@wildorder/nightshift 0.16.0 → 0.18.0

package/dist/author.js

@@ -1,15 +1,23 @@
 import { readFile, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { defaultAgentRunner, describeAgent, invokeAgent, resolveAuthorAgent, resolveDeciderAgent, resolveReviewerAgent, } from "./agent-runner.js";
+import { describeSessionDecline, spawnWithSessionContinuity, SESSION_CONTINUATION_PREAMBLE, } from "./agent-session.js";
 import { resolveSummary, summaryContract } from "./agent-summary.js";
 import { NOOP_PERMITS_CONTEXT } from "./permits.js";
 import { decisionContract, decisionFingerprint, extractDecisions, } from "./decision.js";
-import { appendLedgerEvents } from "./decision-ledger.js";
+import { appendLedgerEvents, readDecisionLedger } from "./decision-ledger.js";
 import { reviewDecisions, triageFindings } from "./decider-review.js";
-import { findCycles, stableTopologicalOrder, topologicalLevels } from "./graph.js";
+import { fingerprint } from "./findings.js";
+import { findCycles, stableTopologicalOrder } from "./graph.js";
 import { loadManifest, saveManifest, specInputsHash, } from "./manifest.js";
-import { extractFindings, findingsContract, findingsToLedgerEvents, hasRoutableEvidence, locateInRepo, reviewerAbsentOutcome, runReviewPass, verifyEvidence, } from "./review-pass.js";
-import { defaultGitOps, downstreamCone } from "./run-program.js";
+import { extractFindings, findingsContract, findingsToLedgerEvents, hasRoutableEvidence, locateInRepo, reviewerAbsentOutcome, runReviewPass, specCritiqueBudget, verifyEvidence, } from "./review-pass.js";
+import { createBriefBuilder, demotedDependenciesPoint, promptComponentSizePoints, } from "./prompt-telemetry.js";
+import { commitEvidence, defaultGitOps, downstreamCone, timed } from "./run-program.js";
+import { NOOP_RUN_RECORDER, recordWorkstreamWaiting, } from "./run-analytics.js";
+import { schedulerLog, workstreamLog } from "./run-log.js";
+import { createDeferred, createMutex } from "./concurrency.js";
+import { normalizeMaxParallel, runReadySet } from "./scheduler.js";
+import { enqueueProgramWrite, programWriteKey } from "./write-queue.js";
 /**
  * The authoring stage: for every workstream whose spec does not exist, a
  * clean agent writes it — human-first, grounded in the repository,
@@ -221,22 +229,31 @@ function prerequisitesSection(manifest, workstream) {
     lines.push("Acceptance criteria in this spec may assert only outcomes the executing", "agent and the runner control. An outcome that depends on one of the human", "actions above — the infrastructure it creates, the secret it sets — must", "not appear as a criterion this run is expected to turn green: no actor in", "this run can make it true.", "", "End-to-end tests that need a human action are still written now, but", "gated on the prerequisite's observable — skip the test when its", "verifyCommand would not pass, with a skip message that names the HP id", '(for example, "skipped: awaiting HP-01"). The gated test is the honest', "second check: it asserts the real outcome and runs for real once the", "human has acted.", "");
     return lines;
 }
-async function dependencySpecsSection(root, workstream, rosterById) {
+async function dependencySpecsSection(root, workstream, rosterById, specFinal) {
     if (workstream.dependencies.length === 0) {
         return {
             section: ["## Dependency specs", "", "No dependencies declared.", ""],
             demoted: [],
+            demotedBytes: 0,
         };
     }
     const entries = await Promise.all(workstream.dependencies
         .map((id) => rosterById.get(id))
         .filter((entry) => entry !== undefined)
-        .map(async (entry) => ({
-        entry,
-        content: await readFinishedSpec(root, entry),
-    })));
+        .map(async (entry) => {
+        const raw = await readFinishedSpec(root, entry);
+        // A dependency whose flow is still running, or that settled without
+        // finishing (a parked protocol failure or throw — WS-03 §3.3), is
+        // never read as content, even when a non-empty file exists: its
+        // bytes on disk may still change (in flight) or were never trusted
+        // in the first place (interrupted). It renders as its roster line,
+        // exactly like a genuinely missing spec, below.
+        const content = raw !== undefined && (specFinal === undefined || specFinal(entry.id)) ? raw : undefined;
+        return { entry, content };
+    }));
     let total = entries.reduce((sum, e) => sum + (e.content?.length ?? 0), 0);
     const demoted = new Set();
+    let demotedBytes = 0;
     const bySizeDesc = entries
         .filter((e) => e.content !== undefined)
         .sort((a, b) => (b.content?.length ?? 0) - (a.content?.length ?? 0));
@@ -245,6 +262,7 @@ async function dependencySpecsSection(root, workstream, rosterById) {
             break;
         demoted.add(e.entry.id);
         total -= e.content?.length ?? 0;
+        demotedBytes += e.content === undefined ? 0 : Buffer.byteLength(e.content, "utf8");
     }
     const lines = ["## Dependency specs", ""];
     for (const { entry, content } of entries) {
@@ -262,7 +280,7 @@ async function dependencySpecsSection(root, workstream, rosterById) {
         lines.push(`### ${entry.id} ${entry.name}`, "", content.trim(), "");
     }
     lines.push("");
-    return { section: lines, demoted: [...demoted] };
+    return { section: lines, demoted: [...demoted], demotedBytes };
 }
 const SPEC_CONTRACT = [
     "## Write a spec for a human",
@@ -307,42 +325,50 @@ block entirely when you have nothing to add.
 function dependenciesContract() {
     return DEPENDENCIES_CONTRACT;
 }
-async function authorBrief(root, manifest, workstream, rosterById, reauthorNote) {
+/**
+ * Builds the author's brief, byte-for-byte identical to the plain
+ * `array.join("\n")` this produced before WS-03 — but through a
+ * `BriefBuilder` so every line is also classified into an SC-07 prompt
+ * component, with `components` summing exactly to the joined brief's byte
+ * length.
+ */
+async function authorBrief(root, manifest, workstream, rosterById, reauthorNote, 
+/**
+ * True when `id`'s spec is final: its authoring flow has settled *and* the
+ * spec on disk classifies `complete` or `legacy`. Both halves are load-
+ * bearing. A flow that is still running may rewrite its file during
+ * critique; a flow that settled on a protocol failure or a throw leaves a
+ * non-empty file the runner has explicitly refused to trust and marked
+ * `in_progress` (WS-03 §3.3). Either way the dependency renders as its
+ * roster line, never as the text currently on disk — a non-empty taskFile
+ * proves only that writing started, which is the distinction `classifySpec`
+ * already draws for the workstream's own spec. `authorProgram` always
+ * supplies this; it is optional only so `authorBrief`'s pure unit tests
+ * keep today's shape.
+ */
+specFinal) {
     const programDoc = await programDocumentSection(root, manifest);
-    const deps = await dependencySpecsSection(root, workstream, rosterById);
-    const brief = [
-        `# Workstream ${workstream.id}: ${workstream.name}`,
-        "",
-        `Program: ${manifest.program.id} — ${manifest.program.name}`,
-        "",
-        "Write this workstream's specification document — the narrative file a",
-        "human and a later implementing agent will both read to build it.",
-        "",
-        ...programDoc,
-        ...successCriteriaSection(manifest),
-        ...scopeSection(workstream),
-        ...rosterSection(manifest),
-        ...prerequisitesSection(manifest, workstream),
-        ...deps.section,
-        ...(reauthorNote ? [reauthorNote, ""] : []),
-        SPEC_CONTRACT,
-        GROUNDING_CONTRACT,
-        dependenciesContract(),
-        "",
-        "## Rules",
-        "",
-        "- Write exactly one file: this workstream's taskFile (create parent",
-        "  directories as needed). Do not write or edit any other file.",
-        "- Your reply is a separate channel from that file. The decision and",
-        "  summary blocks described below go in your reply, never inside the",
-        "  taskFile — the runner reads them from what you say, not what you wrote.",
-        "- Never commit; the runner owns commits.",
-        "",
-        decisionContract(),
-        "",
-        summaryContract(),
-    ].join("\n");
-    return { brief, demoted: deps.demoted };
+    const deps = await dependencySpecsSection(root, workstream, rosterById, specFinal);
+    const builder = createBriefBuilder();
+    builder.push("framing", `# Workstream ${workstream.id}: ${workstream.name}`, "");
+    builder.push("program-narrative", `Program: ${manifest.program.id} — ${manifest.program.name}`);
+    builder.push("framing", "", "Write this workstream's specification document — the narrative file a", "human and a later implementing agent will both read to build it.", "");
+    builder.push("program-narrative", ...programDoc);
+    builder.push("success-criteria", ...successCriteriaSection(manifest));
+    builder.push("scope", ...scopeSection(workstream));
+    builder.push("roster", ...rosterSection(manifest));
+    builder.push("prerequisites", ...prerequisitesSection(manifest, workstream));
+    builder.push("dependency-specs", ...deps.section);
+    builder.push("re-author-note", ...(reauthorNote ? [reauthorNote, ""] : []));
+    builder.push("runner-instructions", SPEC_CONTRACT, GROUNDING_CONTRACT, dependenciesContract());
+    builder.push("framing", "", "## Rules", "", "- Write exactly one file: this workstream's taskFile (create parent", "  directories as needed). Do not write or edit any other file.", "- Your reply is a separate channel from that file. The decision and", "  summary blocks described below go in your reply, never inside the", "  taskFile — the runner reads them from what you say, not what you wrote.", "- Never commit; the runner owns commits.", "");
+    builder.push("runner-instructions", decisionContract(), "", summaryContract());
+    return {
+        brief: builder.join(),
+        demoted: deps.demoted,
+        demotedBytes: deps.demotedBytes,
+        components: builder.components(),
+    };
 }
 const SPEC_CRITIQUE_FRAMING = [
     "## Critique this spec",
@@ -416,36 +442,76 @@ function specCritiqueReviewerBrief(root, manifest, workstream, rosterById, spec,
         ].join("\n");
     })();
 }
-function specCritiqueWriterBrief(workstream, spec, findings) {
-    const findingsList = findings.length === 0
-        ? ["(no findings — this should not happen; treat as a clean read.)"]
-        : findings.map((finding) => {
-            const evidence = finding.evidence
-                .map((entry) => {
-                if (entry.kind === "location") {
-                    return `${entry.file}:${entry.startLine}${entry.excerpt ? ` — ${entry.excerpt}` : ""}`;
-                }
-                if (entry.kind === "concern") {
-                    return entry.detail ? `${entry.named} — ${entry.detail}` : entry.named;
-                }
-                return `${entry.metric}: ${entry.value}`;
-            })
-                .join("; ");
-            return [
-                `- **${finding.severity}** (${finding.category}) ${finding.subject}: ${finding.message}`,
-                evidence ? `  Evidence: ${evidence}` : undefined,
-            ]
-                .filter((line) => line !== undefined)
-                .join("\n");
-        });
+function findingsListLines(findings) {
+    return findings.map((finding) => {
+        const evidence = finding.evidence
+            .map((entry) => {
+            if (entry.kind === "location") {
+                return `${entry.file}:${entry.startLine}${entry.excerpt ? ` — ${entry.excerpt}` : ""}`;
+            }
+            if (entry.kind === "concern") {
+                return entry.detail ? `${entry.named} — ${entry.detail}` : entry.named;
+            }
+            return `${entry.metric}: ${entry.value}`;
+        })
+            .join("; ");
+        return [
+            `- **${finding.severity}** (${finding.category}) ${finding.subject}: ${finding.message}`,
+            evidence ? `  Evidence: ${evidence}` : undefined,
+        ]
+            .filter((line) => line !== undefined)
+            .join("\n");
+    });
+}
+/**
+ * The author's spec-revision re-brief (WS-09 §3.7.2): `binding` is the
+ * decider's `fix-now` triage — a required correction — and `advisory` is
+ * everything else the reviewer raised this cycle, left to the writer's
+ * judgment. Mirrors `testCritiqueFixBrief` on the build side.
+ */
+function specCritiqueWriterBrief(workstream, spec, binding, advisory, resumed, deciderConfigured) {
+    const bindingSection = binding.length > 0
+        ? [
+            "## The decider ruled: fix these now",
+            "",
+            "An independent reviewer raised these and the decider triaged them",
+            "as worth one bounded fix attempt before the run proceeds. Apply",
+            "them.",
+            "",
+            ...findingsListLines(binding),
+            "",
+        ]
+        : [];
+    const advisorySection = advisory.length > 0
+        ? [
+            "## Also raised, for your judgment",
+            "",
+            ...(deciderConfigured
+                ? [
+                    "The reviewer raised these too. The decider did not mark them",
+                    "for an immediate fix. Weigh them and apply what you agree",
+                    "with.",
+                ]
+                : [
+                    "No decider is configured for this run, so none of these were",
+                    "triaged. Weigh them and apply what you agree with.",
+                ]),
+            "",
+            ...findingsListLines(advisory),
+            "",
+        ]
+        : [];
+    const bothEmpty = binding.length === 0 && advisory.length === 0;
     return [
         `# Your spec for ${workstream.id}: ${workstream.name} was reviewed`,
         "",
+        ...(resumed ? [SESSION_CONTINUATION_PREAMBLE] : []),
         "An independent reviewer read the spec you wrote and raised the",
         "following:",
         "",
-        ...findingsList,
-        "",
+        ...(bothEmpty
+            ? ["(no findings — this should not happen; treat as a clean read.)", ""]
+            : [...bindingSection, ...advisorySection]),
         "Here is the spec as it currently stands:",
         "",
         "## Current spec",
@@ -464,12 +530,64 @@ function specCritiqueWriterBrief(workstream, spec, findings) {
 function hasFindingsBlock(output) {
     return /```findings/u.test(output);
 }
+function createSpecGate(args) {
+    const { root, git, isRepository, workstream, programId, log, pushStageError } = args;
+    return {
+        async snapshot() {
+            if (!isRepository)
+                return { dirty: [], untracked: [] };
+            const [dirty, untracked] = await Promise.all([
+                git.dirtyPaths(root),
+                git.untrackedPaths(root),
+            ]);
+            return { dirty, untracked };
+        },
+        async check({ before, snapshot }) {
+            const after = await readFinishedSpec(root, workstream);
+            if (after === undefined) {
+                await writeFile(join(root, workstream.taskFile), before, "utf8");
+                const failure = `${workstream.id}: the spec-critique writer left the spec empty or ` +
+                    "missing; the pre-fix spec was restored";
+                log(failure);
+                pushStageError(failure);
+                return { ok: false, failure, stray: [] };
+            }
+            let stray = [];
+            if (isRepository) {
+                const [dirtyNow, untrackedNow] = await Promise.all([
+                    git.dirtyPaths(root),
+                    git.untrackedPaths(root),
+                ]);
+                const before_ = new Set([...snapshot.dirty, ...snapshot.untracked]);
+                const now_ = new Set([...dirtyNow, ...untrackedNow]);
+                const taskPrefix = `tasks/${programId}/`;
+                stray = [...now_].filter((path) => !before_.has(path) &&
+                    !path.startsWith(taskPrefix) &&
+                    !path.startsWith("docs/programs/"));
+                if (stray.length > 0) {
+                    const message = `${workstream.id}: the spec-critique writer touched path(s) outside ` +
+                        `its own spec: ${stray.join(", ")}`;
+                    log(message);
+                    pushStageError(message);
+                }
+            }
+            return { ok: true, stray };
+        },
+    };
+}
 async function runSpecCritique(options) {
     const reviewer = resolveReviewerAgent(options.config);
     if (!reviewer)
-        return reviewerAbsentOutcome();
+        return { outcome: reviewerAbsentOutcome() };
+    const recorder = options.recorder ?? NOOP_RUN_RECORDER;
     const locate = (file) => locateInRepo(options.root, file);
-    const review = async (_round, priorOpen) => {
+    const span = recorder.span({ stage: "spec-critique", workstream: options.workstream.id });
+    // Explicit parenting (WS-01 §3.3): the reviewer/writer spawns below nest
+    // under this span because the code says so, never because of what
+    // happens to be open on the implicit stack — the one other spot besides
+    // `run` itself that relied on implicit nesting.
+    const scope = span.scope();
+    const review = async (round, priorOpen) => {
         const currentSpec = (await readFinishedSpec(options.root, options.workstream)) ?? options.spec;
         const brief = await specCritiqueReviewerBrief(options.root, options.manifest, options.workstream, options.rosterById, currentSpec, priorOpen);
         let invocation;
@@ -479,7 +597,7 @@ async function runSpecCritique(options) {
                 programId: options.programId,
                 label: `${options.workstream.id}-spec-critique-reviewer`,
                 log: options.log,
-            });
+            }, scope, { workstream: options.workstream.id, attemptIndex: round });
         }
         catch (error) {
             // Fail open, matching the equivalent build-side guard in
@@ -496,17 +614,89 @@ async function runSpecCritique(options) {
         const ran = invocation.exitCode === 0 && hasFindingsBlock(invocation.output);
         return { findings, errors: parsed.errors, ran };
     };
-    const respond = async (_round, findings) => {
-        const currentSpec = (await readFinishedSpec(options.root, options.workstream)) ?? options.spec;
-        const brief = specCritiqueWriterBrief(options.workstream, currentSpec, findings);
-        let invocation;
-        try {
-            invocation = await invokeAgent(options.agentRunner, options.author, brief, options.root, options.permits, "authorAgent", {
+    let sessionFallbackNote;
+    const respond = async (cycle, findings) => {
+        const before = (await readFinishedSpec(options.root, options.workstream)) ?? options.spec;
+        // Step 2: record. Every routable finding this cycle raised reaches the
+        // ledger — not a post-critique residue (WS-09 §3.7.2), anchored to the
+        // same pre-workstream commit `authorWorkstream` uses elsewhere.
+        const routable = findings.filter(hasRoutableEvidence);
+        const events = findingsToLedgerEvents({
+            workstreamId: options.workstream.id,
+            findings: routable,
+            ...(options.baseCommit === undefined ? {} : { baseCommit: options.baseCommit }),
+            now: options.now,
+        });
+        await timed(scope, { stage: "ledger-persist", workstream: options.workstream.id }, () => appendLedgerEvents(options.root, options.programId, events));
+        // Step 3: triage — one decider spawn per routed finding, before the writer runs.
+        const triageErrors = await options.triage(events, options.baseCommit);
+        for (const message of triageErrors)
+            options.pushStageError(message);
+        // Step 4: split. Read the ledger projection *after* triage. A
+        // `human-decided` finding never reaches the writer; a `fix-now` finding
+        // with no fix attempt on it yet is binding; everything else is advisory.
+        const ledger = await readDecisionLedger(options.root, options.programId);
+        const recordsById = new Map(ledger.findings.map((record) => [record.id, record]));
+        const binding = [];
+        const bindingIds = [];
+        const advisory = [];
+        for (const finding of findings) {
+            const id = fingerprint({ ...finding, workstreamId: options.workstream.id });
+            const record = recordsById.get(id);
+            if (record?.status === "human-decided")
+                continue;
+            if (record?.status === "fix-now" && record.fixAttempt === undefined) {
+                binding.push(finding);
+                bindingIds.push(id);
+            }
+            else {
+                advisory.push(finding);
+            }
+        }
+        const gateSnapshot = await options.specGate.snapshot();
+        const spawnOnce = (resume, resumed) => {
+            const brief = specCritiqueWriterBrief(options.workstream, before, binding, advisory, resumed, options.deciderConfigured);
+            return invokeAgent(options.agentRunner, options.author, brief, options.root, options.permits, "authorAgent", {
                 root: options.root,
                 programId: options.programId,
                 label: `${options.workstream.id}-spec-critique-writer`,
                 log: options.log,
+            }, scope, { workstream: options.workstream.id, attemptIndex: cycle, attemptReason: "triaged-findings" }, resume === undefined ? {} : { handle: resume });
+        };
+        let invocation;
+        try {
+            const spawned = await spawnWithSessionContinuity({
+                resume: options.authorSession,
+                spawn: spawnOnce,
+                untouched: async () => (await readFinishedSpec(options.root, options.workstream)) === before,
+                log: options.log,
+                observeContinuity: (continuity) => {
+                    try {
+                        scope.point({
+                            kind: "session-continuity",
+                            coverage: "observed",
+                            label: continuity.mode,
+                            ...(continuity.declineReason ? { detail: continuity.declineReason } : {}),
+                            dimensions: {
+                                stage: "spec-critique",
+                                workstream: options.workstream.id,
+                                role: "authorAgent",
+                                attemptIndex: cycle,
+                            },
+                        });
+                    }
+                    catch (error) {
+                        options.log(`run-analytics: session continuity point failed: ${error.message}`);
+                    }
+                    if (continuity.mode === "fresh" && continuity.declineReason) {
+                        sessionFallbackNote =
+                            `The spec revision could not continue the author's own session ` +
+                                `(${describeSessionDecline(continuity.declineReason)}) and a fresh agent ` +
+                                `applied the findings instead.`;
+                    }
+                },
             });
+            invocation = spawned.result;
         }
         catch (error) {
             // Fail open: the spec is left as the reviewer last saw it and the
@@ -516,9 +706,47 @@ async function runSpecCritique(options) {
                 `findings for ${options.workstream.id}: ${error.message}`);
             return { note: "(spec critique response not attempted — the author agent could not be spawned)" };
         }
+        // Step 5: the runner's own deterministic spec gate — artifact, scope, change.
+        const gate = await options.specGate.check({ before, snapshot: gateSnapshot });
+        // Step 6: journal the fix-now outcome, read *after* the gate so a
+        // restore is reflected. `kept` is the runner's own reading of the file —
+        // never inferred from the writer's prose.
+        const after = (await readFinishedSpec(options.root, options.workstream)) ?? "";
+        if (bindingIds.length > 0) {
+            const kept = gate.ok && after !== before;
+            const bindingSubjects = binding.map((finding) => finding.subject).join(", ");
+            const writerNote = resolveSummary(invocation.output).text;
+            const failureSuffix = gate.ok ? "the spec file was not changed" : (gate.failure ?? "the spec gate failed");
+            const note = kept
+                ? `(fix-now: ${bindingSubjects}) ${writerNote}`
+                : `(fix-now: ${bindingSubjects}) ${writerNote} (${failureSuffix})`;
+            const fixNowEvents = bindingIds.map((id) => ({
+                kind: "finding-fix-attempted",
+                at: options.now().toISOString(),
+                id,
+                outcome: kept ? "kept" : "failed",
+                note,
+                attemptedBy: "implementer",
+            }));
+            await timed(scope, { stage: "ledger-persist", workstream: options.workstream.id }, () => appendLedgerEvents(options.root, options.programId, fixNowEvents));
+        }
         return { note: resolveSummary(invocation.output).text };
     };
-    return runReviewPass({ review, respond });
+    const budget = specCritiqueBudget(options.workstream.size);
+    try {
+        const outcome = await runReviewPass({
+            cycles: budget.cycles,
+            cycleNote: budget.note,
+            review,
+            respond,
+        });
+        span.close({ outcome: "success" });
+        return { outcome, ...(sessionFallbackNote ? { sessionFallbackNote } : {}) };
+    }
+    catch (error) {
+        span.close({ outcome: "failed" });
+        throw error;
+    }
 }
 function mergeDependencies(workstream, rosterIds, declaredIds) {
     const merged = [];
@@ -563,23 +791,25 @@ function extractDependenciesDeclaration(output) {
     return { ids: json };
 }
 /**
- * The authoring stage: writes every missing workstream spec, one clean agent
- * at a time, in dependency-level order. Shaped like `runProgram` — plain
- * inputs, injected boundaries, a structured result the CLI and `run` both
- * consume.
+ * Throws for exactly the reasons `authorProgram` throws today — no author
+ * agent configured, a cyclic manifest, an unknown `--from` id — and throws
+ * them before any agent spawns, so a caller that never reaches the scheduler
+ * fails identically to today.
  */
-export async function authorProgram(options) {
+export async function prepareAuthoring(options) {
     const root = resolve(options.cwd);
     const config = options.config;
     const agentRunner = options.agentRunner ?? defaultAgentRunner;
     const permits = options.permits ?? NOOP_PERMITS_CONTEXT;
     const git = options.git ?? defaultGitOps;
-    const log = options.log ?? ((line) => console.log(line));
+    const baseLog = options.log ?? ((line) => console.log(line));
+    const log = baseLog;
     const now = options.now ?? (() => new Date());
     const force = options.force === true;
     const reviewed = options.reviewed ?? new Set();
     const triaged = options.triaged ?? new Set();
-    const manifest = await loadManifest(root, options.programId);
+    const recorder = options.recorder ?? NOOP_RUN_RECORDER;
+    const manifest = options.manifest ?? (await loadManifest(root, options.programId));
     const resolvedAuthor = resolveAuthorAgent(config);
     if (!resolvedAuthor) {
         throw new Error("No author agent configured, and no implementer to fall back to. Set " +
@@ -602,6 +832,13 @@ export async function authorProgram(options) {
             .map((cycle) => cycle.join(" -> "))
             .join("; ")}. Re-plan with /plan-program.`);
     }
+    // Built once over the initial roster (ids never change; only individual
+    // `.dependencies` arrays mutate in place) and shared by every flow — see
+    // the manifest-object sharing rationale in the spec's §2. `rosterById`'s
+    // values are the same live `Workstream` objects `manifest.workstreams`
+    // holds, so a later mutation is visible through this map with no rebuild.
+    const rosterById = new Map(manifest.workstreams.map((w) => [w.id, w]));
+    const rosterIds = new Set(rosterById.keys());
     // The selected range (SC-05): computed once, up front, from the manifest
     // as loaded — before any agent spawns — so `--from` validation and the
     // selected set are deterministic, independent of dependency edges an
@@ -625,26 +862,182 @@ export async function authorProgram(options) {
     if (!isRepository) {
         log("warning: not a git repository — commits and decision anchors are unavailable");
     }
-    const results = [];
-    const processed = new Set();
     const blockedCone = new Set();
-    while (processed.size < manifest.workstreams.length) {
-        const remaining = manifest.workstreams.filter((w) => !processed.has(w.id));
-        const levels = topologicalLevels(remaining);
-        const next = levels[0]?.[0];
-        if (!next)
-            break;
-        processed.add(next.id);
-        results.push(await handle(next));
+    // The pipeline's run-scoped state (WS-05 §3.3): `dispatched` and
+    // `settledSet` are maintained by `authorWorkstream` itself, on entry and in
+    // its `finally`, rather than by a scheduler this module owns — WS-05's
+    // unified scheduler (or this module's own `authorProgram`, over
+    // `runReadySet`) decides *when* a workstream launches; readiness here only
+    // answers "has this dependency's spec finished", which `specFinal`/
+    // `specFinalSync` and the deferred re-author below still need. Ties no
+    // longer need breaking here — whichever scheduler owns dispatch order
+    // already breaks them against `manifest.workstreams`'s own array order.
+    const dispatched = new Set();
+    const settledSet = new Set();
+    const resultsById = new Map();
+    const settleDeferreds = new Map();
+    // Guards the merge critical section only (WS-05 §3.7): pushing a
+    // discovered dependency edge, saving the manifest, and checking for a
+    // cycle. No git operation ever runs while this is held, and this is never
+    // nested with `rootIndexMutex` or held across an `await` on it.
+    const graphMutex = createMutex();
+    // Guards every operation that takes `.git/index.lock` in the root
+    // checkout — this workstream's own spec commits, and (via
+    // `AuthorOptions.rootIndexMutex`) `runProgram`'s integration squashes and
+    // report commit (WS-05 §3.7). Injected by `runProgram` so both callers
+    // share one serializer; the standalone `author` CLI gets a private one,
+    // which costs nothing since nothing else commits there.
+    const rootIndexMutex = options.rootIndexMutex ?? createMutex();
+    const monotonicFn = options.monotonic ?? (() => performance.now());
+    const scopeFor = (id) => options.runSpan ? options.runSpan.scope({ workstream: id }) : recorder;
+    function settleDeferredFor(id) {
+        let deferred = settleDeferreds.get(id);
+        if (deferred === undefined) {
+            deferred = createDeferred();
+            settleDeferreds.set(id, deferred);
+        }
+        return deferred;
     }
-    const complete = results.every((result) => result.outcome.status === "authored" || result.outcome.status === "kept");
-    return {
-        programId: options.programId,
-        complete,
-        results,
-        borrowedImplementer,
-    };
+    /**
+     * True when `id`'s spec is final: its authoring flow has settled *and*
+     * the spec now on disk classifies as `complete` or `legacy` — the same
+     * lifecycle test `classifySpec` already applies to a workstream's own
+     * spec, given no weaker a bar for a dependency (WS-03 §3.3). Settlement
+     * alone is not enough: a settled-but-parked dependency (a returned
+     * protocol failure or an unexpected throw) deliberately leaves
+     * `specStatus` at `in_progress` and can still have a non-empty draft file
+     * on disk, and a settled dependency that was kept out of selection or
+     * otherwise never authored has no file at all — both must classify as
+     * not-final, not merely "settled". This is the authoritative, async form
+     * used by the discovery path to decide the one re-author pass.
+     * `specFinalSync` below is this same test's cheaper half, valid only
+     * where the caller has already read the file itself and just needs to
+     * know whether that read may be trusted — the two must not drift apart,
+     * so both live here together.
+     */
+    async function specFinal(id) {
+        if (!settledSet.has(id))
+            return false;
+        const dep = rosterById.get(id);
+        if (!dep)
+            return false;
+        const spec = await readFinishedSpec(root, dep);
+        const classification = classifySpec(spec, dep);
+        return classification === "complete" || classification === "legacy";
+    }
+    /**
+     * The synchronous half of `specFinal`: settled and not `in_progress`,
+     * with no file read of its own. Safe only for `dependencySpecsSection`,
+     * which already read the file itself and gates on `raw !== undefined`
+     * before ever consulting this predicate — so the `missing` classification
+     * is already handled there and this only needs to catch `interrupted`.
+     */
+    function specFinalSync(id) {
+        if (!settledSet.has(id))
+            return false;
+        const dep = rosterById.get(id);
+        return dep !== undefined && dep.specStatus !== "in_progress";
+    }
+    /**
+     * WS-05 §3.3: wraps WS-03's `handle` in the dispatch/settle bookkeeping
+     * the deferred re-author (below, inside `handle`) still reads —
+     * `dispatched`/`settledSet` mark this workstream the instant *this*
+     * function is entered, whichever scheduler called it, and the settle
+     * deferred always resolves in a `finally` so a sibling awaiting it (or a
+     * drain after an error) can never hang. A caller is expected to invoke
+     * this exactly once per workstream in the roster.
+     */
+    async function authorWorkstream(workstream) {
+        dispatched.add(workstream.id);
+        try {
+            const result = await handle(workstream);
+            resultsById.set(workstream.id, result);
+            return result;
+        }
+        catch (error) {
+            // A throw (a discovered edge creating a cycle, or anything else
+            // unexpected) is not swallowed here — it propagates to the caller's
+            // own scheduler, which drains every other in-flight flow before
+            // rethrowing (WS-04's `runReadySet`). Logged here because this is the
+            // one place that still knows which siblings were in flight when it
+            // happened.
+            const siblings = [...dispatched].filter((id) => !settledSet.has(id) && id !== workstream.id);
+            schedulerLog(baseLog)(`authoring stopped after an error in ${workstream.id}: ${error.message}` +
+                (siblings.length > 0
+                    ? `; draining in-flight workstream(s): ${siblings.join(", ")}`
+                    : ""));
+            throw error;
+        }
+        finally {
+            // Resolved in a `finally` on every path, including a throw: a settle
+            // deferred left pending would hang every sibling waiting on it and
+            // hang the drain above — the one failure mode that produces a run
+            // which never terminates.
+            settledSet.add(workstream.id);
+            settleDeferredFor(workstream.id).resolve();
+        }
+    }
+    function haltAuthorWorkstream(workstream, reason) {
+        dispatched.add(workstream.id);
+        const result = {
+            id: workstream.id,
+            name: workstream.name,
+            outcome: { status: "parked", reason },
+            decisionIds: [],
+            decisionErrors: [],
+            mergedDependencies: [],
+            unknownDependencyIds: [],
+            demotedDependencies: [],
+            reauthored: false,
+        };
+        resultsById.set(workstream.id, result);
+        settledSet.add(workstream.id);
+        settleDeferredFor(workstream.id).resolve();
+        return result;
+    }
+    /**
+     * `results` is a contract (rendered in the report, pinned by tests): it is
+     * ordered by the final dependency graph, never by completion or dispatch
+     * order, both of which are timing-dependent above `cap: 1` (WS-05 §3.9).
+     * `stableTopologicalOrder` is a pure function of the manifest with no
+     * timing input at all, and it cannot throw here (the graph is acyclic) —
+     * the fallback exists only so a surprising order beats a crashed run that
+     * authored everything.
+     */
+    function finish() {
+        let orderedIds;
+        try {
+            orderedIds = stableTopologicalOrder(manifest.workstreams).map((w) => w.id);
+        }
+        catch {
+            orderedIds = [...resultsById.keys()];
+        }
+        const results = [];
+        for (const id of orderedIds) {
+            const result = resultsById.get(id);
+            if (result === undefined) {
+                // Unreachable when every workstream in the roster went through
+                // `authorWorkstream` exactly once, which every caller of this
+                // pipeline is required to do (WS-04's `runReadySet` settles every
+                // dispatched item before it lets the caller proceed) — filtered
+                // defensively anyway per SC-12's fail-open rule.
+                schedulerLog(baseLog)(`warning: ${id} produced no author result — omitted from the report`);
+                continue;
+            }
+            results.push(result);
+        }
+        const complete = results.every((result) => result.outcome.status === "authored" || result.outcome.status === "kept");
+        return {
+            programId: options.programId,
+            complete,
+            results,
+            borrowedImplementer,
+        };
+    }
+    return { borrowedImplementer, manifest, authorWorkstream, haltAuthorWorkstream, finish };
     async function handle(workstream) {
+        const log = workstreamLog(baseLog, workstream.id);
+        const scope = scopeFor(workstream.id);
         const base = {
             id: workstream.id,
             name: workstream.name,
@@ -658,7 +1051,7 @@ export async function authorProgram(options) {
         };
         if (blockedCone.has(workstream.id)) {
             workstream.status = "parked";
-            await saveManifest(root, options.programId, manifest, { log });
+            await timed(scope, { stage: "manifest-persist", workstream: workstream.id }, () => saveManifest(root, options.programId, manifest, { log }));
             base.outcome = {
                 status: "parked",
                 reason: "an upstream dependency's authoring failed; parked, not attempted",
@@ -685,9 +1078,8 @@ export async function authorProgram(options) {
                 workstream.specHash !== undefined &&
                 specInputsHash(manifest, workstream) === workstream.specHash) {
                 workstream.specStatus = "complete";
-                await saveManifest(root, options.programId, manifest, { log });
-                log(`${workstream.id}: recognized as completed legacy authoring — ` +
-                    'normalized to specStatus "complete"');
+                await timed(scope, { stage: "manifest-persist", workstream: workstream.id }, () => saveManifest(root, options.programId, manifest, { log }));
+                log('recognized as completed legacy authoring — normalized to specStatus "complete"');
                 return base;
             }
             // Drift check: the spec exists and is about to be graded against, but
@@ -702,12 +1094,12 @@ export async function authorProgram(options) {
                 const current = specInputsHash(manifest, workstream);
                 if (current !== workstream.specHash) {
                     workstream.status = "parked";
-                    await saveManifest(root, options.programId, manifest, { log });
+                    await timed(scope, { stage: "manifest-persist", workstream: workstream.id }, () => saveManifest(root, options.programId, manifest, { log }));
                     for (const id of downstreamCone(manifest.workstreams, [workstream.id])) {
                         blockedCone.add(id);
                     }
-                    log(`${workstream.id}: the manifest entry drifted since its spec was ` +
-                        "authored — parked instead of building against stale spec text");
+                    log("the manifest entry drifted since its spec was authored — parked " +
+                        "instead of building against stale spec text");
                     base.outcome = {
                         status: "parked",
                         reason: `the manifest entry (name, scope, dependencies, or the program's ` +
@@ -720,9 +1112,7 @@ export async function authorProgram(options) {
             }
             return base;
         }
-        log(`${workstream.id} ${workstream.name}: authoring`);
-        const rosterById = new Map(manifest.workstreams.map((w) => [w.id, w]));
-        const rosterIds = new Set(rosterById.keys());
+        log(`${workstream.name}: authoring`);
         const baseCommit = isRepository ? await git.currentCommit(root) : undefined;
         // Keyed by fingerprint, last-wins: a re-author pass can re-emit a
         // decision with the same id but revised context/options/chosen (the
@@ -730,14 +1120,24 @@ export async function authorProgram(options) {
         // workstream's current truth. `.set()` on each push naturally keeps the
         // latest occurrence rather than the first.
         const allDecisionsById = new Map();
-        const first = await authorBrief(root, manifest, workstream, rosterById);
+        // WS-08: last-wins across the author and (optional) re-author spawns —
+        // whichever pass most recently reported a session id is the one the
+        // spec-critique writer resumes.
+        let authorSession;
+        const first = await authorBrief(root, manifest, workstream, rosterById, undefined, specFinalSync);
         base.demotedDependencies = first.demoted;
+        for (const point of promptComponentSizePoints(first.components, { role: "authorAgent" })) {
+            scope.point(point);
+        }
+        const firstDemotedPoint = demotedDependenciesPoint(first.demoted, first.demotedBytes, { role: "authorAgent" });
+        if (firstDemotedPoint)
+            scope.point(firstDemotedPoint);
         // Stamped before the agent can write anything (SC-01): the agent has
         // whole-file write access, so a crash at any point after this line
         // leaves a durable `in_progress` marker the next attempt classifies as
         // interrupted, regardless of whether a partial file exists.
         workstream.specStatus = "in_progress";
-        await saveManifest(root, options.programId, manifest, { log });
+        await timed(scope, { stage: "manifest-persist", workstream: workstream.id }, () => saveManifest(root, options.programId, manifest, { log }));
         let invocation;
         try {
             invocation = await invokeAgent(agentRunner, author, first.brief, root, permits, "authorAgent", {
@@ -745,7 +1145,9 @@ export async function authorProgram(options) {
                 programId: options.programId,
                 label: `${workstream.id}-author`,
                 log,
-            });
+            }, scope, { stage: "author", workstream: workstream.id });
+            if (invocation.session)
+                authorSession = invocation.session;
         }
         catch (error) {
             // A spawn error here means the author agent never started — the same
@@ -757,7 +1159,7 @@ export async function authorProgram(options) {
             // stays `in_progress` — never cleared on a failure path — so a later
             // retry resumes without needing --force (SC-07).
             workstream.status = "parked";
-            await saveManifest(root, options.programId, manifest, { log });
+            await timed(scope, { stage: "manifest-persist", workstream: workstream.id }, () => saveManifest(root, options.programId, manifest, { log }));
             for (const id of downstreamCone(manifest.workstreams, [workstream.id])) {
                 blockedCone.add(id);
             }
@@ -774,7 +1176,7 @@ export async function authorProgram(options) {
             // Park exactly like a spawn failure and leave `specStatus` at
             // `in_progress` so a force-free retry re-authors.
             workstream.status = "parked";
-            await saveManifest(root, options.programId, manifest, { log });
+            await timed(scope, { stage: "manifest-persist", workstream: workstream.id }, () => saveManifest(root, options.programId, manifest, { log }));
             for (const id of downstreamCone(manifest.workstreams, [workstream.id])) {
                 blockedCone.add(id);
             }
@@ -800,36 +1202,64 @@ export async function authorProgram(options) {
         base.decisionIds.push(...parsed.decisions.map((decision) => decisionFingerprint(workstream.id, decision)));
         const declaration = extractDependenciesDeclaration(invocation.output);
         if (declaration.error)
-            log(`${workstream.id}: ${declaration.error}`);
-        const merge = mergeDependencies(workstream, rosterIds, declaration.ids);
+            log(declaration.error);
+        // The merge critical section (§3.3): pushing the discovered edges,
+        // saving the manifest, and checking for a cycle run as one serialised
+        // step through the graph mutex, so two concurrent merges cannot jointly
+        // create a cycle. No git operation ever runs while this is held (WS-05
+        // §3.7) — the commit below is a separate, later critical section on a
+        // separate mutex. Nothing here calls `log` — the re-entrancy discipline
+        // WS-01 applies inside its own write queue applies here too; the two
+        // messages below are collected and emitted after the section returns.
+        const merge = await graphMutex.runExclusive(async () => {
+            const result = mergeDependencies(workstream, rosterIds, declaration.ids);
+            if (result.merged.length > 0) {
+                const originalDependencies = workstream.dependencies.filter((id) => !result.merged.includes(id));
+                await timed(scope, { stage: "manifest-persist", workstream: workstream.id }, () => saveManifest(root, options.programId, manifest, { log }));
+                const cyclesNow = findCycles(manifest.workstreams);
+                if (cyclesNow.length > 0) {
+                    workstream.dependencies = originalDependencies;
+                    await timed(scope, { stage: "manifest-persist", workstream: workstream.id }, () => saveManifest(root, options.programId, manifest, { log }));
+                    throw new Error(`Dependency cycle(s) created by a discovered edge from ${workstream.id}: ` +
+                        `${cyclesNow.map((cycle) => cycle.join(" -> ")).join("; ")}. Re-plan with /plan-program.`);
+                }
+            }
+            return result;
+        });
         base.unknownDependencyIds = merge.unknown;
         if (merge.unknown.length > 0) {
-            log(`${workstream.id}: unknown dependency id(s) declared, ignored: ${merge.unknown.join(", ")}`);
+            log(`unknown dependency id(s) declared, ignored: ${merge.unknown.join(", ")}`);
         }
         if (merge.merged.length > 0) {
-            const originalDependencies = workstream.dependencies.filter((id) => !merge.merged.includes(id));
             base.mergedDependencies = merge.merged;
-            await saveManifest(root, options.programId, manifest, { log });
-            log(`${workstream.id}: merged new dependency edge(s): ${merge.merged.join(", ")}`);
-            const cyclesNow = findCycles(manifest.workstreams);
-            if (cyclesNow.length > 0) {
-                workstream.dependencies = originalDependencies;
-                await saveManifest(root, options.programId, manifest, { log });
-                throw new Error(`Dependency cycle(s) created by a discovered edge from ${workstream.id}: ` +
-                    `${cyclesNow.map((cycle) => cycle.join(" -> ")).join("; ")}. Re-plan with /plan-program.`);
-            }
+            log(`merged new dependency edge(s): ${merge.merged.join(", ")}`);
+            // Classify each merged dependency (§3.3): a sibling still in flight is
+            // awaited on its settle deferred — never on a not-yet-dispatched one,
+            // which would risk a deadlock at `cap: 1` — and only a spec that
+            // classifies `complete` or `legacy` after settlement triggers the one
+            // re-author pass. A settled-but-parked sibling (still `in_progress`),
+            // a settled-but-missing sibling (never authored, e.g. an
+            // out-of-selection keep), and one that was never dispatched at all,
+            // all resolve to `false` through the same `specFinal` check.
             const needsReauthor = [];
             for (const id of merge.merged) {
                 const dep = rosterById.get(id);
                 if (!dep)
                     continue;
-                if ((await readFinishedSpec(root, dep)) !== undefined)
+                if (dispatched.has(id) && !settledSet.has(id)) {
+                    const waitStart = monotonicFn();
+                    await settleDeferredFor(id).promise;
+                    recordWorkstreamWaiting(recorder, workstream.id, {
+                        cause: "dependency",
+                        waitedMs: monotonicFn() - waitStart,
+                    });
+                }
+                if (await specFinal(id))
                     needsReauthor.push(id);
             }
             if (needsReauthor.length > 0) {
                 base.reauthored = true;
-                log(`${workstream.id}: re-authoring once with newly discovered dependency spec(s): ` +
-                    needsReauthor.join(", "));
+                log(`re-authoring once with newly discovered dependency spec(s): ${needsReauthor.join(", ")}`);
                 const note = [
                     "## You are being re-authored",
                     "",
@@ -840,11 +1270,21 @@ export async function authorProgram(options) {
                     "re-author pass.",
                     "",
                 ].join("\n");
-                const second = await authorBrief(root, manifest, workstream, rosterById, note);
+                const second = await authorBrief(root, manifest, workstream, rosterById, note, specFinalSync);
                 base.demotedDependencies = second.demoted;
+                for (const point of promptComponentSizePoints(second.components, { role: "authorAgent" })) {
+                    scope.point(point);
+                }
+                const secondDemotedPoint = demotedDependenciesPoint(second.demoted, second.demotedBytes, {
+                    role: "authorAgent",
+                });
+                if (secondDemotedPoint)
+                    scope.point(secondDemotedPoint);
                 let reauthorInvocation;
                 try {
-                    reauthorInvocation = await invokeAgent(agentRunner, author, second.brief, root, permits, "authorAgent", { root, programId: options.programId, label: `${workstream.id}-author-reauthor`, log });
+                    reauthorInvocation = await invokeAgent(agentRunner, author, second.brief, root, permits, "authorAgent", { root, programId: options.programId, label: `${workstream.id}-author-reauthor`, log }, scope, { stage: "re-author", workstream: workstream.id });
+                    if (reauthorInvocation.session)
+                        authorSession = reauthorInvocation.session;
                 }
                 catch (error) {
                     // Fail open: the first pass already wrote a spec and journaled
@@ -866,7 +1306,7 @@ export async function authorProgram(options) {
                         // otherwise untouched; a returned failure carries no such
                         // guarantee.
                         workstream.status = "parked";
-                        await saveManifest(root, options.programId, manifest, { log });
+                        await timed(scope, { stage: "manifest-persist", workstream: workstream.id }, () => saveManifest(root, options.programId, manifest, { log }));
                         for (const id of downstreamCone(manifest.workstreams, [workstream.id])) {
                             blockedCone.add(id);
                         }
@@ -895,8 +1335,8 @@ export async function authorProgram(options) {
                         base.decisionIds.push(...parsed.decisions.map((decision) => decisionFingerprint(workstream.id, decision)));
                         const secondDeclaration = extractDependenciesDeclaration(invocation.output);
                         if (secondDeclaration.ids.length > 0) {
-                            log(`${workstream.id}: additional dependency declaration after the ` +
-                                `re-author pass was not honored: ${secondDeclaration.ids.join(", ")}`);
+                            log(`additional dependency declaration after the re-author pass was not ` +
+                                `honored: ${secondDeclaration.ids.join(", ")}`);
                         }
                     }
                 }
@@ -905,7 +1345,7 @@ export async function authorProgram(options) {
         const final = await readFinishedSpec(root, workstream);
         if (final === undefined) {
             workstream.status = "parked";
-            await saveManifest(root, options.programId, manifest, { log });
+            await timed(scope, { stage: "manifest-persist", workstream: workstream.id }, () => saveManifest(root, options.programId, manifest, { log }));
             for (const id of downstreamCone(manifest.workstreams, [workstream.id])) {
                 blockedCone.add(id);
             }
@@ -929,23 +1369,32 @@ export async function authorProgram(options) {
             agentRunner,
             permits,
             author,
+            deciderConfigured: decider !== undefined,
+            baseCommit,
+            now,
             log,
             pushStageError: (message) => (base.stageErrors ??= []).push(message),
+            recorder: scope,
+            triage: (events, triageBaseCommit) => reviewWorkstreamFindings(workstream.id, events, triageBaseCommit),
+            specGate: createSpecGate({
+                root,
+                git,
+                isRepository,
+                workstream,
+                programId: options.programId,
+                log,
+                pushStageError: (message) => (base.stageErrors ??= []).push(message),
+            }),
+            ...(authorSession ? { authorSession } : {}),
         });
-        base.specCritique = critique;
+        base.specCritique = critique.outcome;
+        if (critique.sessionFallbackNote)
+            (base.notes ??= []).push(critique.sessionFallbackNote);
         const postCritique = await readFinishedSpec(root, workstream);
         if (postCritique === undefined) {
             await writeFile(join(root, workstream.taskFile), final, "utf8");
-            log(`${workstream.id}: a critique round left the spec empty or missing; ` +
-                "the pre-critique spec was restored");
+            log("a critique round left the spec empty or missing; the pre-critique spec was restored");
         }
-        const critiqueEvents = findingsToLedgerEvents({
-            workstreamId: workstream.id,
-            findings: critique.open.filter(hasRoutableEvidence),
-            ...(baseCommit === undefined ? {} : { baseCommit }),
-            now,
-        });
-        await appendLedgerEvents(root, options.programId, critiqueEvents);
         // Stamped after every dependency merge above, so the hash records the
         // manifest exactly as this spec's author last saw it — a later manifest
         // edit is drift; authoring's own merges are not. `specStatus` is
@@ -955,10 +1404,18 @@ export async function authorProgram(options) {
         // must still classify as interrupted on retry, not falsely complete with
         // an unmade commit.
         workstream.specHash = specInputsHash(manifest, workstream);
-        await saveManifest(root, options.programId, manifest, { log });
+        await timed(scope, { stage: "manifest-persist", workstream: workstream.id }, () => saveManifest(root, options.programId, manifest, { log }));
+        // Serialised through `rootIndexMutex` (WS-05 §3.7): concurrent authors
+        // — and, once integration can run at the same time, WS-02's squash —
+        // share one git index, and `git commit` has no queue of its own; two
+        // commits at the same instant fail on `index.lock` rather than
+        // serialising. Also routed through the manifest/ledger write queue,
+        // keyed the same as `saveManifest`/`appendLedgerEvents`: this commit's
+        // `git add` stages `docs/programs`, which a concurrent ledger append
+        // could otherwise be caught mid-write.
         let commit;
         if (isRepository) {
-            commit = await git.commitPaths(root, `nightshift(${options.programId}): author ${workstream.id} ${workstream.name}`, [workstream.taskFile, "docs/programs"]);
+            commit = await rootIndexMutex.runExclusive(() => enqueueProgramWrite(programWriteKey(root, options.programId), () => timed(scope, { stage: "git-commit", workstream: workstream.id }, () => git.commitPaths(root, `nightshift(${options.programId}): author ${workstream.id} ${workstream.name}`, [workstream.taskFile, "docs/programs"]), commitEvidence)));
         }
         // Outside a git repository there is no commit to wait for — the finished
         // spec, its specHash, and this manifest save are already the durable
@@ -966,24 +1423,17 @@ export async function authorProgram(options) {
         // only runs after `commitPaths` above resolves, so the transition is
         // recoverable on both sides of the commit (SC-01, SC-02).
         workstream.specStatus = "complete";
-        await saveManifest(root, options.programId, manifest, { log });
+        await timed(scope, { stage: "manifest-persist", workstream: workstream.id }, () => saveManifest(root, options.programId, manifest, { log }));
         {
             const spawnErrors = await reviewWorkstreamDecisions(workstream.id, [...allDecisionsById.values()], baseCommit);
             if (spawnErrors.length > 0)
                 (base.stageErrors ??= []).push(...spawnErrors);
         }
-        // Findings triage against the same pre-workstream diff base the decision
-        // review used above — a spec-critique finding has no separate green
-        // anchor the way a test-critique fix does.
-        {
-            const spawnErrors = await reviewWorkstreamFindings(workstream.id, critiqueEvents, baseCommit);
-            if (spawnErrors.length > 0)
-                (base.stageErrors ??= []).push(...spawnErrors);
-        }
         base.outcome = { status: "authored", ...(commit === undefined ? {} : { commit }) };
         return base;
     }
     async function journalDecisions(workstream, decisions, baseCommit) {
+        const log = workstreamLog(baseLog, workstream.id);
         const events = decisions.map((decision) => ({
             kind: "decision-recorded",
             at: now().toISOString(),
@@ -993,12 +1443,13 @@ export async function authorProgram(options) {
             ...(baseCommit === undefined ? {} : { baseCommit }),
             decidedBy: "implementer",
         }));
-        await appendLedgerEvents(root, options.programId, events);
+        await timed(scopeFor(workstream.id), { stage: "ledger-persist", workstream: workstream.id }, () => appendLedgerEvents(root, options.programId, events));
         for (const decision of decisions) {
-            log(`${workstream.id} decision: ${decision.title} -> ${decision.chosen}`);
+            log(`decision: ${decision.title} -> ${decision.chosen}`);
         }
     }
     function reviewWorkstreamDecisions(workstreamId, decisions, baseCommit) {
+        const log = workstreamLog(baseLog, workstreamId);
         return reviewDecisions({
             root,
             programId: options.programId,
@@ -1016,9 +1467,11 @@ export async function authorProgram(options) {
             now,
             log,
             observe: { root, programId: options.programId, label: `${workstreamId}-decider-decision`, log },
+            recorder: scopeFor(workstreamId),
         });
     }
     function reviewWorkstreamFindings(workstreamId, findings, baseCommit) {
+        const log = workstreamLog(baseLog, workstreamId);
         return triageFindings({
             root,
             programId: options.programId,
@@ -1036,7 +1489,41 @@ export async function authorProgram(options) {
             now,
             log,
             observe: { root, programId: options.programId, label: `${workstreamId}-decider-finding`, log },
+            recorder: scopeFor(workstreamId),
         });
     }
 }
+/**
+ * The authoring stage, standalone: writes every missing workstream spec, one
+ * clean agent at a time, in dependency order, at `--max-parallel`'s cap —
+ * `runReadySet` over `manifest.workstreams` directly, the same scheduler
+ * `runProgram`'s unified pipeline (WS-05 §3.1) drives, just with only one
+ * kind of item. `--max-parallel 1` reproduces the pre-WS-03 serial behaviour
+ * exactly, including dispatch order and the absence of any deferred
+ * re-author. This module no longer contains a hand-written scheduler of its
+ * own (WS-04 §8, WS-05 §3.3): one implementation, two callers.
+ */
+export async function authorProgram(options) {
+    const pipeline = await prepareAuthoring(options);
+    const baseLog = options.log ?? ((line) => console.log(line));
+    const monotonicFn = options.monotonic ?? (() => performance.now());
+    const cap = normalizeMaxParallel(options.maxParallel);
+    schedulerLog(baseLog)(`authoring ${pipeline.manifest.workstreams.length} workstream(s)` +
+        (cap === Infinity ? "" : ` (cap: ${cap})`));
+    await runReadySet({
+        items: pipeline.manifest.workstreams,
+        cap,
+        monotonic: monotonicFn,
+        classify: () => "launch",
+        launch: (workstream) => pipeline.authorWorkstream(workstream).then(() => undefined),
+        // Genuinely unreachable on the standalone path: an environmental halt is
+        // a property of a *run*, and this stage has no build phase to produce
+        // one. The unified scheduler's author branch does classify "settle" on a
+        // halt (WS-05 §3.1, §3.6); this one never can.
+        settle: () => {
+            throw new Error("unreachable: authoring items never classify settle");
+        },
+    });
+    return pipeline.finish();
+}
 //# sourceMappingURL=author.js.map