@valescoagency/runway 0.12.0 → 0.14.0

package/README.md

@@ -541,7 +541,7 @@ These are tractable, just not v1.
 
 ## Status
 
-0.12.0 — production-shaped and dogfooded against live Linear queues.
+0.14.0 — production-shaped and dogfooded against live Linear queues.
 The end-to-end pipeline (init → run → review → PR) is stable; surface
 may still shift as the orchestrator's policy and iteration mechanics
 mature. See [CHANGELOG.md](./CHANGELOG.md) for per-release detail.

package/dist/commands/dash.js

@@ -5,15 +5,22 @@ import { execa } from "execa";
  * runway-using project without cloning the runway repo or maintaining
  * a docker-compose file.
  *
- * Three verbs:
- *   up     pull the published image and run it as a detached
- *          container (`runway-dashboard`) with loopback ports and a
- *          named volume for the SQLite db.
- *   logs   stream `docker logs` for the container (`--follow` toggles
- *          `-f`; default tails recent output without following).
- *   stop   stop and `rm` the container. The named volume stays so
- *          history survives across restarts; explicit `--purge` drops
- *          the volume too.
+ * Four verbs:
+ *   up      pull the published image and run it as a detached
+ *           container (`runway-dashboard`) with loopback ports and a
+ *           named volume for the SQLite db.
+ *   logs    stream `docker logs` for the container (`--follow` toggles
+ *           `-f`; default tails recent output without following).
+ *   stop    stop and `rm` the container. The named volume stays so
+ *           history survives across restarts; explicit `--purge` drops
+ *           the volume too.
+ *   upgrade VA-451: pull a fresh image, then stop + `rm` the existing
+ *           container and start a new one against the same named
+ *           volume. The pull happens first so a failed pull leaves the
+ *           existing dashboard running. Schema migrations on the
+ *           SQLite db are idempotent (ALTER TABLE ADD COLUMN swallowed
+ *           on duplicate), so column-add releases like VA-450 carry
+ *           forward without operator intervention.
  *
  * Defaults to the `:latest` tag published by `.github/workflows/dashboard-image.yml`.
  * Override via `--image` or the `RUNWAY_DASHBOARD_IMAGE` env var.
@@ -39,6 +46,9 @@ const FORWARDED_ENV_KEYS = [
     "LINEAR_POLL_INTERVAL_SECONDS",
     "RUNWAY_LINEAR_TEAM",
     "RUNWAY_READY_LABEL",
+    // VA-452: workspace slug for the dashboard's `↗ open in Linear`
+    // affordance. Unset → identifiers render as plain text.
+    "RUNWAY_LINEAR_WORKSPACE",
 ];
 export function printDashUsage() {
     console.log(`runway dash — operate the runway operations dashboard
@@ -48,19 +58,25 @@ project without cloning the runway repo. The published image is
 ${DEFAULT_IMAGE}; override via --image or RUNWAY_DASHBOARD_IMAGE.
 
 USAGE
-  runway dash up   [--image=…] [--otlp-port=N] [--dashboard-port=N]
-  runway dash logs [--follow]
-  runway dash stop [--purge]
+  runway dash up      [--image=…] [--otlp-port=N] [--dashboard-port=N]
+  runway dash upgrade [--image=…] [--otlp-port=N] [--dashboard-port=N]
+  runway dash logs    [--follow]
+  runway dash stop    [--purge]
 
 VERBS
-  up     Pull and start the dashboard as a detached container
-         (\`${DEFAULT_CONTAINER_NAME}\`). Ports publish to 127.0.0.1
-         only; a named volume (\`${DEFAULT_VOLUME_NAME}\`) persists
-         the SQLite db across runs.
-  logs   Stream container logs (\`docker logs ${DEFAULT_CONTAINER_NAME}\`).
-         Pass --follow to tail with -f.
-  stop   Stop and remove the container. The named volume stays unless
-         --purge is passed.
+  up       Pull and start the dashboard as a detached container
+           (\`${DEFAULT_CONTAINER_NAME}\`). Ports publish to 127.0.0.1
+           only; a named volume (\`${DEFAULT_VOLUME_NAME}\`) persists
+           the SQLite db across runs.
+  upgrade  Pull a fresh image and replace the running container with
+           one based on it. The pull runs first, so if it fails the
+           existing container is left untouched. The named volume
+           (\`${DEFAULT_VOLUME_NAME}\`) is preserved across the
+           replacement — SQLite history + schema migrate forward.
+  logs     Stream container logs (\`docker logs ${DEFAULT_CONTAINER_NAME}\`).
+           Pass --follow to tail with -f.
+  stop     Stop and remove the container. The named volume stays unless
+           --purge is passed.
 
 OPTIONS
   --image=REF         Override the dashboard image reference.
@@ -85,15 +101,18 @@ OTEL EXPORTER
 }
 export function parseDashArgs(argv) {
     if (argv.length === 0) {
-        throw new Error("missing verb — expected one of: up, logs, stop. Run `runway dash --help`.");
+        throw new Error("missing verb — expected one of: up, upgrade, logs, stop. Run `runway dash --help`.");
     }
     const [verbRaw, ...rest] = argv;
     if (verbRaw === "--help" || verbRaw === "-h") {
         printDashUsage();
         process.exit(0);
     }
-    if (verbRaw !== "up" && verbRaw !== "logs" && verbRaw !== "stop") {
-        throw new Error(`unknown verb "${verbRaw}" — expected one of: up, logs, stop.`);
+    if (verbRaw !== "up" &&
+        verbRaw !== "logs" &&
+        verbRaw !== "stop" &&
+        verbRaw !== "upgrade") {
+        throw new Error(`unknown verb "${verbRaw}" — expected one of: up, upgrade, logs, stop.`);
     }
     const verb = verbRaw;
     let image;
@@ -196,6 +215,9 @@ export async function dashCommand(argv) {
         case "up":
             await dashUp(opts);
             return;
+        case "upgrade":
+            await dashUpgrade(opts);
+            return;
         case "logs":
             await dashLogs(opts);
             return;
@@ -252,6 +274,40 @@ async function dashUp(opts) {
     await execa("docker", args, { stdio: "inherit" });
     await printAccessHints(opts);
 }
+/**
+ * VA-451: pull-then-replace. The pull runs BEFORE the stop so a
+ * failed pull (network, auth, manifest mismatch) leaves the existing
+ * container running — we never take the dashboard down on a failed
+ * upgrade attempt. The named volume is preserved across the
+ * replacement; the dashboard's idempotent ALTER TABLE migrations
+ * handle any column adds on the new container's next boot.
+ */
+async function dashUpgrade(opts) {
+    console.log(`[runway dash] upgrade: pulling ${opts.image}`);
+    try {
+        await execa("docker", ["pull", opts.image], { stdio: "inherit" });
+    }
+    catch {
+        throw new Error(`failed to pull ${opts.image}. ` +
+            "The existing container is unchanged. " +
+            "If the image is private, run `docker login ghcr.io` first.");
+    }
+    const existing = await containerState(opts.containerName);
+    if (existing === "running") {
+        console.log(`[runway dash] upgrade: stopping ${opts.containerName}`);
+        await execa("docker", ["stop", opts.containerName], {
+            stdio: "inherit",
+        });
+    }
+    if (existing !== "absent") {
+        console.log(`[runway dash] upgrade: removing ${opts.containerName} (volume ${opts.volumeName} kept)`);
+        await execa("docker", ["rm", opts.containerName], { stdio: "inherit" });
+    }
+    const args = buildDockerRunArgs(opts);
+    console.log(`[runway dash] starting container ${opts.containerName}`);
+    await execa("docker", args, { stdio: "inherit" });
+    await printAccessHints(opts);
+}
 async function dashLogs(opts) {
     const args = ["logs"];
     if (opts.follow)

package/dist/dashboard/linear-sync.js

@@ -24,6 +24,7 @@ export function createLinearAdapter(opts) {
             identifier: raw.identifier,
             title: raw.title,
             status: state?.name ?? "",
+            statusType: state?.type ?? "",
             labels: labels.nodes.map((l) => l.name),
             projectId: project?.id ?? null,
             projectName: project?.name ?? null,
@@ -110,18 +111,29 @@ export function startLinearSync(opts) {
             // the preview.
             opts.storage.clearLinearQueuePositions();
             const at = new Date().toISOString();
-            queue.forEach((q, i) => {
+            // VA-453: issues whose Linear workflow-state type is `completed`
+            // or `canceled` get saved without a queue position so they drop
+            // out of the Todo queue preview even when they still carry the
+            // `ready-for-agent` label. The snapshot row stays in
+            // linear_snapshots so per-row status badges on the
+            // issue-process list continue to resolve.
+            let position = 0;
+            queue.forEach((q) => {
                 queuedIds.add(q.identifier);
+                const isInactive = q.statusType === "completed" || q.statusType === "canceled";
                 opts.storage.saveLinearSnapshot({
                     issueIdentifier: q.identifier,
                     snapshotAt: at,
                     status: q.status,
+                    statusType: q.statusType,
                     title: q.title,
                     labels: q.labels,
-                    queuePosition: i,
+                    queuePosition: isInactive ? null : position,
                     projectId: q.projectId,
                     projectName: q.projectName,
                 });
+                if (!isInactive)
+                    position += 1;
             });
             log("info", `[runway dashboard] linear sync: refreshed ready queue (${queue.length} issue${queue.length === 1 ? "" : "s"})`);
         }
@@ -144,6 +156,7 @@ export function startLinearSync(opts) {
                         issueIdentifier: r.identifier,
                         snapshotAt: at,
                         status: r.status,
+                        statusType: r.statusType,
                         title: r.title,
                         labels: r.labels,
                         queuePosition: null,

package/dist/dashboard/projector.js

@@ -52,6 +52,10 @@ function projectDrain(span) {
         spanId: span.spanId,
         startTimeUnixNano: span.startTimeUnixNano,
         endTimeUnixNano: span.endTimeUnixNano,
+        // VA-455: an ended drain's "last activity" is its end time —
+        // the storage layer keeps last_seen monotonic, so setting it
+        // here ensures the value never regresses below the real end.
+        lastSeenUnixNano: span.endTimeUnixNano,
         attempts: numAttr(m["runway.drain.attempts"]),
         opened: numAttr(m["runway.drain.opened"]),
         hitl: numAttr(m["runway.drain.hitl"]),
@@ -137,6 +141,53 @@ function numAttr(v) {
 function strArrayAttr(v) {
     return Array.isArray(v) ? v : [];
 }
+/**
+ * VA-455: the canonical body string runway emits at the top of the
+ * `drainQueue` span. The projector matches on this exact value to
+ * decide which log records become active-drain markers — keep them
+ * in lock-step with `orchestrator.ts`.
+ */
+export const DRAIN_STARTED_LOG = "drain.started";
+/**
+ * VA-455: scan an OTLP logs payload for `drain.started` markers.
+ * Each match becomes an `ActiveDrainMarker` carrying the drain's
+ * trace_id, the drainQueue span_id, and the log timestamp. The
+ * storage layer's `markDrainActive` upserts a `drains` row on each
+ * marker so the dashboard's active-drain card lights up within ~1s
+ * of `runway run` starting, instead of waiting for the first
+ * `processIssue` span to end.
+ *
+ * Records missing trace_id, span_id, or a timestamp are dropped —
+ * we won't fabricate any of those, and a drain.started marker
+ * without them has nothing useful to bind.
+ */
+export function extractActiveDrainMarkers(payload) {
+    const out = [];
+    for (const rl of payload.resourceLogs ?? []) {
+        for (const sl of rl.scopeLogs ?? []) {
+            for (const rec of sl.logRecords ?? []) {
+                if (rec.body?.stringValue !== DRAIN_STARTED_LOG)
+                    continue;
+                const traceId = rec.traceId?.trim();
+                if (!traceId)
+                    continue;
+                const spanId = rec.spanId?.trim();
+                if (!spanId)
+                    continue;
+                const ts = rec.timeUnixNano ?? rec.observedTimeUnixNano;
+                if (!ts)
+                    continue;
+                out.push({
+                    traceId,
+                    spanId,
+                    startTimeUnixNano: ts,
+                    lastSeenUnixNano: ts,
+                });
+            }
+        }
+    }
+    return out;
+}
 /**
  * VA-388: project an OTLP logs payload into `LogRecordRow`s. Records
  * without a trace_id are dropped — every Effect log emitted under

package/dist/dashboard/server.js

@@ -1,7 +1,7 @@
 import { createServer } from "node:http";
 import { createLinearAdapter, startLinearSync, } from "./linear-sync.js";
 import { createEventBus } from "./events.js";
-import { projectLogs, projectPayload } from "./projector.js";
+import { extractActiveDrainMarkers, projectLogs, projectPayload, } from "./projector.js";
 import { createStorage, } from "./storage.js";
 import { META_REVIEW_PAGE_SIZE, renderDetailView, renderIssueProcessRows, renderListView, renderLogsSection, renderMetaReviewDetailView, renderMetaReviewListView, } from "./views.js";
 // VA-389: phase spans we surface on the detail page's timeline.
@@ -34,6 +34,7 @@ const MAX_BODY_BYTES = 10 * 1024 * 1024; // 10 MiB — generous; a runway drain
  */
 export function buildServer(storage, opts = {}) {
     const linearEnabled = opts.linearEnabled ?? false;
+    const linearWorkspace = opts.linearWorkspace ?? null;
     // VA-391: an in-process event bus is plumbed through every request
     // handler so the OTLP ingest paths can publish change events that
     // the SSE detail-pane stream re-emits to the browser. Callers can
@@ -41,7 +42,7 @@ export function buildServer(storage, opts = {}) {
     // production gets a fresh per-server bus.
     const events = opts.events ?? createEventBus();
     return createServer((req, res) => {
-        handle(req, res, storage, linearEnabled, events).catch((err) => {
+        handle(req, res, storage, linearEnabled, linearWorkspace, events).catch((err) => {
             writeError(res, 500, "internal_error", asMessage(err));
         });
     });
@@ -53,6 +54,7 @@ export function buildServer(storage, opts = {}) {
 export async function startServer(opts) {
     const server = buildServer(opts.storage, {
         linearEnabled: opts.linearEnabled,
+        linearWorkspace: opts.linearWorkspace,
         events: opts.events,
     });
     const port = opts.port ?? 4318;
@@ -74,7 +76,7 @@ export async function startServer(opts) {
         }),
     };
 }
-async function handle(req, res, storage, linearEnabled, events) {
+async function handle(req, res, storage, linearEnabled, linearWorkspace, events) {
     // Route on method + path. Nothing fancy — slice 1 only has two
     // endpoints; a router becomes worth its weight in slice 2.
     const url = req.url ?? "/";
@@ -88,14 +90,14 @@ async function handle(req, res, storage, linearEnabled, events) {
         return;
     }
     if (method === "GET" && (url === "/" || url.startsWith("/?"))) {
-        handleListView(req, res, storage, linearEnabled);
+        handleListView(req, res, storage, linearEnabled, linearWorkspace);
         return;
     }
     // VA-391: fragment endpoint returns just the tbody so the list view
     // can poll via htmx without redrawing the rest of the page.
     if (method === "GET" &&
         (url === "/issue-processes" || url.startsWith("/issue-processes?"))) {
-        handleIssueProcessRowsFragment(req, res, storage, linearEnabled);
+        handleIssueProcessRowsFragment(req, res, storage, linearEnabled, linearWorkspace);
         return;
     }
     if (method === "GET") {
@@ -111,7 +113,7 @@ async function handle(req, res, storage, linearEnabled, events) {
         const issueProcessMatch = ISSUE_PROCESS_DETAIL_RE.exec(pathOnly);
         if (issueProcessMatch) {
             const spanId = decodeURIComponent(issueProcessMatch[1] ?? "");
-            handleIssueProcessDetailView(res, storage, spanId);
+            handleIssueProcessDetailView(res, storage, spanId, linearWorkspace);
             return;
         }
         // VA-407: meta-review list + detail. List matches the bare path or
@@ -133,7 +135,7 @@ async function handle(req, res, storage, linearEnabled, events) {
         if (detailMatch) {
             const traceId = decodeURIComponent(detailMatch[1] ?? "");
             const spanId = decodeURIComponent(detailMatch[2] ?? "");
-            handleDetailView(res, storage, traceId, spanId);
+            handleDetailView(res, storage, traceId, spanId, linearWorkspace);
             return;
         }
     }
@@ -237,6 +239,14 @@ async function handleOtlpLogs(req, res, storage, events) {
         writeError(res, 400, "invalid_json", asMessage(err));
         return;
     }
+    // VA-455: surface in-flight drains the moment the runway process
+    // emits its `drain.started` log marker — well before the first
+    // processIssue span ends. `markDrainActive` is no-op when the
+    // drain has already closed, so reordering across OTLP retries is
+    // safe.
+    for (const m of extractActiveDrainMarkers(payload)) {
+        storage.markDrainActive(m);
+    }
     for (const r of projectLogs(payload)) {
         storage.appendLogRecord(r);
         // VA-391: the SSE detail-pane stream live-tails the Logs section
@@ -318,7 +328,7 @@ function handleIssueProcessStream(req, res, storage, events, spanId) {
  * preview and drain summary strip stay static between polls — they
  * have their own swap triggers (or sit above the polling target).
  */
-function handleIssueProcessRowsFragment(req, res, storage, linearEnabled) {
+function handleIssueProcessRowsFragment(req, res, storage, linearEnabled, linearWorkspace) {
     // VA-392: the fragment endpoint applies the same filter state as the
     // full list view so a polled refresh doesn't reset the user's chips.
     // The query string is the source of truth — htmx mirrors the page's
@@ -336,6 +346,7 @@ function handleIssueProcessRowsFragment(req, res, storage, linearEnabled) {
         linearEnabled,
         snapshotsByIdentifier,
         isFiltered: isFilteredState(filterState),
+        linearWorkspace,
     });
     res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
     res.end(html);
@@ -346,7 +357,7 @@ function writeSseFrame(res, event, data) {
     const lines = data.split("\n").map((line) => `data: ${line}`).join("\n");
     res.write(`event: ${event}\n${lines}\n\n`);
 }
-function handleListView(req, res, storage, linearEnabled) {
+function handleListView(req, res, storage, linearEnabled, linearWorkspace) {
     // VA-392: filter chips state is encoded in the URL query string so
     // the view is shareable. Parse once and reuse both for the storage
     // query and the chip render (the latter needs to know which chips
@@ -378,6 +389,7 @@ function handleListView(req, res, storage, linearEnabled) {
         filterState,
         recentDrains,
         isFiltered: isFilteredState(filterState),
+        linearWorkspace,
     });
     res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
     res.end(html);
@@ -471,28 +483,28 @@ function formatSqliteDatetime(d) {
  * (trace_id, span_id) pair doesn't match a known issue process — the
  * dashboard never auto-creates rows from a URL.
  */
-function handleDetailView(res, storage, traceId, spanId) {
+function handleDetailView(res, storage, traceId, spanId, linearWorkspace) {
     const ip = storage.getIssueProcess(traceId, spanId);
     if (!ip) {
         writeError(res, 404, "not_found", `no issue process for trace=${traceId} span=${spanId}`);
         return;
     }
-    renderDetailFor(res, storage, ip);
+    renderDetailFor(res, storage, ip, linearWorkspace);
 }
 /**
  * VA-387: detail-route handler keyed on the issue process span_id
  * alone. Reuses the same view model as the older two-segment route
  * once the row is resolved.
  */
-function handleIssueProcessDetailView(res, storage, spanId) {
+function handleIssueProcessDetailView(res, storage, spanId, linearWorkspace) {
     const ip = storage.getIssueProcessBySpanId(spanId);
     if (!ip) {
         writeError(res, 404, "not_found", `no issue process for span=${spanId}`);
         return;
     }
-    renderDetailFor(res, storage, ip);
+    renderDetailFor(res, storage, ip, linearWorkspace);
 }
-function renderDetailFor(res, storage, ip) {
+function renderDetailFor(res, storage, ip, linearWorkspace) {
     const iterations = storage.listAgentIterations(ip.traceId, ip.spanId);
     const phaseSpans = storage.listPhaseSpans(ip.traceId, ip.spanId, [
         ...DETAIL_PHASE_NAMES,
@@ -507,6 +519,7 @@ function renderDetailFor(res, storage, ip) {
         iterations,
         phaseSpans,
         logs,
+        linearWorkspace,
     });
     res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
     res.end(html);
@@ -652,6 +665,13 @@ export async function main() {
     // and start polling at LINEAR_POLL_INTERVAL_SECONDS (default 300).
     const linearApiKey = process.env.LINEAR_API_KEY;
     const linearEnabled = Boolean(linearApiKey);
+    // VA-452: workspace slug for the `↗ open in Linear` affordance.
+    // Trim + collapse empty to null so a stray empty env var doesn't
+    // produce broken `linear.app//issue/...` URLs.
+    const linearWorkspaceRaw = process.env.RUNWAY_LINEAR_WORKSPACE?.trim();
+    const linearWorkspace = linearWorkspaceRaw && linearWorkspaceRaw.length > 0
+        ? linearWorkspaceRaw
+        : null;
     let linearSync = null;
     if (linearApiKey) {
         const adapter = createLinearAdapter({
@@ -675,6 +695,7 @@ export async function main() {
         port: otlpPort,
         host: otlpHost,
         linearEnabled,
+        linearWorkspace,
     });
     // The two listeners can share a server only when both port AND host
     // match — different bind addresses need different listeners.
@@ -685,6 +706,7 @@ export async function main() {
             port: dashboardPort,
             host: dashboardHost,
             linearEnabled,
+            linearWorkspace,
         });
     console.log(`[runway dashboard] OTLP ${otlpHost}:${otlp.port} · dashboard ${dashboardHost}:${dashboard.port}; sqlite=${sqlitePath}`);
     const shutdown = async (signal) => {

package/dist/dashboard/storage.js

@@ -1,4 +1,11 @@
 import { DatabaseSync } from "node:sqlite";
+/**
+ * VA-455: how stale a drain's last_seen can be before getActiveDrain
+ * treats it as crashed and hides it. Runway emits a heartbeat log
+ * every 30s while drainQueue is active; 90s gives 3× headroom so a
+ * single dropped heartbeat doesn't toggle the dashboard card.
+ */
+export const ACTIVE_DRAIN_STALENESS_NANOS = 90n * 1000000000n;
 /**
  * VA-406: named constants for the `meta_reviews.kind` alphabet.
  * Used by the IRA passes when stamping rows + by gateway queries
@@ -23,11 +30,17 @@ export const META_RUN_REVIEW_COMPLETION_KINDS = [
     META_REVIEW_KIND.FAILED,
 ];
 const SCHEMA = `
+  -- VA-455: end_time_unix_nano is nullable so an "active drain" row
+  -- inserted by the drain.started log marker can exist before the
+  -- drainQueue span has actually ended. last_seen_unix_nano carries
+  -- the most recent log record's timestamp for the trace so the
+  -- dashboard's active-drain query can age out crashed drains.
   CREATE TABLE IF NOT EXISTS drains (
     trace_id TEXT NOT NULL,
     span_id TEXT NOT NULL,
     start_time_unix_nano TEXT NOT NULL,
-    end_time_unix_nano TEXT NOT NULL,
+    end_time_unix_nano TEXT,
+    last_seen_unix_nano TEXT,
     attempts INTEGER,
     opened INTEGER,
     hitl INTEGER,
@@ -101,7 +114,8 @@ const SCHEMA = `
     labels_json TEXT,
     queue_position INTEGER,
     project_id TEXT,
-    project_name TEXT
+    project_name TEXT,
+    status_type TEXT
   );
 
   CREATE INDEX IF NOT EXISTS idx_linear_snapshots_queue_position
@@ -164,6 +178,59 @@ const DEFAULT_AGGREGATE_WINDOW = 30;
  * of `hitl_escape_rate` — a review rejection routes to HITL, so both
  * rates count the same row.
  */
+/**
+ * VA-455: relax the `end_time_unix_nano TEXT NOT NULL` constraint on
+ * pre-VA-455 `drains` tables so the log-driven active-drain row can
+ * land with end_time = NULL. SQLite has no `ALTER COLUMN`, so the
+ * idiomatic move is a rebuild — guarded by PRAGMA so fresh installs
+ * (which already created the new schema) skip the work.
+ */
+function relaxDrainsEndTimeNotNull(db) {
+    const cols = db
+        .prepare("PRAGMA table_info('drains')")
+        .all();
+    const endTime = cols.find((c) => c.name === "end_time_unix_nano");
+    if (!endTime || endTime.notnull === 0)
+        return;
+    // Single transaction so the `drains` name is never absent from the
+    // schema between DROP and RENAME — concurrent readers (none today,
+    // but cheap insurance) keep seeing the old table until COMMIT.
+    db.prepare("BEGIN").run();
+    try {
+        db.prepare(`CREATE TABLE drains_v2 (
+        trace_id TEXT NOT NULL,
+        span_id TEXT NOT NULL,
+        start_time_unix_nano TEXT NOT NULL,
+        end_time_unix_nano TEXT,
+        last_seen_unix_nano TEXT,
+        attempts INTEGER,
+        opened INTEGER,
+        hitl INTEGER,
+        errored INTEGER,
+        status_code INTEGER,
+        status_message TEXT,
+        inserted_at TEXT NOT NULL DEFAULT (datetime('now')),
+        PRIMARY KEY (trace_id, span_id)
+      )`).run();
+        db.prepare(`INSERT INTO drains_v2 (
+        trace_id, span_id, start_time_unix_nano, end_time_unix_nano,
+        last_seen_unix_nano, attempts, opened, hitl, errored,
+        status_code, status_message, inserted_at
+      )
+      SELECT
+        trace_id, span_id, start_time_unix_nano, end_time_unix_nano,
+        last_seen_unix_nano, attempts, opened, hitl, errored,
+        status_code, status_message, inserted_at
+      FROM drains`).run();
+        db.prepare("DROP TABLE drains").run();
+        db.prepare("ALTER TABLE drains_v2 RENAME TO drains").run();
+        db.prepare("COMMIT").run();
+    }
+    catch (err) {
+        db.prepare("ROLLBACK").run();
+        throw err;
+    }
+}
 function aggregatesViewDdl(windowDrains) {
     // windowDrains is the only spot we interpolate rather than
     // parameter-bind (CREATE VIEW can't take params). Coerce to a
@@ -294,6 +361,14 @@ export function createStorage(path, opts = {}) {
         // VA-450: project Name + UUID for the Todo queue Project column.
         `ALTER TABLE linear_snapshots ADD COLUMN project_id TEXT`,
         `ALTER TABLE linear_snapshots ADD COLUMN project_name TEXT`,
+        // VA-453: workflow-state TYPE (not name) for cancelled/done queue
+        // filtering. Old rows decode to "" — the poller only filters on
+        // known type values so pre-migration rows behave unchanged.
+        `ALTER TABLE linear_snapshots ADD COLUMN status_type TEXT`,
+        // VA-455: per-trace heartbeat timestamp for the log-driven active
+        // drain query (see SCHEMA above for semantics). Older DBs need
+        // the column added in-place.
+        `ALTER TABLE drains ADD COLUMN last_seen_unix_nano TEXT`,
     ]) {
         try {
             db.exec(sql);
@@ -303,6 +378,12 @@ export function createStorage(path, opts = {}) {
             // dashboard boot ran the same migration.
         }
     }
+    // VA-455: SQLite has no `ALTER COLUMN`, so relaxing the original
+    // `end_time_unix_nano TEXT NOT NULL` constraint on legacy DBs
+    // requires a table-rebuild. Only fire when PRAGMA reports the
+    // column is still NOT NULL — fresh installs go through the new
+    // SCHEMA above and skip this branch.
+    relaxDrainsEndTimeNotNull(db);
     // VA-399: install the evaluator-facing read-model view after the
     // base tables exist (and after VA-387's column migrations above),
     // but before any prepared statement is created — a
@@ -312,17 +393,58 @@ export function createStorage(path, opts = {}) {
     const insertDrain = db.prepare(`
     INSERT INTO drains (
       trace_id, span_id, start_time_unix_nano, end_time_unix_nano,
+      last_seen_unix_nano,
       attempts, opened, hitl, errored, status_code, status_message
-    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     ON CONFLICT (trace_id, span_id) DO UPDATE SET
       start_time_unix_nano = excluded.start_time_unix_nano,
       end_time_unix_nano = excluded.end_time_unix_nano,
+      last_seen_unix_nano = excluded.last_seen_unix_nano,
       attempts = excluded.attempts,
       opened = excluded.opened,
       hitl = excluded.hitl,
       errored = excluded.errored,
       status_code = excluded.status_code,
       status_message = excluded.status_message
+  `);
+    // VA-455: insert (or refresh last_seen on) the active-drain row
+    // when runway emits its `drain.started` log marker. ON CONFLICT
+    // guards against two cases:
+    //   1. The drainQueue span has already ended (end_time NOT NULL)
+    //      — a late-arriving marker can't reanimate a closed drain,
+    //      so we leave the row untouched.
+    //   2. Repeated markers (shouldn't happen, but if they do we just
+    //      bump last_seen forward; monotonic via the MAX comparison).
+    const markActiveDrainStmt = db.prepare(`
+    INSERT INTO drains (
+      trace_id, span_id, start_time_unix_nano,
+      end_time_unix_nano, last_seen_unix_nano,
+      attempts, opened, hitl, errored,
+      status_code, status_message
+    ) VALUES (?, ?, ?, NULL, ?, 0, 0, 0, 0, NULL, NULL)
+    ON CONFLICT (trace_id, span_id) DO UPDATE SET
+      last_seen_unix_nano = excluded.last_seen_unix_nano
+    WHERE drains.end_time_unix_nano IS NULL
+      AND (
+        drains.last_seen_unix_nano IS NULL
+        OR CAST(drains.last_seen_unix_nano AS INTEGER)
+           < CAST(excluded.last_seen_unix_nano AS INTEGER)
+      )
+  `);
+    // VA-455: every log record carrying a trace_id pushes that
+    // trace's active drain's last_seen forward, so the active-drain
+    // query can age out crashed drains. UPDATE-only (never inserts)
+    // so a stray log record from a trace without a `drain.started`
+    // marker doesn't fabricate an active drain.
+    const bumpDrainLastSeenStmt = db.prepare(`
+    UPDATE drains
+    SET last_seen_unix_nano = ?
+    WHERE trace_id = ?
+      AND end_time_unix_nano IS NULL
+      AND (
+        last_seen_unix_nano IS NULL
+        OR CAST(last_seen_unix_nano AS INTEGER) < CAST(? AS INTEGER)
+      )
   `);
     const insertIssueProcess = db.prepare(`
     INSERT INTO issue_processes (
@@ -409,8 +531,8 @@ export function createStorage(path, opts = {}) {
     const upsertLinearSnapshot = db.prepare(`
     INSERT INTO linear_snapshots (
       issue_identifier, snapshot_at, status, title, labels_json, queue_position,
-      project_id, project_name
-    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+      project_id, project_name, status_type
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
     ON CONFLICT (issue_identifier) DO UPDATE SET
       snapshot_at = excluded.snapshot_at,
       status = excluded.status,
@@ -418,48 +540,80 @@ export function createStorage(path, opts = {}) {
       labels_json = excluded.labels_json,
       queue_position = excluded.queue_position,
       project_id = excluded.project_id,
-      project_name = excluded.project_name
+      project_name = excluded.project_name,
+      status_type = excluded.status_type
   `);
     const clearQueuePositionsStmt = db.prepare(`UPDATE linear_snapshots SET queue_position = NULL`);
     const listTodoQueueStmt = db.prepare(`
     SELECT issue_identifier, snapshot_at, status, title, labels_json, queue_position,
-           project_id, project_name
+           project_id, project_name, status_type
     FROM linear_snapshots
     WHERE queue_position IS NOT NULL
     ORDER BY queue_position ASC
   `);
     const listAllSnapshotsStmt = db.prepare(`
     SELECT issue_identifier, snapshot_at, status, title, labels_json, queue_position,
-           project_id, project_name
+           project_id, project_name, status_type
     FROM linear_snapshots
   `);
-    // VA-391: "active drain" = a trace_id with one or more
-    // issue_processes rows but no row in `drains`. The drain span
-    // hasn't been emitted yet (BatchSpanProcessor flushes on end), so
-    // we infer in-flight by the absence of the parent. Earliest
-    // start_time across the trace's issue_processes is the drain
-    // start; the counters slice by outcome_kind. LIMIT 1 picks the
-    // most-recently-started in-flight drain — v1 only runs one drain
-    // at a time but the SQL is robust to a future parallel mode.
+    // VA-391 + VA-455: "active drain" comes from two paths today.
+    //
+    //  (a) VA-455 log-driven: a `drains` row with end_time NULL and a
+    //      fresh `last_seen_unix_nano` (within the staleness window).
+    //      runway emits `Effect.logInfo("drain.started")` at the top
+    //      of the drainQueue span; the projector recognises that body
+    //      and inserts the row via `markDrainActive`. Subsequent log
+    //      records bump last_seen.
+    //
+    //  (b) VA-391 legacy fallback: a trace_id with issue_processes
+    //      rows but no `drains` row at all. Kept so dashboards running
+    //      against pre-VA-455 runway binaries still light up — once
+    //      the first processIssue ends.
+    //
+    // The two paths are mutually exclusive by construction (path (a)
+    // writes a `drains` row, which excludes the trace from path (b)).
+    // Among candidates, most-recently-started wins; v1 only runs one
+    // drain at a time but the SQL is robust to a future parallel mode.
+    //
+    // Bind param: the staleness floor in unix-nanos as a TEXT-encoded
+    // integer. Pass `String(BigInt(Date.now()) * 1_000_000n - staleness)`
+    // at call time so the query stays a static prepared statement.
     const getActiveDrainStmt = db.prepare(`
-    WITH active AS (
-      SELECT trace_id
+    WITH active_candidates AS (
+      SELECT
+        trace_id,
+        start_time_unix_nano AS started_at_unix_nano
+      FROM drains
+      WHERE end_time_unix_nano IS NULL
+        AND last_seen_unix_nano IS NOT NULL
+        AND CAST(last_seen_unix_nano AS INTEGER) > CAST(? AS INTEGER)
+
+      UNION ALL
+
+      SELECT
+        trace_id,
+        CAST(MIN(CAST(start_time_unix_nano AS INTEGER)) AS TEXT)
+          AS started_at_unix_nano
       FROM issue_processes
       WHERE trace_id NOT IN (SELECT trace_id FROM drains)
       GROUP BY trace_id
-      ORDER BY MIN(CAST(start_time_unix_nano AS INTEGER)) DESC
+    ),
+    chosen AS (
+      SELECT trace_id, started_at_unix_nano
+      FROM active_candidates
+      ORDER BY CAST(started_at_unix_nano AS INTEGER) DESC
       LIMIT 1
     )
     SELECT
-      ip.trace_id,
-      MIN(ip.start_time_unix_nano) AS started_at_unix_nano,
-      COUNT(*) AS issue_count,
-      SUM(CASE WHEN ip.outcome_kind = 'opened'  THEN 1 ELSE 0 END) AS opened_count,
-      SUM(CASE WHEN ip.outcome_kind = 'hitl'    THEN 1 ELSE 0 END) AS hitl_count,
-      SUM(CASE WHEN ip.outcome_kind = 'errored' THEN 1 ELSE 0 END) AS errored_count
-    FROM issue_processes ip
-    WHERE ip.trace_id = (SELECT trace_id FROM active)
-    GROUP BY ip.trace_id
+      c.trace_id,
+      c.started_at_unix_nano,
+      COUNT(ip.span_id) AS issue_count,
+      COALESCE(SUM(CASE WHEN ip.outcome_kind = 'opened'  THEN 1 ELSE 0 END), 0) AS opened_count,
+      COALESCE(SUM(CASE WHEN ip.outcome_kind = 'hitl'    THEN 1 ELSE 0 END), 0) AS hitl_count,
+      COALESCE(SUM(CASE WHEN ip.outcome_kind = 'errored' THEN 1 ELSE 0 END), 0) AS errored_count
+    FROM chosen c
+    LEFT JOIN issue_processes ip ON ip.trace_id = c.trace_id
+    GROUP BY c.trace_id, c.started_at_unix_nano
   `);
     const insertLogRecord = db.prepare(`
     INSERT INTO log_records (
@@ -501,7 +655,15 @@ export function createStorage(path, opts = {}) {
     ORDER BY CAST(timestamp_unix_nano AS INTEGER) ASC, span_id ASC
   `);
     const saveDrain = (d) => {
-        insertDrain.run(d.traceId, d.spanId, d.startTimeUnixNano, d.endTimeUnixNano, asInt(d.attempts), asInt(d.opened), asInt(d.hitl), asInt(d.errored), asInt(d.statusCode), d.statusMessage);
+        insertDrain.run(d.traceId, d.spanId, d.startTimeUnixNano, d.endTimeUnixNano, d.lastSeenUnixNano, asInt(d.attempts), asInt(d.opened), asInt(d.hitl), asInt(d.errored), asInt(d.statusCode), d.statusMessage);
+    };
+    // VA-455: log-marker-driven insert for in-flight drains. Called
+    // from server.ts when `projectLogs` surfaces a `drain.started`
+    // record (see `extractActiveDrainMarkers`). The first call lands
+    // the row with end_time NULL; subsequent calls (or any log on the
+    // trace flowing through `appendLogRecord`) push last_seen forward.
+    const markDrainActive = (m) => {
+        markActiveDrainStmt.run(m.traceId, m.spanId, m.startTimeUnixNano, m.lastSeenUnixNano);
     };
     const saveIssueProcess = (p) => {
         insertIssueProcess.run(p.traceId, p.spanId, p.parentSpanId, p.issueIdentifier, p.issueId, p.issueTitle, 
@@ -626,7 +788,7 @@ export function createStorage(path, opts = {}) {
     };
     const listAggregates = () => selectAggregates.all().map(rowToAggregate);
     const saveLinearSnapshot = (s) => {
-        upsertLinearSnapshot.run(s.issueIdentifier, s.snapshotAt, s.status, s.title, s.labels.length === 0 ? null : JSON.stringify(s.labels), s.queuePosition, s.projectId, s.projectName);
+        upsertLinearSnapshot.run(s.issueIdentifier, s.snapshotAt, s.status, s.title, s.labels.length === 0 ? null : JSON.stringify(s.labels), s.queuePosition, s.projectId, s.projectName, s.statusType);
     };
     const clearLinearQueuePositions = () => {
         clearQueuePositionsStmt.run();
@@ -641,10 +803,20 @@ export function createStorage(path, opts = {}) {
         Object.keys(r.attributes).length === 0
             ? null
             : JSON.stringify(r.attributes));
+        // VA-455: piggy-back on every log record to keep the trace's
+        // active-drain row "alive" — drives the staleness TTL in
+        // getActiveDrain. No-op when no active drain exists for the
+        // trace (UPDATE matches zero rows).
+        bumpDrainLastSeenStmt.run(r.timestampUnixNano, r.traceId, r.timestampUnixNano);
     };
     const streamLogsFor = (traceId) => listLogsByTrace.all(traceId).map(rowToLogRecord);
     const getActiveDrain = () => {
-        const row = getActiveDrainStmt.get();
+        // VA-455: staleness floor — drains whose most recent log record
+        // is older than this no longer count as active. Matches the 30s
+        // heartbeat cadence on the runway side with a 3× safety margin
+        // so a single dropped heartbeat doesn't toggle the card to Idle.
+        const stalenessFloorNanos = BigInt(Date.now()) * 1000000n - ACTIVE_DRAIN_STALENESS_NANOS;
+        const row = getActiveDrainStmt.get(String(stalenessFloorNanos));
         if (!row || row.trace_id == null)
             return null;
         return {
@@ -752,6 +924,7 @@ export function createStorage(path, opts = {}) {
     };
     return {
         saveDrain,
+        markDrainActive,
         saveIssueProcess,
         saveAgentIteration,
         saveRawSpan,
@@ -872,6 +1045,7 @@ function rowToLinearSnapshot(row) {
         queuePosition: nullableNum(r.queue_position),
         projectId: r.project_id == null ? null : String(r.project_id),
         projectName: r.project_name == null ? null : String(r.project_name),
+        statusType: r.status_type == null ? "" : String(r.status_type),
     };
 }
 /**

package/dist/dashboard/views.js

@@ -34,6 +34,9 @@ const SHARED_STYLE = `
     .detail { color: #d4d4d8; }
     .muted { color: #9ca3af; }
     .project-uuid { color: #9ca3af; font-size: 11px; display: block; }
+    .linear-link { color: #6b7280; text-decoration: none; margin-left: 6px;
+                   font-size: 11px; vertical-align: middle; }
+    .linear-link:hover { color: #93c5fd; }
     code { background: #1f2937; padding: 1px 6px; border-radius: 3px; }
     .status-badge { display: inline-block; margin-left: 8px;
                     padding: 1px 6px; border-radius: 3px; font-size: 11px;
@@ -53,13 +56,17 @@ export function renderListView(input) {
     const filterState = vm.filterState ?? EMPTY_FILTER_STATE;
     const isFiltered = vm.isFiltered ?? false;
     const recentDrains = vm.recentDrains ?? [];
+    const linearWorkspace = vm.linearWorkspace ?? null;
     const tableBody = renderIssueProcessRows({
         rows: vm.rows,
         linearEnabled: vm.linearEnabled,
         snapshotsByIdentifier: vm.snapshotsByIdentifier,
         isFiltered,
+        linearWorkspace,
     });
-    const queueSection = vm.linearEnabled ? renderTodoQueue(vm.todoQueue) : "";
+    const queueSection = vm.linearEnabled
+        ? renderTodoQueue(vm.todoQueue, linearWorkspace)
+        : "";
     // VA-391: drain summary strip renders ABOVE the queue + run list
     // so the operator sees in-flight progress at the top of the page.
     const drainStrip = renderDrainStrip(vm.activeDrain ?? null);
@@ -191,10 +198,24 @@ export function renderIssueProcessRows(input) {
         }
         return `<tr><td colspan="4" class="empty">No issue processes yet. Run <code>runway run</code> with <code>OTEL_EXPORTER_OTLP_ENDPOINT</code> pointing here to populate.</td></tr>`;
     }
+    const linearWorkspace = input.linearWorkspace ?? null;
     return input.rows
-        .map((r) => renderRow(r, input.snapshotsByIdentifier))
+        .map((r) => renderRow(r, input.snapshotsByIdentifier, linearWorkspace))
         .join("");
 }
+/**
+ * VA-452: render the `↗` anchor that opens the issue in Linear, or
+ * an empty string when the workspace slug isn't configured. Kept
+ * tiny + identifier-agnostic so every render site uses the same
+ * shape. Linear's URL accepts the identifier alone — no slug needed,
+ * the server redirects to the canonical URL.
+ */
+function linearIssueLink(identifier, workspace) {
+    if (workspace == null || workspace === "")
+        return "";
+    const url = `https://linear.app/${encodeURIComponent(workspace)}/issue/${encodeURIComponent(identifier)}`;
+    return ` <a class="linear-link" target="_blank" rel="noopener noreferrer" title="Open ${escapeHtml(identifier)} in Linear" href="${escapeHtml(url)}">↗</a>`;
+}
 // ---------------------------------------------------------------------------
 // VA-392: filter chips
 // ---------------------------------------------------------------------------
@@ -315,10 +336,10 @@ export function filterStateToQueryString(state) {
  * with an empty-state row so the operator knows the poller ran and
  * found nothing to pick up.
  */
-function renderTodoQueue(queue) {
+function renderTodoQueue(queue, linearWorkspace) {
     const body = queue.length === 0
-        ? `<tr><td colspan="4" class="empty">Linear Todo queue is empty.</td></tr>`
-        : queue.map(renderQueueRow).join("");
+        ? `<tr><td colspan="5" class="empty">Linear Todo queue is empty.</td></tr>`
+        : queue.map((s) => renderQueueRow(s, linearWorkspace)).join("");
     return `<h2>Todo queue (next up)</h2>
   <table>
     <thead>
@@ -326,13 +347,14 @@ function renderTodoQueue(queue) {
         <th>Issue</th>
         <th>Title</th>
         <th>Labels</th>
+        <th>Status</th>
         <th>Project</th>
       </tr>
     </thead>
     <tbody>${body}</tbody>
   </table>`;
 }
-function renderQueueRow(s) {
+function renderQueueRow(s, linearWorkspace) {
     const labels = s.labels.length === 0 ? "" : s.labels.join(", ");
     // VA-450: project cell shows the name on top with the UUID muted
     // underneath in the same column. Unprojected issues degrade to an
@@ -343,14 +365,20 @@ function renderQueueRow(s) {
             (s.projectId == null
                 ? ""
                 : `<span class="project-uuid">${escapeHtml(s.projectId)}</span>`);
+    // VA-453: workflow status display name. Empty → em-dash so the
+    // column is never visually empty.
+    const status = s.status === ""
+        ? `<span class="muted">—</span>`
+        : escapeHtml(s.status);
     return `<tr>
-    <td class="id">${escapeHtml(s.issueIdentifier)}</td>
+    <td class="id">${escapeHtml(s.issueIdentifier)}${linearIssueLink(s.issueIdentifier, linearWorkspace)}</td>
     <td class="detail">${escapeHtml(s.title)}</td>
     <td class="muted">${escapeHtml(labels)}</td>
+    <td class="detail">${status}</td>
     <td class="detail">${project}</td>
   </tr>`;
 }
-function renderRow(r, snapshots) {
+function renderRow(r, snapshots, linearWorkspace) {
     const kind = r.outcomeKind ?? "pending";
     const outcomeCls = `outcome outcome-${escapeHtml(kind)}`;
     // VA-387: canonical detail link uses the span_id alone.
@@ -367,7 +395,7 @@ function renderRow(r, snapshots) {
         ? `<span class="status-badge">${escapeHtml(snapshot.status)}</span>`
         : "";
     return `<tr>
-    <td class="id"><a href="${escapeHtml(href)}">${escapeHtml(r.issueIdentifier)}</a>${statusBadge}</td>
+    <td class="id"><a href="${escapeHtml(href)}">${escapeHtml(r.issueIdentifier)}</a>${linearIssueLink(r.issueIdentifier, linearWorkspace)}${statusBadge}</td>
     <td class="${outcomeCls}">${escapeHtml(kind)}</td>
     <td class="detail">${escapeHtml(r.outcomeDetail ?? "")}</td>
     <td>${escapeHtml(r.insertedAt)}</td>
@@ -450,7 +478,7 @@ export function renderDetailView(vm) {
 </head>
 <body>
   <div class="breadcrumb"><a href="/">← all issue processes</a></div>
-  <h1>${escapeHtml(ip.issueIdentifier)} · <span class="${outcomeCls}">${escapeHtml(kind)}</span></h1>
+  <h1>${escapeHtml(ip.issueIdentifier)}${linearIssueLink(ip.issueIdentifier, vm.linearWorkspace ?? null)} · <span class="${outcomeCls}">${escapeHtml(kind)}</span></h1>
   ${titleLine}
   <div class="meta">
     <div><span class="label">branch:</span><code>${escapeHtml(ip.branch ?? "—")}</code></div>

package/dist/linear.js

@@ -357,6 +357,28 @@ export function createLinearGateway(config, limiter = null) {
                             continue;
                         if (labels.includes(config.hitlLabel))
                             continue;
+                        // VA-453: skip issues whose workflow state is already
+                        // terminal (`completed` / `canceled`). Operators sometimes
+                        // mark an issue Done but forget to strip
+                        // `ready-for-agent`; without this check the drain would
+                        // pick up a Done ticket and waste a sandcastle run.
+                        // Filtering by `state.type` (not display name) is robust
+                        // to teams renaming "Cancelled" to "Won't fix" or
+                        // similar. Missing/undecodable state falls through
+                        // (treated as non-terminal) — matches the
+                        // `hasActiveBlocker` posture for the same edge case.
+                        try {
+                            const state = await raw.state;
+                            if (state) {
+                                const stateType = decodeWorkflowStateTypeNode(state).type;
+                                if (isTerminalStateType(stateType))
+                                    continue;
+                            }
+                        }
+                        catch {
+                            // Schema drift or transient SDK error — fall through
+                            // to the existing checks rather than blocking the drain.
+                        }
                         if (await hasActiveBlocker(raw))
                             continue;
                         if (await hasChildIssues(raw)) {

package/dist/orchestrator.js

@@ -1,6 +1,6 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { Effect } from "effect";
+import { Duration, Effect, Schedule } from "effect";
 import { detectBaseBranch, pruneStaleAgentBranch } from "./git.js";
 import { loadPolicy } from "./policy.js";
 import { flagHitl, handleProcessFailure } from "./hitl.js";
@@ -41,6 +41,19 @@ export function assertSandcastleInitialised(cwd) {
 export const drainQueue = (deps, opts = {}) => Effect.gen(function* () {
     const { config, linear } = deps;
     const max = opts.max ?? Number.POSITIVE_INFINITY;
+    // VA-455: announce the drain to the dashboard before any other
+    // work. The log carries the drainQueue span's trace_id/span_id
+    // (we're already inside `Effect.withSpan("drainQueue")`), and the
+    // dashboard's projector matches on the literal body string —
+    // keep it in lock-step with `DRAIN_STARTED_LOG` in projector.ts.
+    yield* Effect.logInfo("drain.started");
+    // VA-455: keep the dashboard's "still alive" signal warm during
+    // long impl/review phases. `Effect.fork` ties the heartbeat fiber
+    // to this gen's lifetime, so it's interrupted automatically when
+    // drainQueue completes (success, failure, or interrupt). The 30s
+    // cadence matches `ACTIVE_DRAIN_STALENESS_NANOS / 3` on the
+    // dashboard so a single dropped flush doesn't toggle the card.
+    yield* Effect.fork(Effect.logInfo("drain.heartbeat").pipe(Effect.repeat(Schedule.spaced(Duration.seconds(30)))));
     // Resolve the base branch once at startup so every issue in the
     // drain sees the same answer (and so a misconfigured repo fails
     // fast, before we touch any Linear state).

package/dist/review.js

@@ -79,7 +79,14 @@ export const runReviewPass = (issue, deps, branch) => Effect.gen(function* () {
             sandbox: docker({ env: dockerEnv(config) }),
             cwd,
             prompt: reviewPrompt,
-            branchStrategy: { type: "head" },
+            // VA-456: review must check out the impl agent's branch
+            // explicitly. The previous `{ type: "head" }` inherited
+            // whatever branch the operator happened to be on in the
+            // main checkout — when that wasn't `branch`, the reviewer
+            // saw a working tree that didn't reconcile with the diff in
+            // its prompt and stalled silently until sandcastle's idle
+            // timeout fired (10 min of dead air, then INFRA_ERROR).
+            branchStrategy: { type: "branch", branch },
             maxIterations: 1,
             name: `review-${issue.identifier}`,
         });

package/dist/sandcastle.js

@@ -1,5 +1,55 @@
 import { run } from "@ai-hero/sandcastle";
 import { Effect, Redacted } from "effect";
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+/**
+ * VA-454: when sandcastle throws, its `Error.message` is opaque
+ * (`claude-code exited with code 1:` with no body — the colon is
+ * literal, the stderr text goes only to the log file). To stop
+ * operators from having to hunt `.sandcastle/logs/` for the real
+ * cause on every failure, we read the tail of the most-recently
+ * modified log file in the project's `.sandcastle/logs/` directory
+ * and append it to the error message.
+ *
+ * Tail is read by capping the byte window (cheap on huge logs) and
+ * then trimming to the last `maxLines`. A missing directory or a
+ * read error degrades silently — the error path must not be the
+ * source of a NEW error.
+ */
+const SANDCASTLE_LOG_TAIL_LINES = 20;
+const SANDCASTLE_LOG_TAIL_MAX_BYTES = 16 * 1024;
+export function readLatestSandcastleLogTail(cwd, maxLines = SANDCASTLE_LOG_TAIL_LINES) {
+    try {
+        const dir = join(cwd, ".sandcastle", "logs");
+        const entries = readdirSync(dir);
+        let newestPath = null;
+        let newestMtime = -Infinity;
+        for (const name of entries) {
+            if (!name.endsWith(".log"))
+                continue;
+            const path = join(dir, name);
+            const mtime = statSync(path).mtimeMs;
+            if (mtime > newestMtime) {
+                newestMtime = mtime;
+                newestPath = path;
+            }
+        }
+        if (!newestPath)
+            return null;
+        const size = statSync(newestPath).size;
+        const offset = Math.max(0, size - SANDCASTLE_LOG_TAIL_MAX_BYTES);
+        const buf = readFileSync(newestPath);
+        // Trim trailing newline BEFORE splitting so a `…line 200\n` file
+        // doesn't yield an empty final element that eats one slot in the
+        // `slice(-maxLines)` window.
+        const tail = buf.subarray(offset).toString("utf8").replace(/\n+$/, "");
+        const lines = tail.split("\n");
+        return lines.slice(-maxLines).join("\n");
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * VA-358: thin Effect wrapper around `sandcastle.run`. The agent run
  * happens inside Docker — sandcastle doesn't (yet) expose a kill
@@ -12,9 +62,18 @@ import { Effect, Redacted } from "effect";
  */
 export const runSandcastle = (args) => Effect.tryPromise({
     try: () => run(args),
-    catch: (err) => ({
-        message: err instanceof Error ? err.message : String(err),
-    }),
+    catch: (err) => {
+        const base = err instanceof Error ? err.message : String(err);
+        // VA-454: append the tail of the most-recent `.sandcastle/logs/`
+        // file so the operator sees the real cause (e.g. "Invalid API
+        // key · Fix external API key") on the same line as the
+        // INFRA_ERROR — instead of having to scroll back to the run-
+        // start banner for the log path and open it.
+        const tail = readLatestSandcastleLogTail(args.cwd ?? process.cwd());
+        return {
+            message: tail ? `${base}\n${tail}` : base,
+        };
+    },
 });
 /**
  * Env vars to inject into every sandcastle container. Today this is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@valescoagency/runway",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "Linear-driven orchestrator + scaffolder for coding agents on Sandcastle. `runway init` scaffolds a target repo (sandcastle + varlock + 1Password); `runway run` drains a Linear queue against it; `runway doctor`, `runway upgrade`, `runway upgrade-repo` round out the lifecycle.",
   "license": "MIT",
   "author": {

package/templates/Dockerfile.claude-code.base

@@ -49,19 +49,29 @@ ENV HOME=/home/agent
 ENV XDG_CACHE_HOME=/home/agent/.cache
 ENV TURBO_CACHE_DIR=/tmp/turbo-cache
 ENV pnpm_config_cache=/home/agent/.cache/pnpm
+# VA-457: pin corepack's data dir under the agent's cache. `corepack
+# prepare` below runs as root (before the USER switch), so without
+# COREPACK_HOME it would write the cached pnpm tarball to /root's
+# default and the agent UID couldn't read it. Anything that resolves
+# `pnpm` through the corepack shim after `USER` — git hooks invoked
+# by lefthook in particular — then fails or hangs trying to refetch.
+ENV COREPACK_HOME=/home/agent/.cache/corepack
 
 # Pre-create cache dirs with agent ownership so the first pnpm/turbo
 # run doesn't have to chown them. Both are inside paths the agent owns
 # anyway; this just makes them exist.
-RUN mkdir -p /home/agent/.cache /home/agent/.cache/pnpm /tmp/turbo-cache \
+RUN mkdir -p /home/agent/.cache /home/agent/.cache/pnpm /home/agent/.cache/corepack /tmp/turbo-cache \
  && chown -R $AGENT_UID:$AGENT_GID /home/agent/.cache /tmp/turbo-cache
 
 # Bake pnpm via corepack at build time so `pnpm` is on PATH inside the
 # container before any agent command runs. Pin a default; target repos
 # can override at runtime via `packageManager` in package.json +
-# `corepack use`.
+# `corepack use`. COREPACK_HOME is set above so the data dir lands
+# under /home/agent/.cache/corepack; the trailing chown re-asserts
+# agent ownership over the files root just wrote there.
 RUN corepack enable \
- && corepack prepare pnpm@11.1.1 --activate
+ && corepack prepare pnpm@11.1.1 --activate \
+ && chown -R $AGENT_UID:$AGENT_GID /home/agent/.cache/corepack
 
 USER ${AGENT_UID}:${AGENT_GID}