ai-foreman 1.7.19 → 1.7.21

package/dist/cli/start.js

@@ -1,9 +1,18 @@
+import { finalQaRoleInstructions, resolveEffectiveQaConfiguration } from "../qaEffectiveConfig.js";
+import { graphContext, sendGraphTurn } from "../graph/turn.js";
+import { initializeSyntheticWork } from "../buildSyntheticWork.js";
+import { admitApprovedTicket } from "../buildWorkAuthorization.js";
+import { WorkflowReader } from "../workflowReader.js";
+import { localBuildAuthority, canonicalProject, withBuildInvocation } from "../buildAdmission.js";
+import { formatRecoveryCommand, formatDecisionCommands, formatExactRunRecovery } from "../recoveryGuidance.js";
 import { durableReadOnlyProposal } from "../readOnlyProposal.js";
 import { captureFrozenQaSource } from "../qaSnapshot.js";
-import { superviseStart, supervisedRunId } from "../supervisedStart.js";
-import { durableHumanDecision, HumanDecisionRequired } from "../humanDecision.js";
-import { requiresBuildApproval, buildScopeRevision } from "../buildApproval.js";
-import { Command } from "commander";
+import { finishStartAdmission, superviseStart, supervisedRunId } from "../supervisedStart.js";
+import { assertBuildAssignmentReconciled } from "../buildAssignment.js";
+import { durableHumanDecision, HumanDecisionRequired, HumanDecisionCancelled, servicePendingHumanDecisions } from "../humanDecision.js";
+import { requiresBuildApproval, buildScopeRevision, createBuildApprovalGate } from "../buildApproval.js";
+import { Command, Option } from "commander";
+import { accent, error, sanitizeTerminalText, success, warning } from "../terminalStyle.js";
 import { resolve, join, relative } from "node:path";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { execFileSync } from "node:child_process";
@@ -18,7 +27,7 @@ import { RecoveringAdapter } from "../adapters/recovering.js";
 import { Foreman, createPermissionHandler } from "../foreman.js";
 import { printEvents } from "./events.js";
 import { loadRoleBundle } from "../roles.js";
-import { ensureRuntimeReadyForCommand } from "./runtimeAuthPrompt.js";
+import { ensureBuildRuntimeReadyForCommand } from "./runtimeAuthPrompt.js";
 import { resolveAgentForProject } from "./runtimeSelection.js";
 import { isTicketsInitialized, loadTicketsConfig, resolveTicketPaths } from "../tickets/config.js";
 import { loadTickets } from "../tickets/ticketLoader.js";
@@ -29,7 +38,7 @@ import { formatGitHubFailure, preflightGh } from "../branch/github.js";
 import { preflightGlab } from "../branch/gitlab.js";
 import { readDeliveryUnitSession, runBranchPlan } from "../branch/runner.js";
 import { branchPlanLogMetadata, presentBranchPlan } from "../branch/presentation.js";
-import { buildRunSessionBinding, checkpointBuildRun, completeBuildRun, createBuildRun, heartbeatBuildRun, persistBuildSession, projectBuildRecovery, readBuildRuns, releaseBuildLease, resumeBuildRun } from "../buildRuns.js";
+import { buildRunSessionBinding, checkpointBuildRun, completeBuildRun, createBuildRun, currentBranchRecoveryTicket, currentBranchTicketProgress, recoveryExecutionTickets, finishRecoveredTicketScope, heartbeatBuildRun, persistBuildSession, projectBuildRecovery, readBuildRuns, releaseBuildLease, resumeBuildRun } from "../buildRuns.js";
 import { parse as parseYaml } from "yaml";
 import { findResumableBranchSessions, formatBranchContinueCommand, formatBranchSummaryFollowupCommands, } from "../branch/resume.js";
 import { detectGitProvider, loadTicketSetupConfig } from "../tickets/setupConfig.js";
@@ -52,7 +61,6 @@ import { ObservabilityStore, RunObserver } from "../observability.js";
 import { loadProjectAutonomyConfig, resolveAutonomyPolicy, resolveQaEnablement } from "../recoveryPolicy.js";
 import { loadQaRecoveryPacket, recoverPendingQaRecoveryPublications } from "../qaRecovery.js";
 import { qaDigest } from "../qaProtocolV2.js";
-import { loadSkill } from "special-agents";
 import { acceptQaRuntimeHandoff, describeQaRuntimeHandle, frozenQaRuntimeSettings } from "../qaRuntime.js";
 const FOREMAN_VERSION = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8")).version;
 function fail(message) {
@@ -144,16 +152,15 @@ export function formatResumeGuidance(executable, projectDir, steps, sessionId, r
         return [
             ...run.decisions.flatMap(decision => [
                 `foreman: input required: ${decision.prompt}`,
-                `foreman: choices: ${decision.choices.map(choice => `${choice.id} (${choice.label})`).join(", ")}`,
-                `  rafi build:decide ${shellQuote(projectDir)} --run ${shellQuote(run.runId)} --decision ${shellQuote(decision.decisionId)} --choice <choice-id>`,
+                ...formatDecisionCommands(projectDir, run.runId, decision, executable),
             ]),
-            "foreman: resume this run with:",
-            `  rafi build:resume ${shellQuote(projectDir)} --run ${shellQuote(run.runId)}`,
+            executable === "rafi" ? "foreman: resume this run with:" : "foreman: review recovery for this run with:",
+            `  ${formatExactRunRecovery(projectDir, run.runId, executable)}`,
         ];
     if (executable === "rafi") {
         return [
             "foreman: resume this run with:",
-            `  rafi build:resume ${shellQuote(projectDir)}`,
+            `  ${formatRecoveryCommand(projectDir, executable, process.cwd(), sessionId ? { id: sessionId, steps } : undefined)}`,
         ];
     }
     if (!sessionId)
@@ -352,6 +359,94 @@ async function ensureReviewProviderReady(cwd, provider, log, yes) {
         currentActivity()?.note("rafi: retrying GitLab readiness check");
     }
 }
+/** Save parsed CLI values as argv, never as executable shell text. */
+export function savedStartArguments(command, projectDir, opts) {
+    const args = ["start", projectDir];
+    for (const option of command.options) {
+        const name = option.attributeName();
+        if (["preparationRun", "launchToken"].includes(name))
+            continue;
+        const value = opts[name];
+        if (value === undefined || (!["steps", "stacks"].includes(name) && command.getOptionValueSource(name) !== "cli"))
+            continue;
+        if (option.negate) {
+            if (value === false)
+                args.push(option.long);
+            continue;
+        }
+        if (value === false)
+            continue;
+        if (value === true)
+            args.push(option.long);
+        else
+            for (const item of Array.isArray(value) ? value : [value])
+                args.push(option.long, name === "tickets" ? resolve(String(item)) : String(item));
+    }
+    return args;
+}
+/** Pure validation shared by interactive start and persisted preparation. */
+export function validateStartOptions(opts, requireCount) {
+    const recovery = Boolean(opts.resume || opts.continue || opts.recoverRun);
+    const tickets = opts.ticket ?? [];
+    if (!recovery && tickets.length > 1)
+        throw new Error("new-ticket selection supports exactly one --ticket");
+    if (!recovery && tickets.length && opts.stacks !== undefined)
+        throw new Error("new-ticket selection cannot be combined with --stacks");
+    if (!recovery && tickets.length === 1 && opts.steps === undefined && opts.stacks === undefined)
+        opts.steps = "1";
+    if (opts.steps !== undefined && opts.stacks !== undefined)
+        throw new Error("--steps and --stacks are mutually exclusive");
+    if (requireCount && opts.steps === undefined && opts.stacks === undefined)
+        throw new Error("exactly one of --steps or --stacks is required");
+    for (const name of ["steps", "stacks"])
+        if (opts[name] !== undefined && (!/^\d+$/.test(String(opts[name])) || !Number.isSafeInteger(Number(opts[name])) || Number(opts[name]) < 1))
+            throw new Error(`--${name} must be a positive integer`);
+    for (const [name, allowed] of Object.entries({ agent: ["claude", "codex"], effort: ["low", "medium", "high", "xhigh"], autonomy: ["supervised", "balanced", "unattended"], completion: ["pr", "auto-merge", "direct-merge", "none"], mergeMethod: ["squash", "merge", "rebase"], provider: ["auto", "github", "gitlab"], acceptHandoffRole: ["builder", "qa"] })) {
+        if (opts[name] !== undefined && !allowed.includes(String(opts[name])))
+            throw new Error(`--${name} must be ${allowed.join(" | ")}`);
+    }
+    for (const name of ["maxBranchDepth", "autoMergeTimeoutMinutes", "acceptHandoff"])
+        if (opts[name] !== undefined && (!/^\d+$/.test(String(opts[name])) || !Number.isSafeInteger(Number(opts[name])) || Number(opts[name]) < 1))
+            throw new Error(`${name} must be a positive integer`);
+    if (opts.autoCompactThreshold !== undefined && (!/^\d+$/.test(String(opts.autoCompactThreshold)) || Number(opts.autoCompactThreshold) < 1 || Number(opts.autoCompactThreshold) > 99))
+        throw new Error("--auto-compact-threshold must be an integer from 1 to 99");
+    if (opts.resume && opts.continue)
+        throw new Error("--resume and --continue are mutually exclusive");
+    if (opts.preparationRun && opts.recoverRun)
+        throw new Error("Preparation and established recovery run modes are mutually exclusive");
+    if (opts.preparationRun && !opts.launchToken)
+        throw new Error("Preparation launch requires both run and token");
+    if (opts.launchToken && !opts.preparationRun && !opts.recoverRun)
+        throw new Error("Launch token requires a preparation or recovery run");
+}
+/** Validate generated established recovery before reserving execution authority. */
+export function validateRecoveryArguments(args, projectDir) {
+    if (args[0] !== "start" || canonicalProject(args[1] ?? "") !== canonicalProject(projectDir))
+        throw new Error("Recovery arguments belong to another project");
+    const command = buildStartCommand().exitOverride().configureOutput({ writeErr: () => { } });
+    const parsed = command.parseOptions([...args.slice(2)]);
+    if (parsed.unknown.length || parsed.operands.length)
+        throw new Error("Unsupported recovery arguments");
+    const opts = command.opts();
+    validateStartOptions(opts, true);
+    if (!opts.recoverRun || opts.preparationRun || opts.launchToken)
+        throw new Error("Invalid generated recovery context");
+}
+/** Validate persisted preparation argv without executing a command or provider. */
+export function validatePreparationArguments(args, projectDir) {
+    if (args[0] !== "start" || !args[1] || canonicalProject(args[1]) !== canonicalProject(projectDir))
+        throw new Error("Saved preparation arguments belong to another project");
+    const command = buildStartCommand().exitOverride().configureOutput({ writeErr: () => { } });
+    const parsed = command.parseOptions([...args.slice(2)]);
+    if (parsed.unknown.length || parsed.operands.length)
+        throw new Error("Saved preparation arguments contain unsupported options or operands");
+    const options = command.opts();
+    validateStartOptions(options, true);
+    for (const name of ["recoverRun", "recoveryMode", "recoveryDecisionDigest", "acceptHandoff", "acceptHandoffRole", "qaRevision", "launchToken", "preparationRun"])
+        if (command.getOptionValueSource(name) === "cli")
+            throw new Error("Saved preparation contains stale internal recovery authority");
+    return savedStartArguments(command, projectDir, options);
+}
 export function buildStartCommand() {
     return new Command("start")
         .description("Enlist a builder and drive it through a batch of N steps.")
@@ -361,6 +456,8 @@ export function buildStartCommand() {
         .option("-a, --agent <agent>", "builder agent (claude | codex)")
         .option("-m, --model <model>", "override the builder's model")
         .option("-r, --resume <sessionId>", "resume a prior builder session")
+        .addOption(new Option("--preparation-run <id>", "authorized preparation successor (internal)").hideHelp())
+        .addOption(new Option("--launch-token <token>", "single-use preparation launch authorization (internal)").hideHelp())
         .option("--recover-run <id>", "continue an existing master recovery run ID")
         .option("--recovery-mode <mode>", "frozen build:resume mode (internal recovery receipt)")
         .option("--recovery-decision-digest <digest>", "exact frozen build:resume decision digest (internal)")
@@ -393,10 +490,18 @@ export function buildStartCommand() {
         .option("--auto-compact-threshold <percent>", "initial Builder context compaction threshold (1-99)")
         .option("--max-branch-depth <n>", "maximum selected branch stack depth", "5")
         .option("--pr-ready", "create ready-for-review PRs instead of draft PRs")
+        .option("--builder-network", "request build-scoped builder internet access with separate explicit approval; rechecked on resume")
+        .option("--builder-approvals", "allow the builder to request explicit per-operation sandbox approvals; QA stays restricted")
         .option("--keep-worktrees", "keep successful ticket worktrees for inspection")
         .option("--ticket <id>", "select one new ticket, or identify recovery tickets with --resume/--continue/--recover-run", collectTicket, [])
         .option("--skip-delivery-unit <id>", "skip one unfinished delivery unit for this run", collectTicket, [])
-        .action(async (project, opts, command) => {
+        .action(async (project, opts, command) => withBuildInvocation(async () => {
+        try {
+            validateStartOptions(opts, false);
+        }
+        catch (error) {
+            fail(error.message);
+        }
         const requestedTicketIds = opts.ticket ?? [];
         const recoveryIntent = Boolean(opts.resume || opts.continue || opts.recoverRun);
         if (!recoveryIntent && requestedTicketIds.length > 1)
@@ -420,6 +525,12 @@ export function buildStartCommand() {
                 process.exit(0);
             opts[mode] = String(count);
         }
+        try {
+            validateStartOptions(opts, true);
+        }
+        catch (error) {
+            fail(error.message);
+        }
         let steps = Number.parseInt(opts.steps ?? "0", 10);
         const stackCount = opts.stacks === undefined ? undefined : Number.parseInt(opts.stacks, 10);
         if (stackCount !== undefined && (!Number.isInteger(stackCount) || stackCount < 1))
@@ -443,1830 +554,2015 @@ export function buildStartCommand() {
         const autonomyProfile = opts.autonomy;
         if (autonomyProfile && !["supervised", "balanced", "unattended"].includes(autonomyProfile))
             fail("--autonomy must be supervised, balanced, or unattended");
-        const frozenPolicy = recoveryRecord && "frozenPolicy" in recoveryRecord
+        const supervisedInvocationId = recoveryRecord?.runId ?? opts.preparationRun ?? supervisedRunId() ?? (process.env.RAFI_DETACHED_SUPERVISOR_RUN || undefined) ?? randomUUID();
+        const policyReader = new WorkflowReader(cwd);
+        const persistedPolicy = policyReader.autonomyPolicy(supervisedInvocationId);
+        policyReader.close();
+        const frozenPolicy = persistedPolicy ?? (recoveryRecord && "frozenPolicy" in recoveryRecord
             ? recoveryRecord.frozenPolicy
-            : resolveAutonomyPolicy(loadProjectAutonomyConfig(cwd), autonomyProfile);
-        const supervisedInvocationId = recoveryRecord?.runId ?? supervisedRunId() ?? (process.env.RAFI_DETACHED_SUPERVISOR_RUN || undefined) ?? randomUUID();
-        if (await superviseStart(cwd, supervisedInvocationId, opts.supervisor === false ? { ...frozenPolicy, supervisorEnabled: false } : frozenPolicy, { steps: opts.steps, stacks: opts.stacks, detach: opts.detach }))
-            return;
-        const autoApprovePlanUpdates = recoveryRecord
-            ? recoveryRecord.recoveryDecision?.planUpdateApproval === "auto"
-            : Boolean(opts.yes);
-        if (opts.recoveryMode) {
-            const allowed = ["exact-session", "fresh-with-handoff", "fresh-recovery-only", "guided-recovery"];
-            if (!allowed.includes(String(opts.recoveryMode)))
-                fail(`unknown frozen recovery mode ${String(opts.recoveryMode)}`);
-            if (!recoveryRecord?.recoveryDecision || recoveryRecord.recoveryDecision.mode !== opts.recoveryMode)
-                fail("recovery mode no longer matches the persisted decision receipt; Rafi will not substitute a path");
-            if (opts.recoveryDecisionDigest && createHash("sha256").update(JSON.stringify(recoveryRecord.recoveryDecision)).digest("hex") !== opts.recoveryDecisionDigest)
-                fail("recovery decision digest no longer matches the persisted decision receipt");
-        }
-        if (opts.acceptHandoff && !recoveryRecord)
-            fail("--accept-handoff requires --recover-run");
-        let pendingHandoffGeneration = opts.acceptHandoff === undefined ? undefined : Number(opts.acceptHandoff);
-        if (pendingHandoffGeneration !== undefined && (!Number.isSafeInteger(pendingHandoffGeneration) || pendingHandoffGeneration < 1))
-            fail("--accept-handoff must be a positive generation");
-        const pendingHandoffRole = String(opts.acceptHandoffRole ?? "builder");
-        if (pendingHandoffRole !== "builder" && pendingHandoffRole !== "qa")
-            fail("--accept-handoff-role must be builder or qa");
-        const roleDefaults = readAgentDefaults(cwd);
-        let deliveryRun;
-        let deliveryConfig;
-        let selectedStacks = [];
-        let selectedStackTickets;
-        if (isTicketsInitialized(cwd)) {
-            const delivery = loadDeliveryConfig(cwd);
-            deliveryConfig = delivery;
-            if (delivery) {
-                const earlyConfig = loadTicketsConfig(cwd);
-                const earlyPaths = resolveTicketPaths(earlyConfig, cwd);
-                const earlyDb = new StateDb(earlyPaths.stateDb);
-                const earlyStates = earlyDb.getAllStates();
-                earlyDb.close();
-                if (stackCount !== undefined) {
-                    const earlyTickets = loadTickets(earlyPaths.tickets);
-                    const selection = selectStacksForRun(delivery, earlyTickets, earlyStates, stackCount);
-                    if (selection.error)
-                        fail(selection.error);
-                    selectedStacks = selection.stacks;
-                    selectedStackTickets = selection.tickets;
-                    steps = selection.tickets.length;
-                    opts.branchPerTicket = true;
-                    opts.completion = "pr";
-                    const providers = new Set(selection.stacks.flatMap((stack) => stack.units.map((id) => delivery.units.find((unit) => unit.id === id)?.provider)).filter((provider) => provider === "github" || provider === "gitlab"));
-                    if (providers.size !== 1)
-                        fail("selected stacks must use one explicit GitHub or GitLab provider per run");
-                    opts.provider = [...providers][0];
+            : resolveAutonomyPolicy(loadProjectAutonomyConfig(cwd), autonomyProfile));
+        try {
+            if (await superviseStart(cwd, supervisedInvocationId, opts.supervisor === false ? { ...frozenPolicy, supervisorEnabled: false } : frozenPolicy, { steps: opts.steps, stacks: opts.stacks, detach: opts.detach, launchToken: opts.launchToken, startArgs: savedStartArguments(command, cwd, opts) }))
+                return;
+            if (recoveryRecord || opts.preparationRun) {
+                assertBuildAssignmentReconciled(cwd, supervisedInvocationId);
+                if (!await servicePendingHumanDecisions({ projectDir: cwd, runId: supervisedInvocationId, tickets: requestedTicketIds.length ? requestedTicketIds : recoveryRecord?.tickets.length ? recoveryRecord.tickets : undefined, scopeRevision: isTicketsInitialized(cwd) ? buildScopeRevision(cwd) : undefined }))
+                    return;
+            }
+            const requestedNetwork = Boolean(opts.builderNetwork || recoveryRecord?.builderCapabilities?.requestedNetwork);
+            let grantedNetwork = false;
+            if (requestedNetwork) {
+                const permissionDb = new WorkflowDb(cwd);
+                let networkKey;
+                try {
+                    networkKey = permissionDb.pendingHumanDecisions(supervisedInvocationId).find(decision => decision.interruptionId.startsWith("builder-network:"))?.interruptionId ?? `builder-network:${process.pid}:${randomUUID()}`;
                 }
-                else
-                    deliveryRun = selectDeliveryUnitForRun(delivery, earlyStates, opts.skipDeliveryUnit ?? []);
-                if (deliveryRun?.state === "resume" && !opts.yes && process.stdin.isTTY && process.stdout.isTTY) {
-                    const answer = await select({ message: `Resume unfinished delivery unit ${deliveryRun.unit.id} (${deliveryRun.remaining.length} remaining)?`, options: [
-                            { value: "resume", label: "Resume (Recommended)" }, { value: "skip", label: "Skip for this run" },
-                        ] });
-                    if (isCancel(answer))
-                        process.exit(0);
-                    if (answer === "skip")
-                        deliveryRun = selectDeliveryUnitForRun(delivery, earlyStates, [deliveryRun.unit.id, ...(opts.skipDeliveryUnit ?? [])]);
+                finally {
+                    permissionDb.close();
                 }
+                const networkDecision = await durableHumanDecision({ projectDir: cwd, runId: supervisedInvocationId, key: networkKey,
+                    prompt: "Allow the builder shell to access the internet for this build? This permits network use by any builder command, not only downloads. Workspace write confinement remains enforced. QA stays offline. Recovery requires approval again; --yes does not approve this permission.",
+                    choices: [{ id: "allow-network", label: "Allow builder internet for this build" }, { id: "stay-offline", label: "Stay offline and use a verified local bundle" }],
+                    operation: async () => {
+                        const action = await select({ message: "Allow builder internet for this build?", options: [{ value: "stay-offline", label: "Stay offline" }, { value: "allow-network", label: "Allow builder internet for this build" }] });
+                        return isCancel(action) ? undefined : action;
+                    } });
+                if (networkDecision === undefined || isCancel(networkDecision))
+                    return;
+                grantedNetwork = networkDecision === "allow-network";
             }
-        }
-        if (stackCount !== undefined && selectedStacks.length !== stackCount)
-            fail("--stacks requires explicit eligible stacks in .tickets/delivery.yaml");
-        const branchDefaults = resolveStartBranchDefaults(cwd, opts, command, deliveryRun);
-        const resolvedPrefix = resolveStartBranchPrefix(cwd, opts, recoveryRecord);
-        const branchPrefix = resolvedPrefix.value;
-        const approvalConsequences = {
-            branch_strategy: branchDefaults.branchMode ? "branch-per-ticket" : "current",
-            branch_prefix: branchPrefix,
-            ...(optionWasProvided(command, "completion") || optionWasProvided(command, "createPr") ? { completion: branchDefaults.completionMode } : {}),
-            ...(optionWasProvided(command, "mergeMethod") ? { merge_method: branchDefaults.mergeMethod } : {}),
-            ...(optionWasProvided(command, "prReady") ? { pr_ready: branchDefaults.prReady } : {}),
-            ...(optionWasProvided(command, "provider") ? { provider: branchDefaults.reviewProvider } : {}),
-        };
-        if (opts.showSessionCost && opts.hideSessionCost)
-            fail("choose either --show-session-cost or --hide-session-cost");
-        const sessionCostOverride = opts.showSessionCost ? true : opts.hideSessionCost ? false : undefined;
-        const thresholdOverride = opts.autoCompactThreshold === undefined ? undefined : Number(opts.autoCompactThreshold);
-        if (thresholdOverride !== undefined && (!Number.isInteger(thresholdOverride) || thresholdOverride < 1 || thresholdOverride > 99))
-            fail("--auto-compact-threshold must be an integer from 1 to 99");
-        let agent;
-        try {
-            agent = resolveAgentForProject(cwd, opts.agent ?? roleDefaults.builder?.make);
-        }
-        catch (err) {
-            fail(err instanceof Error ? err.message : String(err));
-        }
-        let model = opts.model ?? explicitDefaultValue(roleDefaults.builder?.model);
-        let agentExecutable;
-        const builderEffort = opts.effort ?? explicitEffort(roleDefaults.builder?.reasoning);
-        const builderFast = opts.fast ?? roleDefaults.builder?.fast;
-        let qaAgent = resolveAgentForProject(cwd, roleDefaults.qa?.make);
-        let qaModel = explicitDefaultValue(roleDefaults.qa?.model);
-        let qaExecutable;
-        const qaEffort = explicitEffort(roleDefaults.qa?.reasoning);
-        const qaFast = roleDefaults.qa?.fast ?? false;
-        const settingsRevision = roleDefaults.revision ?? 0;
-        const configuredTrackerPath = isTicketsInitialized(cwd)
-            ? loadTicketsConfig(cwd).paths.progressDoc
-            : undefined;
-        const TRACKER_SEARCH_PATHS = unique([
-            configuredTrackerPath,
-            "docs/ticket-progress.md",
-            "ticket-progress.md",
-        ].filter(Boolean));
-        let ticketsContent;
-        let trackerRelPath;
-        if (opts.tickets) {
-            const ticketPath = resolve(opts.tickets);
-            if (!existsSync(ticketPath))
-                fail(`ticket file not found: ${ticketPath}`);
-            ticketsContent = readFileSync(ticketPath, "utf8");
-            trackerRelPath = relative(cwd, ticketPath);
-        }
-        else {
-            for (const rel of TRACKER_SEARCH_PATHS) {
-                const abs = join(cwd, rel);
-                if (existsSync(abs)) {
-                    ticketsContent = readFileSync(abs, "utf8");
-                    trackerRelPath = rel;
-                    break;
+            const builderCapabilities = { requestedNetwork, grantedNetwork, ...(grantedNetwork ? { approvedAt: new Date().toISOString(), grantWorkerPid: process.pid } : {}) };
+            const readinessOwner = { project: cwd, runId: supervisedInvocationId, authority: localBuildAuthority(cwd) };
+            const autoApprovePlanUpdates = recoveryRecord
+                ? recoveryRecord.recoveryDecision?.planUpdateApproval === "auto"
+                : Boolean(opts.yes);
+            if (opts.recoveryMode) {
+                const allowed = ["exact-session", "fresh-with-handoff", "fresh-recovery-only", "guided-recovery"];
+                if (!allowed.includes(String(opts.recoveryMode)))
+                    fail(`unknown frozen recovery mode ${String(opts.recoveryMode)}`);
+                if (!recoveryRecord?.recoveryDecision || recoveryRecord.recoveryDecision.mode !== opts.recoveryMode)
+                    fail("recovery mode no longer matches the persisted decision receipt; Rafi will not substitute a path");
+                if (opts.recoveryDecisionDigest && createHash("sha256").update(JSON.stringify(recoveryRecord.recoveryDecision)).digest("hex") !== opts.recoveryDecisionDigest)
+                    fail("recovery decision digest no longer matches the persisted decision receipt");
+            }
+            if (opts.acceptHandoff && !recoveryRecord)
+                fail("--accept-handoff requires --recover-run");
+            let pendingHandoffGeneration = opts.acceptHandoff === undefined ? undefined : Number(opts.acceptHandoff);
+            if (pendingHandoffGeneration !== undefined && (!Number.isSafeInteger(pendingHandoffGeneration) || pendingHandoffGeneration < 1))
+                fail("--accept-handoff must be a positive generation");
+            const pendingHandoffRole = String(opts.acceptHandoffRole ?? "builder");
+            if (pendingHandoffRole !== "builder" && pendingHandoffRole !== "qa")
+                fail("--accept-handoff-role must be builder or qa");
+            const roleDefaults = readAgentDefaults(cwd);
+            let deliveryRun;
+            let deliveryConfig;
+            let selectedStacks = [];
+            let selectedStackTickets;
+            if (isTicketsInitialized(cwd)) {
+                const delivery = loadDeliveryConfig(cwd);
+                deliveryConfig = delivery;
+                if (delivery) {
+                    const earlyConfig = loadTicketsConfig(cwd);
+                    const earlyPaths = resolveTicketPaths(earlyConfig, cwd);
+                    const earlyDb = new StateDb(earlyPaths.stateDb);
+                    const earlyStates = earlyDb.getAllStates();
+                    earlyDb.close();
+                    if (stackCount !== undefined) {
+                        const earlyTickets = loadTickets(earlyPaths.tickets);
+                        const selection = selectStacksForRun(delivery, earlyTickets, earlyStates, stackCount);
+                        if (selection.error)
+                            fail(selection.error);
+                        selectedStacks = selection.stacks;
+                        selectedStackTickets = selection.tickets;
+                        steps = selection.tickets.length;
+                        opts.branchPerTicket = true;
+                        opts.completion = "pr";
+                        const providers = new Set(selection.stacks.flatMap((stack) => stack.units.map((id) => delivery.units.find((unit) => unit.id === id)?.provider)).filter((provider) => provider === "github" || provider === "gitlab"));
+                        if (providers.size !== 1)
+                            fail("selected stacks must use one explicit GitHub or GitLab provider per run");
+                        opts.provider = [...providers][0];
+                    }
+                    else
+                        deliveryRun = selectDeliveryUnitForRun(delivery, earlyStates, opts.skipDeliveryUnit ?? []);
+                    if (deliveryRun?.state === "resume" && !opts.yes && process.stdin.isTTY && process.stdout.isTTY) {
+                        const answer = await select({ message: `Resume unfinished delivery unit ${deliveryRun.unit.id} (${deliveryRun.remaining.length} remaining)?`, options: [
+                                { value: "resume", label: "Resume (Recommended)" }, { value: "skip", label: "Skip for this run" },
+                            ] });
+                        if (isCancel(answer))
+                            process.exit(0);
+                        if (answer === "skip")
+                            deliveryRun = selectDeliveryUnitForRun(delivery, earlyStates, [deliveryRun.unit.id, ...(opts.skipDeliveryUnit ?? [])]);
+                    }
                 }
             }
-        }
-        if (opts.resume && opts.continue) {
-            fail("choose either --resume <sessionId> or --continue, not both");
-        }
-        const branchMode = branchDefaults.branchMode;
-        const savedWorkMode = loadTicketSetupConfig(cwd)?.build.branch_strategy ?? "current";
-        const workModeSource = recoveryRecord?.runDecisions ? "resume" : branchMode && savedWorkMode === "current" ? "cli" : "project";
-        if (!recoveryRecord && branchMode && savedWorkMode === "current") {
-            console.log(`foreman: run override — project uses Current branch — Rafi works here; you manage Git; this run explicitly uses an isolated workflow`);
-        }
-        const continueTickets = recoveryIntent
-            ? requestedTicketIds.length > 0
-                ? requestedTicketIds
-                : branchDefaults.branchMode && recoveryRecord
-                    ? [...recoveryRecord.tickets]
-                    : []
-            : [];
-        let selectedNewTicket = !recoveryIntent ? requestedTicketIds[0] : undefined;
-        const maxBranchDepth = Number.parseInt(opts.maxBranchDepth, 10);
-        if (!Number.isInteger(maxBranchDepth) || maxBranchDepth < 1) {
-            fail("--max-branch-depth must be a positive integer");
-        }
-        if (!branchMode && continueTickets.length > 1) {
-            fail("current-branch build recovery supports exactly one --ticket");
-        }
-        if (branchMode) {
-            if (opts.resume && continueTickets.length > 1) {
-                fail("--resume <sessionId> in branch mode supports exactly one --ticket; use --continue for multiple tickets");
+            if (stackCount !== undefined && selectedStacks.length !== stackCount)
+                fail("--stacks requires explicit eligible stacks in .tickets/delivery.yaml");
+            const branchDefaults = resolveStartBranchDefaults(cwd, opts, command, deliveryRun);
+            const resolvedPrefix = resolveStartBranchPrefix(cwd, opts, recoveryRecord);
+            const branchPrefix = resolvedPrefix.value;
+            const approvalConsequences = {
+                branch_strategy: branchDefaults.branchMode ? "branch-per-ticket" : "current",
+                branch_prefix: branchPrefix,
+                ...(optionWasProvided(command, "completion") || optionWasProvided(command, "createPr") ? { completion: branchDefaults.completionMode } : {}),
+                ...(optionWasProvided(command, "mergeMethod") ? { merge_method: branchDefaults.mergeMethod } : {}),
+                ...(optionWasProvided(command, "prReady") ? { pr_ready: branchDefaults.prReady } : {}),
+                ...(optionWasProvided(command, "provider") ? { provider: branchDefaults.reviewProvider } : {}),
+            };
+            if (opts.showSessionCost && opts.hideSessionCost)
+                fail("choose either --show-session-cost or --hide-session-cost");
+            const sessionCostOverride = opts.showSessionCost ? true : opts.hideSessionCost ? false : undefined;
+            const thresholdOverride = opts.autoCompactThreshold === undefined ? undefined : Number(opts.autoCompactThreshold);
+            if (thresholdOverride !== undefined && (!Number.isInteger(thresholdOverride) || thresholdOverride < 1 || thresholdOverride > 99))
+                fail("--auto-compact-threshold must be an integer from 1 to 99");
+            let agent;
+            try {
+                agent = resolveAgentForProject(cwd, opts.agent ?? roleDefaults.builder?.make);
             }
-            if ((opts.resume || opts.continue) && continueTickets.length === 0 && !recoveryRecord) {
-                fail(branchContinueTicketHelp(cwd, opts.resume ? "--resume" : "--continue"));
+            catch (err) {
+                fail(err instanceof Error ? err.message : String(err));
             }
-            if (opts.tickets)
-                fail("--tickets is not supported with an isolated branch run; initialize and use .tickets/tickets.yaml");
-            if (!isTicketsInitialized(cwd))
-                fail("isolated branch runs require initialized .tickets/ (run ai-foreman tickets init)");
-            if (branchDefaults.createReview && !branchDefaults.reviewProvider) {
-                fail("PR/MR completion is enabled but no GitHub or GitLab origin remote was detected; pass --provider github|gitlab or --completion none");
+            let model = opts.model ?? explicitDefaultValue(roleDefaults.builder?.model);
+            let agentExecutable;
+            const builderEffort = opts.effort ?? explicitEffort(roleDefaults.builder?.reasoning);
+            const builderFast = opts.fast ?? roleDefaults.builder?.fast;
+            let qaAgent = resolveAgentForProject(cwd, roleDefaults.qa?.make);
+            let qaModel = explicitDefaultValue(roleDefaults.qa?.model);
+            let qaExecutable;
+            const qaEffort = explicitEffort(roleDefaults.qa?.reasoning);
+            const qaFast = roleDefaults.qa?.fast ?? false;
+            const settingsRevision = roleDefaults.revision ?? 0;
+            const configuredTrackerPath = isTicketsInitialized(cwd)
+                ? loadTicketsConfig(cwd).paths.progressDoc
+                : undefined;
+            const TRACKER_SEARCH_PATHS = unique([
+                configuredTrackerPath,
+                "docs/ticket-progress.md",
+                "ticket-progress.md",
+            ].filter(Boolean));
+            let ticketsContent;
+            let trackerRelPath;
+            if (opts.tickets) {
+                const ticketPath = resolve(opts.tickets);
+                if (!existsSync(ticketPath))
+                    fail(`ticket file not found: ${ticketPath}`);
+                ticketsContent = readFileSync(ticketPath, "utf8");
+                trackerRelPath = relative(cwd, ticketPath);
             }
-        }
-        const resumeSessionId = opts.resume ??
-            (!branchMode && opts.continue ? findLastSessionId(join(cwd, ".foreman")) : undefined);
-        if (!branchMode && opts.continue && !resumeSessionId) {
-            fail(`no previous session id found under ${join(cwd, ".foreman")}`);
-        }
-        let resumeSessionRef;
-        if (!branchMode && resumeSessionId) {
-            if (recoveryRecord)
-                resumeSessionRef = buildRunSessionBinding(recoveryRecord, "builder", resumeSessionId);
-            if (!resumeSessionRef) {
-                try {
-                    resumeSessionRef = resolveUniqueSessionBinding(readBuildRuns(cwd).flatMap((run) => run.sessionBindings ?? []), resumeSessionId);
+            else {
+                for (const rel of TRACKER_SEARCH_PATHS) {
+                    const abs = join(cwd, rel);
+                    if (existsSync(abs)) {
+                        ticketsContent = readFileSync(abs, "utf8");
+                        trackerRelPath = rel;
+                        break;
+                    }
                 }
-                catch (error) {
-                    fail(error instanceof Error ? error.message : String(error));
+            }
+            if (opts.resume && opts.continue) {
+                fail("choose either --resume <sessionId> or --continue, not both");
+            }
+            const branchMode = branchDefaults.branchMode;
+            const savedWorkMode = loadTicketSetupConfig(cwd)?.build.branch_strategy ?? "current";
+            const workModeSource = recoveryRecord?.runDecisions ? "resume" : branchMode && savedWorkMode === "current" ? "cli" : "project";
+            if (!recoveryRecord && branchMode && savedWorkMode === "current") {
+                console.log(`foreman: run override — project uses Current branch — Rafi works here; you manage Git; this run explicitly uses an isolated workflow`);
+            }
+            const continueTickets = recoveryIntent
+                ? requestedTicketIds.length > 0
+                    ? requestedTicketIds
+                    : branchDefaults.branchMode && recoveryRecord
+                        ? [...recoveryRecord.tickets]
+                        : recoveryRecord ? [currentBranchRecoveryTicket(cwd, recoveryRecord)].filter((ticket) => ticket !== undefined) : []
+                : [];
+            if (recoveryRecord && continueTickets.some(ticket => !recoveryRecord.tickets.includes(ticket)))
+                fail("Recovery ticket is outside the saved run scope");
+            let selectedNewTicket = !recoveryIntent ? requestedTicketIds[0] : undefined;
+            const maxBranchDepth = Number.parseInt(opts.maxBranchDepth, 10);
+            if (!Number.isInteger(maxBranchDepth) || maxBranchDepth < 1) {
+                fail("--max-branch-depth must be a positive integer");
+            }
+            if (!branchMode && continueTickets.length > 1) {
+                fail("current-branch build recovery supports exactly one --ticket");
+            }
+            if (branchMode) {
+                if (opts.resume && continueTickets.length > 1) {
+                    fail("--resume <sessionId> in branch mode supports exactly one --ticket; use --continue for multiple tickets");
+                }
+                if ((opts.resume || opts.continue) && continueTickets.length === 0 && !recoveryRecord) {
+                    fail(branchContinueTicketHelp(cwd, opts.resume ? "--resume" : "--continue"));
+                }
+                if (opts.tickets)
+                    fail("--tickets is not supported with an isolated branch run; initialize and use .tickets/tickets.yaml");
+                if (!isTicketsInitialized(cwd))
+                    fail("isolated branch runs require initialized .tickets/ (run ai-foreman tickets init)");
+                if (branchDefaults.createReview && !branchDefaults.reviewProvider) {
+                    fail("PR/MR completion is enabled but no GitHub or GitLab origin remote was detected; pass --provider github|gitlab or --completion none");
                 }
             }
-            if (!resumeSessionRef)
-                fail(`session ${resumeSessionId} has no stored location-scoped binding; choose fresh recovery with a validated handoff instead of an unverifiable exact resume`);
-        }
-        if (selectedNewTicket) {
-            if (!isTicketsInitialized(cwd))
-                fail("--ticket requires initialized .tickets/ (run `rafi tickets init`)");
-            const eligibilityConfig = loadTicketsConfig(cwd);
-            const eligibilityPaths = resolveTicketPaths(eligibilityConfig, cwd);
-            const eligibilityDefs = loadTickets(eligibilityPaths.tickets);
-            const eligibilityDb = new StateDb(eligibilityPaths.stateDb);
-            const eligibilityStates = eligibilityDb.getAllStates();
-            eligibilityDb.close();
-            const activeLease = readCurrentWorkflowLease(cwd);
-            let assessment = evaluateTicketEligibility({
-                tickets: eligibilityDefs,
-                states: eligibilityStates,
-                implementationLimit: eligibilityConfig.implementationLimit,
-                delivery: deliveryConfig,
-                activeLease: activeLease ? { runId: activeLease.runId } : undefined,
-            }, selectedNewTicket);
-            if (!assessment.eligible) {
-                console.error(`foreman: ${selectedNewTicket} is not eligible:`);
-                for (const blocker of assessment.blockers)
-                    console.error(`  - ${blocker.detail}`);
-                const dependency = assessment.eligibleDependencies[0];
-                if (!dependency || opts.yes || !process.stdin.isTTY || !process.stdout.isTTY)
-                    fail(`cannot start ${selectedNewTicket}`);
-                const answer = await select({ message: `Start eligible dependency ${dependency.id}: ${dependency.title} instead?`, options: [
-                        { value: "dependency", label: `Start ${dependency.id} (Recommended)` },
-                        { value: "cancel", label: "Cancel" },
-                    ] });
-                if (isCancel(answer) || answer === "cancel") {
-                    console.log("ai-foreman: cancelled; nothing changed");
-                    return;
+            const resumeSessionId = opts.resume ??
+                (!branchMode && opts.continue ? findLastSessionId(join(cwd, ".foreman")) : undefined);
+            if (!branchMode && opts.continue && !resumeSessionId) {
+                fail(`no previous session id found under ${join(cwd, ".foreman")}`);
+            }
+            let resumeSessionRef;
+            if (!branchMode && resumeSessionId) {
+                if (recoveryRecord)
+                    resumeSessionRef = buildRunSessionBinding(recoveryRecord, "builder", resumeSessionId);
+                if (!resumeSessionRef) {
+                    try {
+                        resumeSessionRef = resolveUniqueSessionBinding(readBuildRuns(cwd).flatMap((run) => run.sessionBindings ?? []), resumeSessionId);
+                    }
+                    catch (error) {
+                        fail(error instanceof Error ? error.message : String(error));
+                    }
                 }
-                selectedNewTicket = dependency.id;
-                assessment = evaluateTicketEligibility({ tickets: eligibilityDefs, states: eligibilityStates, implementationLimit: eligibilityConfig.implementationLimit, delivery: deliveryConfig }, selectedNewTicket);
+                if (!resumeSessionRef)
+                    fail(`session ${resumeSessionId} has no stored location-scoped binding; choose fresh recovery with a validated handoff instead of an unverifiable exact resume`);
             }
-            const recommended = eligibleTickets({ tickets: eligibilityDefs, states: eligibilityStates, implementationLimit: eligibilityConfig.implementationLimit, delivery: deliveryConfig })[0];
-            if (assessment.eligible && recommended && recommended.id !== selectedNewTicket) {
-                console.log(`foreman: recommended ${recommended.id}: ${recommended.title}`);
-                console.log(`foreman: requested ${assessment.ticket.id}: ${assessment.ticket.title}`);
-                if (!opts.yes) {
-                    if (!process.stdin.isTTY || !process.stdout.isTTY)
-                        fail(`starting non-recommended ${selectedNewTicket} requires --yes`);
-                    const answer = await select({ message: `Start ${selectedNewTicket} anyway?`, options: [
-                            { value: "start", label: `Start ${selectedNewTicket}` }, { value: "cancel", label: "Cancel" },
+            if (selectedNewTicket) {
+                if (!isTicketsInitialized(cwd))
+                    fail("--ticket requires initialized .tickets/ (run `rafi tickets init`)");
+                const eligibilityConfig = loadTicketsConfig(cwd);
+                const eligibilityPaths = resolveTicketPaths(eligibilityConfig, cwd);
+                const eligibilityDefs = loadTickets(eligibilityPaths.tickets);
+                const eligibilityDb = new StateDb(eligibilityPaths.stateDb);
+                const eligibilityStates = eligibilityDb.getAllStates();
+                eligibilityDb.close();
+                const activeLease = readCurrentWorkflowLease(cwd);
+                let assessment = evaluateTicketEligibility({
+                    tickets: eligibilityDefs,
+                    states: eligibilityStates,
+                    implementationLimit: eligibilityConfig.implementationLimit,
+                    delivery: deliveryConfig,
+                    activeLease: activeLease ? { runId: activeLease.runId } : undefined,
+                }, selectedNewTicket);
+                if (!assessment.eligible) {
+                    console.error(`foreman: ${selectedNewTicket} is not eligible:`);
+                    for (const blocker of assessment.blockers)
+                        console.error(`  - ${blocker.detail}`);
+                    const dependency = assessment.eligibleDependencies[0];
+                    if (!dependency || opts.yes || !process.stdin.isTTY || !process.stdout.isTTY)
+                        fail(`cannot start ${selectedNewTicket}`);
+                    const answer = await select({ message: `Start eligible dependency ${dependency.id}: ${dependency.title} instead?`, options: [
+                            { value: "dependency", label: `Start ${dependency.id} (Recommended)` },
+                            { value: "cancel", label: "Cancel" },
                         ] });
                     if (isCancel(answer) || answer === "cancel") {
                         console.log("ai-foreman: cancelled; nothing changed");
                         return;
                     }
+                    selectedNewTicket = dependency.id;
+                    assessment = evaluateTicketEligibility({ tickets: eligibilityDefs, states: eligibilityStates, implementationLimit: eligibilityConfig.implementationLimit, delivery: deliveryConfig }, selectedNewTicket);
+                }
+                const recommended = eligibleTickets({ tickets: eligibilityDefs, states: eligibilityStates, implementationLimit: eligibilityConfig.implementationLimit, delivery: deliveryConfig })[0];
+                if (assessment.eligible && recommended && recommended.id !== selectedNewTicket) {
+                    console.log(`foreman: recommended ${recommended.id}: ${recommended.title}`);
+                    console.log(`foreman: requested ${assessment.ticket.id}: ${assessment.ticket.title}`);
+                    if (!opts.yes) {
+                        if (!process.stdin.isTTY || !process.stdout.isTTY)
+                            fail(`starting non-recommended ${selectedNewTicket} requires --yes`);
+                        const answer = await select({ message: `Start ${selectedNewTicket} anyway?`, options: [
+                                { value: "start", label: `Start ${selectedNewTicket}` }, { value: "cancel", label: "Cancel" },
+                            ] });
+                        if (isCancel(answer) || answer === "cancel") {
+                            console.log("ai-foreman: cancelled; nothing changed");
+                            return;
+                        }
+                    }
                 }
             }
-        }
-        const recoveryTicket = !branchMode && recoveryRecord ? continueTickets[0] : undefined;
-        const preferredTicket = selectedNewTicket ?? recoveryTicket;
-        const config = loadConfig(join(cwd, "foreman.yaml"));
-        const stamp = new Date().toISOString().replace(/[:.]/g, "-");
-        const logPath = join(cwd, ".foreman", `${stamp}.jsonl`);
-        const log = new Log(logPath);
-        const qaResolution = resolveQaEnablement({
-            cli: command.getOptionValueSource("qa") === "cli" ? Boolean(opts.qa) : undefined,
-            frozen: recoveryRecord && "qaEnabled" in recoveryRecord ? Boolean(recoveryRecord.qaEnabled) : undefined,
-            projectDir: cwd,
-            legacyForeman: config.qa.enabled,
-        });
-        const qaEnabled = qaResolution.enabled;
-        if (qaResolution.deprecationWarning)
-            console.error(`rafi: warning: ${qaResolution.deprecationWarning}`);
-        const invocationRunId = supervisedInvocationId;
-        let observabilityStore;
-        if (config.observability.enabled) {
-            try {
-                observabilityStore = new ObservabilityStore(cwd, { config: config.observability });
-            }
-            catch (error) {
-                console.error(`rafi: observability unavailable; build will continue: ${String(error).replace(/\s+/g, " ").slice(0, 300)}`);
+            const recoveryTicket = !branchMode && recoveryRecord ? continueTickets[0] : undefined;
+            const preferredTicket = selectedNewTicket ?? recoveryTicket;
+            let executionTickets = !branchMode && recoveryRecord && recoveryRecord.tickets.length
+                ? recoveryExecutionTickets(recoveryRecord, requestedTicketIds, Boolean(opts.recoveryMode))
+                : selectedNewTicket ? [selectedNewTicket] : undefined;
+            const config = loadConfig(join(cwd, "foreman.yaml"));
+            const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+            const logPath = join(cwd, ".foreman", `${stamp}.jsonl`);
+            const log = new Log(logPath);
+            const qaResolution = resolveQaEnablement({
+                cli: command.getOptionValueSource("qa") === "cli" ? Boolean(opts.qa) : undefined,
+                frozen: recoveryRecord && "qaEnabled" in recoveryRecord ? Boolean(recoveryRecord.qaEnabled) : undefined,
+                projectDir: cwd,
+                legacyForeman: config.qa.enabled,
+            });
+            const qaEnabled = qaResolution.enabled;
+            if (qaResolution.deprecationWarning)
+                console.error(`rafi: warning: ${qaResolution.deprecationWarning}`);
+            const invocationRunId = supervisedInvocationId;
+            let observabilityStore;
+            if (config.observability.enabled) {
+                try {
+                    observabilityStore = new ObservabilityStore(cwd, { config: config.observability });
+                }
+                catch (error) {
+                    console.error(`rafi: observability unavailable; build will continue: ${String(error).replace(/\s+/g, " ").slice(0, 300)}`);
+                }
             }
-        }
-        let activeObserver = observabilityStore ? new RunObserver(observabilityStore, invocationRunId) : undefined;
-        const finishObservationOnExit = () => {
-            if (!activeObserver)
-                return;
-            activeObserver.finish("interrupted");
-            observabilityStore?.closeLogFile(logPath, "interrupted");
-            observabilityStore?.close();
-            activeObserver = undefined;
-        };
-        process.once("exit", finishObservationOnExit);
-        activeObserver?.startResourceSampling();
-        observabilityStore?.recordCapabilities(invocationRunId, {
-            provider_turns: { source: "provider_turns", state: "available", observedAt: new Date().toISOString() },
-            tools: { source: "tools", state: "available", observedAt: new Date().toISOString() },
-            process_resources: { source: "process_resources", state: "available", observedAt: new Date().toISOString() },
-            child_process_resources: { source: "child_process_resources", state: "unavailable", observedAt: new Date().toISOString(), detail: "provider child-process attribution is unsupported" },
-        }, FOREMAN_VERSION);
-        observabilityStore?.indexLogFile(logPath, invocationRunId);
-        const createRawBuilder = async (builderCwd, sessionId, sessionRef) => {
-            const builderPolicy = new PermissionPolicy(config.permissions, builderCwd, { currentBranchWorkflow: !branchMode });
-            const roleBundle = loadRoleBundle("builder", { projectDir: builderCwd });
-            const adapterOpts = {
-                cwd: builderCwd,
-                runtimeExecutable: agentExecutable,
-                runtimePhase: "builder",
-                preparationTimeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
-                rpcTimeoutMs: frozenPolicy.runtimeDeadlines?.rpc_ms,
-                compactionTimeoutMs: frozenPolicy.runtimeDeadlines?.compaction_ms,
-                shutdownTimeoutMs: frozenPolicy.runtimeDeadlines?.shutdown_ms,
-                turnDeadlineMs: frozenPolicy.runtimeDeadlines?.turn_ms,
-                model,
-                ...(sessionRef ? { resumeSessionRef: sessionRef } : sessionId ? { resumeSessionId: sessionId } : {}),
-                configRoot: cwd,
-                sessionRole: "builder",
-                sessionStream: sessionRef?.stream ?? "builder",
-                sessionGeneration: sessionRef?.generation ?? 0,
-                workspaceIdentity: !branchMode ? captureCurrentWorkflowSessionIdentity(builderCwd) : captureWorkspaceIdentity(builderCwd),
-                ticketId: sessionRef?.ticketId,
-                deliveryUnitId: sessionRef?.deliveryUnitId,
-                permission: createPermissionHandler(builderPolicy, log, { durable: () => ({ projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, ticketId: activeObserver?.context().ticketId }) }),
-                onQuestionTrace: (trace) => log.write("question-round-trip", { ...trace }),
-                onLifecycleTrace: (trace) => log.write("provider-lifecycle", { ...trace }),
-                effort: builderEffort,
-                fast: builderFast,
-                systemPromptAppend: roleBundle.system || undefined,
-                skills: roleBundle.skills.length > 0 ? roleBundle.skills : undefined,
-                autoCompactThresholdPercent: thresholdOverride ?? roleDefaults.builder?.auto_compact_threshold_percent ?? 50,
-                observer: activeObserver,
+            let activeObserver = observabilityStore ? new RunObserver(observabilityStore, invocationRunId) : undefined;
+            const finishObservationOnExit = (exitCode) => {
+                if (!activeObserver)
+                    return;
+                const reader = new WorkflowReader(cwd);
+                const durable = reader.getRun(invocationRunId);
+                reader.close();
+                const outcome = durable?.status === "cancelled" ? "cancelled" : durable?.checkpoint === "waiting-for-human" ? "waiting-for-human" : durable?.status === "failed" ? "failed" : "interrupted";
+                activeObserver.finish(outcome, { checkpoint: durable?.checkpoint, failureCategory: `process-exit:${exitCode}` });
+                observabilityStore?.closeLogFile(logPath, outcome);
+                observabilityStore?.close();
+                activeObserver = undefined;
             };
-            const adapter = agent === "codex"
-                ? new CodexAdapter(adapterOpts)
-                : await ClaudeAdapter.create(adapterOpts);
-            if (sessionRef && adapter.agent === "codex") {
-                const availability = await adapter.validateSession();
-                if (availability.status !== "available") {
-                    await adapter.close().catch(() => { });
-                    throw new SessionUnavailableError({ runtime: "codex", phase: "preflight", dispatchState: "not-sent", executable: agentExecutable ?? "codex", cwd: builderCwd, diagnostics: availability.detail ?? `Codex session ${sessionRef.sessionId} is ${availability.status}`, availability });
+            process.once("exit", finishObservationOnExit);
+            activeObserver?.startResourceSampling();
+            observabilityStore?.recordCapabilities(invocationRunId, {
+                provider_turns: { source: "provider_turns", state: "available", observedAt: new Date().toISOString() },
+                tools: { source: "tools", state: "available", observedAt: new Date().toISOString() },
+                process_resources: { source: "process_resources", state: "available", observedAt: new Date().toISOString() },
+                child_process_resources: { source: "child_process_resources", state: "unavailable", observedAt: new Date().toISOString(), detail: "provider child-process attribution is unsupported" },
+            }, FOREMAN_VERSION);
+            observabilityStore?.indexLogFile(logPath, invocationRunId);
+            const createRawBuilder = async (builderCwd, sessionId, sessionRef) => {
+                const builderPolicy = new PermissionPolicy(config.permissions, builderCwd, { currentBranchWorkflow: !branchMode });
+                const roleBundle = loadRoleBundle("builder", { projectDir: builderCwd });
+                const adapterOpts = {
+                    cwd: builderCwd,
+                    runtimeExecutable: agentExecutable,
+                    runtimePhase: "builder",
+                    preparationTimeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
+                    rpcTimeoutMs: frozenPolicy.runtimeDeadlines?.rpc_ms,
+                    compactionTimeoutMs: frozenPolicy.runtimeDeadlines?.compaction_ms,
+                    shutdownTimeoutMs: frozenPolicy.runtimeDeadlines?.shutdown_ms,
+                    turnDeadlineMs: frozenPolicy.runtimeDeadlines?.turn_ms,
+                    model,
+                    ...(sessionRef ? { resumeSessionRef: sessionRef } : sessionId ? { resumeSessionId: sessionId } : {}),
+                    configRoot: cwd,
+                    sessionRole: "builder",
+                    sessionStream: sessionRef?.stream ?? "builder",
+                    sessionGeneration: sessionRef?.generation ?? 0,
+                    workspaceIdentity: !branchMode ? captureCurrentWorkflowSessionIdentity(builderCwd) : captureWorkspaceIdentity(builderCwd),
+                    ticketId: sessionRef?.ticketId,
+                    deliveryUnitId: sessionRef?.deliveryUnitId,
+                    networkAccess: grantedNetwork,
+                    approvalPolicy: opts.builderApprovals ? "on-request" : "never",
+                    permission: createPermissionHandler(builderPolicy, log, { durable: () => ({ projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, ticketId: activeObserver?.context().ticketId }) }),
+                    onQuestionTrace: (trace) => log.write("question-round-trip", { ...trace }),
+                    onLifecycleTrace: (trace) => log.write("provider-lifecycle", { ...trace }),
+                    effort: builderEffort,
+                    fast: builderFast,
+                    systemPromptAppend: roleBundle.system || undefined,
+                    skills: roleBundle.skills.length > 0 ? roleBundle.skills : undefined,
+                    autoCompactThresholdPercent: thresholdOverride ?? roleDefaults.builder?.auto_compact_threshold_percent ?? 65,
+                    observer: activeObserver,
+                };
+                const adapter = agent === "codex"
+                    ? new CodexAdapter(adapterOpts)
+                    : await ClaudeAdapter.create(adapterOpts);
+                if (sessionRef && adapter.agent === "codex") {
+                    const availability = await adapter.validateSession();
+                    if (availability.status !== "available") {
+                        await adapter.close().catch(() => { });
+                        throw new SessionUnavailableError({ runtime: "codex", phase: "preflight", dispatchState: "not-sent", executable: agentExecutable ?? "codex", cwd: builderCwd, diagnostics: availability.detail ?? `Codex session ${sessionRef.sessionId} is ${availability.status}`, availability });
+                    }
                 }
-            }
-            await prepareNativeAutoCompaction(adapter);
-            return !branchMode ? new CurrentWorkflowGuardAdapter(adapter, builderCwd) : adapter;
-        };
-        let activeContinuityRunId;
-        let liveStatusReporter;
-        let activeBuilderForStatus;
-        const resolvedContinuitySettings = (role) => role === "builder" ? {
-            role, source: roleDefaults.builder ? "project" : "provider", make: agent, model: model ?? "default",
-            reasoning: builderEffort ?? "default", fast: Boolean(builderFast), session_strategy: roleDefaults.builder?.session_strategy ?? "compact",
-            settings_revision: settingsRevision, display_session_cost: sessionCostOverride ?? roleDefaults.builder?.display_session_cost ?? false,
-            auto_compact_threshold_percent: thresholdOverride ?? roleDefaults.builder?.auto_compact_threshold_percent ?? 50,
-            compact_maximum: roleDefaults.builder?.compact_maximum ?? 10,
-        } : {
-            role, source: roleDefaults.qa ? "project" : "provider", make: qaAgent, model: qaModel ?? "default",
-            reasoning: qaEffort ?? "default", fast: qaFast, session_strategy: roleDefaults.qa?.session_strategy ?? "compact",
-            settings_revision: settingsRevision, display_session_cost: sessionCostOverride ?? roleDefaults.qa?.display_session_cost ?? false,
-            auto_compact_threshold_percent: roleDefaults.qa?.auto_compact_threshold_percent ?? 50,
-            compact_maximum: roleDefaults.qa?.compact_maximum ?? 10,
-        };
-        const liveRoleSettings = (role, base) => {
-            const live = readAgentDefaults(cwd);
-            const revision = live.revision ?? 0;
-            if (revision <= base.settings_revision)
-                return base;
-            const defaults = role === "builder" ? live.builder : live.qa;
-            return {
-                ...base,
-                source: defaults ? "project" : base.source,
-                make: defaults?.make ?? base.make,
-                model: defaults?.model ?? base.model,
-                reasoning: defaults?.reasoning ?? base.reasoning,
-                fast: defaults?.fast ?? base.fast,
-                session_strategy: defaults?.session_strategy ?? base.session_strategy,
-                display_session_cost: defaults?.display_session_cost ?? base.display_session_cost,
-                auto_compact_threshold_percent: defaults?.auto_compact_threshold_percent ?? base.auto_compact_threshold_percent,
-                compact_maximum: defaults?.compact_maximum ?? base.compact_maximum,
-                settings_revision: revision,
+                await prepareNativeAutoCompaction(adapter);
+                return !branchMode ? new CurrentWorkflowGuardAdapter(adapter, builderCwd) : adapter;
             };
-        };
-        const settingsForRequestedRuntime = (base, requestedRuntime) => requestedRuntime && requestedRuntime !== base.make
-            ? { ...base, make: requestedRuntime, model: "default", source: "cli" }
-            : base;
-        const handoffRecoveryOptions = (role) => ({
-            allowProviderSwitch: true,
-            desktopNotifications: config.notifications.enabled,
-            terminalBell: config.notifications.terminal_bell,
-            onAccepted: (accepted) => {
-                if (role === "builder" && accepted.successor.agent !== agent) {
-                    agent = accepted.successor.agent;
-                    model = undefined;
-                    agentExecutable = undefined;
-                }
-                if (role === "qa" && accepted.successor.agent !== qaAgent) {
-                    qaAgent = accepted.successor.agent;
-                    qaModel = undefined;
-                    qaExecutable = undefined;
-                }
-            },
-        });
-        const acceptedRuntimeSettings = (current, make, acceptedModel) => current.make === make && current.model === (acceptedModel ?? "default")
-            ? current
-            : { ...current, make, model: acceptedModel ?? "default", source: "cli" };
-        const withRunLocalAcceptedRuntimes = (run) => ({
-            ...run,
-            ...(run.builder ? { builder: { ...run.builder, settings: acceptedRuntimeSettings(run.builder.settings, agent, model) } } : {}),
-            ...(run.qa ? { qa: { ...run.qa, settings: acceptedRuntimeSettings(run.qa.settings, qaAgent, qaModel) } } : {}),
-        });
-        const qaRuntimeMetadata = new WeakMap();
-        const resolveQaRuntimeMetadata = (qaCwd, settings) => {
-            const bundle = loadRoleBundle("qa", { projectDir: qaCwd });
-            const effectiveRoleInstructions = `${bundle.system}\n\nYou are an independent QA reviewer. Do not edit source, tickets, configuration, or project documentation. You may run tests and create only harmless ignored caches or coverage output.`;
-            const skills = bundle.skills.map((name) => {
-                const runtimeRoot = settings.make === "codex" ? ".codex" : ".claude";
-                const path = [join(qaCwd, runtimeRoot, "skills", name, "SKILL.md"), join(qaCwd, ".agents", "skills", name, "SKILL.md")].find(existsSync);
-                if (path) {
-                    const content = `## ${name}\n${readFileSync(path, "utf8").trim()}`;
-                    return { name, path, content, digest: createHash("sha256").update(content).digest("hex") };
-                }
-                const bundled = loadSkill(name);
-                if (!bundled.body?.trim())
-                    throw new Error(`QA runtime ${settings.make} skill ${name} has no exact dispatchable content`);
-                const content = `## ${bundled.name}\n${bundled.body.trim()}`;
-                return { name, path: `special-agents:${name}`, content, digest: createHash("sha256").update(content).digest("hex") };
-            });
-            return { settings: structuredClone(settings), effectiveRoleInstructions, skills };
-        };
-        const createBuilderForSettings = async (builderCwd, settings) => {
-            const ready = await ensureRuntimeReadyForCommand(builderCwd, settings.make, { durable: { projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, scopeRevision: buildScopeRevision(cwd, approvalConsequences) }, timeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
-                label: "live Builder settings",
-                onTrace: trace => log.write("runtime-readiness", { ...trace, role: "builder" }),
-                yes: true,
-                allowSwitch: false,
-                model: settings.model === "default" ? undefined : settings.model,
-            });
-            const policy = new PermissionPolicy(config.permissions, builderCwd, { currentBranchWorkflow: !branchMode });
-            const roleBundle = loadRoleBundle("builder", { projectDir: builderCwd });
-            const adapterOptions = {
-                cwd: builderCwd,
-                configRoot: cwd,
-                sessionRole: "builder",
-                sessionStream: "builder",
-                workspaceIdentity: !branchMode ? captureCurrentWorkflowSessionIdentity(builderCwd) : captureWorkspaceIdentity(builderCwd),
-                runtimeExecutable: ready.executable,
-                runtimePhase: "builder",
-                preparationTimeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
-                rpcTimeoutMs: frozenPolicy.runtimeDeadlines?.rpc_ms,
-                compactionTimeoutMs: frozenPolicy.runtimeDeadlines?.compaction_ms,
-                shutdownTimeoutMs: frozenPolicy.runtimeDeadlines?.shutdown_ms,
-                turnDeadlineMs: frozenPolicy.runtimeDeadlines?.turn_ms,
-                model: settings.model === "default" ? undefined : settings.model,
-                permission: createPermissionHandler(policy, log, { durable: () => ({ projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, ticketId: activeObserver?.context().ticketId }) }),
-                onQuestionTrace: (trace) => log.write("question-round-trip", { ...trace }),
-                onLifecycleTrace: (trace) => log.write("provider-lifecycle", { ...trace }),
-                effort: explicitEffort(settings.reasoning),
-                fast: settings.fast,
-                systemPromptAppend: roleBundle.system || undefined,
-                skills: roleBundle.skills.length > 0 ? roleBundle.skills : undefined,
-                autoCompactThresholdPercent: settings.auto_compact_threshold_percent,
-                observer: activeObserver,
+            let activeContinuityRunId;
+            let liveStatusReporter;
+            let activeBuilderForStatus;
+            const resolvedContinuitySettings = (role) => role === "builder" ? {
+                role, source: roleDefaults.builder ? "project" : "provider", make: agent, model: model ?? "default",
+                reasoning: builderEffort ?? "default", fast: Boolean(builderFast), session_strategy: roleDefaults.builder?.session_strategy ?? "compact",
+                settings_revision: settingsRevision, display_session_cost: sessionCostOverride ?? roleDefaults.builder?.display_session_cost ?? false,
+                auto_compact_threshold_percent: thresholdOverride ?? roleDefaults.builder?.auto_compact_threshold_percent ?? 65,
+                compact_maximum: roleDefaults.builder?.compact_maximum ?? 10,
+            } : {
+                role, source: roleDefaults.qa ? "project" : "provider", make: qaAgent, model: qaModel ?? "default",
+                reasoning: qaEffort ?? "default", fast: qaFast, session_strategy: roleDefaults.qa?.session_strategy ?? "compact",
+                settings_revision: settingsRevision, display_session_cost: sessionCostOverride ?? roleDefaults.qa?.display_session_cost ?? false,
+                auto_compact_threshold_percent: roleDefaults.qa?.auto_compact_threshold_percent ?? 65,
+                compact_maximum: roleDefaults.qa?.compact_maximum ?? 10,
+            };
+            const liveRoleSettings = (role, base) => {
+                const live = readAgentDefaults(cwd);
+                const revision = live.revision ?? 0;
+                if (revision <= base.settings_revision)
+                    return base;
+                const defaults = role === "builder" ? live.builder : live.qa;
+                return {
+                    ...base,
+                    source: defaults ? "project" : base.source,
+                    make: defaults?.make ?? base.make,
+                    model: defaults?.model ?? base.model,
+                    reasoning: defaults?.reasoning ?? base.reasoning,
+                    fast: defaults?.fast ?? base.fast,
+                    session_strategy: defaults?.session_strategy ?? base.session_strategy,
+                    display_session_cost: defaults?.display_session_cost ?? base.display_session_cost,
+                    auto_compact_threshold_percent: defaults?.auto_compact_threshold_percent ?? base.auto_compact_threshold_percent,
+                    compact_maximum: defaults?.compact_maximum ?? base.compact_maximum,
+                    settings_revision: revision,
+                };
             };
-            const created = settings.make === "codex" ? new CodexAdapter(adapterOptions) : await ClaudeAdapter.create(adapterOptions);
-            await prepareNativeAutoCompaction(created);
-            return !branchMode ? new CurrentWorkflowGuardAdapter(created, builderCwd) : created;
-        };
-        const createQaForSettings = async (qaCwd, settings) => {
-            const ready = await ensureRuntimeReadyForCommand(qaCwd, settings.make, { durable: { projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, scopeRevision: buildScopeRevision(cwd, approvalConsequences) }, timeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
-                label: "live QA settings",
-                onTrace: trace => log.write("runtime-readiness", { ...trace, role: "qa" }),
-                yes: true,
-                allowSwitch: false,
-                model: settings.model === "default" ? undefined : settings.model,
+            const settingsForRequestedRuntime = (base, requestedRuntime) => requestedRuntime && requestedRuntime !== base.make
+                ? { ...base, make: requestedRuntime, model: "default", source: "cli" }
+                : base;
+            const handoffRecoveryOptions = (role) => ({
+                allowProviderSwitch: true,
+                desktopNotifications: config.notifications.enabled,
+                terminalBell: config.notifications.terminal_bell,
+                onAccepted: (accepted) => {
+                    if (role === "builder" && accepted.successor.agent !== agent) {
+                        agent = accepted.successor.agent;
+                        model = undefined;
+                        agentExecutable = undefined;
+                    }
+                    if (role === "qa" && accepted.successor.agent !== qaAgent) {
+                        qaAgent = accepted.successor.agent;
+                        qaModel = undefined;
+                        qaExecutable = undefined;
+                    }
+                },
             });
-            const policy = new PermissionPolicy(readOnlyPermissionConfig(), qaCwd);
-            const metadata = resolveQaRuntimeMetadata(qaCwd, settings);
-            const adapterOptions = {
-                cwd: qaCwd,
-                configRoot: cwd,
-                sessionRole: "qa",
-                sessionStream: "qa",
-                runtimeExecutable: ready.executable,
-                runtimePhase: "qa",
-                preparationTimeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
-                rpcTimeoutMs: frozenPolicy.runtimeDeadlines?.rpc_ms,
-                compactionTimeoutMs: frozenPolicy.runtimeDeadlines?.compaction_ms,
-                shutdownTimeoutMs: frozenPolicy.runtimeDeadlines?.shutdown_ms,
-                turnDeadlineMs: frozenPolicy.runtimeDeadlines?.turn_ms,
-                model: settings.model === "default" ? undefined : settings.model,
-                permission: createPermissionHandler(policy, log, { durable: () => ({ projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, ticketId: activeObserver?.context().ticketId }) }),
-                onQuestionTrace: (trace) => log.write("question-round-trip", { ...trace }),
-                onLifecycleTrace: (trace) => log.write("provider-lifecycle", { ...trace }),
-                effort: explicitEffort(settings.reasoning),
-                fast: settings.fast,
-                sandboxMode: "read-only",
-                systemPromptAppend: metadata.effectiveRoleInstructions,
-                preloadedSkillContent: metadata.skills.map(({ name, content }) => ({ name, content })),
-                autoCompactThresholdPercent: settings.auto_compact_threshold_percent,
-                allowAutoCompactionSetupTurn: false,
-                observer: activeObserver,
+            const acceptedRuntimeSettings = (current, make, acceptedModel) => current.make === make && current.model === (acceptedModel ?? "default")
+                ? current
+                : { ...current, make, model: acceptedModel ?? "default", source: "cli" };
+            const withRunLocalAcceptedRuntimes = (run) => ({
+                ...run,
+                ...(run.builder ? { builder: { ...run.builder, settings: acceptedRuntimeSettings(run.builder.settings, agent, model) } } : {}),
+                ...(run.qa ? { qa: { ...run.qa, settings: acceptedRuntimeSettings(run.qa.settings, qaAgent, qaModel) } } : {}),
+            });
+            const qaRuntimeMetadata = new WeakMap();
+            const resolveQaRuntimeMetadata = (qaCwd, settings) => {
+                const effective = resolveEffectiveQaConfiguration(cwd, settings);
+                const effectiveRoleInstructions = finalQaRoleInstructions(effective.qaRules);
+                return { settings: structuredClone(settings), effectiveRoleInstructions, skills: effective.skills.map(skill => ({ ...skill, digest: createHash("sha256").update(skill.content).digest("hex") })) };
             };
-            const created = settings.make === "codex" ? new CodexAdapter(adapterOptions) : await ClaudeAdapter.create(adapterOptions);
-            if (!created.prepareSession)
-                throw new Error(`QA runtime ${settings.make} cannot establish a durable session identity before review`);
-            await created.prepareSession();
-            await prepareNativeAutoCompaction(created);
-            qaRuntimeMetadata.set(created, metadata);
-            return created;
-        };
-        const createRecoveringBuilder = async (builderCwd, sessionId, sessionRef) => {
-            if (sessionId && !sessionRef) {
-                const availability = {
-                    version: 1,
-                    status: "unknown",
-                    checkedAt: new Date().toISOString(),
-                    reason: "legacy-unscoped",
-                    detail: "Builder recovery cannot authorize an exact provider resume from a raw session ID",
-                };
-                throw new SessionUnavailableError({
-                    runtime: agent,
-                    phase: "preflight",
-                    dispatchState: "not-sent",
-                    executable: agentExecutable ?? agent,
+            const createBuilderForSettings = async (builderCwd, settings) => {
+                const ready = await ensureBuildRuntimeReadyForCommand(builderCwd, settings.make, { build: readinessOwner, durable: { projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, scopeRevision: buildScopeRevision(cwd, approvalConsequences) }, timeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
+                    label: "live Builder settings",
+                    onTrace: trace => log.write("runtime-readiness", { ...trace, role: "builder" }),
+                    yes: true,
+                    allowSwitch: false,
+                    model: settings.model === "default" ? undefined : settings.model,
+                });
+                const policy = new PermissionPolicy(config.permissions, builderCwd, { currentBranchWorkflow: !branchMode });
+                const roleBundle = loadRoleBundle("builder", { projectDir: builderCwd });
+                const adapterOptions = {
                     cwd: builderCwd,
-                    diagnostics: availability.detail,
-                    availability,
+                    configRoot: cwd,
+                    sessionRole: "builder",
+                    sessionStream: "builder",
+                    workspaceIdentity: !branchMode ? captureCurrentWorkflowSessionIdentity(builderCwd) : captureWorkspaceIdentity(builderCwd),
+                    runtimeExecutable: ready.executable,
+                    runtimePhase: "builder",
+                    preparationTimeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
+                    rpcTimeoutMs: frozenPolicy.runtimeDeadlines?.rpc_ms,
+                    compactionTimeoutMs: frozenPolicy.runtimeDeadlines?.compaction_ms,
+                    shutdownTimeoutMs: frozenPolicy.runtimeDeadlines?.shutdown_ms,
+                    turnDeadlineMs: frozenPolicy.runtimeDeadlines?.turn_ms,
+                    model: settings.model === "default" ? undefined : settings.model,
+                    networkAccess: grantedNetwork,
+                    approvalPolicy: opts.builderApprovals ? "on-request" : "never",
+                    permission: createPermissionHandler(policy, log, { durable: () => ({ projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, ticketId: activeObserver?.context().ticketId }) }),
+                    onQuestionTrace: (trace) => log.write("question-round-trip", { ...trace }),
+                    onLifecycleTrace: (trace) => log.write("provider-lifecycle", { ...trace }),
+                    effort: explicitEffort(settings.reasoning),
+                    fast: settings.fast,
+                    systemPromptAppend: roleBundle.system || undefined,
+                    skills: roleBundle.skills.length > 0 ? roleBundle.skills : undefined,
+                    autoCompactThresholdPercent: settings.auto_compact_threshold_percent,
+                    observer: activeObserver,
+                };
+                const created = settings.make === "codex" ? new CodexAdapter(adapterOptions) : await ClaudeAdapter.create(adapterOptions);
+                await prepareNativeAutoCompaction(created);
+                return !branchMode ? new CurrentWorkflowGuardAdapter(created, builderCwd) : created;
+            };
+            const createQaForSettings = async (qaCwd, settings) => {
+                const ready = await ensureBuildRuntimeReadyForCommand(qaCwd, settings.make, { build: readinessOwner, durable: { projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, scopeRevision: buildScopeRevision(cwd, approvalConsequences) }, timeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
+                    label: "live QA settings",
+                    onTrace: trace => log.write("runtime-readiness", { ...trace, role: "qa" }),
+                    yes: true,
+                    allowSwitch: false,
+                    model: settings.model === "default" ? undefined : settings.model,
                 });
-            }
-            const initial = await createRawBuilder(builderCwd, sessionId, sessionRef);
-            return new RecoveringAdapter({
-                initial,
-                runtime: agent,
-                label: "builder turn",
-                observer: activeObserver,
-                enabled: Boolean(process.stdin.isTTY && process.stdout.isTTY),
-                allowSwitch: !(opts.resume || opts.continue),
-                recreate: async (nextRuntime, resumeSessionId, resumeRef) => {
-                    const nextReady = await ensureRuntimeReadyForCommand(builderCwd, nextRuntime, { durable: { projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, scopeRevision: buildScopeRevision(cwd, approvalConsequences) }, timeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
-                        label: "builder recovery",
-                        allowSwitch: false,
-                        model: nextRuntime === agent ? model : undefined,
+                const policy = new PermissionPolicy(readOnlyPermissionConfig(), qaCwd);
+                const metadata = resolveQaRuntimeMetadata(qaCwd, settings);
+                const adapterOptions = {
+                    cwd: qaCwd,
+                    configRoot: cwd,
+                    sessionRole: "qa",
+                    sessionStream: "qa",
+                    runtimeExecutable: ready.executable,
+                    runtimePhase: "qa",
+                    preparationTimeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
+                    rpcTimeoutMs: frozenPolicy.runtimeDeadlines?.rpc_ms,
+                    compactionTimeoutMs: frozenPolicy.runtimeDeadlines?.compaction_ms,
+                    shutdownTimeoutMs: frozenPolicy.runtimeDeadlines?.shutdown_ms,
+                    turnDeadlineMs: frozenPolicy.runtimeDeadlines?.turn_ms,
+                    model: settings.model === "default" ? undefined : settings.model,
+                    permission: createPermissionHandler(policy, log, { durable: () => ({ projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, ticketId: activeObserver?.context().ticketId }) }),
+                    onQuestionTrace: (trace) => log.write("question-round-trip", { ...trace }),
+                    onLifecycleTrace: (trace) => log.write("provider-lifecycle", { ...trace }),
+                    effort: explicitEffort(settings.reasoning),
+                    fast: settings.fast,
+                    sandboxMode: "read-only",
+                    systemPromptAppend: metadata.effectiveRoleInstructions,
+                    preloadedSkillContent: metadata.skills.map(({ name, content }) => ({ name, content })),
+                    autoCompactThresholdPercent: settings.auto_compact_threshold_percent,
+                    allowAutoCompactionSetupTurn: false,
+                    observer: activeObserver,
+                };
+                const created = settings.make === "codex" ? new CodexAdapter(adapterOptions) : await ClaudeAdapter.create(adapterOptions);
+                if (!created.prepareSession)
+                    throw new Error(`QA runtime ${settings.make} cannot establish a durable session identity before review`);
+                await created.prepareSession();
+                await prepareNativeAutoCompaction(created);
+                qaRuntimeMetadata.set(created, metadata);
+                return created;
+            };
+            const createRecoveringBuilder = async (builderCwd, sessionId, sessionRef) => {
+                if (sessionId && !sessionRef) {
+                    const availability = {
+                        version: 1,
+                        status: "unknown",
+                        checkedAt: new Date().toISOString(),
+                        reason: "legacy-unscoped",
+                        detail: "Builder recovery cannot authorize an exact provider resume from a raw session ID",
+                    };
+                    throw new SessionUnavailableError({
+                        runtime: agent,
+                        phase: "preflight",
+                        dispatchState: "not-sent",
+                        executable: agentExecutable ?? agent,
+                        cwd: builderCwd,
+                        diagnostics: availability.detail,
+                        availability,
                     });
-                    agent = nextReady.runtime;
-                    model = nextReady.model;
-                    agentExecutable = nextReady.executable;
-                    return createRawBuilder(builderCwd, resumeSessionId, resumeRef);
-                },
-            });
-        };
-        const continuousBuilder = (adapter, builderCwd, runId, settings = resolvedContinuitySettings("builder"), replaceRecoveryLeaseAfterCheckpoint = false) => new ContinuityAdapter({
-            adapter,
-            projectDir: cwd,
-            runId,
-            role: "builder",
-            settings,
-            authoritativeStateRevision: () => readAgentDefaults(cwd).revision ?? settings.settings_revision,
-            createSuccessor: () => createRecoveringBuilder(builderCwd),
-            replaceRecoveryLeaseAfterCheckpoint,
-            recoverWithHandoff: async ({ reason, reconstruction, predecessor }) => {
-                const effectiveSettings = liveRoleSettings("builder", settings);
-                const context = await predecessor.contextUsage?.().catch(() => undefined);
-                const nativeUsage = await predecessor.sessionUsage?.().catch(() => undefined);
-                const sessionId = predecessor.sessionId();
-                const recoveryDb = new WorkflowDb(cwd);
-                let compactionCount = 0;
-                try {
-                    compactionCount = recoveryDb.successfulCompactionCount(runId, "builder", predecessor.sessionRef?.() ?? sessionId);
-                }
-                finally {
-                    recoveryDb.close();
                 }
-                const transfer = await new HandoffService(cwd).transfer({
-                    runId, role: "builder", reason, predecessorSessionId: sessionId, predecessorSessionRef: predecessor.sessionRef?.(),
-                    allowNonCurrentContinuity: true,
-                    roleState: { recovery: "double-invalid-continuity", reconstruction, ...(context ? { contextSample: context } : { occupancy: "unavailable" }) },
-                    ...(nativeUsage ? { sessionUsage: {
-                            version: 1, runId, role: "builder", provider: predecessor.agent,
-                            providerSessionId: sessionId, observedAt: nativeUsage.observedAt, source: nativeUsage.source,
-                            cumulativeInputTokens: nativeUsage.inputTokens, cumulativeOutputTokens: nativeUsage.outputTokens,
-                            cumulativeTotalTokens: nativeUsage.totalTokens, authoritativeCostUsd: nativeUsage.authoritativeCostUsd,
-                        } } : {}),
-                    compactionCount, compactMaximum: effectiveSettings.compact_maximum,
-                    resources: [{ label: "continuity-reconstruction", content: reconstruction, authoritative: true }],
-                }, (_handoff, runtime) => createBuilderForSettings(builderCwd, settingsForRequestedRuntime(effectiveSettings, runtime)), handoffRecoveryOptions("builder"));
-                log.write("handoff-transfer", {
-                    role: "builder", reason, recovery: "double-invalid-continuity", generation: transfer.manifest.generation,
-                    predecessorSessionId: transfer.manifest.predecessorSessionId, successorSessionId: transfer.successorSessionId,
-                    acceptanceCheckpointDigest: transfer.acceptanceCheckpointDigest,
-                });
-                return transfer.successor;
-            },
-            handleHandoffRequest: async (output, predecessor, frozenAction) => {
-                const request = parseBuilderHandoffRequest(output);
-                if (!request)
-                    return undefined;
-                const effectiveSettings = liveRoleSettings("builder", settings);
-                const context = await predecessor.contextUsage?.().catch(() => undefined);
-                const nativeUsage = await predecessor.sessionUsage?.().catch(() => undefined);
-                const sessionId = predecessor.sessionId();
-                const countDb = new WorkflowDb(cwd);
-                let compactionCount = 0;
-                try {
-                    const revision = countDb.continuityHead(runId, "builder")?.authoritativeStateRevision ?? settings.settings_revision;
-                    countDb.appendContinuityEvent({ runId, role: "builder", kind: "builder_requested_handoff_delta", payload: request.delta, authoritativeStateRevision: revision });
-                    countDb.publishContinuityCheckpoint({ runId, role: "builder", delta: request.delta, authoritativeStateRevision: revision });
-                    compactionCount = countDb.successfulCompactionCount(runId, "builder", predecessor.sessionRef?.() ?? sessionId);
-                }
-                finally {
-                    countDb.close();
-                }
-                const transfer = await new HandoffService(cwd).transfer({
-                    runId,
-                    role: "builder",
-                    reason: request.reason,
-                    predecessorSessionId: sessionId,
-                    predecessorSessionRef: predecessor.sessionRef?.(),
-                    requestedByBuilder: true,
-                    roleState: {
-                        ...request.roleState,
-                        frozenActionDigest: createHash("sha256").update(frozenAction).digest("hex"),
-                        ...(context ? { occupancy: context } : { occupancy: "unavailable" }),
+                const initial = await createRawBuilder(builderCwd, sessionId, sessionRef);
+                return new RecoveringAdapter({
+                    initial,
+                    runtime: agent,
+                    label: "builder turn",
+                    observer: activeObserver,
+                    enabled: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+                    allowSwitch: !(opts.resume || opts.continue),
+                    recreate: async (nextRuntime, resumeSessionId, resumeRef) => {
+                        const nextReady = await ensureBuildRuntimeReadyForCommand(builderCwd, nextRuntime, { build: readinessOwner, durable: { projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, scopeRevision: buildScopeRevision(cwd, approvalConsequences) }, timeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
+                            label: "builder recovery",
+                            allowSwitch: false,
+                            model: nextRuntime === agent ? model : undefined,
+                        });
+                        agent = nextReady.runtime;
+                        model = nextReady.model;
+                        agentExecutable = nextReady.executable;
+                        return createRawBuilder(builderCwd, resumeSessionId, resumeRef);
                     },
-                    ...(nativeUsage ? { sessionUsage: {
-                            version: 1, runId, role: "builder", provider: predecessor.agent,
-                            providerSessionId: sessionId, observedAt: nativeUsage.observedAt, source: nativeUsage.source,
-                            cumulativeInputTokens: nativeUsage.inputTokens, cumulativeOutputTokens: nativeUsage.outputTokens,
-                            cumulativeTotalTokens: nativeUsage.totalTokens, authoritativeCostUsd: nativeUsage.authoritativeCostUsd,
-                        } } : {}),
-                    compactionCount,
-                    compactMaximum: effectiveSettings.compact_maximum,
-                    resources: [{ label: "frozen-action", content: frozenAction, authoritative: true }],
-                }, (_handoff, runtime) => createBuilderForSettings(builderCwd, settingsForRequestedRuntime(effectiveSettings, runtime)), handoffRecoveryOptions("builder"));
-                log.write("handoff-transfer", {
-                    requestedByBuilder: true, reason: request.reason, generation: transfer.manifest.generation,
-                    predecessorSessionId: transfer.manifest.predecessorSessionId, successorSessionId: transfer.successorSessionId,
-                    acceptanceCheckpointDigest: transfer.acceptanceCheckpointDigest,
                 });
-                return transfer.successor;
-            },
-        });
-        const createBuilder = async (builderCwd, sessionId, sessionRef) => {
-            const recoveryMode = String(opts.recoveryMode ?? "");
-            const effectiveSessionId = recoveryMode && recoveryMode !== "exact-session" ? undefined : sessionId;
-            let adapter = await createRecoveringBuilder(builderCwd, effectiveSessionId, effectiveSessionId ? sessionRef : undefined);
-            if (pendingHandoffGeneration !== undefined && pendingHandoffRole === "builder" && activeContinuityRunId === recoveryRecord?.runId) {
-                const service = new HandoffService(cwd);
-                const staged = service.loadStaged(recoveryRecord.runId, pendingHandoffGeneration);
-                const accepted = await service.acceptStagedWithRecovery(staged, adapter, (_handoff, runtime) => createBuilderForSettings(builderCwd, settingsForRequestedRuntime(resolvedContinuitySettings("builder"), runtime)), handoffRecoveryOptions("builder"));
-                adapter = accepted.successor;
-                pendingHandoffGeneration = undefined;
-                log.write("recovery-handoff-accepted", { role: "builder", generation: accepted.manifest.generation, successorSessionId: accepted.successorSessionId, acceptanceCheckpointDigest: accepted.acceptanceCheckpointDigest });
-            }
-            return activeContinuityRunId ? continuousBuilder(adapter, builderCwd, activeContinuityRunId, undefined, String(opts.recoveryMode ?? "") === "fresh-recovery-only" && recoveryRecord?.recoveryDecision?.role !== "qa") : adapter;
-        };
-        const applyBuilderSettingsBoundary = async (runId, builderCwd, input) => {
-            const context = await input.adapter.contextUsage?.().catch(() => undefined);
-            const nativeUsage = await input.adapter.sessionUsage?.().catch(() => undefined);
-            const sessionId = input.adapter.sessionId();
-            const countDb = new WorkflowDb(cwd);
-            let compactionCount = 0;
-            try {
-                compactionCount = countDb.successfulCompactionCount(runId, "builder", input.adapter.sessionRef?.() ?? sessionId);
-            }
-            finally {
-                countDb.close();
-            }
-            const reason = `live settings revision ${input.next.settings_revision} changed Builder provider controls from ${input.current.make}/${input.current.model} to ${input.next.make}/${input.next.model}`;
-            const transfer = await new HandoffService(cwd).transfer({
-                runId, role: "builder", reason, predecessorSessionId: sessionId, predecessorSessionRef: input.adapter.sessionRef?.(),
-                roleState: {
-                    settingsFrom: input.current, settingsTo: input.next,
-                    frozenActionDigest: createHash("sha256").update(input.frozenAction).digest("hex"),
-                    ...(context ? { contextSample: context } : { occupancy: "unavailable" }),
-                },
-                ...(nativeUsage ? { sessionUsage: {
-                        version: 1, runId, role: "builder", provider: input.adapter.agent,
-                        providerSessionId: sessionId, observedAt: nativeUsage.observedAt, source: nativeUsage.source,
-                        cumulativeInputTokens: nativeUsage.inputTokens, cumulativeOutputTokens: nativeUsage.outputTokens,
-                        cumulativeTotalTokens: nativeUsage.totalTokens, authoritativeCostUsd: nativeUsage.authoritativeCostUsd,
-                    } } : {}),
-                compactionCount, compactMaximum: input.next.compact_maximum,
-                resources: [{ label: "frozen-action", content: input.frozenAction, authoritative: true }],
-            }, (_handoff, runtime) => createBuilderForSettings(builderCwd, settingsForRequestedRuntime(input.next, runtime)), handoffRecoveryOptions("builder"));
-            log.write("handoff-transfer", {
-                role: "builder", reason, settingsRevision: input.next.settings_revision, generation: transfer.manifest.generation,
-                predecessorSessionId: transfer.manifest.predecessorSessionId, successorSessionId: transfer.successorSessionId,
-                acceptanceCheckpointDigest: transfer.acceptanceCheckpointDigest,
-            });
-            if (input.adapter instanceof ContinuityAdapter) {
-                await input.adapter.adoptValidatedSuccessor(transfer.successor);
-                return input.adapter;
-            }
-            await input.adapter.close().catch(() => { });
-            return continuousBuilder(transfer.successor, builderCwd, runId, input.next);
-        };
-        const createRawQa = async (qaCwd, sessionRef) => {
-            // Isolated QA conversations are intentionally disposable. Resolve live
-            // QA settings for each one so a threshold-only update applies to the
-            // very next review instead of waiting for a nonexistent session reuse.
-            const qaSettings = liveRoleSettings("qa", resolvedContinuitySettings("qa"));
-            const ready = await ensureRuntimeReadyForCommand(qaCwd, qaSettings.make, { durable: { projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, scopeRevision: buildScopeRevision(cwd, approvalConsequences) }, timeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
-                label: "live QA settings",
-                onTrace: trace => log.write("runtime-readiness", { ...trace, role: "qa" }),
-                yes: true,
-                allowSwitch: false,
-                model: qaSettings.model === "default" ? undefined : qaSettings.model,
-            });
-            const qaPolicy = new PermissionPolicy(readOnlyPermissionConfig(), qaCwd);
-            const metadata = resolveQaRuntimeMetadata(qaCwd, qaSettings);
-            const adapterOpts = {
-                cwd: qaCwd,
-                configRoot: cwd,
-                sessionRole: "qa",
-                sessionStream: "qa",
-                runtimeExecutable: ready.executable,
-                runtimePhase: "qa",
-                preparationTimeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
-                rpcTimeoutMs: frozenPolicy.runtimeDeadlines?.rpc_ms,
-                compactionTimeoutMs: frozenPolicy.runtimeDeadlines?.compaction_ms,
-                shutdownTimeoutMs: frozenPolicy.runtimeDeadlines?.shutdown_ms,
-                turnDeadlineMs: frozenPolicy.runtimeDeadlines?.turn_ms,
-                model: qaSettings.model === "default" ? undefined : qaSettings.model,
-                ...(sessionRef ? { resumeSessionRef: sessionRef } : {}),
-                sessionGeneration: sessionRef?.generation ?? 0,
-                workspaceIdentity: captureWorkspaceIdentity(qaCwd),
-                permission: createPermissionHandler(qaPolicy, log, { durable: () => ({ projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, ticketId: activeObserver?.context().ticketId }) }),
-                onQuestionTrace: (trace) => log.write("question-round-trip", { ...trace }),
-                onLifecycleTrace: (trace) => log.write("provider-lifecycle", { ...trace }),
-                effort: explicitEffort(qaSettings.reasoning),
-                fast: qaSettings.fast,
-                sandboxMode: "read-only",
-                systemPromptAppend: metadata.effectiveRoleInstructions,
-                preloadedSkillContent: metadata.skills.map(({ name, content }) => ({ name, content })),
-                autoCompactThresholdPercent: qaSettings.auto_compact_threshold_percent,
-                allowAutoCompactionSetupTurn: false,
-                observer: activeObserver,
             };
-            const created = qaSettings.make === "codex"
-                ? new CodexAdapter(adapterOpts)
-                : await ClaudeAdapter.create(adapterOpts);
-            if (!created.prepareSession)
-                throw new Error(`QA runtime ${qaSettings.make} cannot establish a durable session identity before review`);
-            await created.prepareSession();
-            await prepareNativeAutoCompaction(created);
-            qaRuntimeMetadata.set(created, metadata);
-            return created;
-        };
-        const createRecoveringQa = async (qaCwd, sessionRef) => {
-            const initial = await createRawQa(qaCwd, sessionRef);
-            const recovering = new RecoveringAdapter({
-                initial,
-                runtime: qaAgent,
-                label: "QA turn",
-                observer: activeObserver,
-                // QA retries and provider switches must cross the explicit durable
-                // QA recovery boundary; an adapter-local replay would reuse one turn
-                // intent for two different provider executions.
-                enabled: false,
-                allowSwitch: false,
-                recreate: async (nextRuntime, resumeSessionId, resumeRef) => {
-                    const nextReady = await ensureRuntimeReadyForCommand(qaCwd, nextRuntime, { durable: { projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, scopeRevision: buildScopeRevision(cwd, approvalConsequences) }, timeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
-                        label: "QA recovery",
-                        allowSwitch: false,
-                        model: nextRuntime === qaAgent ? qaModel : undefined,
-                    });
-                    qaAgent = nextReady.runtime;
-                    qaModel = nextReady.model;
-                    qaExecutable = nextReady.executable;
-                    if (resumeSessionId && !resumeRef) {
-                        const availability = {
-                            version: 1,
-                            status: "unknown",
-                            checkedAt: new Date().toISOString(),
-                            reason: "legacy-unscoped",
-                            detail: "QA retry cannot authorize an exact provider resume from a raw session ID",
-                        };
-                        throw new SessionUnavailableError({
-                            runtime: nextRuntime,
-                            phase: "preflight",
-                            dispatchState: "not-sent",
-                            executable: nextReady.executable,
-                            cwd: qaCwd,
-                            diagnostics: availability.detail,
-                            availability,
-                        });
-                    }
-                    return createRawQa(qaCwd, resumeRef);
-                },
-            });
-            const metadata = qaRuntimeMetadata.get(initial);
-            if (metadata)
-                qaRuntimeMetadata.set(recovering, metadata);
-            return recovering;
-        };
-        const decorateQa = (adapter, qaCwd, sessionId) => {
-            const metadata = qaRuntimeMetadata.get(adapter);
-            const qaSettings = frozenQaRuntimeSettings(adapter, metadata);
-            const continuous = activeContinuityRunId ? new ContinuityAdapter({
-                adapter, projectDir: cwd, runId: activeContinuityRunId, role: "qa", settings: qaSettings,
-                durableSingleTurn: true,
-                authoritativeStateRevision: () => readAgentDefaults(cwd).revision ?? settingsRevision,
-                createSuccessor: () => createRecoveringQa(qaCwd),
-                replaceRecoveryLeaseAfterCheckpoint: String(opts.recoveryMode ?? "") === "fresh-recovery-only" && recoveryRecord?.recoveryDecision?.role === "qa",
+            const continuousBuilder = (adapter, builderCwd, runId, settings = resolvedContinuitySettings("builder"), replaceRecoveryLeaseAfterCheckpoint = false) => new ContinuityAdapter({
+                adapter,
+                projectDir: cwd,
+                runId,
+                role: "builder",
+                settings,
+                authoritativeStateRevision: () => readAgentDefaults(cwd).revision ?? settings.settings_revision,
+                createSuccessor: () => createRecoveringBuilder(builderCwd),
+                replaceRecoveryLeaseAfterCheckpoint,
                 recoverWithHandoff: async ({ reason, reconstruction, predecessor }) => {
-                    const effectiveSettings = liveRoleSettings("qa", qaSettings);
+                    const effectiveSettings = liveRoleSettings("builder", settings);
                     const context = await predecessor.contextUsage?.().catch(() => undefined);
                     const nativeUsage = await predecessor.sessionUsage?.().catch(() => undefined);
-                    const predecessorSessionId = predecessor.sessionId();
+                    const sessionId = predecessor.sessionId();
                     const recoveryDb = new WorkflowDb(cwd);
                     let compactionCount = 0;
                     try {
-                        compactionCount = recoveryDb.successfulCompactionCount(activeContinuityRunId, "qa", predecessor.sessionRef?.() ?? predecessorSessionId);
+                        compactionCount = recoveryDb.successfulCompactionCount(runId, "builder", predecessor.sessionRef?.() ?? sessionId);
                     }
                     finally {
                         recoveryDb.close();
                     }
                     const transfer = await new HandoffService(cwd).transfer({
-                        runId: activeContinuityRunId, role: "qa", reason, predecessorSessionId, predecessorSessionRef: predecessor.sessionRef?.(),
+                        runId, role: "builder", reason, predecessorSessionId: sessionId, predecessorSessionRef: predecessor.sessionRef?.(),
                         allowNonCurrentContinuity: true,
                         roleState: { recovery: "double-invalid-continuity", reconstruction, ...(context ? { contextSample: context } : { occupancy: "unavailable" }) },
                         ...(nativeUsage ? { sessionUsage: {
-                                version: 1, runId: activeContinuityRunId, role: "qa", provider: predecessor.agent,
-                                providerSessionId: predecessorSessionId, observedAt: nativeUsage.observedAt, source: nativeUsage.source,
+                                version: 1, runId, role: "builder", provider: predecessor.agent,
+                                providerSessionId: sessionId, observedAt: nativeUsage.observedAt, source: nativeUsage.source,
                                 cumulativeInputTokens: nativeUsage.inputTokens, cumulativeOutputTokens: nativeUsage.outputTokens,
                                 cumulativeTotalTokens: nativeUsage.totalTokens, authoritativeCostUsd: nativeUsage.authoritativeCostUsd,
                             } } : {}),
                         compactionCount, compactMaximum: effectiveSettings.compact_maximum,
                         resources: [{ label: "continuity-reconstruction", content: reconstruction, authoritative: true }],
-                    }, (_handoff, runtime) => createQaForSettings(qaCwd, settingsForRequestedRuntime(effectiveSettings, runtime)), handoffRecoveryOptions("qa"));
+                    }, (_handoff, runtime) => createBuilderForSettings(builderCwd, settingsForRequestedRuntime(effectiveSettings, runtime)), handoffRecoveryOptions("builder"));
                     log.write("handoff-transfer", {
-                        role: "qa", reason, recovery: "double-invalid-continuity", generation: transfer.manifest.generation,
+                        role: "builder", reason, recovery: "double-invalid-continuity", generation: transfer.manifest.generation,
                         predecessorSessionId: transfer.manifest.predecessorSessionId, successorSessionId: transfer.successorSessionId,
                         acceptanceCheckpointDigest: transfer.acceptanceCheckpointDigest,
                     });
                     return transfer.successor;
                 },
-            }) : adapter;
-            const decorated = new RoleStatusAdapter(continuous, (active) => liveStatusReporter?.updateState({
-                role: "qa", provider: active.agent, model: qaSettings.model, reasoning: qaSettings.reasoning, fast: qaSettings.fast,
-                phase: "QA review session", sessionTransition: sessionId ? "resumed QA session" : "QA session", adapter: active,
-                settingsRevision: qaSettings.settings_revision, displaySessionCost: qaSettings.display_session_cost,
-                compactionCount: () => { const db = new WorkflowDb(cwd); try {
-                    return activeContinuityRunId ? db.successfulCompactionCount(activeContinuityRunId, "qa", active.sessionRef?.() ?? active.sessionId()) : 0;
-                }
-                finally {
-                    db.close();
-                } },
-                handoffGeneration: () => { const db = new WorkflowDb(cwd); try {
-                    return activeContinuityRunId ? db.handoffs(activeContinuityRunId).at(-1)?.generation ?? 0 : 0;
-                }
-                finally {
-                    db.close();
-                } },
-            }), () => {
-                const active = activeBuilderForStatus?.();
-                if (active)
-                    liveStatusReporter?.updateState({
-                        role: "builder", provider: active.agent, model: model ?? "default", reasoning: builderEffort ?? "default", fast: Boolean(builderFast),
-                        phase: "builder work session", sessionTransition: "builder session", adapter: active,
-                        settingsRevision, displaySessionCost: sessionCostOverride ?? roleDefaults.builder?.display_session_cost ?? false,
-                        compactionCount: () => { const db = new WorkflowDb(cwd); try {
-                            return activeContinuityRunId ? db.successfulCompactionCount(activeContinuityRunId, "builder", active.sessionRef?.() ?? active.sessionId()) : 0;
-                        }
-                        finally {
-                            db.close();
-                        } },
-                        handoffGeneration: () => { const db = new WorkflowDb(cwd); try {
-                            return activeContinuityRunId ? db.handoffs(activeContinuityRunId).at(-1)?.generation ?? 0 : 0;
-                        }
-                        finally {
-                            db.close();
-                        } },
-                    });
-            });
-            qaRuntimeMetadata.set(continuous, metadata);
-            qaRuntimeMetadata.set(decorated, metadata);
-            return decorated;
-        };
-        const describeQaHandle = (adapter, _qaCwd, handoffReceipt) => describeQaRuntimeHandle(adapter, qaRuntimeMetadata.get(adapter), handoffReceipt);
-        const qaV2SessionRef = (ref) => {
-            if (ref.role !== "qa" || ref.stream !== "qa" || !ref.sessionId || !ref.cwd || !ref.configRoot
-                || /^(?:unavailable|unknown)$/i.test(ref.sessionId.trim()))
-                throw new Error("QA handoff receipt has an invalid scoped session identity");
-            return {
-                version: 2, provider: ref.provider, sessionId: ref.sessionId, role: "qa", stream: "qa",
-                generation: ref.generation, cwd: ref.cwd, configRoot: ref.configRoot,
-                createdAt: ref.createdAt, validatedAt: ref.validatedAt ?? new Date().toISOString(),
-            };
-        };
-        const qaV2HandoffReceipt = (receipt, recovery, confinementDigest) => {
-            if (!receipt.predecessorSessionRef)
-                throw new Error("QA recovery handoff has no scoped predecessor identity");
-            const receiptDb = new WorkflowDb(cwd);
-            try {
-                const head = receiptDb.qaTicketHead(recovery.runId, recovery.ticketId);
-                if (!head.reviewBasisDigest || !head.sourceStateDigest)
-                    throw new Error("QA recovery handoff has no durable predecessor review basis/source state");
-                const resources = receipt.resources.map((resource) => {
-                    if (!resource.path || !resource.purpose || resource.bytes === undefined || !resource.mediaType)
-                        throw new Error(`QA recovery handoff resource ${resource.label} lacks complete inventory metadata`);
-                    return { label: resource.label, digest: resource.digest, authoritative: resource.authoritative,
-                        requiredForRecovery: resource.requiredForRecovery ?? false, mediaType: resource.mediaType,
-                        path: resource.path, purpose: resource.purpose, bytes: resource.bytes };
-                });
-                const base = {
-                    version: 2, runId: recovery.runId, ticketId: recovery.ticketId, qaRevision: head.revision,
-                    sourceStateDigest: recovery.reviewedStateDigest, predecessorSourceStateDigest: head.sourceStateDigest,
-                    reviewBasisDigest: head.reviewBasisDigest, requiresFullReview: true, confinementDigest,
-                    predecessor: qaV2SessionRef(receipt.predecessorSessionRef), successor: qaV2SessionRef(receipt.successorSessionRef),
-                    manifestDigest: receipt.manifestDigest, continuityCheckpointDigest: receipt.continuityCheckpointDigest,
-                    acceptanceCheckpointDigest: receipt.acceptanceCheckpointDigest, packetDigest: recovery.packetDigest,
-                    inventoryDigest: qaDigest("handoff-inventory", resources), resources, acceptedAt: receipt.acceptedAt,
-                };
-                const completed = { ...base, operationId: qaDigest("qa-handoff-operation", base) };
-                receiptDb.recordQaHandoffReceipt(completed);
-                return completed;
-            }
-            finally {
-                receiptDb.close();
-            }
-        };
-        const createQa = async (qaCwd, sessionId) => {
-            const recoveryMode = String(opts.recoveryMode ?? "");
-            // A disposable QA cwd is never eligible for exact reuse, even when a
-            // compatibility caller still supplies the previous raw ID.
-            const effectiveSessionId = undefined;
-            void sessionId;
-            let adapter = await createRecoveringQa(qaCwd, effectiveSessionId);
-            let explicitRecoveryAccepted = false;
-            let handoffReceipt = { kind: "initial" };
-            if (pendingHandoffGeneration !== undefined && pendingHandoffRole === "qa" && activeContinuityRunId === recoveryRecord?.runId) {
-                const service = new HandoffService(cwd);
-                const staged = service.loadStaged(recoveryRecord.runId, pendingHandoffGeneration);
-                const accepted = await service.acceptStagedWithRecovery(staged, adapter, (_handoff, runtime) => createQaForSettings(qaCwd, settingsForRequestedRuntime(resolvedContinuitySettings("qa"), runtime)), handoffRecoveryOptions("qa"));
-                if (!accepted.acceptanceReceipt)
-                    throw new Error("QA recovery handoff did not produce a scoped acceptance receipt");
-                adapter = accepted.successor;
-                pendingHandoffGeneration = undefined;
-                explicitRecoveryAccepted = true;
-                const packet = pendingQaRecoveryPacket(cwd, recoveryRecord.runId, typeof opts.ticket === "string" ? opts.ticket : undefined);
-                if (!packet)
-                    throw new Error("accepted QA recovery handoff has no current durable packet");
-                const confinement = describeQaHandle(adapter, qaCwd, { kind: "initial" }).confinement;
-                handoffReceipt = { kind: "accepted", receipt: qaV2HandoffReceipt(accepted.acceptanceReceipt, {
-                        runId: packet.manifest.runId, ticketId: packet.manifest.ticketId, packetDigest: packet.manifest.packetDigest,
-                        reviewedStateDigest: packet.manifest.reviewedStateDigest,
-                    }, confinement.digest) };
-                log.write("recovery-handoff-accepted", { role: "qa", generation: accepted.manifest.generation, successorSessionId: accepted.successorSessionId, acceptanceCheckpointDigest: accepted.acceptanceCheckpointDigest });
-            }
-            // A new disposable QA worktree always means a new provider session.
-            // Transfer cumulative QA state by accepting a durable handoff in that
-            // fresh session; never attach the old session in the new /tmp cwd.
-            if (!explicitRecoveryAccepted && activeContinuityRunId && recoveryMode !== "fresh-recovery-only") {
-                const stateDb = new WorkflowDb(cwd);
-                const priorLease = stateDb.roleMutationLease(activeContinuityRunId, "qa");
-                const head = stateDb.continuityHead(activeContinuityRunId, "qa");
-                const checkpoint = stateDb.latestContinuityCheckpoint(activeContinuityRunId, "qa");
-                const compactionCount = priorLease
-                    ? stateDb.successfulCompactionCount(activeContinuityRunId, "qa", priorLease.sessionRef ?? priorLease.providerSessionId)
-                    : 0;
-                stateDb.close();
-                if (priorLease) {
-                    if (!head || head.state !== "current" || !checkpoint) {
-                        await adapter.close().catch(() => { });
-                        throw new ContinuityRecoveryRequiredError(activeContinuityRunId, "qa", `cannot transfer cumulative QA state from a ${head?.state ?? "missing"} checkpoint`);
-                    }
-                    const service = new HandoffService(cwd);
-                    const staged = service.stage({
-                        runId: activeContinuityRunId,
-                        role: "qa",
-                        reason: "new disposable QA snapshot requires a fresh location-scoped provider session",
-                        predecessorSessionId: priorLease.providerSessionId,
-                        predecessorSessionRef: priorLease.sessionRef,
-                        roleState: { predecessorGeneration: priorLease.generation, successorSnapshotCwd: qaCwd },
-                        compactionCount,
-                        compactMaximum: resolvedContinuitySettings("qa").compact_maximum,
-                    });
-                    const accepted = await service.acceptStagedWithRecovery(staged, adapter, (_handoff, runtime) => createQaForSettings(qaCwd, settingsForRequestedRuntime(resolvedContinuitySettings("qa"), runtime)), handoffRecoveryOptions("qa"));
-                    if (!accepted.acceptanceReceipt)
-                        throw new Error("QA snapshot handoff did not produce a scoped acceptance receipt");
-                    adapter = accepted.successor;
-                    // This continuity transfer precedes construction of a ticket/source
-                    // review basis, so it is not a QA-report recovery receipt.
-                    handoffReceipt = { kind: "initial" };
-                    log.write("handoff-transfer", {
-                        role: "qa", reason: staged.manifest.reason, generation: accepted.manifest.generation,
-                        predecessorSessionId: staged.manifest.predecessorSessionId, successorSessionId: accepted.successorSessionId,
-                        acceptanceCheckpointDigest: accepted.acceptanceCheckpointDigest,
-                    });
-                }
-            }
-            const decorated = decorateQa(adapter, qaCwd, effectiveSessionId);
-            return describeQaHandle(decorated, qaCwd, handoffReceipt);
-        };
-        const applyQaSettingsBoundary = async (runId, qaCwd, input) => {
-            const context = await input.adapter.contextUsage?.().catch(() => undefined);
-            const nativeUsage = await input.adapter.sessionUsage?.().catch(() => undefined);
-            const sessionId = input.adapter.sessionId();
-            const countDb = new WorkflowDb(cwd);
-            let compactionCount = 0;
-            try {
-                compactionCount = countDb.successfulCompactionCount(runId, "qa", input.adapter.sessionRef?.() ?? sessionId);
-            }
-            finally {
-                countDb.close();
-            }
-            const reason = `live settings revision ${input.next.settings_revision} changed QA provider controls from ${input.current.make}/${input.current.model} to ${input.next.make}/${input.next.model}`;
-            const transfer = await new HandoffService(cwd).transfer({
-                runId, role: "qa", reason, predecessorSessionId: sessionId, predecessorSessionRef: input.adapter.sessionRef?.(),
-                roleState: {
-                    settingsFrom: input.current, settingsTo: input.next,
-                    frozenActionDigest: createHash("sha256").update(input.frozenAction).digest("hex"),
-                    ...(context ? { contextSample: context } : { occupancy: "unavailable" }),
-                },
-                ...(nativeUsage ? { sessionUsage: {
-                        version: 1, runId, role: "qa", provider: input.adapter.agent,
-                        providerSessionId: sessionId, observedAt: nativeUsage.observedAt, source: nativeUsage.source,
-                        cumulativeInputTokens: nativeUsage.inputTokens, cumulativeOutputTokens: nativeUsage.outputTokens,
-                        cumulativeTotalTokens: nativeUsage.totalTokens, authoritativeCostUsd: nativeUsage.authoritativeCostUsd,
-                    } } : {}),
-                compactionCount, compactMaximum: input.next.compact_maximum,
-                resources: [{ label: "frozen-qa-action", content: input.frozenAction, authoritative: true }],
-            }, (_handoff, runtime) => createQaForSettings(qaCwd, settingsForRequestedRuntime(input.next, runtime)), handoffRecoveryOptions("qa"));
-            log.write("handoff-transfer", {
-                role: "qa", reason, settingsRevision: input.next.settings_revision, generation: transfer.manifest.generation,
-                predecessorSessionId: transfer.manifest.predecessorSessionId, successorSessionId: transfer.successorSessionId,
-                acceptanceCheckpointDigest: transfer.acceptanceCheckpointDigest,
-            });
-            await input.adapter.close().catch(() => { });
-            return decorateQa(transfer.successor, qaCwd);
-        };
-        const qaSessionBoundary = async (handle, frozenAction, strategy, qaCwd, recovery) => {
-            const adapter = handle.adapter;
-            if (!activeContinuityRunId)
-                throw new Error("QA session boundary requires an active durable run");
-            const qaSettings = frozenQaRuntimeSettings(adapter, qaRuntimeMetadata.get(adapter));
-            let acceptedBoundary;
-            const controller = RoleSessionController.managed({
-                projectDir: cwd,
-                runId: activeContinuityRunId,
-                role: "qa",
-                initialSettings: qaSettings,
-                historicalCountUncertain: recoveryCompactionHistoryUncertain(cwd, recoveryRecord, activeContinuityRunId, "qa"),
-                readSettings: () => liveRoleSettings("qa", qaSettings),
-                settingsBoundary: (input) => applyQaSettingsBoundary(activeContinuityRunId, qaCwd, input),
-                settingsAdopted: (_settings, active) => {
-                    const actual = frozenQaRuntimeSettings(active, qaRuntimeMetadata.get(active));
-                    liveStatusReporter?.updateState({
-                        role: "qa", provider: active.agent, model: actual.model, reasoning: actual.reasoning, fast: actual.fast,
-                        adapter: active, settingsRevision: actual.settings_revision, displaySessionCost: actual.display_session_cost,
-                        sessionTransition: "adopted live settings",
-                    });
-                },
-                report: (event) => {
-                    currentActivity()?.update(event.kind, event.detail, { provider: qaSettings.make, model: qaSettings.model });
-                },
-                handoff: async ({ reason, adapter: predecessor, sample, settings, compactionCount }) => {
+                handleHandoffRequest: async (output, predecessor, frozenAction) => {
+                    const request = parseBuilderHandoffRequest(output);
+                    if (!request)
+                        return undefined;
+                    const effectiveSettings = liveRoleSettings("builder", settings);
+                    const context = await predecessor.contextUsage?.().catch(() => undefined);
                     const nativeUsage = await predecessor.sessionUsage?.().catch(() => undefined);
+                    const sessionId = predecessor.sessionId();
+                    const countDb = new WorkflowDb(cwd);
+                    let compactionCount = 0;
+                    try {
+                        const revision = countDb.continuityHead(runId, "builder")?.authoritativeStateRevision ?? settings.settings_revision;
+                        countDb.appendContinuityEvent({ runId, role: "builder", kind: "builder_requested_handoff_delta", payload: request.delta, authoritativeStateRevision: revision });
+                        countDb.publishContinuityCheckpoint({ runId, role: "builder", delta: request.delta, authoritativeStateRevision: revision });
+                        compactionCount = countDb.successfulCompactionCount(runId, "builder", predecessor.sessionRef?.() ?? sessionId);
+                    }
+                    finally {
+                        countDb.close();
+                    }
                     const transfer = await new HandoffService(cwd).transfer({
-                        runId: activeContinuityRunId, role: "qa", reason, predecessorSessionId: predecessor.sessionId(), predecessorSessionRef: predecessor.sessionRef?.(),
-                        roleState: { frozenActionDigest: createHash("sha256").update(frozenAction).digest("hex"), contextSample: sample,
-                            ...(recovery ? { recoveryPacketDigest: recovery.packetDigest, reviewedStateDigest: recovery.reviewedStateDigest } : {}) },
+                        runId,
+                        role: "builder",
+                        reason: request.reason,
+                        predecessorSessionId: sessionId,
+                        predecessorSessionRef: predecessor.sessionRef?.(),
+                        requestedByBuilder: true,
+                        roleState: {
+                            ...request.roleState,
+                            frozenActionDigest: createHash("sha256").update(frozenAction).digest("hex"),
+                            ...(context ? { occupancy: context } : { occupancy: "unavailable" }),
+                        },
                         ...(nativeUsage ? { sessionUsage: {
-                                version: 1, runId: activeContinuityRunId, role: "qa", provider: predecessor.agent,
-                                providerSessionId: predecessor.sessionId(), observedAt: nativeUsage.observedAt, source: nativeUsage.source,
+                                version: 1, runId, role: "builder", provider: predecessor.agent,
+                                providerSessionId: sessionId, observedAt: nativeUsage.observedAt, source: nativeUsage.source,
                                 cumulativeInputTokens: nativeUsage.inputTokens, cumulativeOutputTokens: nativeUsage.outputTokens,
                                 cumulativeTotalTokens: nativeUsage.totalTokens, authoritativeCostUsd: nativeUsage.authoritativeCostUsd,
                             } } : {}),
-                        compactionCount, compactMaximum: settings.compact_maximum ?? 10,
-                        resources: [{ label: "frozen-qa-action", content: frozenAction, authoritative: true, purpose: "Frozen QA action across the session boundary" }, ...(recovery ? recovery.resources.map((resource) => ({
-                                label: resource.label, digest: resource.digest, authoritative: true, requiredForRecovery: resource.requiredForRecovery,
-                                mediaType: resource.mediaType, path: resource.path, purpose: resource.purpose, bytes: resource.bytes,
-                            })) : [])],
-                    }, (_handoff, runtime) => createQaForSettings(qaCwd, settingsForRequestedRuntime(settings, runtime)), handoffRecoveryOptions("qa"));
-                    if (!transfer.acceptanceReceipt || !recovery)
-                        throw new Error("QA recovery boundary did not produce a complete receipt context");
-                    const successor = decorateQa(transfer.successor, qaCwd);
-                    acceptedBoundary = acceptQaRuntimeHandoff(describeQaHandle(successor, qaCwd, { kind: "initial" }), (confinementDigest) => qaV2HandoffReceipt(transfer.acceptanceReceipt, recovery, confinementDigest));
-                    log.write("handoff-transfer", { role: "qa", generation: transfer.manifest.generation, predecessorSessionId: transfer.manifest.predecessorSessionId, successorSessionId: transfer.successorSessionId, acceptanceCheckpointDigest: transfer.acceptanceCheckpointDigest });
-                    await predecessor.close().catch(() => { });
-                    return successor;
+                        compactionCount,
+                        compactMaximum: effectiveSettings.compact_maximum,
+                        resources: [{ label: "frozen-action", content: frozenAction, authoritative: true }],
+                    }, (_handoff, runtime) => createBuilderForSettings(builderCwd, settingsForRequestedRuntime(effectiveSettings, runtime)), handoffRecoveryOptions("builder"));
+                    log.write("handoff-transfer", {
+                        requestedByBuilder: true, reason: request.reason, generation: transfer.manifest.generation,
+                        predecessorSessionId: transfer.manifest.predecessorSessionId, successorSessionId: transfer.successorSessionId,
+                        acceptanceCheckpointDigest: transfer.acceptanceCheckpointDigest,
+                    });
+                    return transfer.successor;
                 },
             });
-            const next = (await controller.atWorkSessionBoundary(adapter, frozenAction, strategy)).adapter;
-            if (!acceptedBoundary || acceptedBoundary.handle.adapter !== next)
-                throw new Error("QA recovery boundary did not produce a validated acceptance receipt for its active successor");
-            return acceptedBoundary;
-        };
-        const observeQaNativeCompactions = async (adapter) => {
-            if (!activeContinuityRunId)
-                return;
-            const qaSettings = frozenQaRuntimeSettings(adapter, qaRuntimeMetadata.get(adapter));
-            const controller = new ThresholdCompactionController({
-                projectDir: cwd,
-                runId: activeContinuityRunId,
-                role: "qa",
-                initialSettings: qaSettings,
-                historicalCountUncertain: recoveryCompactionHistoryUncertain(cwd, recoveryRecord, activeContinuityRunId, "qa"),
-            });
-            await controller.observeNativeCompactions(adapter);
-        };
-        const qaNonconvergence = createQaNonconvergenceHandler(cwd, !process.stdin.isTTY || !process.stdout.isTTY, roleDefaults.planner, () => activeObserver, () => activeContinuityRunId ?? invocationRunId);
-        const qaReportRecovery = createQaReportRecoveryHandler(cwd, !process.stdin.isTTY || !process.stdout.isTTY, () => activeObserver);
-        if (branchMode) {
-            const ticketsConfig = loadTicketsConfig(cwd);
-            const allowedBaseDirtyPaths = generatedTrackerDirtyPaths(ticketsConfig.paths);
-            const baseWorktreePolicy = recoveryRecord ? "skip" : "enforce";
-            if (baseWorktreePolicy === "skip") {
-                const projection = recoveryRecord ? projectBuildRecovery(cwd, recoveryRecord) : undefined;
-                if (projection?.expectedChanges.length) {
-                    console.log(`foreman: preserved expected in-progress work: ${projection.expectedChanges.join(", ")}`);
-                }
-                if (projection?.unexpectedChanges.length) {
-                    console.warn("foreman: warning: unexpected changes may conflict with recovery; recovery is still allowed:");
-                    for (const item of projection.unexpectedChanges)
-                        console.warn(`  ${item.path}: ${item.risk}`);
-                    console.warn("foreman: recommended action: preserve or move overlapping changes before continuing");
+            const createBuilder = async (builderCwd, sessionId, sessionRef) => {
+                const recoveryMode = String(opts.recoveryMode ?? "");
+                const effectiveSessionId = recoveryMode && recoveryMode !== "exact-session" ? undefined : sessionId;
+                let adapter = await createRecoveringBuilder(builderCwd, effectiveSessionId, effectiveSessionId ? sessionRef : undefined);
+                if (pendingHandoffGeneration !== undefined && pendingHandoffRole === "builder" && activeContinuityRunId === recoveryRecord?.runId) {
+                    const service = new HandoffService(cwd);
+                    const staged = service.loadStaged(recoveryRecord.runId, pendingHandoffGeneration);
+                    const accepted = await service.acceptStagedWithRecovery(staged, adapter, (_handoff, runtime) => createBuilderForSettings(builderCwd, settingsForRequestedRuntime(resolvedContinuitySettings("builder"), runtime)), handoffRecoveryOptions("builder"));
+                    adapter = accepted.successor;
+                    pendingHandoffGeneration = undefined;
+                    log.write("recovery-handoff-accepted", { role: "builder", generation: accepted.manifest.generation, successorSessionId: accepted.successorSessionId, acceptanceCheckpointDigest: accepted.acceptanceCheckpointDigest });
                 }
-            }
-            else {
+                const continuous = activeContinuityRunId ? continuousBuilder(adapter, builderCwd, activeContinuityRunId, undefined, String(opts.recoveryMode ?? "") === "fresh-recovery-only" && recoveryRecord?.recoveryDecision?.role !== "qa") : adapter;
+                if (continuous instanceof ContinuityAdapter)
+                    await continuous.validateFreshRecovery();
+                return continuous;
+            };
+            const applyBuilderSettingsBoundary = async (runId, builderCwd, input) => {
+                const context = await input.adapter.contextUsage?.().catch(() => undefined);
+                const nativeUsage = await input.adapter.sessionUsage?.().catch(() => undefined);
+                const sessionId = input.adapter.sessionId();
+                const countDb = new WorkflowDb(cwd);
+                let compactionCount = 0;
                 try {
-                    ensureCleanBaseWorktree(cwd, { allowedDirtyPaths: allowedBaseDirtyPaths });
+                    compactionCount = countDb.successfulCompactionCount(runId, "builder", input.adapter.sessionRef?.() ?? sessionId);
                 }
-                catch (err) {
-                    fail(err instanceof Error ? err.message : String(err));
-                }
-            }
-            if (branchDefaults.createReview && branchDefaults.reviewProvider) {
-                await ensureReviewProviderReady(cwd, branchDefaults.reviewProvider, log, Boolean(opts.yes));
-            }
-            const ready = await ensureRuntimeReadyForCommand(cwd, agent, { durable: { projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, scopeRevision: buildScopeRevision(cwd, approvalConsequences) }, timeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
-                label: "start",
-                yes: Boolean(opts.yes),
-                allowSwitch: !(opts.resume || opts.continue),
-                model,
-            });
-            agent = ready.runtime;
-            model = ready.model;
-            agentExecutable = ready.executable;
-            const ticketPaths = resolveTicketPaths(ticketsConfig, cwd);
-            const tickets = loadTickets(ticketPaths.tickets);
-            const db = new StateDb(ticketPaths.stateDb);
-            const states = db.getAllStates();
-            db.close();
-            const ticketById = new Map(tickets.map((ticket) => [ticket.id, ticket]));
-            const resumeSessionByTicket = new Map();
-            let auditDependencyCount;
-            let plan;
-            if (continueTickets.length > 0) {
-                const sessions = findResumableBranchSessions(join(cwd, ".foreman"));
-                const sessionByTicket = new Map(sessions.map((session) => [session.ticket, session]));
-                const nodes = [];
-                for (const ticketId of continueTickets) {
-                    const session = sessionByTicket.get(ticketId);
-                    if (!session) {
-                        fail([
-                            `no resumable branch session found for ticket ${ticketId}`,
-                            branchContinueTicketHelp(cwd),
-                        ].join("\n"));
-                    }
-                    const ticket = ticketById.get(ticketId);
-                    if (!ticket)
-                        fail(`ticket ${ticketId} no longer exists in .tickets/tickets.yaml`);
-                    const sessionId = opts.resume ?? session.sessionId;
-                    let sessionRef = session.sessionRef;
-                    if (sessionRef && sessionRef.sessionId !== sessionId)
-                        sessionRef = undefined;
-                    if (!sessionRef && recoveryRecord)
-                        sessionRef = buildRunSessionBinding(recoveryRecord, "builder", sessionId);
-                    if (!sessionRef && sessionId === session.sessionId)
-                        sessionRef = legacyBranchSessionRef(session, cwd, agent);
-                    if (!sessionRef)
-                        fail(`session ${sessionId} for ${ticketId} has no unique location-scoped binding; use fresh-with-handoff recovery`);
-                    resumeSessionByTicket.set(ticketId, { worktreePath: session.worktreePath, sessionId, sessionRef });
-                    nodes.push({
-                        ticket,
-                        branch: session.branch,
-                        baseRef: session.base,
-                        baseBranch: session.base,
-                        dependencies: [],
-                        depth: 1,
-                        worktreePath: session.worktreePath,
-                        deliveryUnitId: session.deliveryUnitId,
-                        deliveryUnitFinal: session.deliveryUnitFinal,
-                    });
+                finally {
+                    countDb.close();
                 }
-                plan = {
-                    baseRef: nodes[0]?.baseRef ?? (opts.base ?? currentGitRef(cwd)),
-                    nodes,
-                    issues: [],
+                const reason = `live settings revision ${input.next.settings_revision} changed Builder provider controls from ${input.current.make}/${input.current.model} to ${input.next.make}/${input.next.model}`;
+                const transfer = await new HandoffService(cwd).transfer({
+                    runId, role: "builder", reason, predecessorSessionId: sessionId, predecessorSessionRef: input.adapter.sessionRef?.(),
+                    roleState: {
+                        settingsFrom: input.current, settingsTo: input.next,
+                        frozenActionDigest: createHash("sha256").update(input.frozenAction).digest("hex"),
+                        ...(context ? { contextSample: context } : { occupancy: "unavailable" }),
+                    },
+                    ...(nativeUsage ? { sessionUsage: {
+                            version: 1, runId, role: "builder", provider: input.adapter.agent,
+                            providerSessionId: sessionId, observedAt: nativeUsage.observedAt, source: nativeUsage.source,
+                            cumulativeInputTokens: nativeUsage.inputTokens, cumulativeOutputTokens: nativeUsage.outputTokens,
+                            cumulativeTotalTokens: nativeUsage.totalTokens, authoritativeCostUsd: nativeUsage.authoritativeCostUsd,
+                        } } : {}),
+                    compactionCount, compactMaximum: input.next.compact_maximum,
+                    resources: [{ label: "frozen-action", content: input.frozenAction, authoritative: true }],
+                }, (_handoff, runtime) => createBuilderForSettings(builderCwd, settingsForRequestedRuntime(input.next, runtime)), handoffRecoveryOptions("builder"));
+                log.write("handoff-transfer", {
+                    role: "builder", reason, settingsRevision: input.next.settings_revision, generation: transfer.manifest.generation,
+                    predecessorSessionId: transfer.manifest.predecessorSessionId, successorSessionId: transfer.successorSessionId,
+                    acceptanceCheckpointDigest: transfer.acceptanceCheckpointDigest,
+                });
+                if (input.adapter instanceof ContinuityAdapter) {
+                    await input.adapter.adoptValidatedSuccessor(transfer.successor);
+                    return input.adapter;
+                }
+                await input.adapter.close().catch(() => { });
+                return continuousBuilder(transfer.successor, builderCwd, runId, input.next);
+            };
+            const createRawQa = async (qaCwd, sessionRef) => {
+                // Isolated QA conversations are intentionally disposable. Resolve live
+                // QA settings for each one so a threshold-only update applies to the
+                // very next review instead of waiting for a nonexistent session reuse.
+                const qaSettings = liveRoleSettings("qa", resolvedContinuitySettings("qa"));
+                const ready = await ensureBuildRuntimeReadyForCommand(qaCwd, qaSettings.make, { build: readinessOwner, durable: { projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, scopeRevision: buildScopeRevision(cwd, approvalConsequences) }, timeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
+                    label: "live QA settings",
+                    onTrace: trace => log.write("runtime-readiness", { ...trace, role: "qa" }),
+                    yes: true,
+                    allowSwitch: false,
+                    model: qaSettings.model === "default" ? undefined : qaSettings.model,
+                });
+                const qaPolicy = new PermissionPolicy(readOnlyPermissionConfig(), qaCwd);
+                const metadata = resolveQaRuntimeMetadata(qaCwd, qaSettings);
+                const adapterOpts = {
+                    cwd: qaCwd,
+                    configRoot: cwd,
+                    sessionRole: "qa",
+                    sessionStream: "qa",
+                    runtimeExecutable: ready.executable,
+                    runtimePhase: "qa",
+                    preparationTimeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
+                    rpcTimeoutMs: frozenPolicy.runtimeDeadlines?.rpc_ms,
+                    compactionTimeoutMs: frozenPolicy.runtimeDeadlines?.compaction_ms,
+                    shutdownTimeoutMs: frozenPolicy.runtimeDeadlines?.shutdown_ms,
+                    turnDeadlineMs: frozenPolicy.runtimeDeadlines?.turn_ms,
+                    model: qaSettings.model === "default" ? undefined : qaSettings.model,
+                    ...(sessionRef ? { resumeSessionRef: sessionRef } : {}),
+                    sessionGeneration: sessionRef?.generation ?? 0,
+                    workspaceIdentity: captureWorkspaceIdentity(qaCwd),
+                    permission: createPermissionHandler(qaPolicy, log, { durable: () => ({ projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, ticketId: activeObserver?.context().ticketId }) }),
+                    onQuestionTrace: (trace) => log.write("question-round-trip", { ...trace }),
+                    onLifecycleTrace: (trace) => log.write("provider-lifecycle", { ...trace }),
+                    effort: explicitEffort(qaSettings.reasoning),
+                    fast: qaSettings.fast,
+                    sandboxMode: "read-only",
+                    systemPromptAppend: metadata.effectiveRoleInstructions,
+                    preloadedSkillContent: metadata.skills.map(({ name, content }) => ({ name, content })),
+                    autoCompactThresholdPercent: qaSettings.auto_compact_threshold_percent,
+                    allowAutoCompactionSetupTurn: false,
+                    observer: activeObserver,
                 };
-            }
-            else {
-                plan = buildBranchPlan(tickets, states, {
-                    steps,
-                    baseRef: opts.base ?? loadTicketSetupConfig(cwd)?.build.base_branch ?? currentGitRef(cwd),
-                    branchPrefix,
-                    maxBranchDepth,
-                    rootBaseBranches: branchDefaults.rootBaseBranches,
-                    ticketIds: selectedNewTicket ? [selectedNewTicket] : selectedStackTickets ?? deliveryRun?.remaining.slice(0, steps) ?? recoveryRecord?.tickets,
+                const created = qaSettings.make === "codex"
+                    ? new CodexAdapter(adapterOpts)
+                    : await ClaudeAdapter.create(adapterOpts);
+                if (!created.prepareSession)
+                    throw new Error(`QA runtime ${qaSettings.make} cannot establish a durable session identity before review`);
+                await created.prepareSession();
+                await prepareNativeAutoCompaction(created);
+                qaRuntimeMetadata.set(created, metadata);
+                return created;
+            };
+            const createRecoveringQa = async (qaCwd, sessionRef) => {
+                const initial = await createRawQa(qaCwd, sessionRef);
+                const recovering = new RecoveringAdapter({
+                    initial,
+                    runtime: qaAgent,
+                    label: "QA turn",
+                    observer: activeObserver,
+                    // QA retries and provider switches must cross the explicit durable
+                    // QA recovery boundary; an adapter-local replay would reuse one turn
+                    // intent for two different provider executions.
+                    enabled: false,
+                    allowSwitch: false,
+                    recreate: async (nextRuntime, resumeSessionId, resumeRef) => {
+                        const nextReady = await ensureBuildRuntimeReadyForCommand(qaCwd, nextRuntime, { build: readinessOwner, durable: { projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, scopeRevision: buildScopeRevision(cwd, approvalConsequences) }, timeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
+                            label: "QA recovery",
+                            allowSwitch: false,
+                            model: nextRuntime === qaAgent ? qaModel : undefined,
+                        });
+                        qaAgent = nextReady.runtime;
+                        qaModel = nextReady.model;
+                        qaExecutable = nextReady.executable;
+                        if (resumeSessionId && !resumeRef) {
+                            const availability = {
+                                version: 1,
+                                status: "unknown",
+                                checkedAt: new Date().toISOString(),
+                                reason: "legacy-unscoped",
+                                detail: "QA retry cannot authorize an exact provider resume from a raw session ID",
+                            };
+                            throw new SessionUnavailableError({
+                                runtime: nextRuntime,
+                                phase: "preflight",
+                                dispatchState: "not-sent",
+                                executable: nextReady.executable,
+                                cwd: qaCwd,
+                                diagnostics: availability.detail,
+                                availability,
+                            });
+                        }
+                        return createRawQa(qaCwd, resumeRef);
+                    },
+                });
+                const metadata = qaRuntimeMetadata.get(initial);
+                if (metadata)
+                    qaRuntimeMetadata.set(recovering, metadata);
+                return recovering;
+            };
+            const decorateQa = async (adapter, qaCwd, sessionId) => {
+                const metadata = qaRuntimeMetadata.get(adapter);
+                const qaSettings = frozenQaRuntimeSettings(adapter, metadata);
+                const continuous = activeContinuityRunId ? new ContinuityAdapter({
+                    adapter, projectDir: cwd, runId: activeContinuityRunId, role: "qa", settings: qaSettings,
+                    durableSingleTurn: true,
+                    authoritativeStateRevision: () => readAgentDefaults(cwd).revision ?? settingsRevision,
+                    createSuccessor: () => createRecoveringQa(qaCwd),
+                    replaceRecoveryLeaseAfterCheckpoint: String(opts.recoveryMode ?? "") === "fresh-recovery-only" && recoveryRecord?.recoveryDecision?.role === "qa",
+                    recoverWithHandoff: async ({ reason, reconstruction, predecessor }) => {
+                        const effectiveSettings = liveRoleSettings("qa", qaSettings);
+                        const context = await predecessor.contextUsage?.().catch(() => undefined);
+                        const nativeUsage = await predecessor.sessionUsage?.().catch(() => undefined);
+                        const predecessorSessionId = predecessor.sessionId();
+                        const recoveryDb = new WorkflowDb(cwd);
+                        let compactionCount = 0;
+                        try {
+                            compactionCount = recoveryDb.successfulCompactionCount(activeContinuityRunId, "qa", predecessor.sessionRef?.() ?? predecessorSessionId);
+                        }
+                        finally {
+                            recoveryDb.close();
+                        }
+                        const transfer = await new HandoffService(cwd).transfer({
+                            runId: activeContinuityRunId, role: "qa", reason, predecessorSessionId, predecessorSessionRef: predecessor.sessionRef?.(),
+                            allowNonCurrentContinuity: true,
+                            roleState: { recovery: "double-invalid-continuity", reconstruction, ...(context ? { contextSample: context } : { occupancy: "unavailable" }) },
+                            ...(nativeUsage ? { sessionUsage: {
+                                    version: 1, runId: activeContinuityRunId, role: "qa", provider: predecessor.agent,
+                                    providerSessionId: predecessorSessionId, observedAt: nativeUsage.observedAt, source: nativeUsage.source,
+                                    cumulativeInputTokens: nativeUsage.inputTokens, cumulativeOutputTokens: nativeUsage.outputTokens,
+                                    cumulativeTotalTokens: nativeUsage.totalTokens, authoritativeCostUsd: nativeUsage.authoritativeCostUsd,
+                                } } : {}),
+                            compactionCount, compactMaximum: effectiveSettings.compact_maximum,
+                            resources: [{ label: "continuity-reconstruction", content: reconstruction, authoritative: true }],
+                        }, (_handoff, runtime) => createQaForSettings(qaCwd, settingsForRequestedRuntime(effectiveSettings, runtime)), handoffRecoveryOptions("qa"));
+                        log.write("handoff-transfer", {
+                            role: "qa", reason, recovery: "double-invalid-continuity", generation: transfer.manifest.generation,
+                            predecessorSessionId: transfer.manifest.predecessorSessionId, successorSessionId: transfer.successorSessionId,
+                            acceptanceCheckpointDigest: transfer.acceptanceCheckpointDigest,
+                        });
+                        return transfer.successor;
+                    },
+                }) : adapter;
+                if (continuous instanceof ContinuityAdapter)
+                    await continuous.validateFreshRecovery();
+                const decorated = new RoleStatusAdapter(continuous, (active) => liveStatusReporter?.updateState({
+                    role: "qa", provider: active.agent, model: qaSettings.model, reasoning: qaSettings.reasoning, fast: qaSettings.fast,
+                    phase: "QA review session", sessionTransition: sessionId ? "resumed QA session" : "QA session", adapter: active,
+                    settingsRevision: qaSettings.settings_revision, displaySessionCost: qaSettings.display_session_cost,
+                    compactionCount: () => { const db = new WorkflowDb(cwd); try {
+                        return activeContinuityRunId ? db.successfulCompactionCount(activeContinuityRunId, "qa", active.sessionRef?.() ?? active.sessionId()) : 0;
+                    }
+                    finally {
+                        db.close();
+                    } },
+                    handoffGeneration: () => { const db = new WorkflowDb(cwd); try {
+                        return activeContinuityRunId ? db.handoffs(activeContinuityRunId).at(-1)?.generation ?? 0 : 0;
+                    }
+                    finally {
+                        db.close();
+                    } },
+                }), () => {
+                    const active = activeBuilderForStatus?.();
+                    if (active)
+                        liveStatusReporter?.updateState({
+                            role: "builder", provider: active.agent, model: model ?? "default", reasoning: builderEffort ?? "default", fast: Boolean(builderFast),
+                            phase: "builder work session", sessionTransition: "builder session", adapter: active,
+                            settingsRevision, displaySessionCost: sessionCostOverride ?? roleDefaults.builder?.display_session_cost ?? false,
+                            compactionCount: () => { const db = new WorkflowDb(cwd); try {
+                                return activeContinuityRunId ? db.successfulCompactionCount(activeContinuityRunId, "builder", active.sessionRef?.() ?? active.sessionId()) : 0;
+                            }
+                            finally {
+                                db.close();
+                            } },
+                            handoffGeneration: () => { const db = new WorkflowDb(cwd); try {
+                                return activeContinuityRunId ? db.handoffs(activeContinuityRunId).at(-1)?.generation ?? 0 : 0;
+                            }
+                            finally {
+                                db.close();
+                            } },
+                        });
                 });
-                let auditBuilder;
-                let auditViewer;
-                const auditRunId = `audit-${stamp}`;
-                activeContinuityRunId = auditRunId;
+                qaRuntimeMetadata.set(continuous, metadata);
+                qaRuntimeMetadata.set(decorated, metadata);
+                return decorated;
+            };
+            const describeQaHandle = (adapter, _qaCwd, handoffReceipt) => describeQaRuntimeHandle(adapter, qaRuntimeMetadata.get(adapter), handoffReceipt);
+            const qaV2SessionRef = (ref) => {
+                if (ref.role !== "qa" || ref.stream !== "qa" || !ref.sessionId || !ref.cwd || !ref.configRoot
+                    || /^(?:unavailable|unknown)$/i.test(ref.sessionId.trim()))
+                    throw new Error("QA handoff receipt has an invalid scoped session identity");
+                return {
+                    version: 2, provider: ref.provider, sessionId: ref.sessionId, role: "qa", stream: "qa",
+                    generation: ref.generation, cwd: ref.cwd, configRoot: ref.configRoot,
+                    createdAt: ref.createdAt, validatedAt: ref.validatedAt ?? new Date().toISOString(),
+                };
+            };
+            const qaV2HandoffReceipt = (receipt, recovery, confinementDigest) => {
+                if (!receipt.predecessorSessionRef)
+                    throw new Error("QA recovery handoff has no scoped predecessor identity");
+                const receiptDb = new WorkflowDb(cwd);
                 try {
-                    auditBuilder = await createBuilder(cwd);
-                    auditViewer = printEvents(auditBuilder.events());
-                    const audit = await auditBuilder.sendTurn(buildBranchAuditInstruction(plan.nodes.map((node) => node.ticket)));
-                    if (audit.isError)
-                        throw new Error(audit.text);
-                    const auditDependencies = parseAuditDependencies(audit.text);
+                    const head = receiptDb.qaTicketHead(recovery.runId, recovery.ticketId);
+                    if (!head.reviewBasisDigest || !head.sourceStateDigest)
+                        throw new Error("QA recovery handoff has no durable predecessor review basis/source state");
+                    const resources = receipt.resources.map((resource) => {
+                        if (!resource.path || !resource.purpose || resource.bytes === undefined || !resource.mediaType)
+                            throw new Error(`QA recovery handoff resource ${resource.label} lacks complete inventory metadata`);
+                        return { label: resource.label, digest: resource.digest, authoritative: resource.authoritative,
+                            requiredForRecovery: resource.requiredForRecovery ?? false, mediaType: resource.mediaType,
+                            path: resource.path, purpose: resource.purpose, bytes: resource.bytes };
+                    });
+                    const base = {
+                        version: 2, runId: recovery.runId, ticketId: recovery.ticketId, qaRevision: head.revision,
+                        sourceStateDigest: recovery.reviewedStateDigest, predecessorSourceStateDigest: head.sourceStateDigest,
+                        reviewBasisDigest: head.reviewBasisDigest, requiresFullReview: true, confinementDigest,
+                        predecessor: qaV2SessionRef(receipt.predecessorSessionRef), successor: qaV2SessionRef(receipt.successorSessionRef),
+                        manifestDigest: receipt.manifestDigest, continuityCheckpointDigest: receipt.continuityCheckpointDigest,
+                        acceptanceCheckpointDigest: receipt.acceptanceCheckpointDigest, packetDigest: recovery.packetDigest,
+                        inventoryDigest: qaDigest("handoff-inventory", resources), resources, acceptedAt: receipt.acceptedAt,
+                    };
+                    const completed = { ...base, operationId: qaDigest("qa-handoff-operation", base) };
+                    receiptDb.recordQaHandoffReceipt(completed);
+                    return completed;
+                }
+                finally {
+                    receiptDb.close();
+                }
+            };
+            const createQa = async (qaCwd, sessionId) => {
+                const recoveryMode = String(opts.recoveryMode ?? "");
+                // A disposable QA cwd is never eligible for exact reuse, even when a
+                // compatibility caller still supplies the previous raw ID.
+                const effectiveSessionId = undefined;
+                void sessionId;
+                let adapter = await createRecoveringQa(qaCwd, effectiveSessionId);
+                let explicitRecoveryAccepted = false;
+                let handoffReceipt = { kind: "initial" };
+                if (pendingHandoffGeneration !== undefined && pendingHandoffRole === "qa" && activeContinuityRunId === recoveryRecord?.runId) {
+                    const service = new HandoffService(cwd);
+                    const staged = service.loadStaged(recoveryRecord.runId, pendingHandoffGeneration);
+                    const accepted = await service.acceptStagedWithRecovery(staged, adapter, (_handoff, runtime) => createQaForSettings(qaCwd, settingsForRequestedRuntime(resolvedContinuitySettings("qa"), runtime)), handoffRecoveryOptions("qa"));
+                    if (!accepted.acceptanceReceipt)
+                        throw new Error("QA recovery handoff did not produce a scoped acceptance receipt");
+                    adapter = accepted.successor;
+                    pendingHandoffGeneration = undefined;
+                    explicitRecoveryAccepted = true;
+                    const packet = pendingQaRecoveryPacket(cwd, recoveryRecord.runId, requestedTicketIds[0]);
+                    if (!packet)
+                        throw new Error("accepted QA recovery handoff has no current durable packet");
+                    const confinement = describeQaHandle(adapter, qaCwd, { kind: "initial" }).confinement;
+                    handoffReceipt = { kind: "accepted", receipt: qaV2HandoffReceipt(accepted.acceptanceReceipt, {
+                            runId: packet.manifest.runId, ticketId: packet.manifest.ticketId, packetDigest: packet.manifest.packetDigest,
+                            reviewedStateDigest: packet.manifest.reviewedStateDigest,
+                        }, confinement.digest) };
+                    log.write("recovery-handoff-accepted", { role: "qa", generation: accepted.manifest.generation, successorSessionId: accepted.successorSessionId, acceptanceCheckpointDigest: accepted.acceptanceCheckpointDigest });
+                }
+                // A new disposable QA worktree always means a new provider session.
+                // Transfer cumulative QA state by accepting a durable handoff in that
+                // fresh session; never attach the old session in the new /tmp cwd.
+                if (!explicitRecoveryAccepted && activeContinuityRunId && recoveryMode !== "fresh-recovery-only") {
+                    const stateDb = new WorkflowDb(cwd);
+                    const priorLease = stateDb.roleMutationLease(activeContinuityRunId, "qa");
+                    const head = stateDb.continuityHead(activeContinuityRunId, "qa");
+                    const checkpoint = stateDb.latestContinuityCheckpoint(activeContinuityRunId, "qa");
+                    const compactionCount = priorLease
+                        ? stateDb.successfulCompactionCount(activeContinuityRunId, "qa", priorLease.sessionRef ?? priorLease.providerSessionId)
+                        : 0;
+                    stateDb.close();
+                    if (priorLease) {
+                        if (!head || head.state !== "current" || !checkpoint) {
+                            await adapter.close().catch(() => { });
+                            throw new ContinuityRecoveryRequiredError(activeContinuityRunId, "qa", `cannot transfer cumulative QA state from a ${head?.state ?? "missing"} checkpoint`);
+                        }
+                        const service = new HandoffService(cwd);
+                        const staged = service.stage({
+                            runId: activeContinuityRunId,
+                            role: "qa",
+                            reason: "new disposable QA snapshot requires a fresh location-scoped provider session",
+                            predecessorSessionId: priorLease.providerSessionId,
+                            predecessorSessionRef: priorLease.sessionRef,
+                            roleState: { predecessorGeneration: priorLease.generation, successorSnapshotCwd: qaCwd },
+                            compactionCount,
+                            compactMaximum: resolvedContinuitySettings("qa").compact_maximum,
+                        });
+                        const accepted = await service.acceptStagedWithRecovery(staged, adapter, (_handoff, runtime) => createQaForSettings(qaCwd, settingsForRequestedRuntime(resolvedContinuitySettings("qa"), runtime)), handoffRecoveryOptions("qa"));
+                        if (!accepted.acceptanceReceipt)
+                            throw new Error("QA snapshot handoff did not produce a scoped acceptance receipt");
+                        adapter = accepted.successor;
+                        // This continuity transfer precedes construction of a ticket/source
+                        // review basis, so it is not a QA-report recovery receipt.
+                        handoffReceipt = { kind: "initial" };
+                        log.write("handoff-transfer", {
+                            role: "qa", reason: staged.manifest.reason, generation: accepted.manifest.generation,
+                            predecessorSessionId: staged.manifest.predecessorSessionId, successorSessionId: accepted.successorSessionId,
+                            acceptanceCheckpointDigest: accepted.acceptanceCheckpointDigest,
+                        });
+                    }
+                }
+                const decorated = await decorateQa(adapter, qaCwd, effectiveSessionId);
+                return describeQaHandle(decorated, qaCwd, handoffReceipt);
+            };
+            const applyQaSettingsBoundary = async (runId, qaCwd, input) => {
+                const context = await input.adapter.contextUsage?.().catch(() => undefined);
+                const nativeUsage = await input.adapter.sessionUsage?.().catch(() => undefined);
+                const sessionId = input.adapter.sessionId();
+                const countDb = new WorkflowDb(cwd);
+                let compactionCount = 0;
+                try {
+                    compactionCount = countDb.successfulCompactionCount(runId, "qa", input.adapter.sessionRef?.() ?? sessionId);
+                }
+                finally {
+                    countDb.close();
+                }
+                const reason = `live settings revision ${input.next.settings_revision} changed QA provider controls from ${input.current.make}/${input.current.model} to ${input.next.make}/${input.next.model}`;
+                const transfer = await new HandoffService(cwd).transfer({
+                    runId, role: "qa", reason, predecessorSessionId: sessionId, predecessorSessionRef: input.adapter.sessionRef?.(),
+                    roleState: {
+                        settingsFrom: input.current, settingsTo: input.next,
+                        frozenActionDigest: createHash("sha256").update(input.frozenAction).digest("hex"),
+                        ...(context ? { contextSample: context } : { occupancy: "unavailable" }),
+                    },
+                    ...(nativeUsage ? { sessionUsage: {
+                            version: 1, runId, role: "qa", provider: input.adapter.agent,
+                            providerSessionId: sessionId, observedAt: nativeUsage.observedAt, source: nativeUsage.source,
+                            cumulativeInputTokens: nativeUsage.inputTokens, cumulativeOutputTokens: nativeUsage.outputTokens,
+                            cumulativeTotalTokens: nativeUsage.totalTokens, authoritativeCostUsd: nativeUsage.authoritativeCostUsd,
+                        } } : {}),
+                    compactionCount, compactMaximum: input.next.compact_maximum,
+                    resources: [{ label: "frozen-qa-action", content: input.frozenAction, authoritative: true }],
+                }, (_handoff, runtime) => createQaForSettings(qaCwd, settingsForRequestedRuntime(input.next, runtime)), handoffRecoveryOptions("qa"));
+                log.write("handoff-transfer", {
+                    role: "qa", reason, settingsRevision: input.next.settings_revision, generation: transfer.manifest.generation,
+                    predecessorSessionId: transfer.manifest.predecessorSessionId, successorSessionId: transfer.successorSessionId,
+                    acceptanceCheckpointDigest: transfer.acceptanceCheckpointDigest,
+                });
+                await input.adapter.close().catch(() => { });
+                return decorateQa(transfer.successor, qaCwd);
+            };
+            const qaSessionBoundary = async (handle, frozenAction, strategy, qaCwd, recovery) => {
+                const adapter = handle.adapter;
+                if (!activeContinuityRunId)
+                    throw new Error("QA session boundary requires an active durable run");
+                const qaSettings = frozenQaRuntimeSettings(adapter, qaRuntimeMetadata.get(adapter));
+                let acceptedBoundary;
+                const controller = RoleSessionController.managed({
+                    projectDir: cwd,
+                    runId: activeContinuityRunId,
+                    role: "qa",
+                    initialSettings: qaSettings,
+                    historicalCountUncertain: recoveryCompactionHistoryUncertain(cwd, opts.recoveryMode === "fresh-recovery-only" ? undefined : recoveryRecord, activeContinuityRunId, "qa"),
+                    readSettings: () => liveRoleSettings("qa", qaSettings),
+                    settingsBoundary: (input) => applyQaSettingsBoundary(activeContinuityRunId, qaCwd, input),
+                    settingsAdopted: (_settings, active) => {
+                        const actual = frozenQaRuntimeSettings(active, qaRuntimeMetadata.get(active));
+                        liveStatusReporter?.updateState({
+                            role: "qa", provider: active.agent, model: actual.model, reasoning: actual.reasoning, fast: actual.fast,
+                            adapter: active, settingsRevision: actual.settings_revision, displaySessionCost: actual.display_session_cost,
+                            sessionTransition: "adopted live settings",
+                        });
+                    },
+                    report: (event) => {
+                        currentActivity()?.update(event.kind, event.detail, { provider: qaSettings.make, model: qaSettings.model });
+                    },
+                    handoff: async ({ reason, adapter: predecessor, sample, settings, compactionCount }) => {
+                        const nativeUsage = await predecessor.sessionUsage?.().catch(() => undefined);
+                        const transfer = await new HandoffService(cwd).transfer({
+                            runId: activeContinuityRunId, role: "qa", reason, predecessorSessionId: predecessor.sessionId(), predecessorSessionRef: predecessor.sessionRef?.(),
+                            roleState: { frozenActionDigest: createHash("sha256").update(frozenAction).digest("hex"), contextSample: sample,
+                                ...(recovery ? { recoveryPacketDigest: recovery.packetDigest, reviewedStateDigest: recovery.reviewedStateDigest } : {}) },
+                            ...(nativeUsage ? { sessionUsage: {
+                                    version: 1, runId: activeContinuityRunId, role: "qa", provider: predecessor.agent,
+                                    providerSessionId: predecessor.sessionId(), observedAt: nativeUsage.observedAt, source: nativeUsage.source,
+                                    cumulativeInputTokens: nativeUsage.inputTokens, cumulativeOutputTokens: nativeUsage.outputTokens,
+                                    cumulativeTotalTokens: nativeUsage.totalTokens, authoritativeCostUsd: nativeUsage.authoritativeCostUsd,
+                                } } : {}),
+                            compactionCount, compactMaximum: settings.compact_maximum ?? 10,
+                            resources: [{ label: "frozen-qa-action", content: frozenAction, authoritative: true, purpose: "Frozen QA action across the session boundary" }, ...(recovery ? recovery.resources.map((resource) => ({
+                                    label: resource.label, digest: resource.digest, authoritative: true, requiredForRecovery: resource.requiredForRecovery,
+                                    mediaType: resource.mediaType, path: resource.path, purpose: resource.purpose, bytes: resource.bytes,
+                                })) : [])],
+                        }, (_handoff, runtime) => createQaForSettings(qaCwd, settingsForRequestedRuntime(settings, runtime)), handoffRecoveryOptions("qa"));
+                        if (!transfer.acceptanceReceipt || !recovery)
+                            throw new Error("QA recovery boundary did not produce a complete receipt context");
+                        const successor = await decorateQa(transfer.successor, qaCwd);
+                        acceptedBoundary = acceptQaRuntimeHandoff(describeQaHandle(successor, qaCwd, { kind: "initial" }), (confinementDigest) => qaV2HandoffReceipt(transfer.acceptanceReceipt, recovery, confinementDigest));
+                        log.write("handoff-transfer", { role: "qa", generation: transfer.manifest.generation, predecessorSessionId: transfer.manifest.predecessorSessionId, successorSessionId: transfer.successorSessionId, acceptanceCheckpointDigest: transfer.acceptanceCheckpointDigest });
+                        await predecessor.close().catch(() => { });
+                        return successor;
+                    },
+                });
+                const next = (await controller.atWorkSessionBoundary(adapter, frozenAction, strategy)).adapter;
+                if (!acceptedBoundary || acceptedBoundary.handle.adapter !== next)
+                    throw new Error("QA recovery boundary did not produce a validated acceptance receipt for its active successor");
+                return acceptedBoundary;
+            };
+            const observeQaNativeCompactions = async (adapter) => {
+                if (!activeContinuityRunId)
+                    return;
+                const qaSettings = frozenQaRuntimeSettings(adapter, qaRuntimeMetadata.get(adapter));
+                const controller = new ThresholdCompactionController({
+                    projectDir: cwd,
+                    runId: activeContinuityRunId,
+                    role: "qa",
+                    initialSettings: qaSettings,
+                    historicalCountUncertain: recoveryCompactionHistoryUncertain(cwd, opts.recoveryMode === "fresh-recovery-only" ? undefined : recoveryRecord, activeContinuityRunId, "qa"),
+                });
+                await controller.observeNativeCompactions(adapter);
+            };
+            const qaNonconvergence = createQaNonconvergenceHandler(cwd, !process.stdin.isTTY || !process.stdout.isTTY, roleDefaults.planner, () => activeObserver, () => activeContinuityRunId ?? invocationRunId);
+            const qaReportRecovery = createQaReportRecoveryHandler(cwd, !process.stdin.isTTY || !process.stdout.isTTY, () => activeObserver);
+            if (branchMode) {
+                const ticketsConfig = loadTicketsConfig(cwd);
+                const allowedBaseDirtyPaths = generatedTrackerDirtyPaths(ticketsConfig.paths);
+                const baseWorktreePolicy = recoveryRecord ? "skip" : "enforce";
+                if (baseWorktreePolicy === "skip") {
+                    const projection = recoveryRecord ? projectBuildRecovery(cwd, recoveryRecord) : undefined;
+                    if (projection?.expectedChanges.length) {
+                        console.log(`foreman: preserved expected in-progress work: ${projection.expectedChanges.join(", ")}`);
+                    }
+                    if (projection?.unexpectedChanges.length) {
+                        console.warn("foreman: warning: unexpected changes may conflict with recovery; recovery is still allowed:");
+                        for (const item of projection.unexpectedChanges)
+                            console.warn(`  ${item.path}: ${item.risk}`);
+                        console.warn("foreman: recommended action: preserve or move overlapping changes before continuing");
+                    }
+                }
+                else {
+                    try {
+                        ensureCleanBaseWorktree(cwd, { allowedDirtyPaths: allowedBaseDirtyPaths });
+                    }
+                    catch (err) {
+                        fail(err instanceof Error ? err.message : String(err));
+                    }
+                }
+                if (branchDefaults.createReview && branchDefaults.reviewProvider) {
+                    await ensureReviewProviderReady(cwd, branchDefaults.reviewProvider, log, Boolean(opts.yes));
+                }
+                console.log(`foreman: builder capability request: workspace writes, shell network ${grantedNetwork ? "approved for this build" : "off"}, approvals ${opts.builderApprovals ? "per operation" : "never"}; effective policy requires provider confirmation. Use a provenance-verified local source/dependency bundle for offline acquisition.`);
+                const ready = await ensureBuildRuntimeReadyForCommand(cwd, agent, { build: readinessOwner, durable: { projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, scopeRevision: buildScopeRevision(cwd, approvalConsequences) }, timeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
+                    label: "start",
+                    yes: Boolean(opts.yes),
+                    allowSwitch: !(opts.resume || opts.continue),
+                    model,
+                });
+                agent = ready.runtime;
+                model = ready.model;
+                agentExecutable = ready.executable;
+                const ticketPaths = resolveTicketPaths(ticketsConfig, cwd);
+                const tickets = loadTickets(ticketPaths.tickets);
+                const db = new StateDb(ticketPaths.stateDb);
+                const states = db.getAllStates();
+                db.close();
+                const ticketById = new Map(tickets.map((ticket) => [ticket.id, ticket]));
+                const resumeSessionByTicket = new Map();
+                let auditDependencyCount;
+                let plan;
+                if (continueTickets.length > 0) {
+                    const sessions = findResumableBranchSessions(join(cwd, ".foreman"));
+                    const sessionByTicket = new Map(sessions.map((session) => [session.ticket, session]));
+                    const nodes = [];
+                    for (const ticketId of continueTickets) {
+                        const session = sessionByTicket.get(ticketId);
+                        if (!session) {
+                            fail([
+                                `no resumable branch session found for ticket ${ticketId}`,
+                                branchContinueTicketHelp(cwd),
+                            ].join("\n"));
+                        }
+                        const ticket = ticketById.get(ticketId);
+                        if (!ticket)
+                            fail(`ticket ${ticketId} no longer exists in .tickets/tickets.yaml`);
+                        const sessionId = opts.resume ?? session.sessionId;
+                        let sessionRef = session.sessionRef;
+                        if (sessionRef && sessionRef.sessionId !== sessionId)
+                            sessionRef = undefined;
+                        if (!sessionRef && recoveryRecord)
+                            sessionRef = buildRunSessionBinding(recoveryRecord, "builder", sessionId);
+                        if (!sessionRef && sessionId === session.sessionId)
+                            sessionRef = legacyBranchSessionRef(session, cwd, agent);
+                        if (!sessionRef)
+                            fail(`session ${sessionId} for ${ticketId} has no unique location-scoped binding; use fresh-with-handoff recovery`);
+                        resumeSessionByTicket.set(ticketId, { worktreePath: session.worktreePath, sessionId, sessionRef });
+                        nodes.push({
+                            ticket,
+                            branch: session.branch,
+                            baseRef: session.base,
+                            baseBranch: session.base,
+                            dependencies: [],
+                            depth: 1,
+                            worktreePath: session.worktreePath,
+                            deliveryUnitId: session.deliveryUnitId,
+                            deliveryUnitFinal: session.deliveryUnitFinal,
+                        });
+                    }
+                    plan = {
+                        baseRef: nodes[0]?.baseRef ?? (opts.base ?? currentGitRef(cwd)),
+                        nodes,
+                        issues: [],
+                    };
+                }
+                else {
                     plan = buildBranchPlan(tickets, states, {
                         steps,
                         baseRef: opts.base ?? loadTicketSetupConfig(cwd)?.build.base_branch ?? currentGitRef(cwd),
                         branchPrefix,
                         maxBranchDepth,
-                        auditDependencies,
                         rootBaseBranches: branchDefaults.rootBaseBranches,
                         ticketIds: selectedNewTicket ? [selectedNewTicket] : selectedStackTickets ?? deliveryRun?.remaining.slice(0, steps) ?? recoveryRecord?.tickets,
                     });
-                    auditDependencyCount = auditDependencies.length;
+                    let auditBuilder;
+                    let auditViewer;
+                    const auditRunId = `audit-${stamp}`;
+                    activeContinuityRunId = auditRunId;
+                    try {
+                        auditBuilder = await createBuilder(cwd);
+                        auditViewer = printEvents(auditBuilder.events());
+                        const audit = await sendGraphTurn(auditBuilder, buildBranchAuditInstruction(plan.nodes.map((node) => node.ticket)), graphContext(cwd, auditBuilder.sessionRef?.()?.cwd ?? cwd, "branch-dependency-audit", plan.nodes.map(node => node.ticket.id).join(" ")), { purpose: "planning" });
+                        if (audit.isError)
+                            throw new Error(audit.text);
+                        const auditDependencies = parseAuditDependencies(audit.text);
+                        plan = buildBranchPlan(tickets, states, {
+                            steps,
+                            baseRef: opts.base ?? loadTicketSetupConfig(cwd)?.build.base_branch ?? currentGitRef(cwd),
+                            branchPrefix,
+                            maxBranchDepth,
+                            auditDependencies,
+                            rootBaseBranches: branchDefaults.rootBaseBranches,
+                            ticketIds: selectedNewTicket ? [selectedNewTicket] : selectedStackTickets ?? deliveryRun?.remaining.slice(0, steps) ?? recoveryRecord?.tickets,
+                        });
+                        auditDependencyCount = auditDependencies.length;
+                    }
+                    finally {
+                        await auditBuilder?.close().catch(() => { });
+                        await auditViewer?.catch(() => { });
+                        const auditDb = new WorkflowDb(cwd);
+                        try {
+                            if (auditDb.getRun(auditRunId))
+                                auditDb.transition(auditRunId, { status: "completed", checkpoint: "branch-audit-complete", remainingWork: {}, event: "audit_completed" });
+                        }
+                        finally {
+                            auditDb.close();
+                        }
+                        activeContinuityRunId = undefined;
+                    }
+                    if (deliveryRun?.unit.branch_mode === "shared") {
+                        plan = applySharedDeliveryBranch(plan, deliveryRun.unit.id, deliveryRun.remaining, branchPrefix);
+                        const saved = readDeliveryUnitSession(cwd, deliveryRun.unit.id);
+                        const first = plan.nodes[0];
+                        if (saved && first && saved.branch === first.branch && existsSync(saved.worktreePath)) {
+                            const sessionRef = saved.sessionRef ?? createProviderSessionRef({ provider: agent, sessionId: saved.sessionId, role: "builder", stream: "builder", generation: 0, cwd: saved.worktreePath, configRoot: cwd, workspaceIdentity: captureWorkspaceIdentity(saved.worktreePath), ticketId: saved.ticket, deliveryUnitId: saved.unitId, source: "legacy-inferred" });
+                            resumeSessionByTicket.set(first.ticket.id, { worktreePath: saved.worktreePath, sessionId: saved.sessionId, sessionRef });
+                        }
+                    }
+                    if (selectedStacks.length && deliveryConfig) {
+                        plan = applyExplicitStackTopology(plan, selectedStacks, deliveryConfig, branchPrefix);
+                    }
+                    else if (!deliveryRun) {
+                        const branchPolicy = loadTicketSetupConfig(cwd)?.build.branch_policy;
+                        if (branchPolicy)
+                            plan = applySizeBranchPolicy(plan, branchPolicy, deliveryConfig, branchPrefix);
+                    }
+                    if (recoveryRecord && opts.resume && plan.nodes[0]) {
+                        const prior = findResumableBranchSessions(join(cwd, ".foreman")).find((session) => session.ticket === (recoveryRecord.currentTicket ?? plan.nodes[0].ticket.id));
+                        if (prior) {
+                            const requested = String(opts.resume);
+                            const sessionRef = prior.sessionRef?.sessionId === requested ? prior.sessionRef : buildRunSessionBinding(recoveryRecord, "builder", requested) ?? (prior.sessionId === requested ? legacyBranchSessionRef(prior, cwd, agent) : undefined);
+                            if (!sessionRef)
+                                fail(`session ${requested} has no stored scope for ${plan.nodes[0].ticket.id}`);
+                            resumeSessionByTicket.set(plan.nodes[0].ticket.id, { worktreePath: prior.worktreePath, sessionId: requested, sessionRef });
+                        }
+                    }
+                }
+                const branchPresentation = presentBranchPlan(plan, {
+                    stacked: selectedStacks.length > 0,
+                    resumed: continueTickets.length > 0 || Boolean(recoveryRecord),
+                });
+                log.write("branch-plan", {
+                    ...branchPlanLogMetadata(plan, branchPresentation),
+                    ...(auditDependencyCount === undefined ? {} : { auditDependencyCount }),
+                    ...(continueTickets.length > 0 || recoveryRecord ? { resume: true } : {}),
+                });
+                console.log(branchPresentation.banner);
+                console.log(`foreman: project ${cwd}`);
+                console.log(`foreman: base ${plan.baseRef}`);
+                console.log(`foreman: log ${logPath}\n`);
+                if (deliveryRun) {
+                    console.log(`foreman: delivery unit ${deliveryRun.unit.id} — ${deliveryRun.completed}/${deliveryRun.unit.tickets.length} complete, ${deliveryRun.remaining.length} remaining`);
+                    if (deliveryRun.unit.branch_mode === "shared" && steps < deliveryRun.remaining.length)
+                        console.log(`foreman: --steps ${steps} completes ${steps} ticket(s) in this ${deliveryRun.remaining.length}-ticket remainder; branch/session is preserved and PR completion is deferred`);
+                    if (deliveryRun.unit.dependency_mode === "stack")
+                        console.log("foreman: stacked delivery — dependent branches must be rebased or retargeted after prerequisite merges");
+                }
+                for (const node of plan.nodes) {
+                    console.log(`  ${node.ticket.id}  ${node.branch}  base=${node.baseBranch}`);
+                }
+                for (const issue of plan.issues) {
+                    console.log(`  ! ${issue.ticket ?? "plan"}: ${issue.message}`);
+                }
+                console.log();
+                for (const [ticketId, session] of resumeSessionByTicket) {
+                    const ref = session.sessionRef;
+                    if (!ref)
+                        fail(`session ${session.sessionId} for ${ticketId} has no location-scoped binding`);
+                    if (ref.provider !== agent)
+                        fail(`session ${ref.sessionId} belongs to ${ref.provider}, but this recovery selected ${agent}`);
+                    const availability = await resolveProviderSessionAvailability(ref, {
+                        cwd: session.worktreePath,
+                        configRoot: cwd,
+                        workspaceIdentity: captureWorkspaceIdentity(session.worktreePath),
+                        runtimeExecutable: agentExecutable,
+                    });
+                    if (availability.status !== "available" || !availability.sessionRef) {
+                        fail(`exact session ${ref.sessionId} is ${availability.status} (${availability.reason ?? "validation failed"}): ${availability.detail ?? "no provider detail"}. The preserved worktree remains recoverable; choose fresh-with-handoff recovery.`);
+                    }
+                    resumeSessionByTicket.set(ticketId, { ...session, sessionRef: availability.sessionRef });
                 }
-                finally {
-                    await auditBuilder?.close().catch(() => { });
-                    await auditViewer?.catch(() => { });
-                    const auditDb = new WorkflowDb(cwd);
+                const capturedBranchBuilder = {
+                    role: "builder", source: opts.agent || opts.model || opts.effort || opts.fast ? "cli" : roleDefaults.builder ? "project" : "provider",
+                    make: agent, model: model ?? "default", reasoning: builderEffort ?? "default", fast: Boolean(builderFast),
+                    session_strategy: roleDefaults.builder?.session_strategy ?? "compact", settings_revision: settingsRevision,
+                    display_session_cost: sessionCostOverride ?? roleDefaults.builder?.display_session_cost ?? false,
+                    auto_compact_threshold_percent: thresholdOverride ?? roleDefaults.builder?.auto_compact_threshold_percent ?? 65,
+                    compact_maximum: roleDefaults.builder?.compact_maximum ?? 10,
+                };
+                const capturedBranchQa = {
+                    role: "qa", source: roleDefaults.qa ? "project" : "provider", make: qaAgent, model: qaModel ?? "default",
+                    reasoning: qaEffort ?? "default", fast: qaFast, session_strategy: roleDefaults.qa?.session_strategy ?? "compact", settings_revision: settingsRevision,
+                    display_session_cost: sessionCostOverride ?? roleDefaults.qa?.display_session_cost ?? false,
+                    auto_compact_threshold_percent: roleDefaults.qa?.auto_compact_threshold_percent ?? 65,
+                    compact_maximum: roleDefaults.qa?.compact_maximum ?? 10,
+                };
+                const firstResumeRef = plan.nodes[0] ? resumeSessionByTicket.get(plan.nodes[0].ticket.id)?.sessionRef : undefined;
+                let masterRun = recoveryRecord ? resumeBuildRun(cwd, recoveryRecord.runId, { builder: capturedBranchBuilder, qa: capturedBranchQa, builderSessionId: firstResumeRef?.sessionId ?? null, builderSessionRef: firstResumeRef ?? null, expectedRecoveryDecisionDigest: opts.recoveryDecisionDigest }) : createBuildRun({
+                    runId: invocationRunId,
+                    builderCapabilities, tickets: plan.nodes.map((node) => node.ticket.id), deliveryUnit: selectedStacks.length ? selectedStacks.map((stack) => stack.id).join(",") : deliveryRun?.unit.id,
+                    repositoryRoot: cwd, branchMode: branchPresentation.allocationMode, baseRef: plan.baseRef, builder: capturedBranchBuilder, qa: capturedBranchQa,
+                    frozenPolicy, autonomyProfile, qaEnabled,
+                    runDecisions: { workMode: "branch-per-ticket", workModeSource, branchPrefix, branchPrefixSource: resolvedPrefix.source, autoCompactThresholdPercent: capturedBranchBuilder.auto_compact_threshold_percent ?? 65, thresholdSource: thresholdOverride === undefined ? "project" : "cli" },
+                });
+                activeContinuityRunId = masterRun.runId;
+                if (requiresBuildApproval(cwd, plan.nodes.map(node => node.ticket.id), autoApprovePlanUpdates, approvalConsequences) && plan.issues.every((issue) => !issue.blocking)) {
+                    const action = await durableHumanDecision({ projectDir: cwd, runId: invocationRunId, key: `branch-plan:${buildScopeRevision(cwd, approvalConsequences)}`, prompt: branchPresentation.prompt, choices: [{ id: "proceed", label: "Proceed" }, { id: "cancel", label: "Cancel" }], operation: () => select({
+                            message: branchPresentation.prompt,
+                            options: [
+                                { value: "proceed", label: "Proceed" },
+                                { value: "cancel", label: "Cancel" },
+                            ],
+                        }) });
+                    if (isCancel(action) || action === "cancel") {
+                        const cancelled = action === "cancel";
+                        if (cancelled) {
+                            const decisions = new WorkflowDb(cwd);
+                            try {
+                                decisions.cancelPendingHumanDecisions(invocationRunId, "User cancelled build; pending decisions superseded");
+                            }
+                            finally {
+                                decisions.close();
+                            }
+                        }
+                        masterRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, masterRun, cancelled ? "cancelled" : "input-paused", { status: cancelled ? "cancelled" : "recoverable" }), cancelled ? "cancelled" : "recoverable");
+                        activeObserver?.finish(cancelled ? "cancelled" : "paused", { checkpoint: cancelled ? "user-cancel" : "prompt-eof-or-cancel" });
+                        console.log("ai-foreman: cancelled");
+                        process.exit(0);
+                    }
+                }
+                for (const node of plan.nodes)
+                    admitApprovedTicket(cwd, masterRun.runId, node.ticket.id, buildScopeRevision(cwd), `build invocation ${invocationRunId}: approved branch plan`);
+                masterRun = checkpointBuildRun(cwd, masterRun, "capabilities-resolved", { builderCapabilities });
+                const qaResumedRecovery = recoveryRecord ? pendingQaRecoveryPacket(cwd, masterRun.runId, requestedTicketIds[0]) : undefined;
+                let qaProtocolResumeTicket;
+                if (recoveryRecord && !qaResumedRecovery) {
+                    const protocolDb = new WorkflowDb(cwd);
                     try {
-                        if (auditDb.getRun(auditRunId))
-                            auditDb.transition(auditRunId, { status: "completed", checkpoint: "branch-audit-complete", remainingWork: {}, event: "audit_completed" });
+                        const pendingHeads = protocolDb.pendingQaTicketHeads(masterRun.runId);
+                        if (pendingHeads.length > 1 && !requestedTicketIds.length)
+                            fail(`run ${masterRun.runId} has multiple pending QA tickets; select one with --ticket`);
+                        const requested = requestedTicketIds[0];
+                        const head = requested ? pendingHeads.find((item) => item.ticketId === requested) : pendingHeads[0];
+                        if (pendingHeads.length && requested && !head)
+                            fail(`--ticket ${requested} conflicts with the pending QA protocol ticket${pendingHeads.length === 1 ? ` ${pendingHeads[0].ticketId}` : "s"}`);
+                        if (head && !["completed", "waived"].includes(head.state)) {
+                            if (opts.qaRevision === undefined || !/^\d+$/.test(String(opts.qaRevision)) || Number(opts.qaRevision) !== head.revision)
+                                fail(`pending QA protocol requires exact --qa-revision ${head.revision}`);
+                            qaProtocolResumeTicket = head.ticketId;
+                        }
                     }
                     finally {
-                        auditDb.close();
+                        protocolDb.close();
                     }
-                    activeContinuityRunId = undefined;
-                }
-                if (deliveryRun?.unit.branch_mode === "shared") {
-                    plan = applySharedDeliveryBranch(plan, deliveryRun.unit.id, deliveryRun.remaining, branchPrefix);
-                    const saved = readDeliveryUnitSession(cwd, deliveryRun.unit.id);
-                    const first = plan.nodes[0];
-                    if (saved && first && saved.branch === first.branch && existsSync(saved.worktreePath)) {
-                        const sessionRef = saved.sessionRef ?? createProviderSessionRef({ provider: agent, sessionId: saved.sessionId, role: "builder", stream: "builder", generation: 0, cwd: saved.worktreePath, configRoot: cwd, workspaceIdentity: captureWorkspaceIdentity(saved.worktreePath), ticketId: saved.ticket, deliveryUnitId: saved.unitId, source: "legacy-inferred" });
-                        resumeSessionByTicket.set(first.ticket.id, { worktreePath: saved.worktreePath, sessionId: saved.sessionId, sessionRef });
+                }
+                if (qaResumedRecovery && String(opts.ticket ?? qaResumedRecovery.manifest.ticketId) !== qaResumedRecovery.manifest.ticketId)
+                    fail(`--ticket ${String(opts.ticket)} conflicts with pending QA recovery ticket ${qaResumedRecovery.manifest.ticketId}`);
+                if (qaResumedRecovery) {
+                    const protocolDb = new WorkflowDb(cwd);
+                    try {
+                        const revision = protocolDb.qaTicketHead(masterRun.runId, qaResumedRecovery.manifest.ticketId).revision;
+                        if (opts.qaRevision === undefined || !/^\d+$/.test(String(opts.qaRevision)) || Number(opts.qaRevision) !== revision)
+                            fail(`pending QA protocol requires exact --qa-revision ${revision}`);
+                    }
+                    finally {
+                        protocolDb.close();
                     }
                 }
-                if (selectedStacks.length && deliveryConfig) {
-                    plan = applyExplicitStackTopology(plan, selectedStacks, deliveryConfig, branchPrefix);
+                activeObserver?.store.attachExecutionLease(activeObserver.executionId, readCurrentWorkflowLease(cwd)?.generation);
+                const branchContextControllers = new Map();
+                const branchContextController = (worktreePath) => {
+                    const existing = branchContextControllers.get(worktreePath);
+                    if (existing)
+                        return existing;
+                    const controller = RoleSessionController.managed({
+                        projectDir: cwd, runId: masterRun.runId, role: "builder", initialSettings: capturedBranchBuilder,
+                        historicalCountUncertain: recoveryCompactionHistoryUncertain(cwd, opts.recoveryMode === "fresh-recovery-only" ? undefined : recoveryRecord, masterRun.runId, "builder"),
+                        readSettings: () => liveRoleSettings("builder", capturedBranchBuilder),
+                        settingsBoundary: (input) => applyBuilderSettingsBoundary(masterRun.runId, worktreePath, input),
+                        settingsAdopted: (settings, active) => liveStatusReporter?.updateState({
+                            role: "builder", provider: active.agent, model: settings.model, reasoning: settings.reasoning, fast: settings.fast,
+                            adapter: active, settingsRevision: settings.settings_revision, displaySessionCost: settings.display_session_cost,
+                            sessionTransition: "adopted live settings",
+                        }),
+                        report: (event) => { currentActivity()?.update(event.kind, event.detail, { provider: capturedBranchBuilder.make, model: capturedBranchBuilder.model }); },
+                        handoff: async ({ reason, adapter, sample, settings, compactionCount, frozenAction }) => {
+                            const nativeUsage = await adapter.sessionUsage?.().catch(() => undefined);
+                            const transfer = await new HandoffService(cwd).transfer({
+                                runId: masterRun.runId, role: "builder", reason, predecessorSessionId: adapter.sessionId(), predecessorSessionRef: adapter.sessionRef?.(),
+                                roleState: { worktreePath, frozenActionDigest: createHash("sha256").update(frozenAction).digest("hex"), contextSample: sample },
+                                ...(nativeUsage ? { sessionUsage: { version: 1, runId: masterRun.runId, role: "builder", provider: adapter.agent, providerSessionId: adapter.sessionId(), observedAt: nativeUsage.observedAt, source: nativeUsage.source, cumulativeInputTokens: nativeUsage.inputTokens, cumulativeOutputTokens: nativeUsage.outputTokens, cumulativeTotalTokens: nativeUsage.totalTokens, authoritativeCostUsd: nativeUsage.authoritativeCostUsd } } : {}),
+                                compactionCount, compactMaximum: settings.compact_maximum ?? 10,
+                                resources: [{ label: "frozen-action", content: frozenAction, authoritative: true }],
+                            }, (_handoff, runtime) => createBuilderForSettings(worktreePath, settingsForRequestedRuntime(settings, runtime)), handoffRecoveryOptions("builder"));
+                            log.write("handoff-transfer", { worktreePath, generation: transfer.manifest.generation, predecessorSessionId: transfer.manifest.predecessorSessionId, successorSessionId: transfer.successorSessionId, acceptanceCheckpointDigest: transfer.acceptanceCheckpointDigest });
+                            if (adapter instanceof ContinuityAdapter) {
+                                await adapter.adoptValidatedSuccessor(transfer.successor);
+                                return adapter;
+                            }
+                            await adapter.close().catch(() => { });
+                            return continuousBuilder(transfer.successor, worktreePath, masterRun.runId, settings);
+                        },
+                    });
+                    branchContextControllers.set(worktreePath, controller);
+                    return controller;
+                };
+                const branchHeartbeat = setInterval(() => { masterRun = heartbeatBuildRun(cwd, masterRun); }, 10_000);
+                branchHeartbeat.unref();
+                let branchSessionFailure;
+                let summaries;
+                try {
+                    summaries = await runBranchPlan({
+                        projectDir: cwd,
+                        runId: masterRun.runId,
+                        plan,
+                        continueIndependentTickets: frozenPolicy.continueIndependentTickets,
+                        log,
+                        agent,
+                        model,
+                        effort: builderEffort,
+                        fast: builderFast,
+                        notificationsEnabled: config.notifications.enabled,
+                        terminalBellEnabled: config.notifications.terminal_bell,
+                        qaEnabled,
+                        qaRuntimeContext: capturedBranchQa,
+                        qaContinuityManaged: true,
+                        qaReportRecovery,
+                        qaResumedRecovery,
+                        qaProtocolResumeTicket,
+                        qaMaxFixAttempts: frozenPolicy.limits.builderQaFixesPerTicket,
+                        observer: activeObserver,
+                        createPr: branchDefaults.createReview,
+                        completionMode: branchDefaults.completionMode,
+                        reviewProvider: branchDefaults.reviewProvider,
+                        prReady: branchDefaults.prReady,
+                        keepWorktrees: Boolean(opts.keepWorktrees) || selectedStacks.length > 0,
+                        cleanupBranches: branchDefaults.cleanupBranches,
+                        autoMergeWait: branchDefaults.autoMergeWait,
+                        autoMergeTimeoutMinutes: branchDefaults.autoMergeTimeoutMinutes,
+                        mergeMethod: branchDefaults.mergeMethod,
+                        allowedBaseDirtyPaths,
+                        baseWorktreePolicy,
+                        trackerPaths: {
+                            progressDoc: ticketsConfig.paths.progressDoc,
+                            archiveDoc: ticketsConfig.paths.archiveDoc,
+                        },
+                        resumeSessions: resumeSessionByTicket,
+                        createBuilder: (builderCwd, sessionId, sessionRef) => createBuilder(builderCwd, sessionId, sessionRef),
+                        recordBuilderSession: (session, ticketId) => { masterRun = persistBuildSession(cwd, { ...masterRun, currentTicket: ticketId }, "builder", session); },
+                        recordQaSession: (session, ticketId) => { masterRun = persistBuildSession(cwd, { ...masterRun, currentTicket: ticketId }, "qa", session); },
+                        onSessionUnavailable: (error) => { branchSessionFailure = error; },
+                        createQa: (qaCwd, sessionId) => createQa(qaCwd, sessionId),
+                        builderSessionStrategy: roleDefaults.builder?.session_strategy ?? "compact",
+                        qaSessionStrategy: roleDefaults.qa?.session_strategy ?? "compact",
+                        observeBuilder: async (builder) => {
+                            liveStatusReporter?.stop();
+                            activeBuilderForStatus = () => builder;
+                            const reporter = liveStatusReporter = new AgentStatusReporter({
+                                runId: masterRun.runId, role: "builder", provider: builder.agent, model: capturedBranchBuilder.model,
+                                reasoning: capturedBranchBuilder.reasoning, fast: capturedBranchBuilder.fast, step: Math.min(plan.nodes.length, branchContextControllers.size + 1), total: plan.nodes.length,
+                                phase: "builder ticket session", sessionTransition: builder.sessionId() ? "resumed session" : "initial session", adapter: builder,
+                                settingsRevision: capturedBranchBuilder.settings_revision, displaySessionCost: capturedBranchBuilder.display_session_cost ?? false,
+                                compactionCount: () => { const db = new WorkflowDb(cwd); try {
+                                    return db.successfulCompactionCount(masterRun.runId, "builder", builder.sessionRef?.() ?? builder.sessionId());
+                                }
+                                finally {
+                                    db.close();
+                                } },
+                                handoffGeneration: () => { const db = new WorkflowDb(cwd); try {
+                                    return db.handoffs(masterRun.runId).at(-1)?.generation ?? 0;
+                                }
+                                finally {
+                                    db.close();
+                                } },
+                            }, (line, snapshot) => {
+                                const activity = currentActivity();
+                                if (activity)
+                                    activity.setAgentStatus(line.replace(/^\[[^\]]+\]\s*/, ""));
+                                else
+                                    console.log(line);
+                                activeObserver?.store.updateCurrentState({ runId: masterRun.runId, role: "builder", stream: "builder", executionId: activeObserver.executionId, ticketId: masterRun.currentTicket, providerSessionId: snapshot.contextSample.providerSessionId, phase: snapshot.phase, lastSignalAt: snapshot.contextSample.observedAt });
+                                if (snapshot.contextSample.used !== undefined)
+                                    activeObserver?.store.recordMetric({ runId: masterRun.runId, executionId: activeObserver.executionId, role: "builder", stream: "builder", providerSessionId: snapshot.contextSample.providerSessionId }, "context_used_tokens", snapshot.contextSample.used, { unit: "tokens" });
+                            });
+                            reporter.start();
+                            try {
+                                await printEvents(builder.events());
+                            }
+                            finally {
+                                reporter.stop();
+                            }
+                        },
+                        qaNonconvergence,
+                        beforeBuilderTurn: async (adapter, frozenAction, worktreePath) => (await branchContextController(worktreePath).atSafeBoundary(adapter, frozenAction)).adapter,
+                        observeBuilderNativeCompactions: async (adapter, worktreePath) => { await branchContextController(worktreePath).observeNativeCompactions(adapter); },
+                        builderSessionBoundary: async (adapter, frozenAction, strategy, worktreePath) => (await branchContextController(worktreePath).atWorkSessionBoundary(adapter, frozenAction, strategy)).adapter,
+                        qaSessionBoundary,
+                        observeQaNativeCompactions,
+                    });
                 }
-                else if (!deliveryRun) {
-                    const branchPolicy = loadTicketSetupConfig(cwd)?.build.branch_policy;
-                    if (branchPolicy)
-                        plan = applySizeBranchPolicy(plan, branchPolicy, deliveryConfig, branchPrefix);
+                catch (error) {
+                    if (!(error instanceof HandoffAcceptanceError) && !(error instanceof HandoffRecoveryPausedError))
+                        throw error;
+                    const summary = error.message.slice(0, 1000);
+                    masterRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, masterRun, "handoff-recovery-required", {
+                        status: "recoverable",
+                        failure: { category: "unknown", summary, at: new Date().toISOString() },
+                    }), "recoverable");
+                    clearInterval(branchHeartbeat);
+                    log.write("safe-boundary-paused", { runId: masterRun.runId, message: summary, handoff: true });
+                    console.error(`foreman: handoff paused at a recoverable checkpoint: ${summary}`);
+                    console.error(`foreman: resume this run with: ${formatRecoveryCommand(cwd)}`);
+                    process.exit(2);
                 }
-                if (recoveryRecord && opts.resume && plan.nodes[0]) {
-                    const prior = findResumableBranchSessions(join(cwd, ".foreman")).find((session) => session.ticket === (recoveryRecord.currentTicket ?? plan.nodes[0].ticket.id));
-                    if (prior) {
-                        const requested = String(opts.resume);
-                        const sessionRef = prior.sessionRef?.sessionId === requested ? prior.sessionRef : buildRunSessionBinding(recoveryRecord, "builder", requested) ?? (prior.sessionId === requested ? legacyBranchSessionRef(prior, cwd, agent) : undefined);
-                        if (!sessionRef)
-                            fail(`session ${requested} has no stored scope for ${plan.nodes[0].ticket.id}`);
-                        resumeSessionByTicket.set(plan.nodes[0].ticket.id, { worktreePath: prior.worktreePath, sessionId: requested, sessionRef });
+                if (branchSessionFailure) {
+                    const failure = branchSessionFailure;
+                    const guided = failure instanceof SessionUnavailableContinuityError ? failure.guidedRecovery : failure.failure.dispatchState === "unknown";
+                    const summary = failure.message.slice(0, 1000);
+                    masterRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, masterRun, guided ? "guided-recovery-required" : "session-unavailable-before-dispatch", {
+                        status: "recoverable",
+                        failure: { category: "session-unavailable", summary, at: new Date().toISOString() },
+                    }), "recoverable");
+                    clearInterval(branchHeartbeat);
+                    log.write("session-unavailable", { runId: masterRun.runId, guided, message: summary });
+                    console.error(`foreman: exact provider session unavailable; preserved branch work remains recoverable: ${summary}`);
+                    console.error(guided
+                        ? `foreman: continue with: ${formatRecoveryCommand(cwd)}`
+                        : `foreman: inspect recovery with: ${formatRecoveryCommand(cwd)}`);
+                    process.exit(2);
+                }
+                if (pendingHandoffGeneration !== undefined)
+                    throw new Error(`recovery handoff generation ${pendingHandoffGeneration} for ${pendingHandoffRole} was not accepted; recovery mode was not substituted`);
+                clearInterval(branchHeartbeat);
+                if (selectedStacks.length) {
+                    let allComplete = true;
+                    for (const stack of selectedStacks) {
+                        const stackTickets = stack.units.flatMap((id) => deliveryConfig?.units.find((unit) => unit.id === id)?.tickets ?? []);
+                        const rows = summaries.filter((row) => stackTickets.includes(row.ticket));
+                        const complete = rows.length > 0 && rows.every((row) => row.buildStatus === "done" && (!row.pr || ["created", "existing"].includes(row.pr.status)));
+                        allComplete &&= complete;
+                        const successful = rows.filter((row) => row.buildStatus === "done");
+                        updateStackDeliveryState(cwd, [stack.id], complete ? "awaiting_review" : "partial", {
+                            review_links: [...(stack.review_links ?? []), ...successful.flatMap((row) => row.pr?.url ? [row.pr.url] : [])],
+                            published_branches: { ...(stack.published_branches ?? {}), ...Object.fromEntries(successful.map((row) => [row.ticket, row.branch])) },
+                            completed_prefix: [...(stack.completed_prefix ?? []), ...successful.map((row) => row.ticket)],
+                            next_ticket: complete ? undefined : stackTickets.find((ticket) => !successful.some((row) => row.ticket === ticket)),
+                            remote_checked_at: stack.remote_checked_at, remote_stale: true,
+                        });
                     }
+                    console.log(allComplete ? "foreman: stack publication complete; delivery is awaiting_review (no merges were attempted)" : "foreman: partial stack prefix published; resume point is preserved");
                 }
+                masterRun = withRunLocalAcceptedRuntimes(masterRun);
+                masterRun = summaries.every((row) => row.buildStatus === "done")
+                    ? completeBuildRun(cwd, masterRun)
+                    : releaseBuildLease(cwd, checkpointBuildRun(cwd, masterRun, "branch-run-interrupted", { status: "recoverable" }), "recoverable");
+                activeObserver?.finish(masterRun.status, observationSummaryMetadata(cwd, masterRun, qaEnabled, capturedBranchBuilder.make, summaries.find(row => row.pr?.url)));
+                observabilityStore?.closeLogFile(logPath, masterRun.status);
+                observabilityStore?.enforceLimits();
+                observabilityStore?.maintainLogs(cwd);
+                observabilityStore?.close();
+                pruneRecoveryTelemetryAtCompletion(cwd, config.observability.detail_retention_days);
+                activeObserver = undefined;
+                process.off("exit", finishObservationOnExit);
+                console.log("foreman: branch run summary");
+                console.log("ticket\tbranch\tbase\tstatus\tcommit\tpush\tcompletion");
+                for (const row of summaries) {
+                    console.log([
+                        row.ticket,
+                        row.branch || "-",
+                        row.base,
+                        row.buildStatus,
+                        row.commit ?? "-",
+                        row.pushStatus ?? "-",
+                        row.pr?.url ?? row.pr?.error ?? row.detail ?? "-",
+                    ].join("\t"));
+                }
+                const followupCommands = formatBranchSummaryFollowupCommands(cwd, join(cwd, ".foreman"), summaries);
+                if (followupCommands.length > 0) {
+                    console.log();
+                    console.log("foreman: continue blocked branch ticket(s) with:");
+                    for (const command of followupCommands) {
+                        console.log(`  ${command}`);
+                    }
+                }
+                if (masterRun.status === "completed")
+                    printHandoffPruneCommand(masterRun.runId);
+                const failed = summaries.some((row) => row.buildStatus === "blocked" || row.buildStatus === "needs-human");
+                fireTerminalBell(config.notifications.terminal_bell);
+                process.exit(failed ? 2 : 0);
             }
-            const branchPresentation = presentBranchPlan(plan, {
-                stacked: selectedStacks.length > 0,
-                resumed: continueTickets.length > 0 || Boolean(recoveryRecord),
-            });
-            log.write("branch-plan", {
-                ...branchPlanLogMetadata(plan, branchPresentation),
-                ...(auditDependencyCount === undefined ? {} : { auditDependencyCount }),
-                ...(continueTickets.length > 0 || recoveryRecord ? { resume: true } : {}),
-            });
-            console.log(branchPresentation.banner);
-            console.log(`foreman: project ${cwd}`);
-            console.log(`foreman: base ${plan.baseRef}`);
-            console.log(`foreman: log ${logPath}\n`);
-            if (deliveryRun) {
-                console.log(`foreman: delivery unit ${deliveryRun.unit.id} — ${deliveryRun.completed}/${deliveryRun.unit.tickets.length} complete, ${deliveryRun.remaining.length} remaining`);
-                if (deliveryRun.unit.branch_mode === "shared" && steps < deliveryRun.remaining.length)
-                    console.log(`foreman: --steps ${steps} completes ${steps} ticket(s) in this ${deliveryRun.remaining.length}-ticket remainder; branch/session is preserved and PR completion is deferred`);
-                if (deliveryRun.unit.dependency_mode === "stack")
-                    console.log("foreman: stacked delivery — dependent branches must be rebased or retargeted after prerequisite merges");
-            }
-            for (const node of plan.nodes) {
-                console.log(`  ${node.ticket.id}  ${node.branch}  base=${node.baseBranch}`);
-            }
-            for (const issue of plan.issues) {
-                console.log(`  ! ${issue.ticket ?? "plan"}: ${issue.message}`);
+            if (!recoveryRecord && isTicketsInitialized(cwd)) {
+                const paths = resolveTicketPaths(loadTicketsConfig(cwd), cwd);
+                const state = new StateDb(paths.stateDb);
+                try {
+                    executionTickets = executionTickets ?? loadTickets(paths.tickets).filter(ticket => !["done", "canceled", "cancelled", "obsolete"].includes(state.getState(ticket.id)?.status ?? "planned")).sort((a, b) => a.order - b.order).slice(0, steps).map(ticket => ticket.id);
+                }
+                finally {
+                    state.close();
+                }
             }
-            console.log();
-            for (const [ticketId, session] of resumeSessionByTicket) {
-                const ref = session.sessionRef;
-                if (!ref)
-                    fail(`session ${session.sessionId} for ${ticketId} has no location-scoped binding`);
-                if (ref.provider !== agent)
-                    fail(`session ${ref.sessionId} belongs to ${ref.provider}, but this recovery selected ${agent}`);
-                const availability = await resolveProviderSessionAvailability(ref, {
-                    cwd: session.worktreePath,
+            console.log(`foreman: builder capability request: workspace writes, shell network ${grantedNetwork ? "approved for this build" : "off"}, approvals ${opts.builderApprovals ? "per operation" : "never"}; effective policy requires provider confirmation. Use a provenance-verified local source/dependency bundle for offline acquisition.`);
+            const ready = await ensureBuildRuntimeReadyForCommand(cwd, agent, { build: readinessOwner, durable: { projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, scopeRevision: buildScopeRevision(cwd, approvalConsequences) }, timeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
+                label: "start",
+                yes: Boolean(opts.yes),
+                allowSwitch: !(opts.resume || opts.continue),
+                model,
+            });
+            agent = ready.runtime;
+            model = ready.model;
+            agentExecutable = ready.executable;
+            if (resumeSessionRef) {
+                if (resumeSessionRef.provider !== agent)
+                    fail(`session ${resumeSessionRef.sessionId} belongs to ${resumeSessionRef.provider}, but this recovery selected ${agent}`);
+                const availability = await resolveProviderSessionAvailability(resumeSessionRef, {
+                    cwd,
                     configRoot: cwd,
-                    workspaceIdentity: captureWorkspaceIdentity(session.worktreePath),
+                    workspaceIdentity: captureCurrentWorkflowSessionIdentity(cwd),
                     runtimeExecutable: agentExecutable,
                 });
                 if (availability.status !== "available" || !availability.sessionRef) {
-                    fail(`exact session ${ref.sessionId} is ${availability.status} (${availability.reason ?? "validation failed"}): ${availability.detail ?? "no provider detail"}. The preserved worktree remains recoverable; choose fresh-with-handoff recovery.`);
+                    fail(`exact session ${resumeSessionRef.sessionId} is ${availability.status} (${availability.reason ?? "validation failed"}): ${availability.detail ?? "no provider detail"}. The current worktree and recovery checkpoints were preserved; choose fresh-with-handoff recovery.`);
                 }
-                resumeSessionByTicket.set(ticketId, { ...session, sessionRef: availability.sessionRef });
+                resumeSessionRef = availability.sessionRef;
             }
-            const capturedBranchBuilder = {
+            if (qaEnabled) {
+                const qaReady = await ensureBuildRuntimeReadyForCommand(cwd, qaAgent, { build: readinessOwner, durable: { projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, scopeRevision: buildScopeRevision(cwd, approvalConsequences) }, timeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms, label: "independent QA", yes: Boolean(opts.yes), model: qaModel });
+                qaAgent = qaReady.runtime;
+                qaModel = qaReady.model;
+                qaExecutable = qaReady.executable;
+            }
+            const capturedBuilder = {
                 role: "builder", source: opts.agent || opts.model || opts.effort || opts.fast ? "cli" : roleDefaults.builder ? "project" : "provider",
                 make: agent, model: model ?? "default", reasoning: builderEffort ?? "default", fast: Boolean(builderFast),
                 session_strategy: roleDefaults.builder?.session_strategy ?? "compact", settings_revision: settingsRevision,
                 display_session_cost: sessionCostOverride ?? roleDefaults.builder?.display_session_cost ?? false,
-                auto_compact_threshold_percent: thresholdOverride ?? roleDefaults.builder?.auto_compact_threshold_percent ?? 50,
+                auto_compact_threshold_percent: thresholdOverride ?? roleDefaults.builder?.auto_compact_threshold_percent ?? 65,
                 compact_maximum: roleDefaults.builder?.compact_maximum ?? 10,
             };
-            const capturedBranchQa = {
-                role: "qa", source: roleDefaults.qa ? "project" : "provider", make: qaAgent, model: qaModel ?? "default",
-                reasoning: qaEffort ?? "default", fast: qaFast, session_strategy: roleDefaults.qa?.session_strategy ?? "compact", settings_revision: settingsRevision,
-                display_session_cost: sessionCostOverride ?? roleDefaults.qa?.display_session_cost ?? false,
-                auto_compact_threshold_percent: roleDefaults.qa?.auto_compact_threshold_percent ?? 50,
-                compact_maximum: roleDefaults.qa?.compact_maximum ?? 10,
-            };
-            const firstResumeRef = plan.nodes[0] ? resumeSessionByTicket.get(plan.nodes[0].ticket.id)?.sessionRef : undefined;
-            let masterRun = recoveryRecord ? resumeBuildRun(cwd, recoveryRecord.runId, { builder: capturedBranchBuilder, qa: capturedBranchQa, builderSessionId: firstResumeRef?.sessionId ?? null, builderSessionRef: firstResumeRef ?? null, expectedRecoveryDecisionDigest: opts.recoveryDecisionDigest }) : createBuildRun({
+            const capturedQa = { role: "qa", source: roleDefaults.qa ? "project" : "provider", make: qaAgent, model: qaModel ?? "default", reasoning: qaEffort ?? "default", fast: qaFast, session_strategy: roleDefaults.qa?.session_strategy ?? "compact", display_session_cost: sessionCostOverride ?? roleDefaults.qa?.display_session_cost ?? false, auto_compact_threshold_percent: roleDefaults.qa?.auto_compact_threshold_percent ?? 65, compact_maximum: roleDefaults.qa?.compact_maximum ?? 10, settings_revision: settingsRevision };
+            let buildRun = recoveryRecord ? resumeBuildRun(cwd, recoveryRecord.runId, { builder: capturedBuilder, qa: capturedQa, builderSessionId: resumeSessionId ?? null, builderSessionRef: resumeSessionRef ?? null, expectedRecoveryDecisionDigest: opts.recoveryDecisionDigest }) : createBuildRun({
                 runId: invocationRunId,
-                tickets: plan.nodes.map((node) => node.ticket.id), deliveryUnit: selectedStacks.length ? selectedStacks.map((stack) => stack.id).join(",") : deliveryRun?.unit.id,
-                repositoryRoot: cwd, branchMode: branchPresentation.allocationMode, baseRef: plan.baseRef, builder: capturedBranchBuilder, qa: capturedBranchQa,
+                tickets: [...(executionTickets ?? [])], builderCapabilities, authorizedBatch: { tickets: [...(executionTickets ?? [])], requestedSteps: steps, scopeRevision: buildScopeRevision(cwd, approvalConsequences), startedTickets: [] }, repositoryRoot: cwd, branchMode: "current", baseRef: opts.base ?? loadTicketSetupConfig(cwd)?.build.base_branch, builder: capturedBuilder, qa: capturedQa,
                 frozenPolicy, autonomyProfile, qaEnabled,
-                runDecisions: { workMode: "branch-per-ticket", workModeSource, branchPrefix, branchPrefixSource: resolvedPrefix.source, autoCompactThresholdPercent: capturedBranchBuilder.auto_compact_threshold_percent ?? 50, thresholdSource: thresholdOverride === undefined ? "project" : "cli" },
+                runDecisions: { workMode: "current", workModeSource, branchPrefix, branchPrefixSource: resolvedPrefix.source, autoCompactThresholdPercent: capturedBuilder.auto_compact_threshold_percent ?? 65, thresholdSource: thresholdOverride === undefined ? "project" : "cli" },
             });
-            activeContinuityRunId = masterRun.runId;
-            if (requiresBuildApproval(cwd, plan.nodes.map(node => node.ticket.id), autoApprovePlanUpdates, approvalConsequences) && plan.issues.every((issue) => !issue.blocking)) {
-                const action = await durableHumanDecision({ projectDir: cwd, runId: invocationRunId, key: `branch-plan:${buildScopeRevision(cwd, approvalConsequences)}`, prompt: branchPresentation.prompt, choices: [{ id: "proceed", label: "Proceed" }, { id: "cancel", label: "Cancel" }], operation: () => select({
-                        message: branchPresentation.prompt,
-                        options: [
-                            { value: "proceed", label: "Proceed" },
-                            { value: "cancel", label: "Cancel" },
-                        ],
-                    }) });
-                if (isCancel(action) || action === "cancel") {
-                    console.log("ai-foreman: cancelled");
-                    process.exit(0);
-                }
-            }
-            const qaResumedRecovery = recoveryRecord ? pendingQaRecoveryPacket(cwd, masterRun.runId, typeof opts.ticket === "string" ? opts.ticket : undefined) : undefined;
+            buildRun = checkpointBuildRun(cwd, buildRun, "capabilities-resolved", { builderCapabilities });
+            activeObserver?.store.attachExecutionLease(activeObserver.executionId, readCurrentWorkflowLease(cwd)?.generation);
+            activeContinuityRunId = buildRun.runId;
+            const qaResumedRecovery = recoveryRecord ? pendingQaRecoveryPacket(cwd, buildRun.runId, requestedTicketIds[0]) : undefined;
+            let qaFinalizationTicket;
             let qaProtocolResumeTicket;
             if (recoveryRecord && !qaResumedRecovery) {
-                const protocolDb = new WorkflowDb(cwd);
+                const finalizationDb = new WorkflowDb(cwd);
                 try {
-                    const pendingHeads = protocolDb.pendingQaTicketHeads(masterRun.runId);
-                    if (pendingHeads.length > 1 && !opts.ticket)
-                        fail(`run ${masterRun.runId} has multiple pending QA tickets; select one with --ticket`);
-                    const requested = typeof opts.ticket === "string" ? opts.ticket : undefined;
+                    const pendingHeads = finalizationDb.pendingQaTicketHeads(buildRun.runId);
+                    if (pendingHeads.length > 1 && !requestedTicketIds.length)
+                        fail(`run ${buildRun.runId} has multiple pending QA tickets; select one with --ticket`);
+                    const requested = requestedTicketIds[0];
                     const head = requested ? pendingHeads.find((item) => item.ticketId === requested) : pendingHeads[0];
                     if (pendingHeads.length && requested && !head)
                         fail(`--ticket ${requested} conflicts with the pending QA protocol ticket${pendingHeads.length === 1 ? ` ${pendingHeads[0].ticketId}` : "s"}`);
-                    if (head && !["completed", "waived"].includes(head.state)) {
-                        if (opts.qaRevision === undefined || !/^\d+$/.test(String(opts.qaRevision)) || Number(opts.qaRevision) !== head.revision)
+                    if (head) {
+                        if (head.state === "finalizing")
+                            qaFinalizationTicket = head.ticketId;
+                        else if (!["idle", "completed", "waived"].includes(head.state))
+                            qaProtocolResumeTicket = head.ticketId;
+                        if ((qaFinalizationTicket || qaProtocolResumeTicket)
+                            && (opts.qaRevision === undefined || !/^\d+$/.test(String(opts.qaRevision)) || Number(opts.qaRevision) !== head.revision)) {
                             fail(`pending QA protocol requires exact --qa-revision ${head.revision}`);
-                        qaProtocolResumeTicket = head.ticketId;
+                        }
                     }
                 }
                 finally {
-                    protocolDb.close();
+                    finalizationDb.close();
                 }
             }
             if (qaResumedRecovery && String(opts.ticket ?? qaResumedRecovery.manifest.ticketId) !== qaResumedRecovery.manifest.ticketId)
                 fail(`--ticket ${String(opts.ticket)} conflicts with pending QA recovery ticket ${qaResumedRecovery.manifest.ticketId}`);
             if (qaResumedRecovery) {
-                const protocolDb = new WorkflowDb(cwd);
+                const qaDb = new WorkflowDb(cwd);
                 try {
-                    const revision = protocolDb.qaTicketHead(masterRun.runId, qaResumedRecovery.manifest.ticketId).revision;
-                    if (opts.qaRevision === undefined || !/^\d+$/.test(String(opts.qaRevision)) || Number(opts.qaRevision) !== revision)
-                        fail(`pending QA protocol requires exact --qa-revision ${revision}`);
+                    const currentRevision = qaDb.qaTicketHead(buildRun.runId, qaResumedRecovery.manifest.ticketId).revision;
+                    if (opts.qaRevision === undefined || !/^\d+$/.test(String(opts.qaRevision)) || Number(opts.qaRevision) !== currentRevision)
+                        fail(`pending QA recovery requires exact --qa-revision ${currentRevision}`);
                 }
                 finally {
-                    protocolDb.close();
+                    qaDb.close();
                 }
             }
-            activeObserver?.store.attachExecutionLease(activeObserver.executionId, readCurrentWorkflowLease(cwd)?.generation);
-            const branchContextControllers = new Map();
-            const branchContextController = (worktreePath) => {
-                const existing = branchContextControllers.get(worktreePath);
-                if (existing)
-                    return existing;
-                const controller = RoleSessionController.managed({
-                    projectDir: cwd, runId: masterRun.runId, role: "builder", initialSettings: capturedBranchBuilder,
-                    historicalCountUncertain: recoveryCompactionHistoryUncertain(cwd, recoveryRecord, masterRun.runId, "builder"),
-                    readSettings: () => liveRoleSettings("builder", capturedBranchBuilder),
-                    settingsBoundary: (input) => applyBuilderSettingsBoundary(masterRun.runId, worktreePath, input),
-                    settingsAdopted: (settings, active) => liveStatusReporter?.updateState({
-                        role: "builder", provider: active.agent, model: settings.model, reasoning: settings.reasoning, fast: settings.fast,
-                        adapter: active, settingsRevision: settings.settings_revision, displaySessionCost: settings.display_session_cost,
-                        sessionTransition: "adopted live settings",
-                    }),
-                    report: (event) => { currentActivity()?.update(event.kind, event.detail, { provider: capturedBranchBuilder.make, model: capturedBranchBuilder.model }); },
-                    handoff: async ({ reason, adapter, sample, settings, compactionCount, frozenAction }) => {
-                        const nativeUsage = await adapter.sessionUsage?.().catch(() => undefined);
-                        const transfer = await new HandoffService(cwd).transfer({
-                            runId: masterRun.runId, role: "builder", reason, predecessorSessionId: adapter.sessionId(), predecessorSessionRef: adapter.sessionRef?.(),
-                            roleState: { worktreePath, frozenActionDigest: createHash("sha256").update(frozenAction).digest("hex"), contextSample: sample },
-                            ...(nativeUsage ? { sessionUsage: { version: 1, runId: masterRun.runId, role: "builder", provider: adapter.agent, providerSessionId: adapter.sessionId(), observedAt: nativeUsage.observedAt, source: nativeUsage.source, cumulativeInputTokens: nativeUsage.inputTokens, cumulativeOutputTokens: nativeUsage.outputTokens, cumulativeTotalTokens: nativeUsage.totalTokens, authoritativeCostUsd: nativeUsage.authoritativeCostUsd } } : {}),
-                            compactionCount, compactMaximum: settings.compact_maximum ?? 10,
-                            resources: [{ label: "frozen-action", content: frozenAction, authoritative: true }],
-                        }, (_handoff, runtime) => createBuilderForSettings(worktreePath, settingsForRequestedRuntime(settings, runtime)), handoffRecoveryOptions("builder"));
-                        log.write("handoff-transfer", { worktreePath, generation: transfer.manifest.generation, predecessorSessionId: transfer.manifest.predecessorSessionId, successorSessionId: transfer.successorSessionId, acceptanceCheckpointDigest: transfer.acceptanceCheckpointDigest });
-                        if (adapter instanceof ContinuityAdapter) {
-                            await adapter.adoptValidatedSuccessor(transfer.successor);
-                            return adapter;
-                        }
-                        await adapter.close().catch(() => { });
-                        return continuousBuilder(transfer.successor, worktreePath, masterRun.runId, settings);
-                    },
-                });
-                branchContextControllers.set(worktreePath, controller);
-                return controller;
+            const heartbeat = setInterval(() => { buildRun = heartbeatBuildRun(cwd, buildRun); }, 10_000);
+            heartbeat.unref();
+            const checkpointSignal = () => {
+                try {
+                    buildRun = releaseBuildLease(cwd, buildRun, "interrupted");
+                }
+                catch { /* best effort */ }
             };
-            const branchHeartbeat = setInterval(() => { masterRun = heartbeatBuildRun(cwd, masterRun); }, 10_000);
-            branchHeartbeat.unref();
-            let branchSessionFailure;
-            let summaries;
+            process.once("SIGINT", checkpointSignal);
+            process.once("SIGTERM", checkpointSignal);
+            let builder;
             try {
-                summaries = await runBranchPlan({
-                    projectDir: cwd,
-                    runId: masterRun.runId,
-                    plan,
-                    continueIndependentTickets: frozenPolicy.continueIndependentTickets,
-                    log,
-                    agent,
-                    model,
-                    effort: builderEffort,
-                    fast: builderFast,
-                    notificationsEnabled: config.notifications.enabled,
-                    terminalBellEnabled: config.notifications.terminal_bell,
-                    qaEnabled,
-                    qaRuntimeContext: capturedBranchQa,
-                    qaContinuityManaged: true,
-                    qaReportRecovery,
-                    qaResumedRecovery,
-                    qaProtocolResumeTicket,
-                    qaMaxFixAttempts: frozenPolicy.limits.builderQaFixesPerTicket,
-                    observer: activeObserver,
-                    createPr: branchDefaults.createReview,
-                    completionMode: branchDefaults.completionMode,
-                    reviewProvider: branchDefaults.reviewProvider,
-                    prReady: branchDefaults.prReady,
-                    keepWorktrees: Boolean(opts.keepWorktrees) || selectedStacks.length > 0,
-                    cleanupBranches: branchDefaults.cleanupBranches,
-                    autoMergeWait: branchDefaults.autoMergeWait,
-                    autoMergeTimeoutMinutes: branchDefaults.autoMergeTimeoutMinutes,
-                    mergeMethod: branchDefaults.mergeMethod,
-                    allowedBaseDirtyPaths,
-                    baseWorktreePolicy,
-                    trackerPaths: {
-                        progressDoc: ticketsConfig.paths.progressDoc,
-                        archiveDoc: ticketsConfig.paths.archiveDoc,
-                    },
-                    resumeSessions: resumeSessionByTicket,
-                    createBuilder: (builderCwd, sessionId, sessionRef) => createBuilder(builderCwd, sessionId, sessionRef),
-                    recordBuilderSession: (session, ticketId) => { masterRun = persistBuildSession(cwd, { ...masterRun, currentTicket: ticketId }, "builder", session); },
-                    recordQaSession: (session, ticketId) => { masterRun = persistBuildSession(cwd, { ...masterRun, currentTicket: ticketId }, "qa", session); },
-                    onSessionUnavailable: (error) => { branchSessionFailure = error; },
-                    createQa: (qaCwd, sessionId) => createQa(qaCwd, sessionId),
-                    builderSessionStrategy: roleDefaults.builder?.session_strategy ?? "compact",
-                    qaSessionStrategy: roleDefaults.qa?.session_strategy ?? "compact",
-                    observeBuilder: async (builder) => {
-                        liveStatusReporter?.stop();
-                        activeBuilderForStatus = () => builder;
-                        const reporter = liveStatusReporter = new AgentStatusReporter({
-                            runId: masterRun.runId, role: "builder", provider: builder.agent, model: capturedBranchBuilder.model,
-                            reasoning: capturedBranchBuilder.reasoning, fast: capturedBranchBuilder.fast, step: Math.min(plan.nodes.length, branchContextControllers.size + 1), total: plan.nodes.length,
-                            phase: "builder ticket session", sessionTransition: builder.sessionId() ? "resumed session" : "initial session", adapter: builder,
-                            settingsRevision: capturedBranchBuilder.settings_revision, displaySessionCost: capturedBranchBuilder.display_session_cost ?? false,
-                            compactionCount: () => { const db = new WorkflowDb(cwd); try {
-                                return db.successfulCompactionCount(masterRun.runId, "builder", builder.sessionRef?.() ?? builder.sessionId());
-                            }
-                            finally {
-                                db.close();
-                            } },
-                            handoffGeneration: () => { const db = new WorkflowDb(cwd); try {
-                                return db.handoffs(masterRun.runId).at(-1)?.generation ?? 0;
-                            }
-                            finally {
-                                db.close();
-                            } },
-                        }, (line, snapshot) => {
-                            const activity = currentActivity();
-                            if (activity)
-                                activity.setAgentStatus(line.replace(/^\[[^\]]+\]\s*/, ""));
-                            else
-                                console.log(line);
-                            activeObserver?.store.updateCurrentState({ runId: masterRun.runId, role: "builder", stream: "builder", executionId: activeObserver.executionId, ticketId: masterRun.currentTicket, providerSessionId: snapshot.contextSample.providerSessionId, phase: snapshot.phase, lastSignalAt: snapshot.contextSample.observedAt });
-                            if (snapshot.contextSample.used !== undefined)
-                                activeObserver?.store.recordMetric({ runId: masterRun.runId, executionId: activeObserver.executionId, role: "builder", stream: "builder", providerSessionId: snapshot.contextSample.providerSessionId }, "context_used_tokens", snapshot.contextSample.used, { unit: "tokens" });
-                        });
-                        reporter.start();
-                        try {
-                            await printEvents(builder.events());
-                        }
-                        finally {
-                            reporter.stop();
-                        }
-                    },
-                    qaNonconvergence,
-                    beforeBuilderTurn: async (adapter, frozenAction, worktreePath) => (await branchContextController(worktreePath).atSafeBoundary(adapter, frozenAction)).adapter,
-                    observeBuilderNativeCompactions: async (adapter, worktreePath) => { await branchContextController(worktreePath).observeNativeCompactions(adapter); },
-                    builderSessionBoundary: async (adapter, frozenAction, strategy, worktreePath) => (await branchContextController(worktreePath).atWorkSessionBoundary(adapter, frozenAction, strategy)).adapter,
-                    qaSessionBoundary,
-                    observeQaNativeCompactions,
-                });
+                builder = await createBuilder(cwd, resumeSessionId, resumeSessionRef);
             }
             catch (error) {
-                if (!(error instanceof HandoffAcceptanceError) && !(error instanceof HandoffRecoveryPausedError))
+                if (!(error instanceof SessionUnavailableError))
                     throw error;
                 const summary = error.message.slice(0, 1000);
-                masterRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, masterRun, "handoff-recovery-required", {
-                    status: "recoverable",
-                    failure: { category: "unknown", summary, at: new Date().toISOString() },
-                }), "recoverable");
-                clearInterval(branchHeartbeat);
-                log.write("safe-boundary-paused", { runId: masterRun.runId, message: summary, handoff: true });
-                console.error(`foreman: handoff paused at a recoverable checkpoint: ${summary}`);
-                console.error(`foreman: resume this run with: rafi build:resume ${shellQuote(cwd)} --run ${shellQuote(masterRun.runId)}`);
-                process.exit(2);
-            }
-            if (branchSessionFailure) {
-                const failure = branchSessionFailure;
-                const guided = failure instanceof SessionUnavailableContinuityError ? failure.guidedRecovery : failure.failure.dispatchState === "unknown";
-                const summary = failure.message.slice(0, 1000);
-                masterRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, masterRun, guided ? "guided-recovery-required" : "session-unavailable-before-dispatch", {
+                buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, "session-unavailable-before-dispatch", {
                     status: "recoverable",
                     failure: { category: "session-unavailable", summary, at: new Date().toISOString() },
                 }), "recoverable");
-                clearInterval(branchHeartbeat);
-                log.write("session-unavailable", { runId: masterRun.runId, guided, message: summary });
-                console.error(`foreman: exact provider session unavailable; preserved branch work remains recoverable: ${summary}`);
-                console.error(guided
-                    ? `foreman: continue with: rafi build:resume ${shellQuote(cwd)} --run ${shellQuote(masterRun.runId)} --guided-recovery`
-                    : `foreman: inspect recovery with: rafi build:resume ${shellQuote(cwd)} --run ${shellQuote(masterRun.runId)} --inspect`);
+                clearInterval(heartbeat);
+                log.write("session-unavailable", { runId: buildRun.runId, phase: error.failure.phase, dispatchState: error.failure.dispatchState, message: summary });
+                console.error(`foreman: exact provider session unavailable before dispatch; current worktree state was preserved: ${summary}`);
+                console.error(`foreman: inspect recovery with: ${formatRecoveryCommand(cwd)}`);
                 process.exit(2);
             }
-            if (pendingHandoffGeneration !== undefined)
-                throw new Error(`recovery handoff generation ${pendingHandoffGeneration} for ${pendingHandoffRole} was not accepted; recovery mode was not substituted`);
-            clearInterval(branchHeartbeat);
-            if (selectedStacks.length) {
-                let allComplete = true;
-                for (const stack of selectedStacks) {
-                    const stackTickets = stack.units.flatMap((id) => deliveryConfig?.units.find((unit) => unit.id === id)?.tickets ?? []);
-                    const rows = summaries.filter((row) => stackTickets.includes(row.ticket));
-                    const complete = rows.length > 0 && rows.every((row) => row.buildStatus === "done" && (!row.pr || ["created", "existing"].includes(row.pr.status)));
-                    allComplete &&= complete;
-                    const successful = rows.filter((row) => row.buildStatus === "done");
-                    updateStackDeliveryState(cwd, [stack.id], complete ? "awaiting_review" : "partial", {
-                        review_links: [...(stack.review_links ?? []), ...successful.flatMap((row) => row.pr?.url ? [row.pr.url] : [])],
-                        published_branches: { ...(stack.published_branches ?? {}), ...Object.fromEntries(successful.map((row) => [row.ticket, row.branch])) },
-                        completed_prefix: [...(stack.completed_prefix ?? []), ...successful.map((row) => row.ticket)],
-                        next_ticket: complete ? undefined : stackTickets.find((ticket) => !successful.some((row) => row.ticket === ticket)),
-                        remote_checked_at: stack.remote_checked_at, remote_stale: true,
-                    });
+            const contextController = RoleSessionController.managed({
+                projectDir: cwd,
+                runId: buildRun.runId,
+                role: "builder",
+                initialSettings: capturedBuilder,
+                historicalCountUncertain: recoveryCompactionHistoryUncertain(cwd, opts.recoveryMode === "fresh-recovery-only" ? undefined : recoveryRecord, buildRun.runId, "builder"),
+                readSettings: () => liveRoleSettings("builder", capturedBuilder),
+                settingsBoundary: (input) => applyBuilderSettingsBoundary(buildRun.runId, cwd, input),
+                settingsAdopted: (settings, active) => liveStatusReporter?.updateState({
+                    role: "builder", provider: active.agent, model: settings.model, reasoning: settings.reasoning, fast: settings.fast,
+                    adapter: active, settingsRevision: settings.settings_revision, displaySessionCost: settings.display_session_cost,
+                    sessionTransition: "adopted live settings",
+                }),
+                report: (event) => {
+                    currentActivity()?.update(event.kind, event.detail, { provider: capturedBuilder.make, model: capturedBuilder.model });
+                },
+                handoff: async ({ reason, adapter, sample, settings, compactionCount, frozenAction }) => {
+                    const nativeUsage = await adapter.sessionUsage?.().catch(() => undefined);
+                    const transfer = await new HandoffService(cwd).transfer({
+                        runId: buildRun.runId,
+                        role: "builder",
+                        reason,
+                        predecessorSessionId: adapter.sessionId(),
+                        predecessorSessionRef: adapter.sessionRef?.(),
+                        roleState: { frozenActionDigest: createHash("sha256").update(frozenAction).digest("hex"), contextSample: sample },
+                        ...(nativeUsage ? { sessionUsage: {
+                                version: 1, runId: buildRun.runId, role: "builder", provider: adapter.agent,
+                                providerSessionId: adapter.sessionId(), observedAt: nativeUsage.observedAt, source: nativeUsage.source,
+                                cumulativeInputTokens: nativeUsage.inputTokens, cumulativeOutputTokens: nativeUsage.outputTokens,
+                                cumulativeTotalTokens: nativeUsage.totalTokens, authoritativeCostUsd: nativeUsage.authoritativeCostUsd,
+                            } } : {}),
+                        compactionCount,
+                        compactMaximum: settings.compact_maximum ?? 10,
+                        resources: [{ label: "frozen-action", content: frozenAction, authoritative: true }],
+                    }, (_handoff, runtime) => createBuilderForSettings(cwd, settingsForRequestedRuntime(settings, runtime)), handoffRecoveryOptions("builder"));
+                    log.write("handoff-transfer", { generation: transfer.manifest.generation, predecessorSessionId: transfer.manifest.predecessorSessionId, successorSessionId: transfer.successorSessionId, acceptanceCheckpointDigest: transfer.acceptanceCheckpointDigest });
+                    if (adapter instanceof ContinuityAdapter) {
+                        await adapter.adoptValidatedSuccessor(transfer.successor);
+                        return adapter;
+                    }
+                    await adapter.close();
+                    return continuousBuilder(transfer.successor, cwd, buildRun.runId, settings);
+                },
+            });
+            const foreman = new Foreman(builder, log, { desktop: config.notifications.enabled, terminalBell: config.notifications.terminal_bell }, qaEnabled, frozenPolicy.limits.builderQaFixesPerTicket, cwd, undefined, qaEnabled ? createQa : undefined, capturedQa.session_strategy, createBuilder, capturedBuilder.session_strategy, qaNonconvergence, async (adapter, frozenAction) => (await contextController.atSafeBoundary(adapter, frozenAction)).adapter, async (adapter, frozenAction, strategy) => (await contextController.atWorkSessionBoundary(adapter, frozenAction, strategy)).adapter, qaSessionBoundary, observeQaNativeCompactions, async (adapter) => { await contextController.observeNativeCompactions(adapter); }, activeObserver, capturedQa, true, qaReportRecovery, qaResumedRecovery, buildRun.runId, frozenPolicy.continueIndependentTickets);
+            activeBuilderForStatus = () => foreman.builderAdapter();
+            const statusReporter = liveStatusReporter = new AgentStatusReporter({
+                runId: buildRun.runId,
+                role: "builder", provider: capturedBuilder.make, model: capturedBuilder.model,
+                reasoning: capturedBuilder.reasoning, fast: capturedBuilder.fast, step: 1, total: steps,
+                phase: "builder work session", sessionTransition: resumeSessionId ? "resumed exact session" : "initial session", adapter: () => foreman.builderAdapter(),
+                settingsRevision: capturedBuilder.settings_revision,
+                displaySessionCost: capturedBuilder.display_session_cost ?? false,
+                compactionCount: () => { const db = new WorkflowDb(cwd); try {
+                    return db.successfulCompactionCount(buildRun.runId, "builder", foreman.builderAdapter().sessionRef?.() ?? foreman.builderSessionId());
                 }
-                console.log(allComplete ? "foreman: stack publication complete; delivery is awaiting_review (no merges were attempted)" : "foreman: partial stack prefix published; resume point is preserved");
-            }
-            masterRun = withRunLocalAcceptedRuntimes(masterRun);
-            masterRun = summaries.every((row) => row.buildStatus === "done")
-                ? completeBuildRun(cwd, masterRun)
-                : releaseBuildLease(cwd, checkpointBuildRun(cwd, masterRun, "branch-run-interrupted", { status: "recoverable" }), "recoverable");
-            activeObserver?.finish(masterRun.status, observationSummaryMetadata(cwd, masterRun, qaEnabled, capturedBranchBuilder.make, summaries.find(row => row.pr?.url)));
-            observabilityStore?.closeLogFile(logPath, masterRun.status);
-            observabilityStore?.enforceLimits();
-            observabilityStore?.maintainLogs(cwd);
-            observabilityStore?.close();
-            pruneRecoveryTelemetryAtCompletion(cwd, config.observability.detail_retention_days);
-            activeObserver = undefined;
-            process.off("exit", finishObservationOnExit);
-            console.log("foreman: branch run summary");
-            console.log("ticket\tbranch\tbase\tstatus\tcommit\tpush\tcompletion");
-            for (const row of summaries) {
-                console.log([
-                    row.ticket,
-                    row.branch || "-",
-                    row.base,
-                    row.buildStatus,
-                    row.commit ?? "-",
-                    row.pushStatus ?? "-",
-                    row.pr?.url ?? row.pr?.error ?? row.detail ?? "-",
-                ].join("\t"));
-            }
-            const followupCommands = formatBranchSummaryFollowupCommands(cwd, join(cwd, ".foreman"), summaries);
-            if (followupCommands.length > 0) {
-                console.log();
-                console.log("foreman: continue blocked branch ticket(s) with:");
-                for (const command of followupCommands) {
-                    console.log(`  ${command}`);
+                finally {
+                    db.close();
+                } },
+                handoffGeneration: () => { const db = new WorkflowDb(cwd); try {
+                    return db.handoffs(buildRun.runId).at(-1)?.generation ?? 0;
                 }
-            }
-            if (masterRun.status === "completed")
-                printHandoffPruneCommand(masterRun.runId);
-            const failed = summaries.some((row) => row.buildStatus === "blocked" || row.buildStatus === "needs-human");
-            fireTerminalBell(config.notifications.terminal_bell);
-            process.exit(failed ? 2 : 0);
-        }
-        const ready = await ensureRuntimeReadyForCommand(cwd, agent, { durable: { projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, scopeRevision: buildScopeRevision(cwd, approvalConsequences) }, timeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
-            label: "start",
-            yes: Boolean(opts.yes),
-            allowSwitch: !(opts.resume || opts.continue),
-            model,
-        });
-        agent = ready.runtime;
-        model = ready.model;
-        agentExecutable = ready.executable;
-        if (resumeSessionRef) {
-            if (resumeSessionRef.provider !== agent)
-                fail(`session ${resumeSessionRef.sessionId} belongs to ${resumeSessionRef.provider}, but this recovery selected ${agent}`);
-            const availability = await resolveProviderSessionAvailability(resumeSessionRef, {
-                cwd,
-                configRoot: cwd,
-                workspaceIdentity: captureCurrentWorkflowSessionIdentity(cwd),
-                runtimeExecutable: agentExecutable,
+                finally {
+                    db.close();
+                } },
+            }, (line, snapshot) => {
+                const activity = currentActivity();
+                if (activity)
+                    activity.setAgentStatus(line.replace(/^\[[^\]]+\]\s*/, ""));
+                else
+                    console.log(line);
+                activeObserver?.store.updateCurrentState({ runId: buildRun.runId, role: "builder", stream: "builder", executionId: activeObserver.executionId, ticketId: buildRun.currentTicket, providerSessionId: snapshot.contextSample.providerSessionId, phase: snapshot.phase, lastSignalAt: snapshot.contextSample.observedAt });
+                if (snapshot.contextSample.used !== undefined)
+                    activeObserver?.store.recordMetric({ runId: buildRun.runId, executionId: activeObserver.executionId, role: "builder", stream: "builder", providerSessionId: snapshot.contextSample.providerSessionId }, "context_used_tokens", snapshot.contextSample.used, { unit: "tokens" });
             });
-            if (availability.status !== "available" || !availability.sessionRef) {
-                fail(`exact session ${resumeSessionRef.sessionId} is ${availability.status} (${availability.reason ?? "validation failed"}): ${availability.detail ?? "no provider detail"}. The current worktree and recovery checkpoints were preserved; choose fresh-with-handoff recovery.`);
-            }
-            resumeSessionRef = availability.sessionRef;
-        }
-        if (qaEnabled) {
-            const qaReady = await ensureRuntimeReadyForCommand(cwd, qaAgent, { durable: { projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, scopeRevision: buildScopeRevision(cwd, approvalConsequences) }, timeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms, label: "independent QA", yes: Boolean(opts.yes), model: qaModel });
-            qaAgent = qaReady.runtime;
-            qaModel = qaReady.model;
-            qaExecutable = qaReady.executable;
-        }
-        const capturedBuilder = {
-            role: "builder", source: opts.agent || opts.model || opts.effort || opts.fast ? "cli" : roleDefaults.builder ? "project" : "provider",
-            make: agent, model: model ?? "default", reasoning: builderEffort ?? "default", fast: Boolean(builderFast),
-            session_strategy: roleDefaults.builder?.session_strategy ?? "compact", settings_revision: settingsRevision,
-            display_session_cost: sessionCostOverride ?? roleDefaults.builder?.display_session_cost ?? false,
-            auto_compact_threshold_percent: thresholdOverride ?? roleDefaults.builder?.auto_compact_threshold_percent ?? 50,
-            compact_maximum: roleDefaults.builder?.compact_maximum ?? 10,
-        };
-        const capturedQa = { role: "qa", source: roleDefaults.qa ? "project" : "provider", make: qaAgent, model: qaModel ?? "default", reasoning: qaEffort ?? "default", fast: qaFast, session_strategy: roleDefaults.qa?.session_strategy ?? "compact", display_session_cost: sessionCostOverride ?? roleDefaults.qa?.display_session_cost ?? false, auto_compact_threshold_percent: roleDefaults.qa?.auto_compact_threshold_percent ?? 50, compact_maximum: roleDefaults.qa?.compact_maximum ?? 10, settings_revision: settingsRevision };
-        let buildRun = recoveryRecord ? resumeBuildRun(cwd, recoveryRecord.runId, { builder: capturedBuilder, qa: capturedQa, builderSessionId: resumeSessionId ?? null, builderSessionRef: resumeSessionRef ?? null, expectedRecoveryDecisionDigest: opts.recoveryDecisionDigest }) : createBuildRun({
-            runId: invocationRunId,
-            tickets: [], repositoryRoot: cwd, branchMode: "current", baseRef: opts.base ?? loadTicketSetupConfig(cwd)?.build.base_branch, builder: capturedBuilder, qa: capturedQa,
-            frozenPolicy, autonomyProfile, qaEnabled,
-            runDecisions: { workMode: "current", workModeSource, branchPrefix, branchPrefixSource: resolvedPrefix.source, autoCompactThresholdPercent: capturedBuilder.auto_compact_threshold_percent ?? 50, thresholdSource: thresholdOverride === undefined ? "project" : "cli" },
-        });
-        activeObserver?.store.attachExecutionLease(activeObserver.executionId, readCurrentWorkflowLease(cwd)?.generation);
-        activeContinuityRunId = buildRun.runId;
-        const qaResumedRecovery = recoveryRecord ? pendingQaRecoveryPacket(cwd, buildRun.runId, typeof opts.ticket === "string" ? opts.ticket : undefined) : undefined;
-        let qaFinalizationTicket;
-        let qaProtocolResumeTicket;
-        if (recoveryRecord && !qaResumedRecovery) {
-            const finalizationDb = new WorkflowDb(cwd);
+            statusReporter.start();
+            const modifiers = [
+                model ? `model=${model}` : null,
+                builderEffort ? `effort=${builderEffort}` : null,
+                builderFast ? "fast" : null,
+                qaEnabled ? null : "qa=off",
+            ].filter(Boolean).join(" ");
+            console.log(`${accent("foreman:")} driving a ${sanitizeTerminalText(agent)} builder through ${steps} step(s)${modifiers ? ` [${sanitizeTerminalText(modifiers)}]` : ""}`);
+            console.log(`${accent("foreman:")} project ${sanitizeTerminalText(cwd)}`);
+            if (trackerRelPath)
+                console.log(`${accent("foreman:")} tracker ${sanitizeTerminalText(trackerRelPath)}`);
+            console.log(`${accent("foreman:")} log ${sanitizeTerminalText(logPath)}\n`);
+            const viewer = printEvents(builder.events());
             try {
-                const pendingHeads = finalizationDb.pendingQaTicketHeads(buildRun.runId);
-                if (pendingHeads.length > 1 && !opts.ticket)
-                    fail(`run ${buildRun.runId} has multiple pending QA tickets; select one with --ticket`);
-                const requested = typeof opts.ticket === "string" ? opts.ticket : undefined;
-                const head = requested ? pendingHeads.find((item) => item.ticketId === requested) : pendingHeads[0];
-                if (pendingHeads.length && requested && !head)
-                    fail(`--ticket ${requested} conflicts with the pending QA protocol ticket${pendingHeads.length === 1 ? ` ${pendingHeads[0].ticketId}` : "s"}`);
-                if (head) {
-                    if (head.state === "finalizing")
-                        qaFinalizationTicket = head.ticketId;
-                    else if (!["idle", "completed", "waived"].includes(head.state))
-                        qaProtocolResumeTicket = head.ticketId;
-                    if ((qaFinalizationTicket || qaProtocolResumeTicket)
-                        && (opts.qaRevision === undefined || !/^\d+$/.test(String(opts.qaRevision)) || Number(opts.qaRevision) !== head.revision)) {
-                        fail(`pending QA protocol requires exact --qa-revision ${head.revision}`);
+                if (recoveryRecord && currentBranchTicketProgress(cwd, buildRun)?.remaining.length === 0) {
+                    buildRun = finishRecoveredTicketScope(cwd, buildRun, "reconciled-completed-tickets");
+                    clearInterval(heartbeat);
+                    statusReporter.stop("completed");
+                    await foreman.close();
+                    await viewer;
+                    activeObserver?.finish(buildRun.status, observationSummaryMetadata(cwd, buildRun, qaEnabled, capturedBuilder.make));
+                    observabilityStore?.closeLogFile(logPath, buildRun.status);
+                    observabilityStore?.close();
+                    activeObserver = undefined;
+                    process.off("exit", finishObservationOnExit);
+                    console.log("foreman: recovered completed ticket scope");
+                    process.exit(0);
+                }
+                if (qaFinalizationTicket) {
+                    console.log(`ai-foreman: reconciling the interrupted QA finalization for ${qaFinalizationTicket}; Builder dispatch is disabled.\n`);
+                    await foreman.completePendingQaFinalization(qaFinalizationTicket);
+                    buildRun = finishRecoveredTicketScope(cwd, buildRun, "qa-finalization-complete");
+                    clearInterval(heartbeat);
+                    statusReporter.stop("QA finalization complete");
+                    await foreman.close();
+                    await viewer;
+                    activeObserver?.finish(buildRun.status, observationSummaryMetadata(cwd, buildRun, qaEnabled, capturedBuilder.make));
+                    observabilityStore?.closeLogFile(logPath, buildRun.status);
+                    observabilityStore?.close();
+                    activeObserver = undefined;
+                    process.off("exit", finishObservationOnExit);
+                    console.log(`foreman: reconciled QA finalization for ${qaFinalizationTicket}`);
+                    process.exit(0);
+                }
+                if (qaResumedRecovery || qaProtocolResumeTicket) {
+                    const ticketId = qaResumedRecovery?.manifest.ticketId ?? qaProtocolResumeTicket;
+                    console.log(`ai-foreman: resuming the exact QA boundary for ${ticketId}; Builder preflight and work dispatch are disabled.\n`);
+                    buildRun = checkpointBuildRun(cwd, buildRun, "qa-recovery-before-dispatch", { currentTicket: ticketId });
+                    const qa = await (activeObserver
+                        ? activeObserver.span("qa_recovery", "Exact QA-only recovery", () => foreman.completePendingQaRecovery(ticketId))
+                        : foreman.completePendingQaRecovery(ticketId));
+                    if (pendingHandoffGeneration !== undefined)
+                        throw new Error(`recovery handoff generation ${pendingHandoffGeneration} for ${pendingHandoffRole} was not accepted`);
+                    if (foreman.builderSessionId())
+                        buildRun = persistBuildSession(cwd, buildRun, "builder", foreman.builderAdapter().sessionRef?.() ?? foreman.builderSessionId());
+                    if (foreman.qaSessionId())
+                        buildRun = persistBuildSession(cwd, buildRun, "qa", foreman.qaSessionRef() ?? foreman.qaSessionId());
+                    buildRun = qa.outcome === "passed" || qa.outcome === "waived"
+                        ? finishRecoveredTicketScope(cwd, buildRun, "qa-recovery-complete")
+                        : releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, "qa-recovery-paused", {
+                            status: "recoverable", currentTicket: ticketId,
+                        }), "recoverable");
+                    clearInterval(heartbeat);
+                    statusReporter.stop(qa.outcome === "passed" || qa.outcome === "waived" ? "QA recovery complete" : "paused");
+                    await foreman.close();
+                    await viewer;
+                    activeObserver?.finish(buildRun.status, observationSummaryMetadata(cwd, buildRun, qaEnabled, capturedBuilder.make));
+                    observabilityStore?.closeLogFile(logPath, buildRun.status);
+                    observabilityStore?.enforceLimits();
+                    observabilityStore?.maintainLogs(cwd);
+                    observabilityStore?.close();
+                    activeObserver = undefined;
+                    process.off("exit", finishObservationOnExit);
+                    console.log(`foreman: exact QA recovery for ${ticketId} — ${qa.outcome}`);
+                    if (qa.detail)
+                        console.log(`foreman: ${qa.detail}`);
+                    process.exit(qa.outcome === "passed" || qa.outcome === "waived" ? 0 : 2);
+                }
+                console.log("ai-foreman: asking builder to plan the next tickets or steps...\n");
+                buildRun = checkpointBuildRun(cwd, buildRun, "before-preflight");
+                await (activeObserver ? activeObserver.span("preflight", "Builder preflight", () => foreman.runPreflight(steps, ticketsContent, preferredTicket, executionTickets)) : foreman.runPreflight(steps, ticketsContent, preferredTicket, executionTickets));
+                buildRun = withRunLocalAcceptedRuntimes(buildRun);
+                if (foreman.builderSessionId())
+                    buildRun = persistBuildSession(cwd, buildRun, "builder", foreman.builderAdapter().sessionRef?.() ?? foreman.builderSessionId());
+                if (foreman.qaSessionId())
+                    buildRun = persistBuildSession(cwd, buildRun, "qa", foreman.qaSessionRef() ?? foreman.qaSessionId());
+                buildRun = checkpointBuildRun(cwd, buildRun, "preflight-complete");
+                let planDecisionRevision = 0;
+                const ensureApproved = createBuildApprovalGate(cwd, executionTickets, autoApprovePlanUpdates, approvalConsequences, async () => {
+                    while (true) {
+                        console.log();
+                        const action = await durableHumanDecision({ projectDir: cwd, runId: invocationRunId, key: `build-plan:${buildScopeRevision(cwd, approvalConsequences)}:${planDecisionRevision}`, observer: activeObserver, prompt: "How does this plan look?", choices: [{ id: "proceed", label: "Proceed" }, { id: "feedback", label: "Feedback" }, { id: "cancel", label: "Cancel" }], operation: () => select({
+                                message: "How does this plan look?",
+                                options: [
+                                    { value: "proceed", label: "Proceed — start implementing" },
+                                    { value: "feedback", label: "Give feedback — revise the plan" },
+                                    { value: "cancel", label: "Cancel" },
+                                ],
+                            }) });
+                        if (isCancel(action) || action === "cancel") {
+                            const cancelled = action === "cancel";
+                            if (cancelled) {
+                                const decisions = new WorkflowDb(cwd);
+                                try {
+                                    decisions.cancelPendingHumanDecisions(invocationRunId, "User cancelled build; pending decisions superseded");
+                                }
+                                finally {
+                                    decisions.close();
+                                }
+                            }
+                            buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, cancelled ? "cancelled" : "input-paused", { status: cancelled ? "cancelled" : "recoverable" }), cancelled ? "cancelled" : "recoverable");
+                            activeObserver?.finish(cancelled ? "cancelled" : "paused", { checkpoint: cancelled ? "user-cancel" : "prompt-eof-or-cancel" });
+                            console.log("ai-foreman: cancelled");
+                            statusReporter.stop("cancelled");
+                            await foreman.close();
+                            await viewer;
+                            process.exit(0);
+                        }
+                        if (action === "proceed") {
+                            console.log();
+                            break;
+                        }
+                        const fb = await durableHumanDecision({ projectDir: cwd, runId: invocationRunId, key: `build-plan-feedback:${buildScopeRevision(cwd, approvalConsequences)}:${planDecisionRevision}`, observer: activeObserver, prompt: "Your build plan feedback:", choices: [{ id: "custom", label: "Provide feedback" }], operation: () => text({
+                                message: "Your feedback:",
+                                validate: (v) => (v?.trim() ? undefined : "Please enter some feedback"),
+                            }) });
+                        if (isCancel(fb) || fb === undefined) {
+                            buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, "input-paused", { status: "recoverable" }), "recoverable");
+                            activeObserver?.finish("paused", { checkpoint: "feedback-eof-or-cancel" });
+                            console.log("ai-foreman: cancelled");
+                            statusReporter.stop("cancelled");
+                            await foreman.close();
+                            await viewer;
+                            process.exit(0);
+                        }
+                        console.log();
+                        await foreman.sendPreflightFeedback(String(fb));
+                        planDecisionRevision++;
                     }
+                });
+                await ensureApproved();
+                if (!isTicketsInitialized(cwd)) {
+                    const synthetic = initializeSyntheticWork(cwd, buildRun.runId, steps, `Explicit unticketed build invocation ${invocationRunId}`, foreman.approvedPlanText());
+                    buildRun = checkpointBuildRun(cwd, buildRun, "synthetic-work-admitted", { tickets: synthetic });
                 }
-            }
-            finally {
-                finalizationDb.close();
-            }
-        }
-        if (qaResumedRecovery && String(opts.ticket ?? qaResumedRecovery.manifest.ticketId) !== qaResumedRecovery.manifest.ticketId)
-            fail(`--ticket ${String(opts.ticket)} conflicts with pending QA recovery ticket ${qaResumedRecovery.manifest.ticketId}`);
-        if (qaResumedRecovery) {
-            const qaDb = new WorkflowDb(cwd);
-            try {
-                const currentRevision = qaDb.qaTicketHead(buildRun.runId, qaResumedRecovery.manifest.ticketId).revision;
-                if (opts.qaRevision === undefined || !/^\d+$/.test(String(opts.qaRevision)) || Number(opts.qaRevision) !== currentRevision)
-                    fail(`pending QA recovery requires exact --qa-revision ${currentRevision}`);
-            }
-            finally {
-                qaDb.close();
-            }
-        }
-        const heartbeat = setInterval(() => { buildRun = heartbeatBuildRun(cwd, buildRun); }, 10_000);
-        heartbeat.unref();
-        const checkpointSignal = () => {
-            try {
-                buildRun = releaseBuildLease(cwd, buildRun, "interrupted");
-            }
-            catch { /* best effort */ }
-        };
-        process.once("SIGINT", checkpointSignal);
-        process.once("SIGTERM", checkpointSignal);
-        let builder;
-        try {
-            builder = await createBuilder(cwd, resumeSessionId, resumeSessionRef);
-        }
-        catch (error) {
-            if (!(error instanceof SessionUnavailableError))
-                throw error;
-            const summary = error.message.slice(0, 1000);
-            buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, "session-unavailable-before-dispatch", {
-                status: "recoverable",
-                failure: { category: "session-unavailable", summary, at: new Date().toISOString() },
-            }), "recoverable");
-            clearInterval(heartbeat);
-            log.write("session-unavailable", { runId: buildRun.runId, phase: error.failure.phase, dispatchState: error.failure.dispatchState, message: summary });
-            console.error(`foreman: exact provider session unavailable before dispatch; current worktree state was preserved: ${summary}`);
-            console.error(`foreman: inspect recovery with: rafi build:resume ${shellQuote(cwd)} --run ${shellQuote(buildRun.runId)} --inspect`);
-            process.exit(2);
-        }
-        const contextController = RoleSessionController.managed({
-            projectDir: cwd,
-            runId: buildRun.runId,
-            role: "builder",
-            initialSettings: capturedBuilder,
-            historicalCountUncertain: recoveryCompactionHistoryUncertain(cwd, recoveryRecord, buildRun.runId, "builder"),
-            readSettings: () => liveRoleSettings("builder", capturedBuilder),
-            settingsBoundary: (input) => applyBuilderSettingsBoundary(buildRun.runId, cwd, input),
-            settingsAdopted: (settings, active) => liveStatusReporter?.updateState({
-                role: "builder", provider: active.agent, model: settings.model, reasoning: settings.reasoning, fast: settings.fast,
-                adapter: active, settingsRevision: settings.settings_revision, displaySessionCost: settings.display_session_cost,
-                sessionTransition: "adopted live settings",
-            }),
-            report: (event) => {
-                currentActivity()?.update(event.kind, event.detail, { provider: capturedBuilder.make, model: capturedBuilder.model });
-            },
-            handoff: async ({ reason, adapter, sample, settings, compactionCount, frozenAction }) => {
-                const nativeUsage = await adapter.sessionUsage?.().catch(() => undefined);
-                const transfer = await new HandoffService(cwd).transfer({
-                    runId: buildRun.runId,
-                    role: "builder",
-                    reason,
-                    predecessorSessionId: adapter.sessionId(),
-                    predecessorSessionRef: adapter.sessionRef?.(),
-                    roleState: { frozenActionDigest: createHash("sha256").update(frozenAction).digest("hex"), contextSample: sample },
-                    ...(nativeUsage ? { sessionUsage: {
-                            version: 1, runId: buildRun.runId, role: "builder", provider: adapter.agent,
-                            providerSessionId: adapter.sessionId(), observedAt: nativeUsage.observedAt, source: nativeUsage.source,
-                            cumulativeInputTokens: nativeUsage.inputTokens, cumulativeOutputTokens: nativeUsage.outputTokens,
-                            cumulativeTotalTokens: nativeUsage.totalTokens, authoritativeCostUsd: nativeUsage.authoritativeCostUsd,
-                        } } : {}),
-                    compactionCount,
-                    compactMaximum: settings.compact_maximum ?? 10,
-                    resources: [{ label: "frozen-action", content: frozenAction, authoritative: true }],
-                }, (_handoff, runtime) => createBuilderForSettings(cwd, settingsForRequestedRuntime(settings, runtime)), handoffRecoveryOptions("builder"));
-                log.write("handoff-transfer", { generation: transfer.manifest.generation, predecessorSessionId: transfer.manifest.predecessorSessionId, successorSessionId: transfer.successorSessionId, acceptanceCheckpointDigest: transfer.acceptanceCheckpointDigest });
-                if (adapter instanceof ContinuityAdapter) {
-                    await adapter.adoptValidatedSuccessor(transfer.successor);
-                    return adapter;
-                }
-                await adapter.close();
-                return continuousBuilder(transfer.successor, cwd, buildRun.runId, settings);
-            },
-        });
-        const foreman = new Foreman(builder, log, { desktop: config.notifications.enabled, terminalBell: config.notifications.terminal_bell }, qaEnabled, frozenPolicy.limits.builderQaFixesPerTicket, cwd, undefined, qaEnabled ? createQa : undefined, capturedQa.session_strategy, createBuilder, capturedBuilder.session_strategy, qaNonconvergence, async (adapter, frozenAction) => (await contextController.atSafeBoundary(adapter, frozenAction)).adapter, async (adapter, frozenAction, strategy) => (await contextController.atWorkSessionBoundary(adapter, frozenAction, strategy)).adapter, qaSessionBoundary, observeQaNativeCompactions, async (adapter) => { await contextController.observeNativeCompactions(adapter); }, activeObserver, capturedQa, true, qaReportRecovery, qaResumedRecovery, buildRun.runId, frozenPolicy.continueIndependentTickets);
-        activeBuilderForStatus = () => foreman.builderAdapter();
-        const statusReporter = liveStatusReporter = new AgentStatusReporter({
-            runId: buildRun.runId,
-            role: "builder", provider: capturedBuilder.make, model: capturedBuilder.model,
-            reasoning: capturedBuilder.reasoning, fast: capturedBuilder.fast, step: 1, total: steps,
-            phase: "builder work session", sessionTransition: resumeSessionId ? "resumed exact session" : "initial session", adapter: () => foreman.builderAdapter(),
-            settingsRevision: capturedBuilder.settings_revision,
-            displaySessionCost: capturedBuilder.display_session_cost ?? false,
-            compactionCount: () => { const db = new WorkflowDb(cwd); try {
-                return db.successfulCompactionCount(buildRun.runId, "builder", foreman.builderAdapter().sessionRef?.() ?? foreman.builderSessionId());
-            }
-            finally {
-                db.close();
-            } },
-            handoffGeneration: () => { const db = new WorkflowDb(cwd); try {
-                return db.handoffs(buildRun.runId).at(-1)?.generation ?? 0;
-            }
-            finally {
-                db.close();
-            } },
-        }, (line, snapshot) => {
-            const activity = currentActivity();
-            if (activity)
-                activity.setAgentStatus(line.replace(/^\[[^\]]+\]\s*/, ""));
-            else
-                console.log(line);
-            activeObserver?.store.updateCurrentState({ runId: buildRun.runId, role: "builder", stream: "builder", executionId: activeObserver.executionId, ticketId: buildRun.currentTicket, providerSessionId: snapshot.contextSample.providerSessionId, phase: snapshot.phase, lastSignalAt: snapshot.contextSample.observedAt });
-            if (snapshot.contextSample.used !== undefined)
-                activeObserver?.store.recordMetric({ runId: buildRun.runId, executionId: activeObserver.executionId, role: "builder", stream: "builder", providerSessionId: snapshot.contextSample.providerSessionId }, "context_used_tokens", snapshot.contextSample.used, { unit: "tokens" });
-        });
-        statusReporter.start();
-        const modifiers = [
-            model ? `model=${model}` : null,
-            builderEffort ? `effort=${builderEffort}` : null,
-            builderFast ? "fast" : null,
-            qaEnabled ? null : "qa=off",
-        ].filter(Boolean).join(" ");
-        console.log(`foreman: driving a ${agent} builder through ${steps} step(s)${modifiers ? ` [${modifiers}]` : ""}`);
-        console.log(`foreman: project ${cwd}`);
-        if (trackerRelPath)
-            console.log(`foreman: tracker ${trackerRelPath}`);
-        console.log(`foreman: log ${logPath}\n`);
-        const viewer = printEvents(builder.events());
-        try {
-            if (qaFinalizationTicket) {
-                console.log(`ai-foreman: reconciling the interrupted QA finalization for ${qaFinalizationTicket}; Builder dispatch is disabled.\n`);
-                await foreman.completePendingQaFinalization(qaFinalizationTicket);
-                buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, "qa-finalization-complete", { status: "recoverable", currentTicket: qaFinalizationTicket }), "recoverable");
-                clearInterval(heartbeat);
-                statusReporter.stop("QA finalization complete");
-                await foreman.close();
-                await viewer;
-                activeObserver?.finish(buildRun.status, observationSummaryMetadata(cwd, buildRun, qaEnabled, capturedBuilder.make));
-                observabilityStore?.closeLogFile(logPath, buildRun.status);
-                observabilityStore?.close();
-                activeObserver = undefined;
-                process.off("exit", finishObservationOnExit);
-                console.log(`foreman: reconciled QA finalization for ${qaFinalizationTicket}`);
-                process.exit(0);
-            }
-            if (qaResumedRecovery || qaProtocolResumeTicket) {
-                const ticketId = qaResumedRecovery?.manifest.ticketId ?? qaProtocolResumeTicket;
-                console.log(`ai-foreman: resuming the exact QA boundary for ${ticketId}; Builder preflight and work dispatch are disabled.\n`);
-                buildRun = checkpointBuildRun(cwd, buildRun, "qa-recovery-before-dispatch", { currentTicket: ticketId });
-                const qa = await (activeObserver
-                    ? activeObserver.span("qa_recovery", "Exact QA-only recovery", () => foreman.completePendingQaRecovery(ticketId))
-                    : foreman.completePendingQaRecovery(ticketId));
+                const onTicketStart = async (ticketId) => {
+                    await ensureApproved();
+                    admitApprovedTicket(cwd, buildRun.runId, ticketId, buildScopeRevision(cwd), `build invocation ${invocationRunId}: approved ticket selection`);
+                    const tickets = buildRun.tickets.includes(ticketId) ? buildRun.tickets : [...buildRun.tickets, ticketId];
+                    buildRun = checkpointBuildRun(cwd, buildRun, "ticket-selected", { tickets, currentTicket: ticketId,
+                        ...(buildRun.authorizedBatch ? { authorizedBatch: { ...buildRun.authorizedBatch, approvalRevisions: [...new Set([...(buildRun.authorizedBatch.approvalRevisions ?? [buildRun.authorizedBatch.scopeRevision]), buildScopeRevision(cwd, approvalConsequences)])], startedTickets: [...new Set([...buildRun.authorizedBatch.startedTickets, ticketId])] } } : {}) });
+                };
+                const batch = () => foreman.runBatch(steps, trackerRelPath, onTicketStart, preferredTicket, executionTickets);
+                const result = await (activeObserver ? activeObserver.span("builder_work", "Builder and QA batch", batch) : batch());
                 if (pendingHandoffGeneration !== undefined)
-                    throw new Error(`recovery handoff generation ${pendingHandoffGeneration} for ${pendingHandoffRole} was not accepted`);
+                    throw new Error(`recovery handoff generation ${pendingHandoffGeneration} for ${pendingHandoffRole} was not accepted; recovery mode was not substituted`);
                 if (foreman.builderSessionId())
                     buildRun = persistBuildSession(cwd, buildRun, "builder", foreman.builderAdapter().sessionRef?.() ?? foreman.builderSessionId());
                 if (foreman.qaSessionId())
                     buildRun = persistBuildSession(cwd, buildRun, "qa", foreman.qaSessionRef() ?? foreman.qaSessionId());
-                buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, qa.outcome === "passed" || qa.outcome === "waived" ? "qa-recovery-complete" : "qa-recovery-paused", {
-                    status: "recoverable", currentTicket: ticketId,
-                }), "recoverable");
+                buildRun = buildRun.tickets.length && isTicketsInitialized(cwd)
+                    ? finishRecoveredTicketScope(cwd, buildRun, "ticket-recovery-boundary")
+                    : result.outcome === "all-done" || result.outcome === "plan-complete"
+                        ? completeBuildRun(cwd, buildRun)
+                        : releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, "builder-or-qa-interrupted", { status: "recoverable" }), "recoverable");
                 clearInterval(heartbeat);
-                statusReporter.stop(qa.outcome === "passed" || qa.outcome === "waived" ? "QA recovery complete" : "paused");
+                statusReporter.stop(buildRun.status === "completed" ? "completed" : "paused");
                 await foreman.close();
                 await viewer;
                 activeObserver?.finish(buildRun.status, observationSummaryMetadata(cwd, buildRun, qaEnabled, capturedBuilder.make));
@@ -2274,183 +2570,123 @@ export function buildStartCommand() {
                 observabilityStore?.enforceLimits();
                 observabilityStore?.maintainLogs(cwd);
                 observabilityStore?.close();
+                pruneRecoveryTelemetryAtCompletion(cwd, config.observability.detail_retention_days);
                 activeObserver = undefined;
                 process.off("exit", finishObservationOnExit);
-                console.log(`foreman: exact QA recovery for ${ticketId} — ${qa.outcome}`);
-                if (qa.detail)
-                    console.log(`foreman: ${qa.detail}`);
-                process.exit(qa.outcome === "passed" || qa.outcome === "waived" ? 0 : 2);
-            }
-            console.log("ai-foreman: asking builder to plan the next tickets or steps...\n");
-            buildRun = checkpointBuildRun(cwd, buildRun, "before-preflight");
-            await (activeObserver ? activeObserver.span("preflight", "Builder preflight", () => foreman.runPreflight(steps, ticketsContent, preferredTicket)) : foreman.runPreflight(steps, ticketsContent, preferredTicket));
-            buildRun = withRunLocalAcceptedRuntimes(buildRun);
-            if (foreman.builderSessionId())
-                buildRun = persistBuildSession(cwd, buildRun, "builder", foreman.builderAdapter().sessionRef?.() ?? foreman.builderSessionId());
-            if (foreman.qaSessionId())
-                buildRun = persistBuildSession(cwd, buildRun, "qa", foreman.qaSessionRef() ?? foreman.qaSessionId());
-            buildRun = checkpointBuildRun(cwd, buildRun, "preflight-complete");
-            let planDecisionRevision = 0;
-            if (requiresBuildApproval(cwd, preferredTicket ? [preferredTicket] : undefined, autoApprovePlanUpdates, approvalConsequences)) {
-                while (true) {
-                    console.log();
-                    const action = await durableHumanDecision({ projectDir: cwd, runId: invocationRunId, key: `build-plan:${buildScopeRevision(cwd, approvalConsequences)}:${planDecisionRevision}`, observer: activeObserver, prompt: "How does this plan look?", choices: [{ id: "proceed", label: "Proceed" }, { id: "feedback", label: "Feedback" }, { id: "cancel", label: "Cancel" }], operation: () => select({
-                            message: "How does this plan look?",
-                            options: [
-                                { value: "proceed", label: "Proceed — start implementing" },
-                                { value: "feedback", label: "Give feedback — revise the plan" },
-                                { value: "cancel", label: "Cancel" },
-                            ],
-                        }) });
-                    if (isCancel(action) || action === "cancel") {
-                        console.log("ai-foreman: cancelled");
-                        statusReporter.stop("cancelled");
-                        await foreman.close();
-                        await viewer;
-                        process.exit(0);
-                    }
-                    if (action === "proceed") {
-                        console.log();
-                        break;
+                console.log(`\n${accent("foreman:")} ${result.completed}/${result.requested} step(s) completed`);
+                const safeOutcome = sanitizeTerminalText(result.outcome);
+                const resultOutcome = /success|complete|pass/i.test(safeOutcome) ? success(safeOutcome)
+                    : /fail|error/i.test(safeOutcome) ? error(safeOutcome)
+                        : /warn|partial|blocked/i.test(safeOutcome) ? warning(safeOutcome) : safeOutcome;
+                console.log(`${accent("foreman:")} outcome — ${resultOutcome}`);
+                if (result.detail)
+                    console.log(`foreman: ${result.detail}`);
+                if (buildRun.status === "completed")
+                    printHandoffPruneCommand(buildRun.runId);
+                if (result.outcome !== "all-done" && result.outcome !== "plan-complete") {
+                    const executable = command.parent?.name() === "rafi" ? "rafi" : "ai-foreman";
+                    const remainingSteps = Math.max(1, result.requested - result.completed);
+                    const decisionsDb = new WorkflowDb(cwd);
+                    try {
+                        for (const line of formatResumeGuidance(executable, cwd, remainingSteps, foreman.builderSessionId(), {
+                            runId: buildRun.runId, decisions: decisionsDb.pendingHumanDecisions(buildRun.runId),
+                        }))
+                            console.log(line);
                     }
-                    const fb = await durableHumanDecision({ projectDir: cwd, runId: invocationRunId, key: `build-plan-feedback:${buildScopeRevision(cwd, approvalConsequences)}:${planDecisionRevision}`, observer: activeObserver, prompt: "Your build plan feedback:", choices: [{ id: "custom", label: "Provide feedback" }], operation: () => text({
-                            message: "Your feedback:",
-                            validate: (v) => (v?.trim() ? undefined : "Please enter some feedback"),
-                        }) });
-                    if (isCancel(fb)) {
-                        console.log("ai-foreman: cancelled");
-                        statusReporter.stop("cancelled");
-                        await foreman.close();
-                        await viewer;
-                        process.exit(0);
+                    finally {
+                        decisionsDb.close();
                     }
-                    console.log();
-                    await foreman.sendPreflightFeedback(String(fb));
-                    planDecisionRevision++;
                 }
+                fireTerminalBell(config.notifications.terminal_bell);
+                process.exit(result.outcome === "needs-human" || result.outcome === "blocked" ? 2 : 0);
             }
-            const result = await (activeObserver ? activeObserver.span("builder_work", "Builder and QA batch", () => foreman.runBatch(steps, trackerRelPath, (ticketId) => {
-                const tickets = buildRun.tickets.includes(ticketId)
-                    ? buildRun.tickets
-                    : [...buildRun.tickets, ticketId];
-                buildRun = checkpointBuildRun(cwd, buildRun, "ticket-selected", {
-                    tickets,
-                    currentTicket: ticketId,
-                });
-            }, preferredTicket)) : foreman.runBatch(steps, trackerRelPath, (ticketId) => {
-                const tickets = buildRun.tickets.includes(ticketId) ? buildRun.tickets : [...buildRun.tickets, ticketId];
-                buildRun = checkpointBuildRun(cwd, buildRun, "ticket-selected", { tickets, currentTicket: ticketId });
-            }, preferredTicket));
-            if (pendingHandoffGeneration !== undefined)
-                throw new Error(`recovery handoff generation ${pendingHandoffGeneration} for ${pendingHandoffRole} was not accepted; recovery mode was not substituted`);
-            if (foreman.builderSessionId())
-                buildRun = persistBuildSession(cwd, buildRun, "builder", foreman.builderAdapter().sessionRef?.() ?? foreman.builderSessionId());
-            if (foreman.qaSessionId())
-                buildRun = persistBuildSession(cwd, buildRun, "qa", foreman.qaSessionRef() ?? foreman.qaSessionId());
-            buildRun = result.outcome === "all-done" || result.outcome === "plan-complete"
-                ? completeBuildRun(cwd, buildRun)
-                : releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, "builder-or-qa-interrupted", { status: "recoverable" }), "recoverable");
-            clearInterval(heartbeat);
-            statusReporter.stop(buildRun.status === "completed" ? "completed" : "paused");
-            await foreman.close();
-            await viewer;
-            activeObserver?.finish(buildRun.status, observationSummaryMetadata(cwd, buildRun, qaEnabled, capturedBuilder.make));
-            observabilityStore?.closeLogFile(logPath, buildRun.status);
-            observabilityStore?.enforceLimits();
-            observabilityStore?.maintainLogs(cwd);
-            observabilityStore?.close();
-            pruneRecoveryTelemetryAtCompletion(cwd, config.observability.detail_retention_days);
-            activeObserver = undefined;
-            process.off("exit", finishObservationOnExit);
-            console.log(`\nforeman: ${result.completed}/${result.requested} step(s) completed`);
-            console.log(`foreman: outcome — ${result.outcome}`);
-            if (result.detail)
-                console.log(`foreman: ${result.detail}`);
-            if (buildRun.status === "completed")
-                printHandoffPruneCommand(buildRun.runId);
-            if (result.outcome !== "all-done" && result.outcome !== "plan-complete") {
-                const executable = command.parent?.name() === "rafi" ? "rafi" : "ai-foreman";
-                const remainingSteps = Math.max(1, result.requested - result.completed);
-                const decisionsDb = new WorkflowDb(cwd);
-                try {
-                    for (const line of formatResumeGuidance(executable, cwd, remainingSteps, foreman.builderSessionId(), {
-                        runId: buildRun.runId, decisions: decisionsDb.pendingHumanDecisions(buildRun.runId),
-                    }))
-                        console.log(line);
+            catch (err) {
+                clearInterval(heartbeat);
+                statusReporter.stop("interrupted");
+                if (err instanceof ContextCapabilityError || err instanceof CurrentWorkflowChangedError) {
+                    const summary = err.message.slice(0, 1000);
+                    buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, "safe-boundary-paused", {
+                        status: "recoverable",
+                        failure: { category: "unknown", summary, at: new Date().toISOString() },
+                    }), "recoverable");
+                    await foreman.close().catch(() => { });
+                    log.write("safe-boundary-paused", { runId: buildRun.runId, message: summary });
+                    console.error(`foreman: run paused safely: ${summary}`);
+                    console.error(`foreman: after resolving the condition, inspect recovery with: ${formatRecoveryCommand(cwd)}`);
+                    process.exit(2);
                 }
-                finally {
-                    decisionsDb.close();
+                if (err instanceof SessionUnavailableContinuityError || err instanceof SessionUnavailableError) {
+                    const guided = err instanceof SessionUnavailableContinuityError ? err.guidedRecovery : err.failure.dispatchState === "unknown";
+                    const summary = err.message.slice(0, 1000);
+                    buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, guided ? "guided-recovery-required" : "session-unavailable-before-dispatch", {
+                        status: "recoverable",
+                        failure: { category: "session-unavailable", summary, at: new Date().toISOString() },
+                    }), "recoverable");
+                    await foreman.close().catch(() => { });
+                    log.write("session-unavailable", { runId: buildRun.runId, guided, message: summary });
+                    console.error(`foreman: exact provider session unavailable; current worktree state was preserved: ${summary}`);
+                    console.error(guided
+                        ? `foreman: continue with: ${formatRecoveryCommand(cwd)}`
+                        : `foreman: inspect recovery with: ${formatRecoveryCommand(cwd)}`);
+                    process.exit(2);
                 }
-            }
-            fireTerminalBell(config.notifications.terminal_bell);
-            process.exit(result.outcome === "needs-human" || result.outcome === "blocked" ? 2 : 0);
-        }
-        catch (err) {
-            clearInterval(heartbeat);
-            statusReporter.stop("interrupted");
-            if (err instanceof ContextCapabilityError || err instanceof CurrentWorkflowChangedError) {
-                const summary = err.message.slice(0, 1000);
-                buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, "safe-boundary-paused", {
-                    status: "recoverable",
-                    failure: { category: "unknown", summary, at: new Date().toISOString() },
-                }), "recoverable");
-                await foreman.close().catch(() => { });
-                log.write("safe-boundary-paused", { runId: buildRun.runId, message: summary });
-                console.error(`foreman: run paused safely: ${summary}`);
-                console.error(`foreman: after resolving the condition, inspect recovery with: rafi build:resume ${shellQuote(cwd)} --run ${shellQuote(buildRun.runId)} --inspect`);
-                process.exit(2);
-            }
-            if (err instanceof SessionUnavailableContinuityError || err instanceof SessionUnavailableError) {
-                const guided = err instanceof SessionUnavailableContinuityError ? err.guidedRecovery : err.failure.dispatchState === "unknown";
-                const summary = err.message.slice(0, 1000);
-                buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, guided ? "guided-recovery-required" : "session-unavailable-before-dispatch", {
-                    status: "recoverable",
-                    failure: { category: "session-unavailable", summary, at: new Date().toISOString() },
-                }), "recoverable");
-                await foreman.close().catch(() => { });
-                log.write("session-unavailable", { runId: buildRun.runId, guided, message: summary });
-                console.error(`foreman: exact provider session unavailable; current worktree state was preserved: ${summary}`);
-                console.error(guided
-                    ? `foreman: continue with: rafi build:resume ${shellQuote(cwd)} --run ${shellQuote(buildRun.runId)} --guided-recovery`
-                    : `foreman: inspect recovery with: rafi build:resume ${shellQuote(cwd)} --run ${shellQuote(buildRun.runId)} --inspect`);
-                process.exit(2);
-            }
-            if (err instanceof HandoffAcceptanceError || err instanceof HandoffRecoveryPausedError) {
-                const summary = err.message.slice(0, 1000);
-                buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, "handoff-recovery-required", {
-                    status: "recoverable",
-                    failure: { category: "unknown", summary, at: new Date().toISOString() },
-                }), "recoverable");
-                await foreman.close().catch(() => { });
-                log.write("safe-boundary-paused", { runId: buildRun.runId, message: summary, handoff: true });
-                console.error(`foreman: handoff paused at a recoverable checkpoint: ${summary}`);
-                console.error(`foreman: resume this run with: rafi build:resume ${shellQuote(cwd)} --run ${shellQuote(buildRun.runId)}`);
-                process.exit(2);
-            }
-            if (err instanceof HumanDecisionRequired) {
-                buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, "waiting-for-human", { status: "recoverable" }), "recoverable");
+                if (err instanceof HandoffAcceptanceError || err instanceof HandoffRecoveryPausedError) {
+                    const summary = err.message.slice(0, 1000);
+                    buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, "handoff-recovery-required", {
+                        status: "recoverable",
+                        failure: { category: "unknown", summary, at: new Date().toISOString() },
+                    }), "recoverable");
+                    await foreman.close().catch(() => { });
+                    log.write("safe-boundary-paused", { runId: buildRun.runId, message: summary, handoff: true });
+                    console.error(`foreman: handoff paused at a recoverable checkpoint: ${summary}`);
+                    console.error(`foreman: resume this run with: ${formatRecoveryCommand(cwd)}`);
+                    process.exit(2);
+                }
+                if (err instanceof HumanDecisionCancelled) {
+                    buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, "cancelled", { status: "cancelled" }), "cancelled");
+                    activeObserver?.finish("cancelled", { checkpoint: "question-menu" });
+                    await foreman.close().catch(() => { });
+                    console.log("ai-foreman: cancelled");
+                    process.exit(0);
+                }
+                if (err instanceof HumanDecisionRequired) {
+                    buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, "waiting-for-human", { status: "recoverable" }), "recoverable");
+                    await foreman.close().catch(() => { });
+                    console.error(err.message);
+                    process.exit(2);
+                }
+                if (err instanceof HandoffLoopError || err instanceof ContinuityRecoveryRequiredError) {
+                    const summary = err.message.slice(0, 1000);
+                    buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, "guided-recovery-required", {
+                        status: "recoverable",
+                        failure: { category: "unknown", summary, at: new Date().toISOString() },
+                    }), "recoverable");
+                    await foreman.close().catch(() => { });
+                    log.write("guided-recovery-required", { runId: buildRun.runId, message: summary });
+                    console.error(`foreman: run paused at a recoverable continuity checkpoint: ${summary}`);
+                    console.error(`foreman: continue with: ${formatRecoveryCommand(cwd)}`);
+                    process.exit(2);
+                }
+                buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, "failed", { status: "failed", failure: { category: "unknown", summary: err instanceof Error ? err.message.slice(0, 1000) : String(err).slice(0, 1000), at: new Date().toISOString() } }), "failed");
                 await foreman.close().catch(() => { });
-                console.error(err.message);
-                process.exit(2);
+                log.write("error", { message: String(err) });
+                fail(`run failed: ${err instanceof Error ? err.message : String(err)}`);
             }
-            if (err instanceof HandoffLoopError || err instanceof ContinuityRecoveryRequiredError) {
-                const summary = err.message.slice(0, 1000);
-                buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, "guided-recovery-required", {
-                    status: "recoverable",
-                    failure: { category: "unknown", summary, at: new Date().toISOString() },
-                }), "recoverable");
-                await foreman.close().catch(() => { });
-                log.write("guided-recovery-required", { runId: buildRun.runId, message: summary });
-                console.error(`foreman: run paused at a recoverable continuity checkpoint: ${summary}`);
-                console.error(`foreman: continue with: rafi build:resume ${shellQuote(cwd)} --run ${shellQuote(buildRun.runId)} --guided-recovery`);
-                process.exit(2);
+        }
+        catch (error) {
+            if (error instanceof HumanDecisionCancelled) {
+                console.log("ai-foreman: cancelled");
+                return;
             }
-            buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, "failed", { status: "failed", failure: { category: "unknown", summary: err instanceof Error ? err.message.slice(0, 1000) : String(err).slice(0, 1000), at: new Date().toISOString() } }), "failed");
-            await foreman.close().catch(() => { });
-            log.write("error", { message: String(err) });
-            fail(`run failed: ${err instanceof Error ? err.message : String(err)}`);
+            if (!(error instanceof HumanDecisionRequired))
+                throw error;
+            console.error(error.message);
+            process.exitCode = 2;
         }
-    });
+        finally {
+            finishStartAdmission(cwd, supervisedInvocationId);
+        }
+    }));
 }
 function ticketSizeBucket(projectDir, ticketIds) {
     if (!ticketIds.length || !isTicketsInitialized(projectDir))
@@ -2542,8 +2778,11 @@ export function createQaNonconvergenceHandler(projectDir, noninteractive, planne
             throw new Error("QA nonconvergence requires its owning build run");
         const scope = createHash("sha256").update(JSON.stringify([buildScopeRevision(projectDir), context.ticket, context.history])).digest("hex");
         let round = 0;
+        let waiverDecisionId;
         const ask = (phase, choices, operation) => durableHumanDecision({
             projectDir, runId, ticketId: context.ticket.id, observer: observer?.(), defer: noninteractive,
+            onAnswered: decision => { if (phase.startsWith("QA waiver confirmation") && decision.selectedChoiceId === "yes")
+                waiverDecisionId = decision.decisionId; },
             key: `qa-nonconvergence:${scope}:${round}:${phase}`, prompt: `${context.ticket.id}: ${phase}`, choices, operation,
         });
         while (true) {
@@ -2564,7 +2803,10 @@ export function createQaNonconvergenceHandler(projectDir, noninteractive, planne
                     ] }));
                 if (approved === "yes") {
                     const db = new WorkflowDb(projectDir);
+                    let authorizationRef;
                     try {
+                        if (db.qaPreparationStore().policy(runId)?.mode === "enforce")
+                            authorizationRef = db.authorizeContractQaWaiver(runId, context.ticket.id, waiverDecisionId);
                         const lease = db.currentLease();
                         if (lease) {
                             const detail = JSON.stringify({ decision: "waive", ticket: context.ticket.id, unresolved: context.history, at: new Date().toISOString() });
@@ -2576,7 +2818,7 @@ export function createQaNonconvergenceHandler(projectDir, noninteractive, planne
                         db.close();
                     }
                     console.log(`foreman: QA WAIVER recorded for ${context.ticket.id}; validation_result will be failed`);
-                    return { action: "waive" };
+                    return { action: "waive", ...(authorizationRef ? { authorizationRef } : {}) };
                 }
                 continue;
             }