ready means work that can be STARTED.
+const ACTIVE = new Set(['running', 'queued', 'offered', 'preparing', 'finalizing', 'active']);
+/**
+ * v1.2.7: the relay's scheduler reports 'waiting' for a task whose prerequisites are unsettled. Reading that as "ready" was the
+ * exact board/scheduler disagreement this set closes.
+ */
+const WAITING = new Set(['waiting']);
+
+/**
+ * @param {{nodes?: Array<{task_id?: string, depends_on?: string[]}>}} input
+ * @returns {{ok: true, nodes: Map<string, string[]>} | {ok: false, code: string, detail: object}}
+ */
+export function buildGraph({ nodes = [] } = {}) {
+  if (!Array.isArray(nodes)) return { ok: false, code: TASK_GRAPH_REFUSAL.BAD_NODE, detail: {} };
+  const map = new Map();
+  for (const node of nodes) {
+    const id = typeof node?.task_id === 'string' && node.task_id !== '' ? node.task_id : null;
+    if (id === null) return { ok: false, code: TASK_GRAPH_REFUSAL.BAD_NODE, detail: { node } };
+    const deps = Array.isArray(node.depends_on) ? node.depends_on.filter((dep) => typeof dep === 'string' && dep !== '') : [];
+    map.set(id, deps);
+  }
+  return { ok: true, nodes: map };
+}
+
+/**
+ * A stable topological order, or the cycle that prevents one.
+ *
+ * Ties are broken by id so the same graph renders in the same order on every machine -- a board that reshuffles between two
+ * reads looks like it is changing.
+ *
+ * @param {Map<string, string[]>} graph
+ * @returns {{ok: true, order: string[]} | {ok: false, code: string, detail: {cycle: string[]}}}
+ */
+export function topoOrder(graph) {
+  const indegree = new Map();
+  const dependents = new Map();
+  for (const id of graph.keys()) {
+    indegree.set(id, 0);
+    dependents.set(id, []);
+  }
+  for (const [id, deps] of graph.entries()) {
+    for (const dep of deps) {
+      // A prerequisite OUTSIDE this page is not an edge in it. The relay refuses an unknown prerequisite when the task is
+      // created, so a missing one here means the reader's list is truncated -- and treating that as a broken graph would
+      // make an ordinary limited read report a cycle.
+      if (!graph.has(dep)) continue;
+      indegree.set(id, (indegree.get(id) ?? 0) + 1);
+      if (!dependents.has(dep)) dependents.set(dep, []);
+      dependents.get(dep).push(id);
+    }
+  }
+  const ready = [...indegree.entries()].filter(([, count]) => count === 0).map(([id]) => id).sort();
+  const order = [];
+  while (ready.length > 0) {
+    const id = ready.shift();
+    order.push(id);
+    for (const next of (dependents.get(id) ?? []).slice().sort()) {
+      indegree.set(next, indegree.get(next) - 1);
+      if (indegree.get(next) === 0) { ready.push(next); ready.sort(); }
+    }
+  }
+  if (order.length !== graph.size) {
+    const remaining = [...graph.keys()].filter((id) => !order.includes(id));
+    return { ok: false, code: TASK_GRAPH_REFUSAL.CYCLE, detail: { cycle: remaining } };
+  }
+  return { ok: true, order };
+}
+
+/**
+ * Classify one task against the states of the tasks a reader can see.
+ *
+ * @param {{task_id: string, depends_on?: string[], status?: string, statuses?: Map<string, string>}} input
+ * @returns {'ready'|'waiting'|'blocked'|'done'|'active'|'unknown'}
+ */
+export function classifyTask({ task_id, depends_on = [], status = null, statuses = new Map() } = {}) {
+  if (typeof task_id !== 'string' || task_id === '') return 'unknown';
+  if (typeof status === 'string' && DONE.has(status)) return 'done';
+  if (typeof status === 'string' && FAILED.has(status)) return 'blocked';
+  let waiting = false;
+  for (const dep of depends_on) {
+    const depStatus = statuses.get(dep);
+    if (depStatus === undefined) { waiting = true; continue; }
+    if (FAILED.has(depStatus)) return 'blocked';
+    if (!DONE.has(depStatus)) waiting = true;
+  }
+  if (waiting) return 'waiting';
+  // In flight ONLY once its prerequisites are satisfied: a queued task behind a failed prerequisite is blocked, not active.
+  if (typeof status === 'string' && WAITING.has(status)) return 'waiting';
+  if (typeof status === 'string' && ACTIVE.has(status)) return 'active';
+  return 'ready';
+}
+
+/**
+ * The whole board, in one pass: every visible task classified, and the readies in dependency order.
+ *
+ * @param {{tasks?: Array<{task_id?: string, depends_on?: string[], status?: string}>}} input
+ * @returns {{ok: true, by_task: Record<string, string>, ready: string[], waiting: string[], blocked: string[], done: string[], active: string[], order: string[]} |
+ *           {ok: false, code: string, detail: object}}
+ */
+export function buildBoard({ tasks = [] } = {}) {
+  const built = buildGraph({ nodes: tasks });
+  if (built.ok !== true) return built;
+  const statuses = new Map();
+  for (const task of tasks) {
+    const id = typeof task?.task_id === 'string' ? task.task_id : null;
+    if (id !== null) statuses.set(id, typeof task?.status === 'string' ? task.status : 'unknown');
+  }
+  const byTask = {};
+  const buckets = { ready: [], waiting: [], blocked: [], done: [], active: [] };
+  for (const [id, deps] of built.nodes.entries()) {
+    const kind = classifyTask({ task_id: id, depends_on: deps, status: statuses.get(id), statuses });
+    byTask[id] = kind;
+    if (kind === 'done') buckets.done.push(id);
+    else if (kind === 'active') buckets.active.push(id);
+    else if (kind === 'blocked') buckets.blocked.push(id);
+    else if (kind === 'waiting') buckets.waiting.push(id);
+    else buckets.ready.push(id);
+  }
+  const order = topoOrder(built.nodes);
+  return {
+    ok: true,
+    by_task: byTask,
+    ready: buckets.ready.sort(),
+    waiting: buckets.waiting.sort(),
+    blocked: buckets.blocked.sort(),
+    done: buckets.done.sort(),
+    active: buckets.active.sort(),
+    order: order.ok === true ? order.order : [],
+  };
+}

package/src/plugin/tools.mjs

@@ -272,7 +272,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.2.6';
+const PLUGIN_VERSION = '1.2.7';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -3771,6 +3771,15 @@ export async function apply(ctx, config = {}) {
         items: { type: 'string' },
         description: 'Which terminal conditions justify another attempt: expired, failed, partial, timeout. Omit to never retry.',
       },
+      depends_on: {
+        type: 'array',
+        items: { type: 'string' },
+        description: 'Task ids this task waits for. The relay will not dispatch it until every dependency has settled; then it is offered automatically.',
+      },
+      assignee: {
+        type: 'string',
+        description: 'Machine id that must execute this task. An assignee is a restriction: no other machine is offered the work, and an unknown id is refused by name.',
+      },
     },
     output: jsonOutput,
     async execute(args, exec) {
@@ -4181,6 +4190,11 @@ export async function apply(ctx, config = {}) {
         // v1.2.4: the retry policy travels only when the caller asked for one, so a default dispatch stays byte-identical.
         ...(Number.isInteger(args?.max_attempts) && args.max_attempts > 1 ? { max_attempts: args.max_attempts } : {}),
         ...(Array.isArray(args?.retry_on) && args.retry_on.length > 0 ? { retry_on: args.retry_on } : {}),
+        // v1.2.7: graph edges and assignment travel only when declared, so a default dispatch stays byte-identical.
+        ...(Array.isArray(args?.depends_on) && args.depends_on.filter((id) => typeof id === 'string' && id !== '').length > 0
+          ? { depends_on: args.depends_on.filter((id) => typeof id === 'string' && id !== '') }
+          : {}),
+        ...(typeof args?.assignee === 'string' && args.assignee.trim() !== '' ? { assignee: args.assignee.trim() } : {}),
         created_by: cfg.machineName,
         // Only sent for broadcast; the relay ignores it otherwise, and the validation above already
         // refused the combination, so this cannot silently mean nothing.
@@ -4515,13 +4529,24 @@ export async function apply(ctx, config = {}) {
       const reducerMachineId = typeof args?.reducer_machine_id === 'string' && args.reducer_machine_id.trim() !== ''
         ? args.reducer_machine_id.trim()
         : null;
-      const rawMachines = Array.isArray(aggregate.detail?.machines) ? aggregate.detail.machines : [];
-      const mapResults = rawMachines.map((machine) => {
+      // v1.2.7: the relay publishes machine facts directly on the aggregate; `detail.machines` is a test/report shape that the
+      // real /v1/tasks response does not carry. Reading only the latter made the reduce plan silently unreachable in production.
+      const rawMachines = Array.isArray(aggregate.detail?.machines)
+        ? aggregate.detail.machines
+        : (Array.isArray(aggregate.machines) ? aggregate.machines : []);
+      // v1.2.7: only a machine that actually reported can claim a shard. An expired lease still carries an index, and counting
+      // it as "produced" would make a partial run look complete -- the exact failure the expected-index check exists to prevent.
+      const reportedMachines = rawMachines.filter((machine) => (machine?.envelope ?? machine?.result ?? null) !== null || typeof machine?.blob_sha256 === 'string' || typeof machine?.stdout_head === 'string' || Number.isFinite(machine?.stdout_bytes) || (typeof machine?.status === 'string' && machine.status !== '' && Number.isFinite(machine?.exit_code)));
+      const mapResults = reportedMachines.map((machine) => {
         const envelope = machine?.envelope ?? machine?.result ?? null;
-        const blobSha = typeof envelope?.blob_sha256 === 'string' ? envelope.blob_sha256 : null;
-        const inline = typeof envelope?.stdout_head === 'string' && envelope.stdout_head !== '' ? envelope.stdout_head : null;
+        const blobSha = typeof envelope?.blob_sha256 === 'string' ? envelope.blob_sha256
+          : (typeof machine?.blob_sha256 === 'string' ? machine.blob_sha256 : null);
+        const inline = typeof envelope?.stdout_head === 'string' && envelope.stdout_head !== '' ? envelope.stdout_head
+          : (typeof machine?.stdout_head === 'string' && machine.stdout_head !== '' ? machine.stdout_head : null);
         return {
           machine_id: machine?.machine_id ?? null,
+          // v1.2.7: the shard this result belongs to, so the reduce plan can tell "complete" from "the rest never reported".
+          index: Number.isInteger(machine?.index) ? machine.index : (Number.isInteger(envelope?.index) ? envelope.index : null),
           mode: blobSha === null ? 'inline' : 'blob',
           ...(inline === null ? {} : { stdout: inline }),
           ...(blobSha === null ? {} : { blob_sha256: blobSha }),
@@ -4529,7 +4554,12 @@ export async function apply(ctx, config = {}) {
       });
       const anyBlob = mapResults.some((entry) => entry.mode === 'blob');
       const reduce = anyBlob && reducerMachineId !== null
-        ? buildReducePlan({ results: mapResults, reducerMachineId })
+        ? buildReducePlan({
+            results: mapResults,
+            reducerMachineId,
+            // v1.2.7: the task's own shard count is the completeness contract; absent it, the old "just what arrived" plan stands.
+            expectedIndexTotal: Number.isInteger(body?.task?.index_total) ? body.task.index_total : null,
+          })
         : null;
       const dataflowDegraded = reduce !== null && reduce.ok !== true;
 
@@ -6601,6 +6631,10 @@ export async function apply(ctx, config = {}) {
         type: 'string',
         description: 'For send/ask: replay protection. A retry with the same key returns the first message instead of posting the same sentence twice.',
       },
+      reply_state: {
+        type: 'string',
+        description: 'For send/ask: answer the turn as "answered" or "refused". A refusal is a state the awaiter reads, not a wording it has to guess from.',
+      },
       timeout_ms: { type: 'number', description: 'For await: how long to wait before reporting a timeout (default 60000, capped at 300000). A timeout is a value, not an error.' },
     },
     output: jsonOutput,
@@ -6610,6 +6644,8 @@ export async function apply(ctx, config = {}) {
       const action = typeof args?.action === 'string' ? args.action : 'list';
       const sessionId = typeof args?.session_id === 'string' ? args.session_id.trim() : '';
       if (sessionId === '') throw new W2MError('W2M_CHAT_SESSION', 'W2M_CHAT_SESSION: session_id is required', { hint: 'chat is scoped to a conversation' });
+      // v1.2.7: expire stale turns on every entry, so `asks` reports the truth after downtime.
+      askStore.expireDue();
       if (action === 'asks') {
         // The persisted questions for this conversation, in the states they are in. A read, so it needs no relay.
         return JSON.stringify({ ok: true, action, session_id: sessionId, ...askStore.list({ sessionId }) });
@@ -6655,26 +6691,84 @@ export async function apply(ctx, config = {}) {
       if (typeof args?.reply_to === 'string' && args.reply_to.trim() !== '') addressing.reply_to = args.reply_to.trim();
 
       if (action === 'await') {
-        // Waiting for an ANSWER is a state machine, and a timeout is a value the caller reads rather than an exception
-        // that loses the question. The question stays in the flow, so it can still be answered later.
+        // v1.2.7: waiting is a persisted turn, not a poll loop.
+        //
+        // The question is written to the ask store when it is ASKED; await attaches to that record, so a restart in between
+        // does not lose the question or turn a late answer into silence. The event stream is tried first (the reply arrives
+        // when it is posted, not up to a poll interval later), and polling remains the fallback for a relay or proxy that
+        // cannot stream -- an old relay must not break awaiting.
         const target = typeof args?.reply_to === 'string' ? args.reply_to.trim() : '';
-        if (target === '') throw new W2MError('W2M_CHAT_AWAIT', 'W2M_CHAT_AWAIT: reply_to is required for await', { hint: 'pass the message_id returned by ask' });
+        if (target === '') throw new W2MError('W2M_CHAT_AWAIT', 'W2M_CHAT_AWAIT: reply_to is required for await', { hint: 'pass reply_to: <message_id of the question>' });
         const timeoutMs = Number.isFinite(args?.timeout_ms) ? Math.max(1000, Math.min(args.timeout_ms, 300000)) : 60000;
         const startedAt = Date.now();
+        askStore.expireDue();
+        let turn = askStore.list({ sessionId }).asks.find((ask) => (ask.state === 'open' || ask.state === 'timeout') && ask.message_id === target) ?? null;
+        if (turn === null) {
+          const opened = askStore.openAsk({ sessionId, messageId: target, timeoutMs });
+          turn = opened.ok === true ? opened.ask : null;
+        }
+        const ownMachineId = cfg.machineId ?? null;
+        const findReply = async () => {
+          const listed = await request({ rabbitUrl, token, signal: exec?.signal, method: 'GET', pathname: '/v1/fleet/messages', query: { session_id: sessionId, limit: 200 } });
+          const rows = Array.isArray(listed?.json?.messages) ? listed.json.messages : [];
+          return rows.find((message) => message.reply_to === target && message.machine_id !== ownMachineId) ?? null;
+        };
+        const finish = (replyMessage, via) => {
+          const verdict = replyMessage?.reply_state === 'refused' ? 'refused' : 'answered';
+          if (turn !== null) askStore.settle(turn.ask_id, verdict, { messageId: replyMessage?.message_id ?? null });
+          const recorded = turn === null ? null : (askStore.list({ sessionId }).asks.find((ask) => ask.ask_id === turn.ask_id) ?? null);
+          return JSON.stringify({ ok: true, action, state: verdict, via, reply_to: target, reply: replyMessage, replies: replyMessage === null ? [] : [replyMessage], ask: recorded });
+        };
+        // 1) stream first -- and RE-subscribe while the budget remains: a dropped stream is not the end of the wait.
+        let emptyStreams = 0;
+        while (Date.now() - startedAt < timeoutMs) {
+          const remaining = timeoutMs - (Date.now() - startedAt);
+          const controller = new AbortController();
+          const timer = setTimeout(() => controller.abort(), Math.min(remaining, 30000));
+          let reachable = false;
+          let gotEvent = false;
+          try {
+            const streamUrl = joinUrl(rabbitUrl, '/v1/fleet/messages/stream') + '?session_id=' + encodeURIComponent(sessionId);
+            const response = await fetch(streamUrl, { headers: { authorization: 'Bearer ' + token }, signal: controller.signal });
+            if (response.ok === true && response.body !== null) {
+              reachable = true;
+              const reader = response.body.getReader();
+              const decoder = new TextDecoder();
+              let buffer = '';
+              for (;;) {
+                const { value, done } = await reader.read();
+                if (done === true) break;
+                buffer += decoder.decode(value, { stream: true });
+                const parts = buffer.split('\n\n');
+                buffer = parts.pop() ?? '';
+                for (const part of parts) {
+                  const line = part.split('\n').find((entry) => entry.startsWith('data: '));
+                  if (line === undefined) continue;
+                  gotEvent = true;
+                  const reply = await findReply();
+                  if (reply !== null) return finish(reply, 'stream');
+                }
+              }
+            }
+          } catch (error) {
+            if (error?.name === 'AbortError' && Date.now() - startedAt >= timeoutMs) break;
+          } finally { clearTimeout(timer); }
+          if (reachable !== true) break; // a relay that will not stream at all: polling is the contract
+          emptyStreams = gotEvent === true ? 0 : emptyStreams + 1;
+          if (emptyStreams >= 2) break; // two streams that end immediately will not deliver this reply
+          await new Promise((resolve) => { setTimeout(resolve, 100); });
+        }
+        // 2) polling fallback
         for (;;) {
           throwIfAborted(exec?.signal);
-          const reply = await request({ rabbitUrl, token, signal: exec?.signal, method: 'GET', pathname: '/v1/fleet/messages', query: { session_id: sessionId, reply_to: target, limit: '10' } });
-          const found = Array.isArray(reply?.json?.messages) ? reply.json.messages : [];
-          if (found.length > 0) {
-            for (const open of askStore.list({ sessionId }).asks) {
-              if (open.state === 'open' && open.message_id === target) askStore.settle(open.ask_id, 'answered', { messageId: found[0]?.message_id ?? null });
-            }
-            return JSON.stringify({ ok: true, action, state: 'answered', reply_to: target, replies: found });
-          }
+          const reply = await findReply();
+          if (reply !== null) return finish(reply, 'poll');
           if (Date.now() - startedAt >= timeoutMs) {
-            return JSON.stringify({ ok: true, action, state: 'timeout', reply_to: target, waited_ms: Date.now() - startedAt, hint: 'the question is still in the flow and can be answered later' });
+            if (turn !== null) askStore.expire(turn.ask_id);
+            const recorded = turn === null ? null : (askStore.list({ sessionId }).asks.find((ask) => ask.ask_id === turn.ask_id) ?? null);
+            return JSON.stringify({ ok: true, action, state: 'timeout', reply_to: target, waited_ms: Date.now() - startedAt, ask: recorded, hint: 'the question stays in the flow and can still be answered later' });
           }
-          await new Promise((resolve) => { setTimeout(resolve, 1500); });
+          await new Promise((resolve) => { setTimeout(resolve, 1000); });
         }
       }
       if (action === 'send' || action === 'ask') {
@@ -6699,6 +6793,7 @@ export async function apply(ctx, config = {}) {
           ...addressing,
           ...(mentions.length === 0 ? {} : { mentions }),
           ...(typeof args?.idempotency_key === 'string' && args.idempotency_key.trim() !== '' ? { idempotency_key: args.idempotency_key.trim() } : { idempotency_key: 'spool-' + Date.now() + '-' + Math.random().toString(36).slice(2) }),
+            ...(typeof args?.reply_state === 'string' && (args.reply_state === 'answered' || args.reply_state === 'refused') ? { reply_state: args.reply_state } : {}),
         };
         let posted = null;
         try {
@@ -6715,9 +6810,23 @@ export async function apply(ctx, config = {}) {
           const code = posted?.json?.error?.code ?? posted?.error?.code ?? 'W2M_CHAT_SEND';
           throw new W2MError('W2M_CHAT_SEND', code + ': the message was refused', { reason_code: code, hint: 'quota, size and non-text each need a different answer' });
         }
+        let ask = null;
+        if (action === 'ask' && posted.json?.message?.message_id !== undefined) {
+          // v1.2.7: the question becomes a turn on disk the moment it is asked, so a later await (in this process or after a
+          // restart) settles the same record instead of opening a second one.
+          const opened = askStore.openAsk({
+            sessionId,
+            messageId: posted.json.message.message_id,
+            threadId: typeof args?.thread_id === 'string' ? args.thread_id : null,
+            to: typeof args?.to === 'string' ? args.to : null,
+            timeoutMs: Number.isFinite(args?.timeout_ms) ? args.timeout_ms : 60000,
+          });
+          if (opened.ok === true) ask = opened.ask;
+        }
         return JSON.stringify({
           ok: true, action, message: posted.json?.message ?? null, message_id: posted.json?.message?.message_id ?? null,
           encrypted: sealed !== null && sealed.ok === true,
+          ...(ask === null ? {} : { ask }),
           ...(posted.json?.deduped === true ? { deduped: true } : {}),
         });
       }
@@ -7069,6 +7178,11 @@ export async function apply(ctx, config = {}) {
           mode: row?.mode ?? null,
           status: row?.status ?? null,
           cancelled: row?.cancelled === true,
+          // v1.2.7: graph facts travel with each row so the board and the scheduler cannot disagree.
+          depends_on: Array.isArray(row?.depends_on) ? row.depends_on : [],
+          assignee: row?.assignee ?? null,
+          waiting_on: Array.isArray(row?.waiting_on) ? row.waiting_on : [],
+          lease_states: row?.lease_states ?? {},
           machines: Array.isArray(row?.leases)
             ? row.leases.map((lease) => lease?.machine_id ?? null).filter((id) => typeof id === "string")
             : [],

package/src/relay/fleet-messages.mjs

@@ -143,6 +143,11 @@ export function createFleetMessages(options = {}) {
       mentions = [...new Set(rawMentions)];
     }
 
+    // v1.2.7: a reply can be an ANSWER or a REFUSAL, and the difference is a state, not a wording. Validated here so the
+    // turn state machine reads the sender's own word instead of guessing from text.
+    const replyState = input?.reply_state === undefined || input?.reply_state === null ? null : input.reply_state;
+    if (replyState !== null && replyState !== 'answered' && replyState !== 'refused') return { ok: false, code: 'BAD_REPLY_STATE' };
+
     const threadId = typeof input?.thread_id === 'string' && input.thread_id.trim() !== ''
       ? input.thread_id.trim().slice(0, 64)
       : null;
@@ -179,6 +184,7 @@ export function createFleetMessages(options = {}) {
       // the cipher it does not have a key for.
       ...(enc === null ? {} : { enc }),
       ...(idempotencyKey === null ? {} : { idempotency_key: idempotencyKey }),
+      ...(replyState === null ? {} : { reply_state: replyState }),
       at_ms: now(),
       bytes,
     };

package/src/relay/report.mjs

@@ -492,6 +492,17 @@ export function aggregate(task, resultRecords = [], opts = {}) {
       reasons: m.reasons,
       // v1.2.6: the relay's verdict, bound to the key registered at pairing.
       signature_status: m.signature_status ?? null,
+      /**
+       * v1.2.7: the dataflow facts a reader needs to build a reduce plan.
+       *
+       * The aggregate used to publish only a summary per machine, so a client could not see that a result was a blob -- the
+       * reduce plan existed in tests and read raw envelopes that the production response never carried. These four fields are
+       * that omission, closed: the blob hash, the file/blob mode, the inline head, and the byte count.
+       */
+      blob_sha256: m.envelope?.blob_sha256 ?? null,
+      output_mode: m.envelope?.output_mode ?? null,
+      stdout_head: m.envelope?.stdout_head ?? null,
+      stdout_bytes: m.envelope?.stdout_bytes ?? null,
     })),
     steps,
     differences: step3.differences ?? [],

package/src/relay/server.mjs

@@ -22,6 +22,14 @@ import {
   RabbitState,
   rfc3339,
 } from './state.mjs';
+
+// v1.2.7: the content-addressed blob channel carries ARTIFACTS, so its frame limit cannot be the JSON frame limit.
+//
+// MAX_FRAME_BYTES (64 KiB) is exactly the inline threshold: any blob is larger than an inline result by construction, so with
+// one shared limit the blob channel could never accept a single byte -- a pipeline blob upload from a real relay failed with
+// FRAME_TOO_LARGE while the fake relay in the tests accepted it. The dataflow hard cap stays the agent-side bound; this is the
+// transport bound, and it is still bounded.
+export const BLOB_FRAME_BYTES = 1024 * 1024; // 1 MiB per blob frame
 import { createFleetMessages } from './fleet-messages.mjs';
 import { can as mayAct } from '../util/policy-matrix.mjs';
 import { createFleetMemory } from './fleet-memory.mjs';
@@ -687,7 +695,9 @@ export class RelayServer {
 
     // v0.3.0 §9: read the body ONCE, before routing. An HMAC covers the exact
     // received bytes, so no route may consume the stream first and re-serialise.
-    const rawBody = methodHasBody(method) ? await readRawBody(req, this.frameLimitBytes) : null;
+    /** v1.2.7: only the blob channel gets the larger frame cap; every JSON route keeps the 64 KiB frame limit. */
+    const blobFrameLimit = method === 'PUT' && path.startsWith('/v1/fleet/blobs/') ? BLOB_FRAME_BYTES : this.frameLimitBytes;
+    const rawBody = methodHasBody(method) ? await readRawBody(req, blobFrameLimit) : null;
     const takeJson = () => parseJsonBody(rawBody);
 
     /* ---- public endpoints ---- */
@@ -1145,6 +1155,7 @@ export class RelayServer {
         text: body.text,
         mentions: body.mentions,
         enc: body.enc,
+        reply_state: body.reply_state,
         idempotency_key: body.idempotency_key,
       });
       if (posted.ok !== true) {

package/src/relay/state.mjs

@@ -734,6 +734,9 @@ export class RabbitState {
           created_at_ms: Number.isFinite(createdAt) ? createdAt : this.nowMs(),
           command_hash: t.command_hash ?? null,
           attempt: t.attempt ?? 1,
+          // v1.2.7: a revived task keeps its graph edges and assignment, or the scheduler silently becomes a different scheduler.
+          depends_on: Array.isArray(t.depends_on) ? t.depends_on : [],
+          assignee: typeof t.assignee === 'string' && t.assignee !== '' ? t.assignee : null,
           leases: new Map(),
           cancelled: false,
           cancel_reason: null,
@@ -1917,6 +1920,31 @@ export class RabbitState {
     if (typeof dedupeKeyBase !== 'string' || dedupeKeyBase.length !== 64) {
       throw new ProtocolError('INTERNAL', 'failed to compute dedupe_key');
     }
+    /**
+     * v1.2.7: a dependency that is not settled means this task is NOT dispatched yet. Its leases are recorded as `waiting`,
+     * which the sweeper ignores and redelivery skips, and `_releaseDependents` moves them to offers when the graph allows it.
+     */
+    const dependencyStates = (task.depends_on ?? []).map((depId) => {
+      const dep = this.tasks.get(depId);
+      if (dep === undefined) return 'unknown';
+      if (dep.cancelled === true) return 'cancelled';
+      return this._taskSettled(dep) === true ? 'completed' : 'waiting';
+    });
+    const graphBlocked = dependencyStates.some((state) => state === 'cancelled' || state === 'unknown');
+    const graphReady = graphBlocked !== true && dependencyStates.every((state) => state === 'completed');
+    const waitingOn = graphReady === true ? [] : (task.depends_on ?? []);
+    /**
+     * v1.2.7: an assignee is a restriction, not a label. Only that machine gets a lease; another machine cannot accidentally
+     * take work that was meant for one host. An unknown assignee is refused by name rather than producing a task nobody holds.
+     */
+    if (task.assignee !== null && !this.devices.has(task.assignee)) {
+      throw new ProtocolError('BAD_REQUEST', 'assignee is not a known device on this relay', { assignee: task.assignee });
+    }
+    if (task.assignee !== null) {
+      const narrowed = targets.filter((device) => device.machine_id === task.assignee);
+      targets.length = 0;
+      targets.push(...narrowed);
+    }
     let lastSeq = this.seq;
     targets.forEach((device, i) => {
       const index = mode === 'replicate' ? 0 : i % indexTotal;
@@ -1950,6 +1978,12 @@ export class RabbitState {
         task.leases.set(device.machine_id, lease);
         return;
       }
+      if (graphReady !== true) {
+        lease.state = 'waiting';
+        lease.waiting_on = waitingOn;
+        task.leases.set(device.machine_id, lease);
+        return;
+      }
       const gate = gateMachine(task, device);
       if (gate) {
         lease.state = 'refused';
@@ -2002,6 +2036,9 @@ export class RabbitState {
         attempt: task.attempt,
         deadline_ms: task.deadline_ms,
         // v0.4.0: routing metadata, so a restarted relay re-offers with the same facts.
+            // v1.2.7: the dependency graph and assignment belong to the task record, not to a reader's memory of it.
+            depends_on: Array.isArray(task.depends_on) ? task.depends_on : [],
+            assignee: task.assignee ?? null,
         origin_machine_id: task.origin_machine_id ?? null,
         p2p: task.p2p ?? null,
       },
@@ -2211,6 +2248,47 @@ export class RabbitState {
       .map((t) => this.taskSummary(t));
   }
 
+  /** v1.2.7: a task is settled when no lease can still produce a result. Dependencies wait for that, not for a wording. */
+  _taskSettled(task) {
+    for (const lease of task.leases.values()) if (ACTIVE_LEASE_STATES.includes(lease.state)) return false;
+    return true;
+  }
+
+  /**
+   * v1.2.7: release tasks whose prerequisites are all settled.
+   *
+   * Called after a result is stored: a dependency that finished must actually move its dependents from `waiting` to an offer.
+   * Without this the graph would be validated, stored, and then never scheduled -- the exact "validated but not enforced" gap.
+   */
+  _releaseDependents(completedTaskId = null) {
+    const released = [];
+    for (const candidate of this.tasks.values()) {
+      if (!Array.isArray(candidate.depends_on) || candidate.depends_on.length === 0) continue;
+      if (completedTaskId !== null && !candidate.depends_on.includes(completedTaskId)) continue;
+      const waiting = [...candidate.leases.values()].filter((lease) => lease.state === 'waiting');
+      if (waiting.length === 0) continue;
+      let ready = true;
+      for (const depId of candidate.depends_on) {
+        const dep = this.tasks.get(depId);
+        if (dep === undefined) { ready = false; break; }
+        if (dep.cancelled === true) { ready = false; break; }
+        if (this._taskSettled(dep) !== true) { ready = false; break; }
+      }
+      if (ready !== true) continue;
+      for (const lease of waiting) {
+        lease.state = 'queued';
+        lease.claimed_at_ms = this.nowMs();
+        lease.lease_until_ms = this.nowMs() + this.leaseWindowMs();
+        const device = this.devices.get(lease.machine_id);
+        if (device === undefined) continue;
+        this.emitOffer(candidate, lease);
+      }
+      this.emit('notice', { level: 'info', code: 'TASK_READY', message: candidate.task_id + ' is ready: dependencies settled', task_id: candidate.task_id });
+      released.push(candidate.task_id);
+    }
+    return released;
+  }
+
   taskSummary(task) {
     return {
       task_id: task.task_id,
@@ -2222,6 +2300,24 @@ export class RabbitState {
       degraded: task.degraded,
       leases: [...task.leases.values()].map((l) => l.machine_id),
       lease_states: Object.fromEntries([...task.leases.values()].map((l) => [l.machine_id, l.state])),
+      /**
+       * v1.2.7: the state the scheduler is actually in, derived here rather than by each reader.
+       *
+       * Before this, GET /v1/tasks carried no status at all, so a board classified a waiting task as "ready" (its dependencies
+       * map empty) and a released task as "waiting" forever. The board must read the scheduler's own words or it is decoration.
+       */
+      status: (() => {
+        if (task.cancelled === true) return 'cancelled';
+        const leases = [...task.leases.values()];
+        if (leases.some((lease) => lease.state === 'waiting')) return 'waiting';
+        if (leases.some((lease) => ACTIVE_LEASE_STATES.includes(lease.state))) return 'active';
+        const results = [...this.results.values()].filter((record) => record?.envelope?.task_id === task.task_id);
+        if (results.length > 0 && results.every((record) => ['failed', 'crashed', 'refused', 'timeout'].includes(record?.envelope?.status))) return 'failed';
+        return this._taskSettled(task) === true ? 'done' : 'unknown';
+      })(),
+      depends_on: Array.isArray(task.depends_on) ? task.depends_on : [],
+      assignee: task.assignee ?? null,
+      waiting_on: [...task.leases.values()].some((l) => l.state === 'waiting') ? (Array.isArray(task.depends_on) ? task.depends_on : []) : [],
     };
   }
 
@@ -2450,6 +2546,9 @@ export class RabbitState {
       }
       if (changed) task.degraded = 'partial';
     }
+    // v1.2.7: a lease that expires (or a machine that refuses) is a settlement too -- the dependent graph must move.
+    this._releaseDependents();
+
     return expired;
   }
 
@@ -2738,6 +2837,9 @@ export class RabbitState {
     });
 
     // §7: results go into the ledger so the dedupe index survives a restart.
+    // v1.2.7: a settled task may be the prerequisite that frees its dependents.
+    this._releaseDependents(taskId);
+
     this._ledger({ type: 'result.stored', task_id: taskId, machine_id: machineId, result: record });
     if (machineId) {
       const changed = task.leases.get(machineId);

package/src/util/dataflow.mjs

@@ -41,7 +41,8 @@ const SHA256 = /^[0-9a-f]{64}$/;
  * A missing or malformed hash is refused by name -- the reduce step must never run on a partial fleet and call the answer
  * complete.
  *
- * @param {{results?: Array<{machine_id?: string, mode?: string, stdout?: string, blob_sha256?: string}>,
+ * @param {{results?: Array<{machine_id?: string, mode?: string, stdout?: string, blob_sha256?: string, index?: number}>,
+ *          expectedIndexTotal?: number|null,
  *          reducerMachineId?: string}} input
  * @returns {{ok: true, reducerMachineId: string, inputs: Array<{machine_id: string, mode: 'inline'|'blob', stdout?: string, sha256?: string}>} |
  *           {ok: false, code: string, detail: object}}
@@ -51,6 +52,15 @@ export function buildReducePlan(input = {}) {
   if (reducer === null) return { ok: false, code: 'REDUCER_MISSING', detail: {} };
   const results = Array.isArray(input.results) ? input.results : null;
   if (results === null || results.length === 0) return { ok: false, code: 'NO_MAP_RESULTS', detail: {} };
+  /**
+   * v1.2.7: what the task SAID would be produced, not just what arrived.
+   *
+   * Without an expected count the plan can only describe the reports it was handed, so a split run where one shard never
+   * reported produced a plan that looked complete. The count comes from the task (index_total); a missing index is refused
+   * by name before the reduce step can run on a partial fleet.
+   */
+  const expectedTotal = Number.isInteger(input.expectedIndexTotal) && input.expectedIndexTotal > 0 ? input.expectedIndexTotal : null;
+  const seenIndexes = new Set();
 
   const seen = new Set();
   const inputs = [];
@@ -59,6 +69,14 @@ export function buildReducePlan(input = {}) {
     if (machineId === null) return { ok: false, code: 'MAP_MACHINE_MISSING', detail: {} };
     if (seen.has(machineId)) return { ok: false, code: 'MAP_MACHINE_DUPLICATE', detail: { machineId } };
     seen.add(machineId);
+    if (expectedTotal !== null) {
+      const index = Number.isInteger(result?.index) ? result.index : null;
+      if (index === null) return { ok: false, code: 'MAP_INDEX_MISSING', detail: { machineId } };
+      if (index < 0 || index >= expectedTotal) {
+        return { ok: false, code: 'MAP_INDEX_OUT_OF_RANGE', detail: { machineId, index, expectedIndexTotal: expectedTotal } };
+      }
+      seenIndexes.add(index);
+    }
     const mode = result?.mode === 'blob' ? 'blob' : 'inline';
     if (mode === 'blob') {
       const sha = typeof result?.blob_sha256 === 'string' ? result.blob_sha256.toLowerCase() : '';
@@ -68,5 +86,10 @@ export function buildReducePlan(input = {}) {
       inputs.push({ machine_id: machineId, mode, stdout: typeof result?.stdout === 'string' ? result.stdout : '' });
     }
   }
+  if (expectedTotal !== null) {
+    const missing = [];
+    for (let index = 0; index < expectedTotal; index += 1) if (!seenIndexes.has(index)) missing.push(index);
+    if (missing.length > 0) return { ok: false, code: 'MISSING_SHARD', detail: { missing, expectedIndexTotal: expectedTotal } };
+  }
   return { ok: true, reducerMachineId: reducer, inputs };
 }