@yagni-app/code-staging 0.3.2-staging.1112.1 → 0.3.2-staging.1115.1

package/dist/extension/pipeline/fanout.d.ts

@@ -0,0 +1,116 @@
+/**
+ * PURE partition contract for the implement diamond — the analogue of
+ * `findings.ts` for the fan-out orchestrator's output.
+ *
+ * `parsePartition` reads the orchestrator child's fenced ```partition JSON block
+ * and validates it against the contract (spec "Partition contract"): mode legal,
+ * width in {2,4,8} with a matching workstream count, per-workstream tier legal
+ * (absent defaults to `standard`), every workstream named + tasked with at least
+ * one file claim, and claims pairwise DISJOINT across workstreams.
+ *
+ * Two failure kinds, deliberately distinct because the pipeline treats them
+ * differently:
+ *  - SOFT (`hard: false`): malformed block, illegal field, missing reason. The
+ *    caller gets one cheap-tier format re-ask and then degrades to single-writer.
+ *    A partition is never guessed.
+ *  - HARD (`hard: true`): overlapping claims. Two writers on one file is the one
+ *    thing the design refuses to discover at merge time, so it fails the stage at
+ *    partition time with the colliding paths and workstreams named. The caller
+ *    (orchestrator) raises it as a `PipelineStageError`; keeping the throw out of
+ *    here keeps this module pure and free of an import cycle.
+ *
+ * `auditClaims` is the post-fan check: claims are path PREFIXES (a directory
+ * claims its whole subtree), so a file a builder legitimately created inside its
+ * claimed directory is in-claim, and anything else is named as a violation for
+ * the synthesizer to reconcile.
+ */
+import type { FanoutMode } from "./types.js";
+/** The tiers a workstream may run on: load-bearing work standard, mechanical work efficient. */
+export type WorkstreamTier = "standard" | "efficient";
+/**
+ * The `go.fanout` knob's environment surface (spec decision 8), named the way
+ * `YAGNI_GO_TIER_CAP` is (see tierCap.ts): a run-wide /go setting an eval or
+ * benchmark lane pins from the outside. `always` forces the diamond attempt;
+ * unset (everywhere else) leaves the partitioner's own conservative verdict as
+ * the only thing that decides.
+ */
+export declare const FANOUT_MODE_ENV = "YAGNI_GO_FANOUT";
+/**
+ * Parse a raw env value into a mode. Unset, empty, or unrecognized all yield
+ * undefined so a caller can warn about a typo; {@link resolveFanoutMode} is what
+ * turns that into the safe `auto` default. A typo must never pin a lane.
+ */
+export declare function parseFanoutMode(raw: string | undefined): FanoutMode | undefined;
+/** The run's fan-out mode from an environment. Defaults to `auto`. */
+export declare function resolveFanoutMode(env: NodeJS.ProcessEnv): FanoutMode;
+/** The only legal fan widths (execution concurrency is capped separately by the session). */
+export declare const PARTITION_WIDTHS: readonly [2, 4, 8];
+export type PartitionWidth = (typeof PARTITION_WIDTHS)[number];
+/** One workstream: a named, tasked builder with a disjoint set of prefix claims. */
+export interface PartitionWorkstream {
+    name: string;
+    task: string;
+    /** Normalized, deduped path prefixes; a directory claim covers its subtree. */
+    files: string[];
+    tier: WorkstreamTier;
+}
+/** The orchestrator's verdict: fan into workstreams, or run today's single writer. */
+export interface PartitionDecision {
+    mode: "fan" | "single";
+    /** Fan only; always equals `workstreams.length`. */
+    width?: PartitionWidth;
+    /** Always present: why this width, or why single-writer. */
+    reason: string;
+    /** Fan only. */
+    workstreams?: PartitionWorkstream[];
+}
+/** One pair of colliding claims across two workstreams. */
+export interface ClaimCollision {
+    path: string;
+    otherPath: string;
+    workstreams: [string, string];
+}
+/**
+ * Parse outcome. `ok: false` splits into the re-askable soft rejection and the
+ * hard overlap error (see the module comment).
+ */
+export type PartitionParse = {
+    ok: true;
+    decision: PartitionDecision;
+} | {
+    ok: false;
+    hard: false;
+    reason: string;
+} | {
+    ok: false;
+    hard: true;
+    reason: string;
+    collisions: ClaimCollision[];
+};
+/** Extract the inner text of a fenced ```partition block, if present. */
+export declare function extractPartitionBlock(raw: string): string | null;
+/**
+ * Normalize a claim or changed path for prefix comparison: trim, convert
+ * backslashes, collapse doubled slashes, drop interior `.` segments, a leading
+ * `./`, and trailing slashes. Purely lexical — no filesystem access. Without
+ * the collapse, `packages//backend` and `packages/./backend` pass disjointness
+ * against `packages/backend` while claiming the same directory — the exact
+ * two-writers-one-file outcome the partition-time hard error exists to prevent.
+ */
+export declare function normalizeClaimPath(path: string): string;
+/** True when `claim` is the path itself or a directory containing it. */
+export declare function claimCovers(claim: string, path: string): boolean;
+/**
+ * Parse the orchestrator's raw output into a {@link PartitionDecision}. Never
+ * throws: an unusable block is a soft rejection (re-ask, then single-writer) and
+ * overlapping claims are the hard rejection the caller turns into a stage error.
+ */
+export declare function parsePartition(raw: string): PartitionParse;
+/**
+ * Post-fan claim audit: the changed paths not covered by any workstream's claims,
+ * normalized, deduped, in first-seen order. Claims are prefixes, so a file created
+ * under a claimed directory is in-claim; anything else is a named violation the
+ * synthesizer reconciles.
+ */
+export declare function auditClaims(changedPaths: string[], workstreams: PartitionWorkstream[]): string[];
+//# sourceMappingURL=fanout.d.ts.map

package/dist/extension/pipeline/fanout.js

@@ -0,0 +1,248 @@
+/**
+ * PURE partition contract for the implement diamond — the analogue of
+ * `findings.ts` for the fan-out orchestrator's output.
+ *
+ * `parsePartition` reads the orchestrator child's fenced ```partition JSON block
+ * and validates it against the contract (spec "Partition contract"): mode legal,
+ * width in {2,4,8} with a matching workstream count, per-workstream tier legal
+ * (absent defaults to `standard`), every workstream named + tasked with at least
+ * one file claim, and claims pairwise DISJOINT across workstreams.
+ *
+ * Two failure kinds, deliberately distinct because the pipeline treats them
+ * differently:
+ *  - SOFT (`hard: false`): malformed block, illegal field, missing reason. The
+ *    caller gets one cheap-tier format re-ask and then degrades to single-writer.
+ *    A partition is never guessed.
+ *  - HARD (`hard: true`): overlapping claims. Two writers on one file is the one
+ *    thing the design refuses to discover at merge time, so it fails the stage at
+ *    partition time with the colliding paths and workstreams named. The caller
+ *    (orchestrator) raises it as a `PipelineStageError`; keeping the throw out of
+ *    here keeps this module pure and free of an import cycle.
+ *
+ * `auditClaims` is the post-fan check: claims are path PREFIXES (a directory
+ * claims its whole subtree), so a file a builder legitimately created inside its
+ * claimed directory is in-claim, and anything else is named as a violation for
+ * the synthesizer to reconcile.
+ */
+/**
+ * The `go.fanout` knob's environment surface (spec decision 8), named the way
+ * `YAGNI_GO_TIER_CAP` is (see tierCap.ts): a run-wide /go setting an eval or
+ * benchmark lane pins from the outside. `always` forces the diamond attempt;
+ * unset (everywhere else) leaves the partitioner's own conservative verdict as
+ * the only thing that decides.
+ */
+export const FANOUT_MODE_ENV = "YAGNI_GO_FANOUT";
+/**
+ * Parse a raw env value into a mode. Unset, empty, or unrecognized all yield
+ * undefined so a caller can warn about a typo; {@link resolveFanoutMode} is what
+ * turns that into the safe `auto` default. A typo must never pin a lane.
+ */
+export function parseFanoutMode(raw) {
+    const normalized = raw?.trim().toLowerCase();
+    if (normalized === "auto" || normalized === "always")
+        return normalized;
+    return undefined;
+}
+/** The run's fan-out mode from an environment. Defaults to `auto`. */
+export function resolveFanoutMode(env) {
+    return parseFanoutMode(env[FANOUT_MODE_ENV]) ?? "auto";
+}
+/** The only legal fan widths (execution concurrency is capped separately by the session). */
+export const PARTITION_WIDTHS = [2, 4, 8];
+const TIERS = ["standard", "efficient"];
+function soft(reason) {
+    return { ok: false, hard: false, reason };
+}
+/** Extract the inner text of a fenced ```partition block, if present. */
+export function extractPartitionBlock(raw) {
+    const m = raw.match(/```partition[^\n]*\n([\s\S]*?)```/i);
+    return m ? m[1] : null;
+}
+/**
+ * Normalize a claim or changed path for prefix comparison: trim, convert
+ * backslashes, collapse doubled slashes, drop interior `.` segments, a leading
+ * `./`, and trailing slashes. Purely lexical — no filesystem access. Without
+ * the collapse, `packages//backend` and `packages/./backend` pass disjointness
+ * against `packages/backend` while claiming the same directory — the exact
+ * two-writers-one-file outcome the partition-time hard error exists to prevent.
+ */
+export function normalizeClaimPath(path) {
+    return path
+        .trim()
+        .replace(/\\/g, "/")
+        .split("/")
+        .filter((segment) => segment.length > 0 && segment !== ".")
+        .join("/");
+}
+/** True when `claim` is the path itself or a directory containing it. */
+export function claimCovers(claim, path) {
+    const c = normalizeClaimPath(claim);
+    const p = normalizeClaimPath(path);
+    if (!c || !p)
+        return false;
+    return p === c || p.startsWith(`${c}/`);
+}
+/** Reject claims that escape the repo, are absolute, or claim everything. */
+function claimIsLegal(claim) {
+    if (!claim || claim === "." || claim.startsWith("/") || claim.startsWith("\\"))
+        return false;
+    return !normalizeClaimPath(claim).split("/").includes("..");
+}
+function readWorkstream(value, index) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return `workstream ${index + 1} is not an object`;
+    }
+    const obj = value;
+    const name = typeof obj.name === "string" ? obj.name.trim() : "";
+    if (!name)
+        return `workstream ${index + 1} has no name`;
+    const task = typeof obj.task === "string" ? obj.task.trim() : "";
+    if (!task)
+        return `workstream "${name}" has no task`;
+    if (!Array.isArray(obj.files))
+        return `workstream "${name}" has no file claims`;
+    const files = [];
+    for (const entry of obj.files) {
+        if (typeof entry !== "string")
+            return `workstream "${name}" has a non-string file claim`;
+        // Legality reads the RAW entry: normalization collapses the leading `/`
+        // (and `\`) markers legality has to see.
+        const claim = normalizeClaimPath(entry);
+        if (!claim || !claimIsLegal(entry.trim())) {
+            return `workstream "${name}" has an illegal file claim: ${entry}`;
+        }
+        if (!files.includes(claim))
+            files.push(claim);
+    }
+    if (files.length === 0)
+        return `workstream "${name}" has no file claims`;
+    let tier = "standard";
+    if (obj.tier !== undefined) {
+        if (typeof obj.tier !== "string" || !TIERS.includes(obj.tier)) {
+            return `workstream "${name}" has an illegal tier: ${String(obj.tier)}`;
+        }
+        tier = obj.tier;
+    }
+    return { name, task, files, tier };
+}
+/**
+ * Find every pair of claims that collide across two workstreams. Prefix nesting
+ * counts: a workstream claiming `packages/backend/src` collides with a sibling
+ * claiming `packages/backend/src/routes/x.ts`.
+ */
+function findCollisions(workstreams) {
+    const collisions = [];
+    for (let i = 0; i < workstreams.length; i += 1) {
+        for (let j = i + 1; j < workstreams.length; j += 1) {
+            for (const a of workstreams[i].files) {
+                for (const b of workstreams[j].files) {
+                    if (claimCovers(a, b) || claimCovers(b, a)) {
+                        collisions.push({
+                            path: a,
+                            otherPath: b,
+                            workstreams: [workstreams[i].name, workstreams[j].name],
+                        });
+                    }
+                }
+            }
+        }
+    }
+    return collisions;
+}
+function collisionReason(collisions) {
+    const parts = collisions.map((c) => c.path === c.otherPath
+        ? `${c.path} claimed by both ${c.workstreams[0]} and ${c.workstreams[1]}`
+        : `${c.path} (${c.workstreams[0]}) contains ${c.otherPath} (${c.workstreams[1]})`);
+    return `Overlapping file claims: ${parts.join("; ")}`;
+}
+/** Pull the JSON payload out of a partition fence, a json fence, or bare output. */
+function extractPayload(raw) {
+    const partition = extractPartitionBlock(raw);
+    if (partition !== null)
+        return partition.trim();
+    const json = raw.match(/```json[^\n]*\n([\s\S]*?)```/i);
+    if (json)
+        return json[1].trim();
+    const trimmed = raw.trim();
+    return trimmed.startsWith("{") ? trimmed : null;
+}
+/**
+ * Parse the orchestrator's raw output into a {@link PartitionDecision}. Never
+ * throws: an unusable block is a soft rejection (re-ask, then single-writer) and
+ * overlapping claims are the hard rejection the caller turns into a stage error.
+ */
+export function parsePartition(raw) {
+    if (!raw || !raw.trim())
+        return soft("empty partition output");
+    const payload = extractPayload(raw);
+    if (payload === null)
+        return soft("no ```partition block in the output");
+    let parsed;
+    try {
+        parsed = JSON.parse(payload);
+    }
+    catch {
+        return soft("the partition block is not valid JSON");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return soft("the partition block is not a JSON object");
+    }
+    const obj = parsed;
+    const mode = obj.mode;
+    if (mode !== "fan" && mode !== "single") {
+        return soft(`illegal partition mode: ${String(mode)}`);
+    }
+    const reason = typeof obj.reason === "string" ? obj.reason.trim() : "";
+    if (!reason)
+        return soft("the partition block has no reason");
+    if (mode === "single")
+        return { ok: true, decision: { mode: "single", reason } };
+    const width = obj.width;
+    if (typeof width !== "number" || !PARTITION_WIDTHS.includes(width)) {
+        return soft(`illegal fan width: ${String(width)}`);
+    }
+    if (!Array.isArray(obj.workstreams))
+        return soft("a fan partition has no workstreams");
+    const workstreams = [];
+    for (const [index, entry] of obj.workstreams.entries()) {
+        const read = readWorkstream(entry, index);
+        if (typeof read === "string")
+            return soft(read);
+        if (workstreams.some((w) => w.name === read.name)) {
+            return soft(`duplicate workstream name: ${read.name}`);
+        }
+        workstreams.push(read);
+    }
+    if (workstreams.length !== width) {
+        return soft(`fan width ${width} does not match ${workstreams.length} workstreams`);
+    }
+    const collisions = findCollisions(workstreams);
+    if (collisions.length > 0) {
+        return { ok: false, hard: true, reason: collisionReason(collisions), collisions };
+    }
+    return {
+        ok: true,
+        decision: { mode: "fan", width: width, reason, workstreams },
+    };
+}
+/**
+ * Post-fan claim audit: the changed paths not covered by any workstream's claims,
+ * normalized, deduped, in first-seen order. Claims are prefixes, so a file created
+ * under a claimed directory is in-claim; anything else is a named violation the
+ * synthesizer reconciles.
+ */
+export function auditClaims(changedPaths, workstreams) {
+    const claims = workstreams.flatMap((w) => w.files);
+    const violations = [];
+    for (const raw of changedPaths) {
+        const path = normalizeClaimPath(raw);
+        if (!path)
+            continue;
+        if (claims.some((claim) => claimCovers(claim, path)))
+            continue;
+        if (!violations.includes(path))
+            violations.push(path);
+    }
+    return violations;
+}
+//# sourceMappingURL=fanout.js.map

package/dist/extension/pipeline/fanoutBeats.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The implement diamond's RECORDING thread: pipeline progress in, run-session
+ * stage beats out (spec "Recording and the run surface").
+ *
+ * The pipeline already says everything the run surface needs — the partition
+ * verdict, each builder starting and finishing, each bounded fix turn — on the
+ * `onProgress` channel. This folds that stream into the additive
+ * `fanout` / `children` / `fixTurns` payloads on `POST /runs/:id/stages`, so the
+ * web run surface can render per-workstream rows without the pipeline growing a
+ * second reporting path.
+ *
+ * PURE and I/O-free, like `findings.ts` and `fanout.ts`: `apply` returns the beat
+ * to send (or null when the signal is not the diamond's), and the caller decides
+ * whether to POST it. Two properties are load-bearing:
+ *
+ *  1. **Recorded states only.** A child row exists only once its `stage_start`
+ *     arrives, and it is `failed` only when the pipeline said the child died.
+ *     There is no invented "pending", and no tick nobody earned.
+ *  2. **Every beat is a copy.** The roster keeps mutating as children finish, so
+ *     a beat already handed to the (async, fail-soft) session must never change
+ *     underneath it.
+ */
+import type { StageArgs } from "./runSession.js";
+import type { PipelineProgress } from "./types.js";
+/** Folds the diamond's progress signals into the stage beats that record them. */
+export interface FanoutBeats {
+    /** The beat this signal produces, or null when it is not the diamond's. */
+    apply(p: PipelineProgress): StageArgs | null;
+}
+export declare function makeFanoutBeats(): FanoutBeats;
+//# sourceMappingURL=fanoutBeats.d.ts.map

package/dist/extension/pipeline/fanoutBeats.js

@@ -0,0 +1,86 @@
+/**
+ * The implement diamond's RECORDING thread: pipeline progress in, run-session
+ * stage beats out (spec "Recording and the run surface").
+ *
+ * The pipeline already says everything the run surface needs — the partition
+ * verdict, each builder starting and finishing, each bounded fix turn — on the
+ * `onProgress` channel. This folds that stream into the additive
+ * `fanout` / `children` / `fixTurns` payloads on `POST /runs/:id/stages`, so the
+ * web run surface can render per-workstream rows without the pipeline growing a
+ * second reporting path.
+ *
+ * PURE and I/O-free, like `findings.ts` and `fanout.ts`: `apply` returns the beat
+ * to send (or null when the signal is not the diamond's), and the caller decides
+ * whether to POST it. Two properties are load-bearing:
+ *
+ *  1. **Recorded states only.** A child row exists only once its `stage_start`
+ *     arrives, and it is `failed` only when the pipeline said the child died.
+ *     There is no invented "pending", and no tick nobody earned.
+ *  2. **Every beat is a copy.** The roster keeps mutating as children finish, so
+ *     a beat already handed to the (async, fail-soft) session must never change
+ *     underneath it.
+ */
+/** The stage every fan-out beat belongs to: the diamond lives INSIDE implement. */
+const IMPLEMENT = "implement";
+export function makeFanoutBeats() {
+    // Name -> tier + claim count from the partition verdict, so a child row can
+    // carry them the moment that child starts.
+    const shape = new Map();
+    const children = [];
+    const fixTurns = [];
+    const roster = () => children.map((c) => ({ ...c }));
+    const upsert = (name, state) => {
+        const existing = children.find((c) => c.name === name);
+        if (existing) {
+            existing.state = state;
+        }
+        else {
+            const meta = shape.get(name) ?? {};
+            children.push({
+                name,
+                ...(meta.tier ? { tier: meta.tier } : {}),
+                ...(meta.files !== undefined ? { files: meta.files } : {}),
+                state,
+            });
+        }
+        return { stage: IMPLEMENT, phase: "start", children: roster() };
+    };
+    return {
+        apply(p) {
+            switch (p.kind) {
+                case "fanout": {
+                    for (const w of p.workstreams ?? [])
+                        shape.set(w.name, { tier: w.tier, files: w.files });
+                    return {
+                        stage: IMPLEMENT,
+                        phase: "start",
+                        fanout: {
+                            mode: p.mode,
+                            ...(p.width ? { width: p.width } : {}),
+                            reason: p.reason,
+                        },
+                    };
+                }
+                case "stage_start":
+                    if (p.stageId !== IMPLEMENT || !p.workstream)
+                        return null;
+                    return upsert(p.workstream, "running");
+                case "stage_done":
+                    if (p.stageId !== IMPLEMENT || !p.workstream)
+                        return null;
+                    return upsert(p.workstream, p.degraded === "failed" ? "failed" : "done");
+                case "fix_turn": {
+                    fixTurns.push({ turn: p.turn, findings: p.findings, reengaged: [...p.reengaged] });
+                    return {
+                        stage: IMPLEMENT,
+                        phase: "start",
+                        fixTurns: fixTurns.map((t) => ({ ...t, reengaged: [...t.reengaged] })),
+                    };
+                }
+                default:
+                    return null;
+            }
+        },
+    };
+}
+//# sourceMappingURL=fanoutBeats.js.map

package/dist/extension/pipeline/goCommand.d.ts

@@ -114,6 +114,20 @@ export interface RegisterGoDeps {
     exists?: (path: string) => boolean;
     /** Clock seam for registry rows + staleness. */
     now?: () => number;
+    /**
+     * Environment the run-wide /go settings are read from (today: `go.fanout` via
+     * YAGNI_GO_FANOUT). Defaults to `process.env`; injected so a test can pin a
+     * benchmark lane without mutating the process.
+     */
+    env?: NodeJS.ProcessEnv;
+    /**
+     * Is /ultra on right now? The same holder the subagent tool reads (wired in
+     * index.ts), consulted per call because /ultra can flip mid-session. It is the
+     * implement diamond's parallel ceiling: ultra runs the fan (and its fix turns)
+     * up to 8 wide, everything else stays at 4. Absent (an unwired embedder or a
+     * test) simply means "not ultra", which is today's behavior.
+     */
+    isUltra?: () => boolean;
     baseUrl?: string;
     getToken?: () => string | undefined;
     /**

package/dist/extension/pipeline/goCommand.js

@@ -63,6 +63,8 @@ import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { eventToLine } from "./activity.js";
 import { ActivityFeed, SPINNER_FRAMES } from "./activityFeed.js";
+import { resolveFanoutMode } from "./fanout.js";
+import { makeFanoutBeats } from "./fanoutBeats.js";
 import { RunState } from "./runState.js";
 import { aggregateRunUsage } from "./budget.js";
 import { formatRunCostTable } from "./runCostTable.js";
@@ -78,7 +80,7 @@ import { runPipeline as defaultRunPipeline } from "./orchestrator.js";
 import { composeAbortSignal } from "./resilience.js";
 import { planResume } from "./resume.js";
 import { activeRunCount, beginRun, classifyRunLiveness, findActiveRunByTicket, isRunInFlight, isTerminalStatus, lastJournalTs, loadRegistryRows, resolveMaxConcurrentRuns, settleRun, trackRunAbort, trackRunPromise, worktreesDir, } from "./runRegistry.js";
-import { makeRunSession as defaultMakeRunSession } from "./runSession.js";
+import { makeRunSession as defaultMakeRunSession, } from "./runSession.js";
 import { recordSessionRun } from "../sessionRuns.js";
 import { resolveTicketBrief as defaultResolveTicketBrief } from "./ticketResolution.js";
 import { snapshotWorkspace as defaultSnapshotWorkspace } from "./workspace.js";
@@ -422,6 +424,13 @@ export function registerGoCommand(pi, deps = {}) {
     const loadJournal = deps.loadJournal ?? ((sessionKey) => makeFileCheckpointStore(sessionKey).load());
     const exists = deps.exists ?? existsSync;
     const now = deps.now ?? Date.now;
+    // `go.fanout` (spec decision 8): `always` pins the implement diamond for
+    // benchmark / eval lanes; unset leaves the partitioner's conservative verdict
+    // as the only thing that decides.
+    const fanoutMode = resolveFanoutMode(deps.env ?? process.env);
+    // The dial is held, never its value: /ultra can be toggled between runs, so
+    // the pipeline calls it when it needs the ceiling rather than reading it here.
+    const isUltra = deps.isUltra;
     // Task 8: no default — see the RegisterGoDeps doc comment for why (only
     // index.ts's real wiring makes sense here; absent, `resolveCostText` falls
     // back to the local client estimate).
@@ -559,6 +568,10 @@ export function registerGoCommand(pi, deps = {}) {
             const feed = ctx.hasUI && !desktop ? new ActivityFeed(ticket) : undefined;
             const startedAt = Date.now();
             const run = ctx.hasUI && desktop ? new RunState({ runId: runShortId, ticket, startedAt }) : undefined;
+            // The implement diamond's recording thread. Per RUN (never module-scoped):
+            // it holds this run's child roster and fix turns. Independent of `feed` /
+            // `run`, because the Work page's run surface is fed on headless runs too.
+            const fanoutBeats = makeFanoutBeats();
             const stateKey = `${STATE_KEY_PREFIX}${runShortId}`;
             let paintTimer;
             let animationTimer;
@@ -639,6 +652,21 @@ export function registerGoCommand(pi, deps = {}) {
                 baseUrl: deps.baseUrl ?? resolveBaseUrl(),
                 getToken: deps.getToken ?? defaultGetToken,
             });
+            // The diamond's own recording channel is STRICTLY ORDERED, and it is the
+            // only one that has to be. Every roster beat carries the WHOLE roster and
+            // the run surface derives it last-one-wins (FanoutSection's `readFanout`),
+            // so two beats in flight at once can land in either order and a "running"
+            // that overtakes its own "done" paints a finished builder as running for
+            // the rest of the run. Chaining them through one promise makes the order
+            // the surface reads the order the pipeline produced. Still fire-and-forget
+            // (nothing on the run's critical path waits on it) and still fail-soft: a
+            // rejected beat never breaks the chain. The other stage beats stay
+            // unserialized on purpose — each names its own boundary, so their arrival
+            // order carries no state a later beat can undo.
+            let fanBeatChain = Promise.resolve();
+            const recordFanBeat = (b) => {
+                fanBeatChain = fanBeatChain.then(() => session.stage(b)).catch(() => { });
+            };
             const repoCtx = await resolveRepoContext(runCwd, ctx.signal);
             // Durable resilience journal, keyed by the RUN tree (the worktree path for
             // a default run; ctx.cwd for --here). Detect an interrupted prior /go for
@@ -880,10 +908,19 @@ export function registerGoCommand(pi, deps = {}) {
                     let result = await runPipeline(ticket, {
                         cwd: runCwd,
                         signal: runSignal,
+                        fanout: fanoutMode,
+                        ...(isUltra ? { isUltra } : {}),
                         ...(ticketBrief ? { ticketBrief } : {}),
                         onProgress: (p) => {
                             feed?.applyProgress(p);
                             run?.applyProgress(p, Date.now());
+                            // The implement diamond's own beats (the partition verdict, each
+                            // child's state, each fix turn) ride the SAME fail-soft stage
+                            // channel as every other boundary, additively: a signal that is not
+                            // the diamond's produces no beat at all.
+                            const fanBeat = fanoutBeats.apply(p);
+                            if (fanBeat)
+                                recordFanBeat(fanBeat);
                             // The ribbon replaces the status chip on the desktop, so the chip is
                             // only set for the terminal's status-line fallback.
                             if (ctx.hasUI && !desktop) {