atris 3.60.0 → 3.62.0

package/lib/fleet.js

@@ -23,7 +23,9 @@ const {
   worktreeBaseRef,
 } = require('./brief-ledger');
 const { RUNNER_PROFILE_DEFS, buildRunnerCommand } = require('./runner-command');
-const { engineFailureHealthStatus, setEngineHealth } = require('./engine-registry');
+const { setEngineHealth, recordEngineRunHealth, engineStallReason, engineFailureHealthStatus, resolveJobTeam, rosterDecided, rosterPinFor } = require('./engine-registry');
+const { appendRosterAttempts, parseRunUsage } = require('./roster-runs');
+const { engineRunsView } = require('./roster-models');
 const { resolveDefaultVerifier } = require('./default-verifier');
 const { rankEnginesDetailed } = require('./router-brain');
 const {
@@ -37,6 +39,7 @@ const { sleepSync } = require('./sleep-sync');
 const { ownerIdentity } = require('../utils/owner-identity');
 const { matchTaste } = require('./taste-lessons');
 const { buildVerifiedScoutPack, appendVerifiedScoutPack } = require('./dispatch-scout');
+const { runPrepPass, withPrepBrief, prepRecordFields } = require('./roster-prep');
 const { mapNotesPath } = require('./map-refs');
 const {
   applySecretGrantEnvironment,
@@ -220,7 +223,17 @@ function validatorPin(validatorModels, engine) {
   const pin = validatorModels && validatorModels[engine];
   if (!pin) return { model: '', effort: '', maxSeconds: 0 };
   if (typeof pin === 'string') return { model: pin, effort: '', maxSeconds: 0 };
-  return { model: String(pin.model || ''), effort: String(pin.effort || ''), maxSeconds: capSeconds(pin.max_seconds) };
+  return {
+    model: String(pin.model || ''),
+    effort: String(pin.effort || ''),
+    maxSeconds: capSeconds(pin.max_seconds),
+    ...(pin.prep ? { prep: String(pin.prep) } : {}),
+  };
+}
+
+// The engine flags a pin sets, never its prep job.
+function pinEngineFlags(pin) {
+  return { model: pin.model, effort: pin.effort, maxSeconds: pin.maxSeconds };
 }
 
 function wrapCodexWithWatchdog(cmd, watchdogPath = CODEX_WATCHDOG_SOURCE, receiptPath = '', maxSeconds = 0) {
@@ -650,9 +663,20 @@ function detectDeadEngineDispatch(result) {
   const signal = dispatchResultSignal(result);
   if (signal) return { reason: 'signalled', signal, exitCode };
   if (terminal.reason === 'ok') return null;
-  const output = dispatchResultOutput(result).toLowerCase();
+  // A credit wall is read from engine-level signals only. The report and
+  // stdout are the task's own work: a failing "rate limit" test says nothing
+  // about the engine's credits.
+  const rateLimitInfo = result && result.rate_limit_info;
+  const rateLimitStatus = String(
+    rateLimitInfo && typeof rateLimitInfo === 'object' ? rateLimitInfo.status || '' : rateLimitInfo || '',
+  ).trim().toLowerCase();
+  const engineText = [
+    result && result.stderr,
+    result && result.error && (result.error.message || result.error.code || result.error),
+    rateLimitStatus && rateLimitStatus !== 'allowed' ? `rate limit ${rateLimitStatus}` : '',
+  ].filter(Boolean).map(String).join('\n').toLowerCase();
   const pattern = Number.isInteger(exitCode) && exitCode !== 0
-    ? DEAD_ENGINE_OUTPUT_PATTERNS.find((p) => output.includes(p))
+    ? DEAD_ENGINE_OUTPUT_PATTERNS.find((p) => engineText.includes(p))
     : null;
   if (pattern) return { reason: 'usage_limit', pattern };
   if (terminal.reason === 'no_output' || terminal.reason === 'unknown' || terminal.reason === 'timeout' || terminal.reason === 'cancelled') {
@@ -680,16 +704,15 @@ function plainDispatchFailureCause(result, failure = {}) {
   return (reason || 'the engine failed').replace(/_/g, ' ');
 }
 
+// A stalled run (time cap, watchdog, dropped connection) benches its engine
+// for the cooldown; other failures keep today's health write.
 function recordDispatchEngineHealth(result, failure, root) {
   if (!result || !result.engine) return null;
-  const status = failure
-    ? engineFailureHealthStatus({
-      ...result,
-      status: 'errored',
-      reason: [result.reason, failure.reason].filter(Boolean).join('\n'),
-    })
-    : 'ready';
-  return status ? setEngineHealth(result.engine, status, root) : null;
+  if (!failure) return setEngineHealth(result.engine, 'ready', root);
+  return recordEngineRunHealth(result.engine, {
+    ...result,
+    reason: [result.reason, failure.reason].filter(Boolean).join('\n'),
+  }, root);
 }
 
 function normalizeInstalledEngines(engines) {
@@ -754,6 +777,97 @@ function failedDispatchLeg(result, engineName) {
   return leg;
 }
 
+// How one attempt ended, before landing decides the last one: a credit wall,
+// a stall with its plain text, a real task failure, or provisionally landed.
+// Same engine-level rule as the health write: the task's own words never
+// decide the engine's outcome.
+function rosterAttemptOutcome(result) {
+  const dead = detectDeadEngineDispatch(result);
+  if (!dead) return { outcome: 'landed' };
+  const health = engineFailureHealthStatus({
+    ...result,
+    status: 'errored',
+    reason: [result && result.reason, dead.reason].filter(Boolean).join('\n'),
+  });
+  if (health === 'credit_out') return { outcome: 'credit out', detail: dead.pattern ? `said "${dead.pattern}"` : plainDispatchFailureCause(result, dead) };
+  const stall = engineStallReason(result);
+  if (stall) return { outcome: 'stalled', detail: stall.text };
+  return { outcome: 'failed', detail: plainDispatchFailureCause(result, dead) };
+}
+
+// One attempt's line: the worker as it really ran (its pin, else the model
+// the engine runs on its own), the seconds, and tokens only when printed.
+function rosterAttemptRecord(engineName, pin, startedMs, endedMs, result, prep = null) {
+  const model = (pin && pin.model) || engineRunsView(engineName).model || '';
+  return {
+    ...prepRecordFields(prep),
+    at: new Date(startedMs).toISOString(),
+    engine: engineName,
+    ...(model ? { model } : {}),
+    ...(pin && pin.effort ? { effort: pin.effort } : {}),
+    ...(pin && pin.maxSeconds ? { max_seconds: pin.maxSeconds } : {}),
+    seconds: Math.max(0, (endedMs - startedMs) / 1000),
+    ...parseRunUsage({
+      usage: result && result.usage,
+      cost_usd: result && result.cost_usd,
+      stdout: result && (result.report || result.stdout),
+      stderr: result && result.stderr,
+    }),
+    ...rosterAttemptOutcome(result),
+  };
+}
+
+// After landing: the last attempt landed only when its task is in the landed
+// or proof-ready rows; otherwise it failed at the stage that paused it. Every
+// earlier attempt keeps its own outcome and names who took over.
+function recordFlightRosterRuns(root, flight, results, { job = 'build', member = '', source = '' } = {}) {
+  for (const { entry, result } of results || []) {
+    const attempts = (result && Array.isArray(result.attempts) ? result.attempts : []).map((attempt) => ({ ...attempt }));
+    if (!attempts.length) continue;
+    const taskId = String(entry.taskId || dispatchTaskId(entry.task));
+    const sameTask = (row) => row && String(row.task) === taskId;
+    const last = attempts[attempts.length - 1];
+    if (last.outcome === 'landed') {
+      const landed = (flight.landed || []).some(sameTask) || (flight.ready || []).some(sameTask);
+      const paused = (flight.paused || []).find(sameTask);
+      if (!landed) {
+        last.outcome = 'failed';
+        last.detail = paused
+          ? `paused at ${String(paused.stage || 'landing').replace(/_/g, ' ')}${paused.detail ? `: ${String(paused.detail).split('\n')[0]}` : ''}`
+          : 'did not land';
+      }
+    }
+    appendRosterAttempts(root, attempts, {
+      job: entry.roster_job || job,
+      ...(member ? { member } : {}),
+      task: taskId,
+      ...(source ? { source } : {}),
+    });
+  }
+}
+
+// A dispatch no flight watches (a mission blocker's build): the same health
+// write and run line the flight paths make, so a stall benches the engine
+// and the record shows how it did. Never throws.
+function recordDispatchOutcome(root, { engine, pin = {}, startedMs, endedMs, result, job = 'build', task = '', source = '', member = '' } = {}) {
+  try {
+    const run = normalizeDispatchResult(result, engine);
+    if (!run.max_seconds && pin && pin.maxSeconds) run.max_seconds = pin.maxSeconds;
+    const dead = detectDeadEngineDispatch(run);
+    recordDispatchEngineHealth(run, dead, root);
+    const attempt = rosterAttemptRecord(engine, pin, startedMs, endedMs, run);
+    appendRosterAttempts(root, [attempt], {
+      job,
+      ...(task ? { task: String(task) } : {}),
+      ...(source ? { source } : {}),
+      ...(member ? { member } : {}),
+    });
+    return { outcome: attempt.outcome, ...(attempt.detail ? { detail: attempt.detail } : {}) };
+  } catch {
+    return null;
+  }
+}
+
 async function dispatchEntryWithRestaff({
   entry,
   engine,
@@ -762,8 +876,55 @@ async function dispatchEntryWithRestaff({
   installedEngines = null,
   restaffState,
   scoutAsk,
+  clock = Date.now,
+  defaultPin = null,
+  job = 'build',
+  prepAsk = undefined,
+}) {
+  const attempts = [];
+  const result = await dispatchEntryAttempts({ entry, engine, root, dispatch, installedEngines, restaffState, scoutAsk, clock, defaultPin, attempts, job, prepAsk });
+  return { ...result, attempts };
+}
+
+// One prep pass per prep job per task: a backup whose line asks for the same
+// prep job reuses the brief the lead's prep already wrote.
+function prepPassCache({ entry, root, clock, prepAsk, job }) {
+  const passes = new Map();
+  return (prepJob, prompt) => {
+    if (!prepJob) return Promise.resolve(null);
+    if (!passes.has(prepJob)) {
+      passes.set(prepJob, runPrepPass({
+        prepJob,
+        forJob: entry.roster_job || job,
+        task: entry.task,
+        prompt,
+        worktreePath: entry.worktreePath,
+        root,
+        clock,
+        ...(prepAsk ? { ask: prepAsk } : {}),
+        record: { member: entry.member || '' },
+      }));
+    }
+    return passes.get(prepJob);
+  };
+}
+
+async function dispatchEntryAttempts({
+  entry,
+  engine,
+  root,
+  dispatch,
+  installedEngines = null,
+  restaffState,
+  scoutAsk,
+  clock = Date.now,
+  defaultPin = null,
+  attempts = [],
+  job = 'build',
+  prepAsk = undefined,
 }) {
   const basePrompt = entry.prompt || buildFleetPrompt(entry.task, { worktreePath: entry.worktreePath, yolo: entry.yolo });
+  const prepFor = prepPassCache({ entry, root, clock, prepAsk, job });
   let scoutPackPromise = null;
   const scoutPack = () => {
     if (scoutAsk === false) return Promise.resolve(null);
@@ -776,8 +937,12 @@ async function dispatchEntryWithRestaff({
     }
     return scoutPackPromise;
   };
-  const runOnce = async (engineName) => {
-    const prompt = appendVerifiedScoutPack(basePrompt, await scoutPack(), { worktreePath: entry.worktreePath });
+  const runOnce = async (engineName, pin = null) => {
+    const ranWith = pin || entry.roster_pin || (engineName === engine ? defaultPin : null) || {};
+    const scouted = appendVerifiedScoutPack(basePrompt, await scoutPack(), { worktreePath: entry.worktreePath });
+    // A worker whose roster line asks for prep gets its brief first.
+    const prep = ranWith.prep ? await prepFor(ranWith.prep, scouted) : null;
+    const prompt = withPrepBrief(scouted, prep);
     const brief = captureDispatchBrief({
       root,
       task: entry.task,
@@ -788,24 +953,36 @@ async function dispatchEntryWithRestaff({
       author: entry.author || '',
       yolo: entry.yolo,
     });
+    const startedMs = clock();
+    let runResult;
     try {
-      const runResult = normalizeDispatchResult(await dispatch({ ...entry, engine: engineName, prompt, brief_id: brief.brief_id, briefId: brief.brief_id, skipBriefCapture: true }), engineName);
+      runResult = normalizeDispatchResult(await dispatch({ ...entry, engine: engineName, prompt, brief_id: brief.brief_id, briefId: brief.brief_id, skipBriefCapture: true, ...(pin ? { roster_pin: pin } : {}) }), engineName);
       if (!runResult.brief_id) runResult.brief_id = brief.brief_id;
-      return runResult;
+      if (pin && pin.maxSeconds && !runResult.max_seconds) runResult.max_seconds = pin.maxSeconds;
     } catch (err) {
-      return normalizeDispatchResult({
+      runResult = normalizeDispatchResult({
         brief_id: brief.brief_id,
         exitCode: 1,
         report: '',
         stderr: String(err && err.message || err),
       }, engineName);
     }
+    if (!runResult.max_seconds && ranWith.maxSeconds) runResult.max_seconds = ranWith.maxSeconds;
+    attempts.push(rosterAttemptRecord(engineName, ranWith, startedMs, clock(), runResult, prep));
+    return runResult;
   };
 
   const first = await runOnce(engine);
+  if (!first.max_seconds && entry.maxSeconds) first.max_seconds = entry.maxSeconds;
   const deadEngine = detectDeadEngineDispatch(first);
   recordDispatchEngineHealth(first, deadEngine, root);
   if (!deadEngine) return first;
+  // A stall (time cap, watchdog, dropped connection) walks the roster's build
+  // team; with no roster line the one-shot restaff below runs as before.
+  const handover = deadEngine && engineStallReason(first)
+    ? await handOverStalledDispatch({ entry, engine, first, root, runOnce })
+    : null;
+  if (handover) return handover;
   stampDispatchBrief(root, first.brief_id, 'fail', `restaffed from ${engine}: ${deadEngine.reason}`);
 
   const outage = { from: engine, reason: deadEngine.reason };
@@ -832,6 +1009,129 @@ async function dispatchEntryWithRestaff({
   };
 }
 
+function stallLine(result, engineName) {
+  const stall = engineStallReason(result);
+  return `${engineName} ${stall ? stall.text : 'failed'}`;
+}
+
+// A stalled run hands the same brief to the next ready worker on the build
+// roster, each with its own model, effort, and time cap, once per worker.
+// It stops at the first run that succeeds or fails for a real task reason,
+// or when the team runs out. The stalled engine is already benched, so the
+// team read here starts past it. Null when no roster line decides build.
+async function handOverStalledDispatch({ entry, engine, first, root, runOnce, job = 'build' }) {
+  const tried = new Set([engine]);
+  const reasons = [];
+  const legs = [];
+  let last = first;
+  let lastEngine = engine;
+  for (;;) {
+    let team;
+    try {
+      team = resolveJobTeam(entry.roster_job || job, root, { lowStakes: false });
+    } catch {
+      team = null;
+    }
+    // Once every worker is benched the roster stops deciding; that is the
+    // team running out, not a missing roster.
+    const decided = Boolean(team && rosterDecided(team.source));
+    const next = decided
+      ? team.team.find((worker) => worker && !tried.has(worker.id) && DISPATCH_CAPABLE.includes(worker.id))
+      : null;
+    if (!next) {
+      if (!legs.length) return null;
+      reasons.push(`${stallLine(last, lastEngine)}; no one left on the ${entry.roster_job || job} team`);
+      break;
+    }
+    const line = stallLine(last, lastEngine);
+    tried.add(next.id);
+    reasons.push(`${line}; ${next.id} took over`);
+    stampDispatchBrief(root, last.brief_id, 'fail', reasons[reasons.length - 1]);
+    legs.push(failedDispatchLeg(last, lastEngine));
+    // A backup preps only when its own line asks.
+    const pin = {
+      model: next.roster_model || '',
+      effort: next.roster_effort || '',
+      maxSeconds: capSeconds(next.roster_max_seconds),
+      prep: next.roster_prep || '',
+    };
+    const result = await runOnce(next.id, pin);
+    const dead = detectDeadEngineDispatch(result);
+    recordDispatchEngineHealth(result, dead, root);
+    last = result;
+    lastEngine = next.id;
+    if (!dead || !engineStallReason(result)) break;
+  }
+  return {
+    ...last,
+    handover: {
+      from: engine,
+      to: lastEngine,
+      reasons,
+      failed_legs: legs,
+    },
+    handover_reason: reasons.join('. '),
+  };
+}
+
+// Claude prints plain text by default, so a claude run had no tokens on its
+// record. Asked for its result as JSON, it prints one object with the same
+// final text plus usage and cost. Only the claude CLI itself gets the flag;
+// a custom runner template or a renamed runner keeps its plain launch.
+const CLAUDE_JSON_ENGINES = new Set(['claude', 'fable', 'haiku']);
+
+function claudeJsonLaunch(engine, command) {
+  return CLAUDE_JSON_ENGINES.has(engine) && /^'?(?:[^'\s]*\/)?claude'? -p /.test(String(command || ''));
+}
+
+// One parsed claude result object from a line of stdout, or null when the
+// line is not one (plain text, partial json, some other event shape).
+function claudeResultEvent(line) {
+  const text = String(line || '').trim();
+  if (!text.startsWith('{')) return null;
+  try {
+    const event = JSON.parse(text);
+    if (!event || typeof event !== 'object' || (event.type !== 'result' && typeof event.result !== 'string')) return null;
+    return event;
+  } catch {
+    return null;
+  }
+}
+
+// The report text for a claude result event. A run that ended in an error
+// carries no result string, only a subtype and an errors list; without this
+// the report and live log went blank on exactly the runs that needed their
+// error kept.
+function claudeResultText(event) {
+  const result = typeof event.result === 'string' ? event.result : '';
+  if (result.trim()) return result;
+  const errors = (Array.isArray(event.errors) ? event.errors : [])
+    .map((entry) => String(entry).trim())
+    .filter(Boolean);
+  if (event.is_error !== true && !errors.length) return result;
+  return [String(event.subtype || '').trim(), errors.join('; ')].filter(Boolean).join(': ');
+}
+
+// The final text, usage, and cost from claude's JSON result, or null when
+// the output is not one (the run died first, or a stand-in printed text).
+// The result is the last line that parses as one, so plain lines the engine
+// printed earlier in the run do not hide it.
+function unwrapClaudeJsonResult(stdout) {
+  const text = String(stdout || '').trim();
+  if (!text) return null;
+  const candidates = [text, ...text.split(/\r?\n/).reverse()];
+  for (const candidate of candidates) {
+    const event = claudeResultEvent(candidate);
+    if (!event) continue;
+    return {
+      text: claudeResultText(event),
+      ...(event.usage && typeof event.usage === 'object' ? { usage: event.usage } : {}),
+      ...(typeof event.total_cost_usd === 'number' ? { cost_usd: event.total_cost_usd } : {}),
+    };
+  }
+  return null;
+}
+
 // Run one engine on one task in one worktree. Blocking; the conductor runs
 // dispatches in parallel via child processes, not threads. `runner` is
 // injectable for tests. `prompt` is injectable too: a caller-supplied prompt
@@ -858,7 +1158,7 @@ function dispatchToEngine({ task, engine, worktreePath, root = process.cwd(), ti
     fs.mkdirSync(artifactDir, { recursive: true });
     watchdogArtifact = path.join(artifactDir, `codex-watchdog-${task.display_id || 'task'}-${crypto.randomBytes(4).toString('hex')}.json`);
   }
-  const command = buildEngineCommand(engine, promptFile, {
+  let command = buildEngineCommand(engine, promptFile, {
     yolo,
     sealed,
     allowedTools,
@@ -868,6 +1168,9 @@ function dispatchToEngine({ task, engine, worktreePath, root = process.cwd(), ti
     effort,
     maxSeconds,
   });
+  // Tokens for the run record only: the report stays claude's final text.
+  const claudeJson = claudeJsonLaunch(engine, command);
+  if (claudeJson) command = `${command} --output-format json`;
   // A roster time cap replaces the default backstop. Codex keeps a minute of
   // slack past its watchdog so the watchdog's own receipt gets written.
   const cap = capSeconds(maxSeconds);
@@ -875,6 +1178,7 @@ function dispatchToEngine({ task, engine, worktreePath, root = process.cwd(), ti
     ? cap * 1000 + (engine === 'codex' ? 60000 : 0)
     : (engine === 'codex' ? CODEX_DISPATCH_TIMEOUT_MS : DEFAULT_DISPATCH_TIMEOUT_MS);
   const dispatchTimeoutMs = timeoutMs === null || timeoutMs === undefined ? defaultTimeoutMs : timeoutMs;
+  let flushLiveLogTail = null;
   const exec = runner || ((cmd) => {
     const childEnv = sealed && environment
       ? { ...environment }
@@ -907,7 +1211,28 @@ function dispatchToEngine({ task, engine, worktreePath, root = process.cwd(), ti
       };
       if (liveLogPath) {
         fs.mkdirSync(path.dirname(liveLogPath), { recursive: true });
-        spawnOptions.onOutputChunk = (chunk) => appendEngineLiveLogChunk(liveLogPath, chunk);
+        // Claude's result JSON is one line at the end of the stream: every
+        // other stdout line goes to the live log as it lands so a watching
+        // operator sees the run while it runs, and the held-back result line
+        // is written as its final text once the run closes. A partial last
+        // line waits in the tail until more output or the flush.
+        let stdoutTail = '';
+        spawnOptions.onOutputChunk = (chunk, stream) => {
+          if (!claudeJson || stream !== 'stdout') {
+            appendEngineLiveLogChunk(liveLogPath, chunk);
+            return;
+          }
+          stdoutTail += String(chunk);
+          const lines = stdoutTail.split('\n');
+          stdoutTail = lines.pop();
+          const pass = lines.filter((line) => !claudeResultEvent(line));
+          if (pass.length) appendEngineLiveLogChunk(liveLogPath, `${pass.join('\n')}\n`);
+        };
+        flushLiveLogTail = () => {
+          const tail = stdoutTail;
+          stdoutTail = '';
+          if (tail && !claudeResultEvent(tail)) appendEngineLiveLogChunk(liveLogPath, tail);
+        };
       }
       const run = sandboxProfile
         ? runInReapedProcessGroup(executable, args, spawnOptions, cleanupControlDir, statusFile)
@@ -927,6 +1252,14 @@ function dispatchToEngine({ task, engine, worktreePath, root = process.cwd(), ti
     if (watchdogArtifact && fs.existsSync(watchdogArtifact)) {
       try { watchdogReceipt = JSON.parse(fs.readFileSync(watchdogArtifact, 'utf8')); } catch {}
     }
+    const unwrapped = claudeJson ? unwrapClaudeJsonResult(run.stdout) : null;
+    const stdout = unwrapped ? unwrapped.text : String(run.stdout || '');
+    if (flushLiveLogTail) {
+      try { flushLiveLogTail(); } catch {}
+    }
+    if (claudeJson && liveLogPath && stdout) {
+      try { appendEngineLiveLogChunk(liveLogPath, stdout); } catch {}
+    }
     return {
       task: task.display_id || task.id,
       engine,
@@ -940,8 +1273,10 @@ function dispatchToEngine({ task, engine, worktreePath, root = process.cwd(), ti
       signal: run.signal || null,
       timed_out: Boolean(run.error && run.error.code === 'ETIMEDOUT'),
       cancelled: Boolean(run.cancelled),
-      report: String(run.stdout || '').slice(-8000),
+      report: stdout.slice(-8000),
       stderr: String(run.stderr || '').slice(-2000),
+      ...(unwrapped && unwrapped.usage ? { usage: unwrapped.usage } : {}),
+      ...(unwrapped && unwrapped.cost_usd !== undefined ? { cost_usd: unwrapped.cost_usd } : {}),
     };
   };
   if (result && typeof result.then === 'function') return result.then(toDispatch);
@@ -1232,6 +1567,7 @@ module.exports = {
   nextInstalledFleetEngine,
   rankFleetEnginesDetailed,
   dispatchToEngine,
+  recordDispatchOutcome,
   taskTags,
   isHumanHoldTag,
   isDecisionTask,
@@ -2204,7 +2540,23 @@ function reviewWorktreeSnapshot(worktreePath) {
   };
 }
 
-async function runIndependentValidator({
+// Every validator attempt records one review line, handed over when a credit
+// wall passes the review to the next validator.
+async function runIndependentValidator(options) {
+  const attempts = [];
+  const clock = typeof options.clock === 'function' ? options.clock : Date.now;
+  try {
+    return await validateWithAttempts({ ...options, clock, attempts });
+  } finally {
+    appendRosterAttempts(options.root || process.cwd(), attempts, {
+      job: 'review',
+      task: dispatchTaskId(options.task),
+      source: 'one lap',
+    });
+  }
+}
+
+async function validateWithAttempts({
   root,
   task,
   worktreePath,
@@ -2214,6 +2566,9 @@ async function runIndependentValidator({
   validatorDispatcher = null,
   stateInspector = reviewWorktreeSnapshot,
   validatorModels = null,
+  clock = Date.now,
+  attempts = [],
+  prepAsk = undefined,
 }) {
   const candidates = [...new Set((validatorEngines || []).map((value) => String(value || '').trim()).filter(Boolean))]
     .filter((name) => RUNNER_PROFILE_DEFS[name] && name !== executorEngine);
@@ -2236,7 +2591,7 @@ async function runIndependentValidator({
     };
   }
   const dispatch = validatorDispatcher || ((entry) => Promise.resolve(dispatchToEngine({
-    ...validatorPin(validatorModels, entry.engine),
+    ...pinEngineFlags(validatorPin(validatorModels, entry.engine)),
     task,
     engine: entry.engine,
     worktreePath,
@@ -2252,9 +2607,20 @@ async function runIndependentValidator({
     skipBriefCapture: true,
   })));
 
+  // One prep pass per prep job for this task: a backup reviewer whose line
+  // asks for the same prep reuses the brief the first reviewer's prep wrote.
+  const reviewPrompt = buildOneLapValidatorPrompt(task, { verifierCommand, executorEngine });
+  const prepPasses = new Map();
   for (let index = 0; index < candidates.length; index += 1) {
     const validatorEngine = candidates[index];
-    const prompt = buildOneLapValidatorPrompt(task, { verifierCommand, executorEngine });
+    const pin = validatorPin(validatorModels, validatorEngine);
+    // A reviewer whose roster line asks for prep reads a brief first; the
+    // prep pass is read-only and runs before the worktree snapshot.
+    if (pin.prep && !prepPasses.has(pin.prep)) {
+      prepPasses.set(pin.prep, runPrepPass({ prepJob: pin.prep, forJob: 'review', task, prompt: reviewPrompt, worktreePath, root, clock, ...(prepAsk ? { ask: prepAsk } : {}) }));
+    }
+    const prep = pin.prep ? await prepPasses.get(pin.prep) : null;
+    const prompt = withPrepBrief(reviewPrompt, prep);
     const before = stateInspector(worktreePath);
     if (!before || before.ok !== true) {
       return {
@@ -2275,6 +2641,7 @@ async function runIndependentValidator({
       };
     }
     let dispatched;
+    const startedMs = clock();
     try {
       dispatched = normalizeDispatchResult(await dispatch({
         task,
@@ -2285,6 +2652,8 @@ async function runIndependentValidator({
     } catch (error) {
       dispatched = normalizeDispatchResult({ exitCode: 1, stderr: error.message || String(error) }, validatorEngine);
     }
+    const attempt = rosterAttemptRecord(validatorEngine, pin, startedMs, clock(), dispatched, prep);
+    attempts.push(attempt);
     const after = stateInspector(worktreePath);
     const output = dispatchResultOutput(dispatched).slice(-8000);
     const verdictOutput = [dispatched.report, dispatched.stdout]
@@ -2306,6 +2675,12 @@ async function runIndependentValidator({
       brief_id: dispatched.brief_id || null,
       worktree_unchanged: unchanged,
     };
+    if (attempt.outcome === 'landed') {
+      if (!unchanged) Object.assign(attempt, { outcome: 'failed', detail: 'changed the worktree it was reviewing' });
+      else if (verdict.verdict === 'reject') attempt.detail = 'rejected the change';
+      else if (verdict.passed) attempt.detail = 'signed off';
+      else Object.assign(attempt, { outcome: 'failed', detail: 'gave no clear verdict' });
+    }
     if (!unchanged) return { ok: false, stage: 'validator_mutated_worktree', validator_result: validatorResult };
     if (exitCode !== 0) {
       const outage = detectDeadEngineDispatch(dispatched);
@@ -2620,6 +2995,17 @@ function defaultSelfLandCheck({ worktreePath, targetRef = DISPATCH_SELF_LAND_TAR
 // One flight. Staff -> dispatch in parallel -> land serially -> receipt.
 // No fleet state file: progress is narrated via `log`, durability lives in
 // worktrees, task claims, and the receipt written at the end.
+// Fleet builds run on each engine's own defaults; the one thing the build
+// line adds is its prep job, when the line for this same engine asks for one.
+function fleetPrepPin(engineName, root) {
+  try {
+    const pin = rosterPinFor('executor', engineName, root);
+    return pin.roster_prep ? { prep: pin.roster_prep } : null;
+  } catch {
+    return null;
+  }
+}
+
 async function runFleetFlight({
   root = process.cwd(),
   slots = 3,
@@ -2633,6 +3019,8 @@ async function runFleetFlight({
   checkoutBase = 'origin/master',
   guardCliLink = guardGlobalCliLink,
   scoutAsk = null,
+  clock = Date.now,
+  prepAsk = undefined,
 } = {}) {
   const cli = ownCli || defaultOwnCli(root);
   // Staff first, rank second: every task staffFlight returns already cleared
@@ -2694,6 +3082,7 @@ async function runFleetFlight({
       briefId: entry.brief_id,
       skipBriefCapture: true,
       liveLogPath,
+      ...(entry.roster_pin ? { model: entry.roster_pin.model, effort: entry.roster_pin.effort, maxSeconds: entry.roster_pin.maxSeconds } : {}),
     }));
   }));
   const restaffState = { used: false };
@@ -2733,12 +3122,16 @@ async function runFleetFlight({
       installedEngines: roster,
       restaffState,
       scoutAsk: scoutAsk === null && dispatcher ? false : (scoutAsk || undefined),
+      clock,
+      defaultPin: fleetPrepPin(entry.engine, root),
+      prepAsk,
     }).then((result) => ({ entry, result }))
   ));
   flight.results = results.map(({ entry, result }) => {
     const row = { task: entry.task.display_id, engine: result.engine || entry.engine, exitCode: result.exitCode };
     if (result.brief_id) row.brief_id = result.brief_id;
     if (result.restaffed) row.restaffed = result.restaffed;
+    if (result.handover) row.handover = result.handover;
     if (result.deadEngine) row.deadEngine = result.deadEngine;
     return row;
   });
@@ -2760,6 +3153,7 @@ async function runFleetFlight({
     const activeEngine = result.engine || entry.engine;
     const landingEntry = { ...entry, engine: activeEngine };
     if (result.restaffed) log(`    restaffed ${entry.task.display_id}: ${result.restaffed.from} -> ${result.restaffed.to} (${result.restaffed.reason})`);
+    if (result.handover) log(`    handed over ${entry.task.display_id}: ${result.handover_reason}`);
     const buildFailure = detectDeadEngineDispatch(result);
     if (buildFailure) {
       const paused = {
@@ -2770,6 +3164,7 @@ async function runFleetFlight({
         detail: String(result.stderr || buildFailure.reason).slice(0, 200),
       };
       if (result.restaffed) paused.restaffed = result.restaffed;
+      if (result.handover) paused.handover = result.handover;
       if (result.deadEngine) paused.deadEngine = result.deadEngine;
       flight.paused.push(paused);
       stampDispatchBrief(root, result.brief_id, 'fail', `build failed for ${entry.task.display_id}`);
@@ -2824,6 +3219,7 @@ async function runFleetFlight({
     log,
   });
 
+  recordFlightRosterRuns(root, flight, results, { job: 'build', source: 'fleet' });
   flight.status = flight.paused.length ? 'failed' : 'completed';
   flight.finished_at = new Date().toISOString();
   atomicWriteFlightReceipt(flight, receiptPath);
@@ -2920,6 +3316,13 @@ async function runDispatchFlight({
   effort = '',
   maxSeconds = 0,
   validatorModels = null,
+  // The roster job this dispatch runs for, and the clock its run record uses.
+  rosterJob = 'build',
+  clock = Date.now,
+  // The job whose lead writes the requested engine a brief first ("prep:
+  // search" on its roster line), and an injectable ask for that prep pass.
+  prep = '',
+  prepAsk = undefined,
 } = {}) {
   if (!engine) throw new Error('runDispatchFlight: engine is required');
   if (!DISPATCH_CAPABLE.includes(engine)) {
@@ -3046,6 +3449,7 @@ async function runDispatchFlight({
         remoteBoundary,
         remoteMasterBefore: remoteBoundary ? remoteBoundary.protectedMaster : '',
         startCommit,
+        ...(maxSeconds ? { maxSeconds } : {}),
         ...(trustedPrompt ? { prompt: trustedPrompt } : {}),
       });
       log(`    building ${taskId} in ${path.basename(worktreePath)}`);
@@ -3077,9 +3481,9 @@ async function runDispatchFlight({
       briefId: entry.brief_id,
       skipBriefCapture: true,
       liveLogPath,
-      model: entry.engine === engine ? model : '',
-      effort: entry.engine === engine ? effort : '',
-      maxSeconds: entry.engine === engine ? maxSeconds : 0,
+      model: entry.roster_pin ? entry.roster_pin.model : (entry.engine === engine ? model : ''),
+      effort: entry.roster_pin ? entry.roster_pin.effort : (entry.engine === engine ? effort : ''),
+      maxSeconds: entry.roster_pin ? entry.roster_pin.maxSeconds : (entry.engine === engine ? maxSeconds : 0),
     }));
   }));
   const restaffState = { used: false };
@@ -3098,6 +3502,10 @@ async function runDispatchFlight({
       installedEngines,
       restaffState,
       scoutAsk: scoutAsk === null && dispatcher ? false : (scoutAsk || undefined),
+      clock,
+      defaultPin: { model, effort, maxSeconds: capSeconds(maxSeconds), ...(prep ? { prep } : {}) },
+      job: rosterJob,
+      prepAsk,
     }).then((result) => {
       const completedAtMs = Date.now();
       return {
@@ -3124,6 +3532,7 @@ async function runDispatchFlight({
     if (entry.startCommit) row.start_commit = entry.startCommit;
     if (result.brief_id) row.brief_id = result.brief_id;
     if (result.restaffed) row.restaffed = result.restaffed;
+    if (result.handover) row.handover = result.handover;
     if (result.deadEngine) row.deadEngine = result.deadEngine;
     if (candidate && candidate.ok) {
       row.candidate_commit = candidate.commit;
@@ -3216,6 +3625,7 @@ async function runDispatchFlight({
     const readyActor = explicitActor || `fleet-${activeEngine}`;
     const landingEntry = { ...entry, engine: activeEngine, candidate };
     if (result.restaffed) log(`    restaffed ${entry.taskId}: ${result.restaffed.from} -> ${result.restaffed.to} (${result.restaffed.reason})`);
+    if (result.handover) log(`    handed over ${entry.taskId}: ${result.handover_reason}`);
     const buildFailure = detectDeadEngineDispatch(result);
     if (buildFailure) {
       const paused = {
@@ -3227,6 +3637,7 @@ async function runDispatchFlight({
         worktree: entry.worktreePath,
       };
       if (result.restaffed) paused.restaffed = result.restaffed;
+      if (result.handover) paused.handover = result.handover;
       if (result.deadEngine) paused.deadEngine = result.deadEngine;
       flight.paused.push(paused);
       stampDispatchBrief(root, result.brief_id, 'fail', `build failed for ${entry.taskId}`);
@@ -3368,6 +3779,8 @@ async function runDispatchFlight({
             validatorDispatcher,
             stateInspector: validatorStateInspector || reviewWorktreeSnapshot,
             validatorModels,
+            clock,
+            prepAsk,
           });
           validatorResult = validation.validator_result;
           flight.validator_result = validatorResult;
@@ -3612,6 +4025,11 @@ async function runDispatchFlight({
     log,
   });
 
+  recordFlightRosterRuns(root, flight, results, {
+    job: rosterJob,
+    member: /^fleet-/.test(explicitActor) ? '' : explicitActor,
+    source: flight.context && flight.context.source === 'one_lap' ? 'one lap' : 'dispatch',
+  });
   flight.status = flight.paused.length ? 'failed' : 'completed';
   flight.finished_at = new Date().toISOString();
   writeDispatchReceipt(flight, receiptPath, { ids, reviewOnly, enforceRemoteBoundary });