@wardby/cli 0.4.1 → 0.5.0

package/dist/core/runner.js

@@ -26,6 +26,8 @@ import { scopeDatastore } from "../providers/datastore/scoped.js";
 import { buildSecretsAccessor, scopeSecretsAccessor } from "./secrets.js";
 import { buildSharedDatastoreAccessor, scopeSharedDatastoreAccessor } from "./datastores.js";
 import { effectiveBudgetForRun } from "./budget-groups.js";
+import { createDelegationSiblings } from "./delegation-siblings.js";
+import { createSerialGate } from "./serial-gate.js";
 import { withRunHeartbeat } from "./run-heartbeat.js";
 import { ContinuationRefusedError, dispatchRun } from "./dispatch.js";
 import { canDelegate } from "./grants.js";
@@ -38,12 +40,15 @@ import { loadCodingConcurrencyConfig } from "../config/providers.js";
 import { REVIEW_HOST_TOOL_DEFS, REVIEW_HOST_TOOL_NAMES, handleReviewHostTool, } from "./review-host-tools.js";
 import { closeOpenHostCheck } from "./review-host-checks.js";
 import { serviceRefusalSentence } from "../coding/services/wording.js";
+import { CONTINUATION_CLOSED_SENTENCE, isContinuationClosedError } from "../coding/continuation-wording.js";
 import { RUN_TASK_TAG, splitTaskOverride, wrapUntrusted } from "./untrusted-content.js";
-import { completeHostStatus } from "./host-status.js";
+import { completeHostStatus, pullRequestOutcome } from "./host-status.js";
 import { ISSUE_TRACKER_TOOL_DEFS, ISSUE_TRACKER_TOOL_NAMES, handleIssueTrackerTool, } from "./issue-tracker-tools.js";
 import { completeIssueStatus } from "./issue-status.js";
 import { fileIssue } from "./issue-dedupe.js";
 import { fileSelfDefect } from "./self-defects.js";
+import { startReviewFixAfterReview } from "./review-fix.js";
+import { updateRelatedPullRequests } from "./related-pull-requests.js";
 import { recordNativeModelUsage } from "./model-usage.js";
 import { pinNativeRunPricing } from "./run-pricing.js";
 import { RoutingLlmProvider } from "../providers/llm/routing.js";
@@ -54,11 +59,15 @@ const runnerLog = logger.child({ module: "runner" });
 /**
  * Sub-agent dispatch uses one synthetic tool per declared child, named by the
  * boundName it's attached
- * under. Synchronous only for v1: the parent's turn blocks until the child
- * run reaches a terminal state, and its result comes back as this tool
- * call's result. At most one dispatch is honored per run (see the
- * "already dispatched" check below) — a haiku-tier classifier deciding
- * plan-vs-implement should commit to exactly one child, not spray both.
+ * under. The parent's tool call blocks until the child run reaches a
+ * terminal state, and its result comes back as this tool call's result.
+ * A run delegates at most maxDelegationsPerRun times (default one: a
+ * classifier deciding plan-vs-implement commits to exactly one child) and to
+ * each child at most once. With Agent.parallelDelegations, the delegate_to_*
+ * calls of one turn run at the same time (NativeEngine.runToolCalls); their
+ * admission (the checks below plus the child row) is still one at a time,
+ * through the run's delegation gate, and a child refused for budget while a
+ * sibling runs waits for that sibling to finish (delegation-siblings.ts).
  *
  * Two execution paths depending on the child's `kind`:
  * - `native`: calls `executeRun` directly, bypassing any `Executor` — the
@@ -82,10 +91,15 @@ const runnerLog = logger.child({ module: "runner" });
  * The `delegate_to_` prefix lives in core/tool-names.ts, which reserves it
  * so no user tool can be created under a name this dispatch would shadow.
  */
-function delegateToolDef(boundName) {
+function delegateToolDef(boundName, parallel) {
+    // With the flag off the description stays byte-identical to before, so
+    // existing leads keep their cached tool definitions.
+    const timing = parallel
+        ? "Blocks until it finishes. Several delegate_to_* calls made in the same turn run at the same time, so make them together when their tasks don't need each other's results. Its spend"
+        : "Runs synchronously and blocks until it finishes; its spend";
     return {
         name: `${DELEGATE_TOOL_PREFIX}${boundName}`,
-        description: `Delegates a task to your "${boundName}" sub-agent. Runs synchronously and blocks until it finishes; its spend counts against your own run's shared budget scope. If the sub-agent belongs to another owner it runs only its own instructions: pass an empty task.`,
+        description: `Delegates a task to your "${boundName}" sub-agent. ${timing} counts against your own run's shared budget scope. If the sub-agent belongs to another owner it runs only its own instructions: pass an empty task.`,
         jsonSchema: {
             type: "object",
             properties: {
@@ -189,7 +203,7 @@ async function finishRunClaimed(db, runId, data) {
  * ("requires the Phase 5 container executor") read as if Phase 5 were unbuilt.
  */
 const CODING_EXECUTOR_NOT_CONFIGURED = "Coding agents need a container executor, but this deployment runs with JOB_LAUNCHER=local. " +
-    "Set JOB_LAUNCHER=docker on a host with Docker to run them (see docs/coding-worker-isolation.md).";
+    "Set JOB_LAUNCHER=docker (or kubernetes) to run them (see docs/coding-worker-isolation.md).";
 /**
  * Slack past the child's own queue wait + container deadline before the
  * parent gives up: the executor needs a moment after a deadline kill to
@@ -201,8 +215,17 @@ export const CODING_CHILD_WAIT_GRACE_SEC = 60;
  * over its services carries the host sentence (never the raw Run.error), so
  * the parent can pass it on — for a mention, that is the requester.
  */
-export function codingChildResult(run) {
-    const refusal = run.status === "refused" ? serviceRefusalSentence(run.error) : null;
+export function codingChildResult(run, codingResult) {
+    // Checked before the "refused" branch: a continuation whose PR closed
+    // before the run ever spent anything is stored as "refused" (a preflight
+    // refusal, container.ts), not "failed" -- but it is the same
+    // continuation_closed category either way, and gets the same sentence
+    // regardless of which status it landed on.
+    const refusal = isContinuationClosedError(run.error)
+        ? CONTINUATION_CLOSED_SENTENCE
+        : run.status === "refused"
+            ? serviceRefusalSentence(run.error)
+            : null;
     return JSON.stringify({
         status: run.status,
         finalText: run.finalText,
@@ -210,8 +233,26 @@ export function codingChildResult(run) {
         tokensIn: run.tokensIn,
         tokensOut: run.tokensOut,
         ...(refusal ? { refusal } : {}),
+        ...pullRequestOf(codingResult),
     });
 }
+/**
+ * The pull request the coding sub-run opened or pushed to, from wardby's own
+ * stored result (never the sub-agent's text), so the parent can cite it.
+ */
+function pullRequestOf(codingResult) {
+    const pr = pullRequestOutcome(codingResult);
+    if (!pr)
+        return {};
+    return {
+        pullRequest: {
+            outcome: pr.outcome === "pull_request_opened" ? "opened" : "updated",
+            repository: pr.repository,
+            number: pr.pullRequestNumber,
+            ...(pr.pullRequestUrl ? { url: pr.pullRequestUrl } : {}),
+        },
+    };
+}
 /**
  * Polls a dispatched coding child until it reaches a terminal status. Needed
  * because a queued child (every concurrency slot taken) makes Executor.start
@@ -334,14 +375,16 @@ async function executeTrackedRun(runId, providers, db, onText, step) {
             where: { parentAgentId: agent.id },
             select: { boundName: true, childAgentId: true },
         });
-        // Only queried when a review host is configured, so deployments without
-        // a GitHub App (and tests) never touch the table.
+        // Only queried when the runner was given review hosts. buildReviewHosts
+        // always includes the local host, so a configured server always queries;
+        // only a runner built without hosts (as in many tests) skips the table.
         const repositoryLinks = reviewHosts
             ? (await db.agentRepository.findMany({ where: { agentId: agent.id } })).map((l) => ({
                 provider: l.provider,
                 repository: l.repository,
                 access: l.access === "write" ? "write" : "read",
                 checkName: l.checkName,
+                waitForCi: l.waitForCi,
             }))
             : [];
         // Likewise only when a Jira site is configured.
@@ -375,6 +418,10 @@ async function executeTrackedRun(runId, providers, db, onText, step) {
             pricing,
             memoryEnabled: agent.memoryEnabled,
             subAgentEdges,
+            // Only when above the default of one, so a default agent's pinned step result is unchanged.
+            ...(agent.maxDelegationsPerRun > 1 ? { maxDelegationsPerRun: agent.maxDelegationsPerRun } : {}),
+            // Only when on, so a default agent's pinned step result is unchanged.
+            ...(agent.parallelDelegations ? { parallelDelegations: true } : {}),
             repositoryLinks,
             issueProjectLinks,
             agent: {
@@ -407,7 +454,7 @@ async function executeTrackedRun(runId, providers, db, onText, step) {
                 ...(agent.memoryEnabled ? MEMORY_TOOL_DEFS : []),
                 ...(subAgentEdges.length > 0 ? [SUBAGENT_MEMORY_GET_TOOL] : []),
                 ...(isDispatchedChild ? [PARENT_MEMORY_GET_TOOL] : []),
-                ...subAgentEdges.map((edge) => delegateToolDef(edge.boundName)),
+                ...subAgentEdges.map((edge) => delegateToolDef(edge.boundName, agent.parallelDelegations)),
                 ...(repositoryLinks.length > 0 ? REVIEW_HOST_TOOL_DEFS : []),
                 ...(issueProjectLinks.length > 0 ? ISSUE_TRACKER_TOOL_DEFS : []),
             ],
@@ -469,6 +516,13 @@ async function executeTrackedRun(runId, providers, db, onText, step) {
         // jira_create_issue's per-run cap counter: shared by every tool call of this attempt (a resumed attempt
         // starts a fresh one, floored by the run's recorded fingerprint creates).
         const issueCreationCounters = new Map();
+        // One per attempt: admits this run's delegations one at a time (see the delegate branch).
+        const delegationGate = createSerialGate();
+        // The children this attempt's delegations have running, and the sub-agents whose delegation is
+        // waiting for one of them to free budget (parallelDelegations): a waiting delegation keeps its
+        // place in the same-child and limit checks while the gate is open to the others.
+        const delegationSiblings = createDelegationSiblings();
+        const waitingDelegations = new Set();
         const runSandboxTool = async (name, argsJson) => {
             if (loaded.memoryEnabled && MEMORY_TOOL_NAMES.has(name)) {
                 return handleMemoryTool(name, argsJson, loaded.agentId, providers.memory);
@@ -488,8 +542,15 @@ async function executeTrackedRun(runId, providers, db, onText, step) {
                             prNumber: check.prNumber,
                         }
                         : null,
-                    markRunCheckCompleted: async () => {
-                        await db.runHostCheck.update({ where: { runId }, data: { completedAt: new Date() } });
+                    markRunCheckCompleted: async (review) => {
+                        await db.runHostCheck.update({
+                            where: { runId },
+                            data: {
+                                completedAt: new Date(),
+                                ...(review ? { verdict: review.verdict, reviewBody: review.body } : {}),
+                                ...(review?.ciPending !== undefined ? { ciPendingAtReview: review.ciPending } : {}),
+                            },
+                        });
                     },
                     // Live, not from the pinned load: the link's current stamp and
                     // access, and the agent's CURRENT owner (a make_owner, unlink, or
@@ -560,195 +621,301 @@ async function executeTrackedRun(runId, providers, db, onText, step) {
                         message: `No sub-agent is bound to name "${boundName}".`,
                     });
                 }
-                // At most one dispatch per run: a classifier deciding plan-vs-implement
-                // should commit to exactly one child, never both and never a retry
-                // that leaves two children racing on the same task.
-                const priorDispatches = await db.run.findMany({ where: { parentRunId: { in: [runId] } } });
-                if (priorDispatches.length > 0) {
-                    return JSON.stringify({
-                        error: "already_dispatched",
-                        message: "This run already delegated to a sub-agent; only one delegation is allowed per run.",
-                    });
-                }
-                let parsed;
+                let release = await delegationGate.acquire();
+                let finishSibling = () => { };
                 try {
-                    parsed = JSON.parse(argsJson || "{}");
-                }
-                catch (err) {
-                    return JSON.stringify({
-                        error: "invalid_arguments_json",
-                        message: err instanceof Error ? err.message : String(err),
-                    });
-                }
-                let args;
-                try {
-                    args = DelegateArgs.parse(parsed);
-                }
-                catch (err) {
-                    if (err instanceof z.ZodError) {
+                    // At most maxDelegationsPerRun dispatches per run (default one: a
+                    // classifier deciding plan-vs-implement commits to exactly one child),
+                    // and never the same child twice, so a retry can't leave two children
+                    // racing on the same task. Checked and the child row written under the
+                    // run's delegation gate: delegations started together in one turn
+                    // (parallelDelegations) are admitted one at a time.
+                    const limit = loaded.maxDelegationsPerRun ?? 1;
+                    const priorDispatches = await db.run.findMany({ where: { parentRunId: { in: [runId] } } });
+                    if (priorDispatches.some((prior) => prior.agentId === edge.childAgentId) ||
+                        waitingDelegations.has(edge.childAgentId)) {
                         return JSON.stringify({
-                            error: "validation_failed",
-                            message: err.issues.map((issue) => `${issue.path.join(".") || "input"}: ${issue.message}`).join("; "),
+                            error: "already_dispatched",
+                            message: `This run already delegated to "${boundName}"; a run delegates to each sub-agent at most once.`,
                         });
                     }
-                    throw err;
-                }
-                // Owners are re-read live on every delegation (resource-sharing
-                // grants spec §3.4.4, N1): the child must have the parent's current
-                // owner, or that owner must still hold execute on the child. A
-                // revoked grant or a make_owner transfer stops the very next call.
-                const [parentNow, childAgent] = await Promise.all([
-                    db.agent.findUnique({ where: { id: loaded.agentId }, select: { ownerId: true } }),
-                    db.agent.findUniqueOrThrow({
-                        where: { id: edge.childAgentId },
-                        select: {
-                            id: true,
-                            kind: true,
-                            budgetGroupId: true,
-                            budgetUsd: true,
-                            ownerId: true,
-                            codingProfile: { select: { allowWebhookTaskOverride: true } },
-                        },
-                    }),
-                ]);
-                const parentOwnerId = parentNow?.ownerId ?? null;
-                const childOwnerId = childAgent.ownerId ?? null;
-                if (!parentNow ||
-                    !(await canDelegate(db, { ownerId: parentOwnerId }, { id: childAgent.id, ownerId: childOwnerId }))) {
-                    return JSON.stringify({
-                        error: "subagent_not_authorized",
-                        message: `The "${boundName}" sub-agent belongs to another owner who has not given this agent's owner execute access to it.`,
-                    });
-                }
-                if (parentOwnerId !== childOwnerId) {
-                    // Across owners the edge carries execute and nothing more: no
-                    // model-chosen memory grant, no continuation of another run's PR,
-                    // and no task text the caller couldn't give the child directly --
-                    // the trigger_agent rule (review I3): a coding child only with its
-                    // owner's allowWebhookTaskOverride opt-in, a native child never
-                    // (it runs its owner's fixed prompt; pass an empty task).
-                    const refusal = (args.grantParentMemoryKeys?.length ?? 0) > 0
-                        ? "grantParentMemoryKeys is only allowed when the sub-agent has the same owner."
-                        : args.continuePriorRun !== undefined
-                            ? "continuePriorRun is only allowed when the sub-agent has the same owner."
-                            : childAgent.kind === "coding" && !childAgent.codingProfile?.allowWebhookTaskOverride
-                                ? "This coding sub-agent belongs to another owner and does not accept task text from others (allowWebhookTaskOverride)."
-                                : childAgent.kind !== "coding" && (args.task.trim() !== "" || args.datastoreRef !== undefined)
-                                    ? 'This sub-agent belongs to another owner and runs only its own instructions: delegate with task "" and no datastoreRef.'
-                                    : null;
-                    if (refusal)
-                        return JSON.stringify({ error: "cross_owner_not_allowed", message: refusal });
-                }
-                if (args.continuePriorRun !== undefined && childAgent.kind !== "coding") {
-                    return JSON.stringify({
-                        error: "continuation_requires_coding_agent",
-                        message: "continuePriorRun is only supported when the sub-agent is coding-kind.",
-                    });
-                }
-                if (childAgent.kind === "coding") {
-                    // Coding-kind children need a real Docker container (Codex/Claude
-                    // Code), which executeRun explicitly refuses to drive — go through
-                    // the same dispatchRun path webhooks/trigger_agent use instead.
-                    // datastoreRef/grantParentMemoryKeys have no equivalent inside a
-                    // coding container's own tool surface (subagent_memory_get/
-                    // parent_memory_get are native-engine built-ins only), so they're
-                    // deliberately dropped here rather than silently implying a
-                    // capability that doesn't exist for this path.
-                    if (!providers.executor) {
+                    if (priorDispatches.length < limit && priorDispatches.length + waitingDelegations.size >= limit) {
+                        // Only a waiting delegation (parallelDelegations) holds the remaining place.
                         return JSON.stringify({
-                            error: "coding_dispatch_unavailable",
-                            message: "This execution context has no Executor wired in, so a coding-kind sub-agent cannot be dispatched.",
+                            error: "already_dispatched",
+                            message: `This run reached its limit of ${limit} delegations: ${priorDispatches.length} made and ${waitingDelegations.size} waiting for budget.`,
                         });
                     }
-                    // dispatchRun reserves the child's budget itself, inside its persist
-                    // transaction: the agent's budgetUsd tightened by its budget group and
-                    // by this run tree (parentRunId), or refused when either is spent.
-                    let dispatched;
-                    try {
-                        dispatched = await dispatchRun({
-                            db,
-                            executor: providers.executor,
-                            selfDefects: { db, issueTrackers },
-                            agentId: edge.childAgentId,
-                            trigger: "subagent",
-                            codingTask: args.task,
-                            continuesCodingRunId: args.continuePriorRun,
-                            parentRunId: runId,
-                            // The child's result flows back into this run, which the
-                            // triggerer sees, so the child is visible to them too.
-                            triggeredById: existingRun.triggeredById,
-                            awaitExecution: true,
+                    if (priorDispatches.length >= limit) {
+                        return JSON.stringify({
+                            error: "already_dispatched",
+                            message: limit === 1
+                                ? "This run already delegated to a sub-agent; only one delegation is allowed per run."
+                                : `This run already made ${limit} delegations, the most this agent allows per run.`,
                         });
                     }
+                    let parsed;
+                    try {
+                        parsed = JSON.parse(argsJson || "{}");
+                    }
                     catch (err) {
-                        // A continuation this deployment cannot make (the run id came from
-                        // a pull request another deployment opened, say) is the model's to
-                        // report, not a reason to fail the whole run.
-                        if (!(err instanceof ContinuationRefusedError))
-                            throw err;
                         return JSON.stringify({
-                            error: "continuation_refused",
-                            message: `${err.message} No sub-agent run was started. Do not open a new pull request in its place: ` +
-                                "tell the requester that this wardby deployment cannot continue that pull request's branch.",
+                            error: "invalid_arguments_json",
+                            message: err instanceof Error ? err.message : String(err),
                         });
                     }
-                    if (!dispatched) {
-                        return JSON.stringify({ error: "dispatch_failed", message: "The sub-agent run could not be created." });
+                    let args;
+                    try {
+                        args = DelegateArgs.parse(parsed);
                     }
-                    const childRunId = dispatched.run.id;
-                    const codingRun = await db.codingRun.findUnique({
-                        where: { runId: childRunId },
-                        select: { timeoutSec: true },
-                    });
-                    const { queueTimeoutSec } = loadCodingConcurrencyConfig();
-                    const waited = await waitForCodingChild({
-                        db,
-                        executor: providers.executor,
-                        childRunId,
-                        parentRunId: runId,
-                        boundMs: (queueTimeoutSec + (codingRun?.timeoutSec ?? 0) + CODING_CHILD_WAIT_GRACE_SEC) * 1000,
-                    });
-                    if (waited.kind === "timed_out") {
+                    catch (err) {
+                        if (err instanceof z.ZodError) {
+                            return JSON.stringify({
+                                error: "validation_failed",
+                                message: err.issues.map((issue) => `${issue.path.join(".") || "input"}: ${issue.message}`).join("; "),
+                            });
+                        }
+                        throw err;
+                    }
+                    // Owners are re-read live on every delegation (resource-sharing
+                    // grants spec §3.4.4, N1): the child must have the parent's current
+                    // owner, or that owner must still hold execute on the child. A
+                    // revoked grant or a make_owner transfer stops the very next call.
+                    const [parentNow, childAgent] = await Promise.all([
+                        db.agent.findUnique({ where: { id: loaded.agentId }, select: { ownerId: true } }),
+                        db.agent.findUniqueOrThrow({
+                            where: { id: edge.childAgentId },
+                            select: {
+                                id: true,
+                                kind: true,
+                                budgetGroupId: true,
+                                budgetUsd: true,
+                                ownerId: true,
+                                codingProfile: { select: { allowWebhookTaskOverride: true, timeoutSec: true } },
+                            },
+                        }),
+                    ]);
+                    const parentOwnerId = parentNow?.ownerId ?? null;
+                    const childOwnerId = childAgent.ownerId ?? null;
+                    if (!parentNow ||
+                        !(await canDelegate(db, { ownerId: parentOwnerId }, { id: childAgent.id, ownerId: childOwnerId }))) {
                         return JSON.stringify({
-                            error: "subagent_wait_timed_out",
-                            runId: childRunId,
-                            message: "The coding sub-agent did not finish within its queue timeout plus run timeout; it was stopped and produced no result.",
+                            error: "subagent_not_authorized",
+                            message: `The "${boundName}" sub-agent belongs to another owner who has not given this agent's owner execute access to it.`,
                         });
                     }
-                    if (waited.kind === "parent_cancelled") {
+                    if (parentOwnerId !== childOwnerId) {
+                        // Across owners the edge carries execute and nothing more: no
+                        // model-chosen memory grant, no continuation of another run's PR,
+                        // and no task text the caller couldn't give the child directly --
+                        // the trigger_agent rule (review I3): a coding child only with its
+                        // owner's allowWebhookTaskOverride opt-in, a native child never
+                        // (it runs its owner's fixed prompt; pass an empty task).
+                        const refusal = (args.grantParentMemoryKeys?.length ?? 0) > 0
+                            ? "grantParentMemoryKeys is only allowed when the sub-agent has the same owner."
+                            : args.continuePriorRun !== undefined
+                                ? "continuePriorRun is only allowed when the sub-agent has the same owner."
+                                : childAgent.kind === "coding" && !childAgent.codingProfile?.allowWebhookTaskOverride
+                                    ? "This coding sub-agent belongs to another owner and does not accept task text from others (allowWebhookTaskOverride)."
+                                    : childAgent.kind !== "coding" && (args.task.trim() !== "" || args.datastoreRef !== undefined)
+                                        ? 'This sub-agent belongs to another owner and runs only its own instructions: delegate with task "" and no datastoreRef.'
+                                        : null;
+                        if (refusal)
+                            return JSON.stringify({ error: "cross_owner_not_allowed", message: refusal });
+                    }
+                    if (args.continuePriorRun !== undefined && childAgent.kind !== "coding") {
                         return JSON.stringify({
-                            error: "parent_cancelled",
-                            runId: childRunId,
-                            message: "This run was cancelled while waiting for the coding sub-agent; the sub-agent was stopped.",
+                            error: "continuation_requires_coding_agent",
+                            message: "continuePriorRun is only supported when the sub-agent is coding-kind.",
                         });
                     }
-                    return codingChildResult(waited.run);
+                    // parallelDelegations: a child the budget would refuse (run_tree_exhausted or
+                    // budget_group_exhausted:*) while a sibling still runs waits for a sibling to finish and
+                    // free its hold, then tries again while siblings remain, up to the child's own wait bound
+                    // (as for waitForCodingChild below). With no sibling running, it is refused as before.
+                    if (loaded.parallelDelegations && delegationSiblings.inFlight > 0) {
+                        const { queueTimeoutSec } = loadCodingConcurrencyConfig();
+                        const runTimeoutSec = childAgent.kind === "coding" ? (childAgent.codingProfile?.timeoutSec ?? 0) : 0;
+                        const deadline = Date.now() + (queueTimeoutSec + runTimeoutSec + CODING_CHILD_WAIT_GRACE_SEC) * 1000;
+                        let waited = false;
+                        while (delegationSiblings.inFlight > 0) {
+                            // Taken before the budget read, so a sibling that finishes during it still wakes this wait.
+                            const finishes = delegationSiblings.finishes;
+                            const { exhaustedBy } = await effectiveBudgetForRun(db, childAgent, new Date(), runId);
+                            const remainingMs = deadline - Date.now();
+                            if (!exhaustedBy || remainingMs <= 0)
+                                break;
+                            runnerLog.info({ runId, boundName, exhaustedBy, siblingsInFlight: delegationSiblings.inFlight }, "delegation waiting for a sibling to free budget");
+                            waitingDelegations.add(edge.childAgentId);
+                            waited = true;
+                            release();
+                            try {
+                                await delegationSiblings.nextFinish(remainingMs, finishes);
+                            }
+                            finally {
+                                release = await delegationGate.acquire();
+                                waitingDelegations.delete(edge.childAgentId);
+                            }
+                        }
+                        // The parent may have been stopped while this delegation waited: start nothing for it.
+                        if (waited) {
+                            const parent = await db.run.findUnique({ where: { id: runId }, select: { status: true } });
+                            const parentEnded = !parent || !DRIVABLE.includes(parent.status);
+                            if (parentEnded ||
+                                (await db.task.findFirst({ where: { runId, status: "cancelled" }, select: { id: true } })) !== null) {
+                                return JSON.stringify({
+                                    error: "parent_cancelled",
+                                    message: "This run was cancelled while the sub-agent waited for budget; no sub-agent run was started.",
+                                });
+                            }
+                        }
+                    }
+                    if (childAgent.kind === "coding") {
+                        // Coding-kind children need a real Docker container (Codex/Claude
+                        // Code), which executeRun explicitly refuses to drive — go through
+                        // the same dispatchRun path webhooks/trigger_agent use instead.
+                        // datastoreRef/grantParentMemoryKeys have no equivalent inside a
+                        // coding container's own tool surface (subagent_memory_get/
+                        // parent_memory_get are native-engine built-ins only), so they're
+                        // deliberately dropped here rather than silently implying a
+                        // capability that doesn't exist for this path.
+                        if (!providers.executor) {
+                            return JSON.stringify({
+                                error: "coding_dispatch_unavailable",
+                                message: "This execution context has no Executor wired in, so a coding-kind sub-agent cannot be dispatched.",
+                            });
+                        }
+                        // dispatchRun reserves the child's budget itself, inside its persist
+                        // transaction: the agent's budgetUsd tightened by its budget group and
+                        // by this run tree (parentRunId), or refused when either is spent.
+                        let dispatched;
+                        try {
+                            dispatched = await dispatchRun({
+                                db,
+                                executor: providers.executor,
+                                selfDefects: { db, issueTrackers },
+                                agentId: edge.childAgentId,
+                                trigger: "subagent",
+                                codingTask: args.task,
+                                continuesCodingRunId: args.continuePriorRun,
+                                parentRunId: runId,
+                                // The child's result flows back into this run, which the
+                                // triggerer sees, so the child is visible to them too.
+                                triggeredById: existingRun.triggeredById,
+                                awaitExecution: true,
+                                // The child row is committed: count it as running (unless refused at dispatch) and
+                                // admit the next delegation while this one's run starts or queues.
+                                onPersisted: (persistedRun) => {
+                                    if (persistedRun.status !== "refused" && persistedRun.status !== "failed") {
+                                        finishSibling = delegationSiblings.start();
+                                    }
+                                    release();
+                                },
+                            });
+                        }
+                        catch (err) {
+                            // A continuation this deployment cannot make (the run id came from
+                            // a pull request another deployment opened, say) is the model's to
+                            // report, not a reason to fail the whole run.
+                            if (!(err instanceof ContinuationRefusedError))
+                                throw err;
+                            return JSON.stringify({
+                                error: "continuation_refused",
+                                message: `${err.message} No sub-agent run was started. Do not open a new pull request in its place: ` +
+                                    "tell the requester that this wardby deployment cannot continue that pull request's branch.",
+                            });
+                        }
+                        if (!dispatched) {
+                            return JSON.stringify({ error: "dispatch_failed", message: "The sub-agent run could not be created." });
+                        }
+                        const childRunId = dispatched.run.id;
+                        const startedAt = Date.now();
+                        runnerLog.info({ runId, childRunId, boundName, kind: "coding" }, "delegation started");
+                        const codingRun = await db.codingRun.findUnique({
+                            where: { runId: childRunId },
+                            select: { timeoutSec: true },
+                        });
+                        const { queueTimeoutSec } = loadCodingConcurrencyConfig();
+                        const waited = await waitForCodingChild({
+                            db,
+                            executor: providers.executor,
+                            childRunId,
+                            parentRunId: runId,
+                            boundMs: (queueTimeoutSec + (codingRun?.timeoutSec ?? 0) + CODING_CHILD_WAIT_GRACE_SEC) * 1000,
+                        });
+                        finishSibling();
+                        runnerLog.info({
+                            runId,
+                            childRunId,
+                            boundName,
+                            outcome: waited.kind === "terminal" ? waited.run.status : waited.kind,
+                            durationMs: Date.now() - startedAt,
+                        }, "delegation finished");
+                        if (waited.kind === "timed_out") {
+                            return JSON.stringify({
+                                error: "subagent_wait_timed_out",
+                                runId: childRunId,
+                                message: "The coding sub-agent did not finish within its queue timeout plus run timeout; it was stopped and produced no result.",
+                            });
+                        }
+                        if (waited.kind === "parent_cancelled") {
+                            return JSON.stringify({
+                                error: "parent_cancelled",
+                                runId: childRunId,
+                                message: "This run was cancelled while waiting for the coding sub-agent; the sub-agent was stopped.",
+                            });
+                        }
+                        const stored = await db.codingRun
+                            .findUnique({ where: { runId: childRunId }, select: { result: true } })
+                            .catch((err) => {
+                            runnerLog.warn({ err, childRunId }, "could not read the coding sub-run's result");
+                            return null;
+                        });
+                        return codingChildResult(waited.run, stored?.result);
+                    }
+                    const taskOverride = args.datastoreRef
+                        ? `${args.task}\n\n[Referenced datastore: name="${args.datastoreRef.name}", key="${args.datastoreRef.key}" — use your datastore tools to read it.]`
+                        : args.task.trim() !== ""
+                            ? args.task
+                            : undefined;
+                    const childRun = await db.run.create({
+                        data: {
+                            agentId: edge.childAgentId,
+                            trigger: "subagent",
+                            parentRunId: runId,
+                            grantedParentMemoryKeys: args.grantParentMemoryKeys ?? [],
+                            taskOverride,
+                            triggeredById: existingRun.triggeredById,
+                        },
+                    });
+                    finishSibling = delegationSiblings.start();
+                    // The child row exists: admit the next delegation while this child runs.
+                    release();
+                    const startedAt = Date.now();
+                    runnerLog.info({ runId, childRunId: childRun.id, boundName, kind: "native" }, "delegation started");
+                    // Runs inline, so no executor beats for it: beat here to keep its
+                    // budget-group hold live while it runs (and let it lapse if we die).
+                    const childResult = await withRunHeartbeat(db, childRun.id, () => executeRun(childRun.id, providers, db));
+                    finishSibling();
+                    runnerLog.info({
+                        runId,
+                        childRunId: childRun.id,
+                        boundName,
+                        outcome: childResult.status,
+                        durationMs: Date.now() - startedAt,
+                    }, "delegation finished");
+                    return JSON.stringify({
+                        status: childResult.status,
+                        finalText: childResult.finalText,
+                        costUsd: Number(childResult.costUsd),
+                        tokensIn: childResult.tokensIn,
+                        tokensOut: childResult.tokensOut,
+                    });
+                }
+                finally {
+                    finishSibling();
+                    release();
                 }
-                const taskOverride = args.datastoreRef
-                    ? `${args.task}\n\n[Referenced datastore: name="${args.datastoreRef.name}", key="${args.datastoreRef.key}" — use your datastore tools to read it.]`
-                    : args.task.trim() !== ""
-                        ? args.task
-                        : undefined;
-                const childRun = await db.run.create({
-                    data: {
-                        agentId: edge.childAgentId,
-                        trigger: "subagent",
-                        parentRunId: runId,
-                        grantedParentMemoryKeys: args.grantParentMemoryKeys ?? [],
-                        taskOverride,
-                        triggeredById: existingRun.triggeredById,
-                    },
-                });
-                // Runs inline, so no executor beats for it: beat here to keep its
-                // budget-group hold live while it runs (and let it lapse if we die).
-                const childResult = await withRunHeartbeat(db, childRun.id, () => executeRun(childRun.id, providers, db));
-                return JSON.stringify({
-                    status: childResult.status,
-                    finalText: childResult.finalText,
-                    costUsd: Number(childResult.costUsd),
-                    tokensIn: childResult.tokensIn,
-                    tokensOut: childResult.tokensOut,
-                });
             }
             const tool = toolsByName.get(name);
             if (!tool) {
@@ -819,6 +986,10 @@ async function executeTrackedRun(runId, providers, db, onText, step) {
                     : providers.llm,
             },
             runSandboxTool,
+            // A replay recorded before this flag existed has none: its delegations stay sequential.
+            ...(loaded.parallelDelegations
+                ? { runsConcurrently: (toolName) => toolName.startsWith(DELEGATE_TOOL_PREFIX) }
+                : {}),
             onText,
             onProgress,
             step,
@@ -838,6 +1009,18 @@ async function executeTrackedRun(runId, providers, db, onText, step) {
         await closeOpenHostCheck(db, finished, reviewHosts);
         await completeHostStatus(db, finished, reviewHosts);
         await completeIssueStatus(db, finished, issueTrackers);
+        // After the issue status, so IssuePullRequest rows for this run exist. Bounded and never throws.
+        if (claimed)
+            await updateRelatedPullRequests(db, finished, reviewHosts, issueTrackers);
+        if (claimed && providers.executor && reviewHosts && repoAccess) {
+            await startReviewFixAfterReview(runId, {
+                db,
+                executor: providers.executor,
+                hosts: reviewHosts,
+                repoAccess,
+                issueTrackers,
+            });
+        }
         // Only the call that made the row terminal files, so a run another finalizer (the reconciler) ended is not
         // filed twice. Bounded and never throws.
         if (claimed)
@@ -858,6 +1041,18 @@ async function executeTrackedRun(runId, providers, db, onText, step) {
         await closeOpenHostCheck(db, finished, reviewHosts);
         await completeHostStatus(db, finished, reviewHosts);
         await completeIssueStatus(db, finished, issueTrackers);
+        // After the issue status, so IssuePullRequest rows for this run exist. Bounded and never throws.
+        if (claimed)
+            await updateRelatedPullRequests(db, finished, reviewHosts, issueTrackers);
+        if (claimed && providers.executor && reviewHosts && repoAccess) {
+            await startReviewFixAfterReview(runId, {
+                db,
+                executor: providers.executor,
+                hosts: reviewHosts,
+                repoAccess,
+                issueTrackers,
+            });
+        }
         // Only the call that made the row terminal files, so a run another finalizer (the reconciler) ended is not
         // filed twice. Bounded and never throws.
         if (claimed)