akm-cli 0.9.1 → 0.9.2-alpha.2

package/dist/commands/proposal/drain.js

@@ -23,9 +23,9 @@
  *   - The judgment tier (Phase 3) adjudicates the deferred items: when a
  *     `judgment` RunnerSpec is supplied the engine pre-fetches context (the live
  *     asset + sibling pending proposals for the same ref) into a prompt,
- *     dispatches it to the configured runner (llm → `chatCompletion`, agent →
- *     `runAgent`, sdk → `runOpencodeSdk`, mirroring `reflect.ts`'s switch), and
- *     performs the resulting accept / reject *itself* (the runner only judges).
+ *     dispatches it through the shared resolved/lowered execution boundary,
+ *     and performs the resulting accept / reject *itself* (the runner only
+ *     judges).
  *     Items the runner cannot resolve — and any deferred items when no runner is
  *     configured — surface a `triage_deferred` event so "enabled, no agent"
  *     never silently looks like full success.
@@ -40,13 +40,14 @@ import path from "node:path";
 import { assetPathForName, stashDirFor } from "../../core/asset/asset-placement.js";
 import { parseFrontmatter } from "../../core/asset/frontmatter.js";
 import { parseRefInput } from "../../core/asset/resolve-ref.js";
+import { ConfigError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
 import { escapeJsonStringControls, stripCodeFences, stripThinkBlocks } from "../../core/parse.js";
 import { info, warn } from "../../core/warn.js";
-import { executeRunner } from "../../integrations/agent/runner-dispatch.js";
-import { chatCompletion } from "../../llm/client.js";
+import { acquireLoweredExecutionDispatchLease, dispatchLoweredExecutionRequest, disposeLoweredExecutionDispatchLease, lowerResolvedExecutionRequestWithRunner, } from "../../integrations/agent/execution-lowering.js";
+import { prepareInlineExecutionWithRunner } from "../../integrations/agent/inline-execution.js";
 import { akmProposalAccept, akmProposalReject } from "./proposal.js";
-import { listProposals, preflightProposalPromotion, proposalContent, recordGateDecision, } from "./repository.js";
+import { listProposals, listProposalsReadOnly, preflightProposalPromotion, proposalContent, recordGateDecision, } from "./repository.js";
 // ---------------------------------------------------------------------------
 // Content helpers
 // ---------------------------------------------------------------------------
@@ -208,39 +209,56 @@ export function parseJudgmentVerdict(raw) {
         return null;
     return { decision, reason: typeof reason === "string" ? reason : "" };
 }
-/**
- * Dispatch a single judgment prompt to the resolved runner via the unified
- * {@link executeRunner} seam (X3). The `llm` arm is drain-specific (wraps
- * `chatCompletion` — no filesystem) so it is supplied as the `llm` handler; the
- * byte-identical `agent` / `sdk` arms route to the default profile runners (or
- * the injected {@link JudgmentSeams} test fakes). A failed spawn warns and
- * yields `null`, matching the prior per-arm behavior.
- */
-async function dispatchJudgment(runner, prompt, seams) {
-    const runOptions = {
-        stdio: "captured",
-        parseOutput: "text",
-        ...(runner.timeoutMs !== undefined ? { timeoutMs: runner.timeoutMs } : {}),
-    };
-    const result = await executeRunner(runner, prompt, runOptions, {
-        llm: async (spec, p) => {
-            const messages = [{ role: "user", content: p }];
-            const raw = seams.chat
-                ? await seams.chat(spec, messages)
-                : await chatCompletion(spec.connection, messages, {
-                    ...(spec.timeoutMs !== undefined ? { timeoutMs: spec.timeoutMs } : {}),
-                });
-            // chatCompletion has no failure envelope — a returned string is success.
-            return { ok: true, exitCode: 0, stdout: raw, stderr: "", durationMs: 0 };
-        },
+async function dispatchJudgment(runner, prompt, seams, lease) {
+    const prepared = prepareInlineExecutionWithRunner({
+        content: prompt,
+        runner,
+        invocationKind: "direct",
+    });
+    const lowered = lowerResolvedExecutionRequestWithRunner(prepared.request, prepared.runner);
+    const chat = seams.chat;
+    const llmRunner = lowered.runner.kind === "llm" ? lowered.runner : undefined;
+    const dispatchOptions = {
+        lease,
         ...(seams.runAgentFn ? { runAgent: seams.runAgentFn } : {}),
         ...(seams.runSdkFn ? { runSdk: seams.runSdkFn } : {}),
-    });
+        ...(chat && llmRunner
+            ? {
+                chat: async (connection, messages) => chat({ ...llmRunner, connection }, messages),
+            }
+            : {}),
+    };
+    let result;
+    try {
+        result = await dispatchLoweredExecutionRequest(lowered, dispatchOptions);
+    }
+    catch (error) {
+        if (error instanceof ConfigError)
+            throw error;
+        return {
+            verdict: null,
+            notices: lowered.notices,
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
     if (!result.ok) {
-        warn(`[triage] judgment ${runner.kind} failed: ${result.error ?? result.reason ?? "unknown error"}`);
-        return null;
+        return {
+            verdict: null,
+            notices: lowered.notices,
+            error: result.error ?? result.reason ?? "unknown error",
+        };
     }
-    return parseJudgmentVerdict(result.stdout);
+    return { verdict: parseJudgmentVerdict(result.stdout), notices: lowered.notices };
+}
+/** Validate symbolic judgment credentials without contacting a provider. */
+async function preflightJudgmentRunner(runner) {
+    const prepared = prepareInlineExecutionWithRunner({
+        content: "Validate the selected proposal judgment runner before mutation.",
+        runner,
+        invocationKind: "direct",
+    });
+    const lowered = lowerResolvedExecutionRequestWithRunner(prepared.request, prepared.runner);
+    return acquireLoweredExecutionDispatchLease(lowered);
 }
 function judgedContentHash(proposal) {
     return createHash("sha256").update(proposalContent(proposal), "utf8").digest("hex");
@@ -260,6 +278,7 @@ async function runJudgmentTier(input) {
     const staged = [];
     const skippedByCap = [];
     const stillDeferred = [];
+    const noticesByKey = new Map();
     // Remaining accept budget shared with the deterministic promote loop.
     let acceptBudget = Math.max(0, input.remainingAcceptBudget);
     for (const item of input.deferred) {
@@ -270,15 +289,28 @@ async function runJudgmentTier(input) {
         }
         const ctx = prefetchJudgmentContext(input.stashDir, proposal, input.pending);
         const prompt = buildJudgmentPrompt(proposal, item.reason, ctx);
-        let verdict;
+        let dispatch;
         try {
-            verdict = await dispatchJudgment(input.runner, prompt, input.seams);
+            dispatch = await dispatchJudgment(input.runner, prompt, input.seams, input.lease);
         }
         catch (err) {
+            if (err instanceof ConfigError)
+                throw err;
             warn(`[triage] judgment dispatch failed for ${item.id}: ${err instanceof Error ? err.message : String(err)}`);
             stillDeferred.push(item);
             continue;
         }
+        for (const notice of dispatch.notices) {
+            const key = JSON.stringify(notice);
+            if (!noticesByKey.has(key))
+                noticesByKey.set(key, notice);
+        }
+        if (dispatch.error) {
+            warn(`[triage] judgment dispatch failed for ${item.id}: ${dispatch.error}`);
+            stillDeferred.push(item);
+            continue;
+        }
+        const verdict = dispatch.verdict;
         if (!verdict || verdict.decision === "defer") {
             stillDeferred.push(item);
             continue;
@@ -367,37 +399,35 @@ async function runJudgmentTier(input) {
             stillDeferred.push(item);
         }
     }
-    return { promoted, rejected, staged, skippedByCap, stillDeferred };
+    return {
+        promoted,
+        rejected,
+        staged,
+        skippedByCap,
+        stillDeferred,
+        notices: Object.freeze([...noticesByKey.values()]),
+    };
 }
-// ---------------------------------------------------------------------------
-// Engine
-// ---------------------------------------------------------------------------
-/**
- * Drain the standing pending backlog under a deterministic policy.
- *
- * @param opts       Drain options (policy, applyMode, ceilings, dry-run).
- * @param promoteFn  Injectable override for `akmProposalAccept` (test seam).
- * @param rejectFn   Injectable override for `akmProposalReject` (test seam).
- */
-export async function drainProposals(opts, promoteFn = akmProposalAccept, rejectFn = akmProposalReject, judgmentSeams = {}) {
-    const result = { promoted: [], rejected: [], deferred: [], skippedByCap: [], staged: [] };
+/** Classify the queue without mutating proposal, event, or promotion state. */
+function classifyPendingProposals(opts) {
     const exclude = opts.excludeIds ?? new Set();
-    const pending = listProposals(opts.stashDir, { status: "pending" }).filter((p) => !exclude.has(p.id));
-    // First, classify every proposal deterministically.
+    // A configured judgment runner must be credential-validated before any live
+    // state connection or migration. Its classification pass therefore reads an
+    // isolated SQLite snapshot; deterministic-only drains retain the historical
+    // live/migrating queue read.
+    const pending = (opts.judgment ? listProposalsReadOnly : listProposals)(opts.stashDir, {
+        status: "pending",
+    }).filter((proposal) => !exclude.has(proposal.id));
     const acceptIds = [];
     const acceptGateReasons = new Map();
     const rejectTargets = [];
+    const deferred = [];
+    const deferredGateDecisions = [];
     const gateLabel = `triage:${opts.policy.name}`;
-    // Items deferred purely because they need a judge (no threshold-based reason)
-    // — these are re-stamped `no-judge-configured` when no runner resolves them.
     const needsJudge = new Set();
     for (const proposal of pending) {
-        // Do NOT reclassify a proposal that was already conclusively stamped
-        // `auto-rejected` by a prior gate run (e.g. the improve confidence gate).
-        // Overwriting an authoritative rejection with `auto-accepted` would corrupt
-        // the audit trail and silently promote content the gate explicitly rejected.
-        // Such proposals remain pending until the TTL expires them — the queue is
-        // audited-autonomous; no manual-review rung exists (06-M3).
+        // An authoritative rejection from another gate stays pending and is never
+        // silently overwritten by this triage policy.
         if (proposal.gateDecision?.outcome === "auto-rejected" && !proposal.gateDecision.gate?.startsWith("triage:")) {
             continue;
         }
@@ -411,23 +441,19 @@ export async function drainProposals(opts, promoteFn = akmProposalAccept, reject
         const decision = classifyProposal(proposal, opts.policy, opts.maxDiffLines);
         if (decision === null)
             continue;
-        // #577: stamp the gate's verdict onto the proposal so `akm proposal show`
-        // can explain WHY it landed here. A dry-run performs zero writes, so it
-        // records nothing.
         if (decision.verdict === "defer") {
-            stampGateDecision(opts, proposal.id, {
-                outcome: "deferred",
-                reason: decision.gate.reason,
-                ...(decision.gate.measured !== undefined ? { measured: decision.gate.measured } : {}),
-                ...(decision.gate.thresholds ? { thresholds: decision.gate.thresholds } : {}),
-                gate: gateLabel,
+            deferredGateDecisions.push({
+                id: proposal.id,
+                decision: {
+                    outcome: "deferred",
+                    reason: decision.gate.reason,
+                    ...(decision.gate.measured !== undefined ? { measured: decision.gate.measured } : {}),
+                    ...(decision.gate.thresholds ? { thresholds: decision.gate.thresholds } : {}),
+                    gate: gateLabel,
+                },
             });
-        }
-        // A defer with no threshold (mid-band / possible-dup from the defer list) is
-        // pending only because it needs adjudication — re-stampable to
-        // `no-judge-configured`. A band-based defer keeps its specific reason.
-        if (decision.verdict === "defer" && !decision.gate.thresholds) {
-            needsJudge.add(proposal.id);
+            if (!decision.gate.thresholds)
+                needsJudge.add(proposal.id);
         }
         if (decision.verdict === "accept") {
             acceptIds.push(proposal.id);
@@ -437,141 +463,187 @@ export async function drainProposals(opts, promoteFn = akmProposalAccept, reject
             rejectTargets.push({ id: proposal.id, reason: decision.reason });
         }
         else {
-            result.deferred.push({ id: proposal.id, reason: decision.reason });
+            deferred.push({ id: proposal.id, reason: decision.reason });
         }
     }
-    // --- Reject empties (independent of the accept ceiling / applyMode) ---
-    for (const target of rejectTargets) {
-        if (opts.dryRun) {
-            result.rejected.push(target.id);
-            continue;
-        }
-        try {
-            await rejectFn({
-                stashDir: opts.stashDir,
-                id: target.id,
-                reason: target.reason,
-                gateDecision: { outcome: "auto-rejected", reason: "empty-diff", gate: gateLabel },
-            });
-            result.rejected.push(target.id);
-        }
-        catch (err) {
-            warn(`[triage] reject failed for ${target.id}: ${err instanceof Error ? err.message : String(err)}`);
-        }
-    }
-    // --- Accept ceiling: enforced BEFORE the promote loop ---
-    const withinCap = acceptIds.slice(0, Math.max(0, opts.maxAccepts));
-    result.skippedByCap = acceptIds.slice(Math.max(0, opts.maxAccepts));
-    if (result.skippedByCap.length > 0) {
-        info(`[triage] accept ceiling reached: ${withinCap.length} promoted, ${result.skippedByCap.length} skipped by cap (maxAccepts=${opts.maxAccepts})`);
-    }
-    // --- Promotion gate: applyMode "queue" never promotes (stage only) ---
-    // Count deterministic promotions so the judgment tier shares the same accept
-    // budget (deterministic + judgment promotions ≤ maxAccepts).
-    let deterministicPromoted = 0;
-    if (opts.applyMode === "promote" && !opts.dryRun) {
-        info(`[triage] auto-promote active: ${withinCap.length} accepts allowed this run`);
-        for (const id of withinCap) {
+    return {
+        pending,
+        acceptIds,
+        acceptGateReasons,
+        rejectTargets,
+        deferred,
+        deferredGateDecisions,
+        gateLabel,
+        needsJudge,
+    };
+}
+/**
+ * Drain the standing pending backlog under a deterministic policy.
+ *
+ * @param opts       Drain options (policy, applyMode, ceilings, dry-run).
+ * @param promoteFn  Injectable override for `akmProposalAccept` (test seam).
+ * @param rejectFn   Injectable override for `akmProposalReject` (test seam).
+ */
+export async function drainProposals(opts, promoteFn = akmProposalAccept, rejectFn = akmProposalReject, judgmentSeams = {}) {
+    const classification = classifyPendingProposals(opts);
+    const { pending, acceptIds, acceptGateReasons, rejectTargets, deferredGateDecisions, gateLabel, needsJudge } = classification;
+    const result = {
+        promoted: [],
+        rejected: [],
+        deferred: classification.deferred,
+        skippedByCap: [],
+        staged: [],
+    };
+    // A configured judgment runner makes every deferred item dispatch-eligible.
+    // Validate its symbolic credentials before applying any deterministic gate,
+    // reject, promote, or event mutation. Provider/runtime failures remain the
+    // judgment tier's fail-soft responsibility after this configuration fence.
+    const dispatchLease = opts.judgment && result.deferred.length > 0 ? await preflightJudgmentRunner(opts.judgment) : undefined;
+    try {
+        for (const { id, decision } of deferredGateDecisions)
+            stampGateDecision(opts, id, decision);
+        // --- Reject empties (independent of the accept ceiling / applyMode) ---
+        for (const target of rejectTargets) {
+            if (opts.dryRun) {
+                result.rejected.push(target.id);
+                continue;
+            }
             try {
-                await promoteFn({
+                await rejectFn({
                     stashDir: opts.stashDir,
-                    id,
-                    ...(opts.target ? { target: opts.target } : {}),
-                    ...(opts.config ? { config: opts.config } : {}),
-                    gateDecision: {
-                        outcome: "auto-accepted",
-                        reason: acceptGateReasons.get(id) ?? "policy-accept",
-                        gate: gateLabel,
-                    },
+                    id: target.id,
+                    reason: target.reason,
+                    gateDecision: { outcome: "auto-rejected", reason: "empty-diff", gate: gateLabel },
                 });
-                result.promoted.push(id);
-                deterministicPromoted += 1;
+                result.rejected.push(target.id);
             }
             catch (err) {
-                warn(`[triage] promote failed for ${id}: ${err instanceof Error ? err.message : String(err)}`);
+                warn(`[triage] reject failed for ${target.id}: ${err instanceof Error ? err.message : String(err)}`);
             }
         }
-    }
-    else if (opts.applyMode === "promote" && opts.dryRun) {
-        // Exercise the same stamped candidate and lint boundary as real promotion.
-        // Tests that omit config retain the classification-only seam.
-        const byId = new Map(pending.map((proposal) => [proposal.id, proposal]));
-        for (const id of withinCap) {
-            try {
-                if (opts.config) {
-                    const proposal = byId.get(id);
-                    if (!proposal)
-                        throw new Error(`Proposal ${id} disappeared during drain preflight.`);
-                    preflightProposalPromotion(opts.config, proposal, {
+        // --- Accept ceiling: enforced BEFORE the promote loop ---
+        const withinCap = acceptIds.slice(0, Math.max(0, opts.maxAccepts));
+        result.skippedByCap = acceptIds.slice(Math.max(0, opts.maxAccepts));
+        if (result.skippedByCap.length > 0) {
+            info(`[triage] accept ceiling reached: ${withinCap.length} promoted, ${result.skippedByCap.length} skipped by cap (maxAccepts=${opts.maxAccepts})`);
+        }
+        // --- Promotion gate: applyMode "queue" never promotes (stage only) ---
+        // Count deterministic promotions so the judgment tier shares the same accept
+        // budget (deterministic + judgment promotions ≤ maxAccepts).
+        let deterministicPromoted = 0;
+        if (opts.applyMode === "promote" && !opts.dryRun) {
+            info(`[triage] auto-promote active: ${withinCap.length} accepts allowed this run`);
+            for (const id of withinCap) {
+                try {
+                    await promoteFn({
+                        stashDir: opts.stashDir,
+                        id,
                         ...(opts.target ? { target: opts.target } : {}),
+                        ...(opts.config ? { config: opts.config } : {}),
                         gateDecision: {
                             outcome: "auto-accepted",
                             reason: acceptGateReasons.get(id) ?? "policy-accept",
                             gate: gateLabel,
                         },
                     });
+                    result.promoted.push(id);
+                    deterministicPromoted += 1;
+                }
+                catch (err) {
+                    warn(`[triage] promote failed for ${id}: ${err instanceof Error ? err.message : String(err)}`);
                 }
-                result.promoted.push(id);
-                deterministicPromoted += 1;
             }
-            catch (err) {
-                warn(`[triage] preflight failed for ${id}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        else if (opts.applyMode === "promote" && opts.dryRun) {
+            // Exercise the same stamped candidate and lint boundary as real promotion.
+            // Tests that omit config retain the classification-only seam.
+            const byId = new Map(pending.map((proposal) => [proposal.id, proposal]));
+            for (const id of withinCap) {
+                try {
+                    if (opts.config) {
+                        const proposal = byId.get(id);
+                        if (!proposal)
+                            throw new Error(`Proposal ${id} disappeared during drain preflight.`);
+                        preflightProposalPromotion(opts.config, proposal, {
+                            ...(opts.target ? { target: opts.target } : {}),
+                            gateDecision: {
+                                outcome: "auto-accepted",
+                                reason: acceptGateReasons.get(id) ?? "policy-accept",
+                                gate: gateLabel,
+                            },
+                        });
+                    }
+                    result.promoted.push(id);
+                    deterministicPromoted += 1;
+                }
+                catch (err) {
+                    warn(`[triage] preflight failed for ${id}: ${err instanceof Error ? err.message : String(err)}`);
+                }
             }
         }
-    }
-    // applyMode "queue": leave accept candidates pending (staged). No promotion.
-    // Remaining accept budget for the judgment tier: maxAccepts minus what was
-    // actually promoted deterministically. Bounds the TOTAL promotions, not just
-    // the deterministic path. Moot in queue mode (it promotes nothing).
-    const remainingAcceptBudget = Math.max(0, Math.max(0, opts.maxAccepts) - deterministicPromoted);
-    // --- Judgment tier (Phase 3): adjudicate the deferred items ---
-    // Only runs when a RunnerSpec is configured. The runner returns a verdict; the
-    // ENGINE performs the resulting accept (respecting applyMode) / reject write.
-    if (opts.judgment && result.deferred.length > 0) {
-        const tier = await runJudgmentTier({
-            stashDir: opts.stashDir,
-            applyMode: opts.applyMode,
-            dryRun: opts.dryRun,
-            runner: opts.judgment,
-            deferred: result.deferred,
-            pending,
-            promoteFn,
-            rejectFn,
-            seams: judgmentSeams,
-            ...(opts.target ? { target: opts.target } : {}),
-            ...(opts.config ? { config: opts.config } : {}),
-            remainingAcceptBudget,
-            gateLabel,
-        });
-        result.promoted.push(...tier.promoted);
-        result.rejected.push(...tier.rejected);
-        result.staged.push(...tier.staged);
-        // Judgment-tier accepts dropped by the shared accept cap surface under
-        // skippedByCap, same as deterministic cap drops.
-        result.skippedByCap.push(...tier.skippedByCap);
-        if (tier.skippedByCap.length > 0) {
-            info(`[triage] accept ceiling reached in judgment tier: ${tier.skippedByCap.length} judged-accept items skipped by cap (maxAccepts=${opts.maxAccepts})`);
+        // applyMode "queue": leave accept candidates pending (staged). No promotion.
+        // Remaining accept budget for the judgment tier: maxAccepts minus what was
+        // actually promoted deterministically. Bounds the TOTAL promotions, not just
+        // the deterministic path. Moot in queue mode (it promotes nothing).
+        const remainingAcceptBudget = Math.max(0, Math.max(0, opts.maxAccepts) - deterministicPromoted);
+        // --- Judgment tier (Phase 3): adjudicate the deferred items ---
+        // Only runs when a RunnerSpec is configured. The runner returns a verdict; the
+        // ENGINE performs the resulting accept (respecting applyMode) / reject write.
+        if (opts.judgment && result.deferred.length > 0) {
+            if (!dispatchLease)
+                throw new TypeError("proposal judgment work requires an operation dispatch lease");
+            const tier = await runJudgmentTier({
+                stashDir: opts.stashDir,
+                applyMode: opts.applyMode,
+                dryRun: opts.dryRun,
+                runner: opts.judgment,
+                lease: dispatchLease,
+                deferred: result.deferred,
+                pending,
+                promoteFn,
+                rejectFn,
+                seams: judgmentSeams,
+                ...(opts.target ? { target: opts.target } : {}),
+                ...(opts.config ? { config: opts.config } : {}),
+                remainingAcceptBudget,
+                gateLabel,
+            });
+            result.promoted.push(...tier.promoted);
+            result.rejected.push(...tier.rejected);
+            result.staged.push(...tier.staged);
+            if (tier.notices.length > 0)
+                result.notices = tier.notices;
+            // Judgment-tier accepts dropped by the shared accept cap surface under
+            // skippedByCap, same as deterministic cap drops.
+            result.skippedByCap.push(...tier.skippedByCap);
+            if (tier.skippedByCap.length > 0) {
+                info(`[triage] accept ceiling reached in judgment tier: ${tier.skippedByCap.length} judged-accept items skipped by cap (maxAccepts=${opts.maxAccepts})`);
+            }
+            // Replace the deferred list with only the items the judgment tier could NOT
+            // resolve (verdict "defer", parse failure, or runner error). Staged
+            // queue-mode accepts are RESOLVED and tracked in result.staged instead.
+            result.deferred = tier.stillDeferred;
         }
-        // Replace the deferred list with only the items the judgment tier could NOT
-        // resolve (verdict "defer", parse failure, or runner error). Staged
-        // queue-mode accepts are RESOLVED and tracked in result.staged instead.
-        result.deferred = tier.stillDeferred;
-    }
-    else if (result.deferred.length > 0) {
-        // #577: no judgment runner configured — items deferred *because they need a
-        // judge* (mid-band / possible-dup, no threshold reason) stay pending solely
-        // for lack of one. Re-stamp those as `no-judge-configured` so the operator
-        // sees a per-proposal reason instead of inferring it from the run-level
-        // triage_deferred aggregate. Band-deferred items keep their specific reason
-        // (e.g. `max-diff-lines`), which is more actionable than "no judge".
-        for (const item of result.deferred) {
-            if (needsJudge.has(item.id)) {
-                stampGateDecision(opts, item.id, { outcome: "deferred", reason: "no-judge-configured", gate: gateLabel });
+        else if (result.deferred.length > 0) {
+            // #577: no judgment runner configured — items deferred *because they need a
+            // judge* (mid-band / possible-dup, no threshold reason) stay pending solely
+            // for lack of one. Re-stamp those as `no-judge-configured` so the operator
+            // sees a per-proposal reason instead of inferring it from the run-level
+            // triage_deferred aggregate. Band-deferred items keep their specific reason
+            // (e.g. `max-diff-lines`), which is more actionable than "no judge".
+            for (const item of result.deferred) {
+                if (needsJudge.has(item.id)) {
+                    stampGateDecision(opts, item.id, { outcome: "deferred", reason: "no-judge-configured", gate: gateLabel });
+                }
             }
         }
+        emitDrainEvents(opts, result);
+        return result;
+    }
+    finally {
+        if (dispatchLease)
+            disposeLoweredExecutionDispatchLease(dispatchLease);
     }
-    emitDrainEvents(opts, result);
-    return result;
 }
 /**
  * Persist a gate decision onto a proposal, honouring the dry-run contract

package/dist/commands/proposal/proposal-cli.js

@@ -18,16 +18,24 @@ import { parsePositiveIntFlag } from "../../cli/parse-args.js";
 import { defineGroupCommand, defineJsonCommand, output } from "../../cli/shared.js";
 import { resolveStashDir } from "../../core/common.js";
 import { loadConfig } from "../../core/config/config.js";
-import { UsageError } from "../../core/errors.js";
-import { resolveTriageJudgmentRunner } from "../../integrations/agent/runner.js";
+import { ConfigError, UsageError } from "../../core/errors.js";
 import { installLlmUsagePersistenceIfAbsent } from "../../llm/usage-persist.js";
 import { withLlmStage } from "../../llm/usage-telemetry.js";
+import { resolveImproveExecution } from "../improve/execution.js";
 import { extractCommand } from "../improve/extract-cli.js";
 import { resolveImproveStrategy } from "../improve/improve-strategies.js";
 import { drainProposals } from "./drain.js";
 import { resolveDrainPolicy } from "./drain-policies.js";
 import { akmProposalAccept, akmProposalDiff, akmProposalList, akmProposalReject, akmProposalRevert, akmProposalShow, bulkAdjudicateProposals, } from "./proposal.js";
 import { proposeCommand } from "./propose-cli.js";
+export function mergeProposalDrainNotices(resolutionNotices, dispatchNotices) {
+    const byKey = new Map();
+    for (const notice of resolutionNotices ?? [])
+        byKey.set(JSON.stringify(notice), notice);
+    for (const notice of dispatchNotices ?? [])
+        byKey.set(JSON.stringify(notice), notice);
+    return byKey.size > 0 ? Object.freeze([...byKey.values()]) : undefined;
+}
 /**
  * `--source` was renamed to `--generator` on `proposal accept`/`proposal
  * reject` in 0.9 (WS3/S8 — "Removed in 0.9.0"). citty is non-strict, so the
@@ -352,7 +360,7 @@ const proposalDrainCommand = defineJsonCommand({
         },
         judgment: {
             type: "boolean",
-            description: "Opt into the judgment tier (llm by default; agent/sdk per config) for deferred items. No-op with a logged triage_deferred summary when no runner is configured.",
+            description: "Explicitly enable the judgment tier for this drain (overrides judgment.enabled=false; agent/sdk per config). No-op with a logged triage_deferred summary when no runner is configured.",
             default: false,
         },
         strategy: {
@@ -408,14 +416,25 @@ const proposalDrainCommand = defineJsonCommand({
             })
                 .map((proposal) => proposal.id));
         }
-        // Phase 3: resolve the judgment runner when --judgment is set. Default
-        // mode is llm; falls back to defaults.llm when the triage block sets
-        // no explicit engine selection. null when
-        // nothing is configured → the engine leaves deferred items unresolved and
-        // emits triage_deferred.
-        const judgment = args.judgment === true
-            ? resolveTriageJudgmentRunner(triageConfig?.judgment, cfg, triageConfig, selectedStrategy.config)
+        // Phase 3: --judgment is an invocation-level opt-in. It deliberately
+        // overrides judgment.enabled=false for this standalone drain while still
+        // reusing that block's execution overrides. Without the flag, configured
+        // judgment enablement is owned only by `akm improve`. A missing runner is
+        // a documented standalone no-op that leaves deferred items unresolved.
+        const judgmentResolution = args.judgment === true
+            ? resolveImproveExecution({
+                config: cfg,
+                profile: selectedStrategy.config,
+                process: triageConfig,
+                current: triageConfig?.judgment,
+                processName: "proposal-triage-judgment",
+            })
             : null;
+        const judgment = judgmentResolution?.runner ?? null;
+        const effectiveJudgmentLlm = triageConfig?.judgment?.llm ?? triageConfig?.llm ?? selectedStrategy.config.llm;
+        if (judgment && judgment.kind !== "llm" && effectiveJudgmentLlm) {
+            throw new ConfigError(`Triage judgment engine "${judgment.engine ?? "unknown"}" is an agent engine and cannot receive llm overrides.`, "INVALID_CONFIG_FILE");
+        }
         // #576: persist + attribute per-call LLM usage for the standalone drain
         // path. `IfAbsent` keeps an enclosing `akm improve` sink in charge when
         // drain runs as a sub-step; the disposer clears only a sink we installed.
@@ -437,6 +456,8 @@ const proposalDrainCommand = defineJsonCommand({
         finally {
             disposeDrainUsageSink();
         }
+        const dispatchNotices = result.notices;
+        const notices = mergeProposalDrainNotices(judgmentResolution?.notices, dispatchNotices);
         output("proposal-drain", {
             schemaVersion: 1,
             ok: true,
@@ -446,6 +467,7 @@ const proposalDrainCommand = defineJsonCommand({
             strategy: selectedStrategy.name,
             judgmentEngine: judgment?.engine ?? null,
             judgmentKind: judgment?.kind ?? null,
+            ...(notices ? { notices } : {}),
             promoted: result.promoted,
             rejected: result.rejected,
             deferred: result.deferred,