audit-tools 0.33.4 → 0.33.7

package/dist/remediate/steps/nextStep.js

@@ -3,14 +3,14 @@ import { existsSync, statSync } from "node:fs";
 import { mkdir, readFile, rename } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { StateStore } from "../state/store.js";
-import { readConfirmedDispatchPolicy, resolveDispatchExclusion, readOptionalJsonFile, readValidatedRepoSessionIntent, stagedAndUntracked, writeJsonFile, writeTextFile, buildAuditDeliverablePair, formatValidationIssues, isRecord, withFsRetry, RunLogger, DISPATCH_PROMPT_HANDOFF_NOTE, renderHostScratchNote, hostScratchDir, renderQuotaCoverageNudge, renderTokenBudgetView, coerceJsonObjectArg, driveRolling, resolveLedgerBudgets, setQuotaStateDir, detectHostDispatchWall, admissionBlockedOnBudget, reconcileAdmissionLeasesFromQuotaFile, buildQuotaPausedTerminal, interpretFreeFormIntent, advance, decideFrictionTriage, buildFrictionTriageBlock, planHybridDispatch, readSettledPools, addSettledPool, isPoolSettlingOutcome, isInProcessWorkerProvider, isHeadlessPrimaryProvider, sourceByPoolId, classifyProvider, selectDispatchDriver, renderDispatchDriverInstruction, HostSessionQuotaSource, buildProviderModelKey, captureStepBoundaryFriction, captureCostDriftFriction, captureCreditExhaustionFriction, captureQuotaUnclassifiedFriction, captureModelUnavailableFriction, capturePacketTooLargeFriction, LENSES, SEVERITIES, resolveHostProviderName, resolveConversationHostProvider, resolveHostDispatchCapability as sharedResolveHostDispatchCapability, resolveAutonomousMode, resolveRollingEngineFlag, shouldDemotePrimaryInProcess, DEFAULT_CONTEXT_TOKENS } from "audit-tools/shared";
+import { readConfirmedDispatchPolicy, resolveDispatchExclusion, readOptionalJsonFile, readValidatedRepoSessionIntent, stagedAndUntracked, writeJsonFile, writeTextFile, buildAuditDeliverablePair, formatValidationIssues, isRecord, withFsRetry, RunLogger, DISPATCH_PROMPT_HANDOFF_NOTE, renderHostScratchNote, hostScratchDir, renderQuotaCoverageNudge, renderTokenBudgetView, coerceJsonObjectArg, driveRolling, resolveLedgerBudgets, setQuotaStateDir, detectHostDispatchWall, admissionBlockedOnBudget, reconcileAdmissionLeasesFromQuotaFile, buildQuotaPausedTerminal, interpretFreeFormIntent, advance, decideFrictionTriage, buildFrictionTriageBlock, planHybridDispatch, readSettledPools, addSettledPool, isPoolSettlingOutcome, isInProcessWorkerProvider, sourceByPoolId, classifyProvider, selectDispatchDriver, renderDispatchDriverInstruction, HostSessionQuotaSource, buildProviderModelKey, captureStepBoundaryFriction, captureCostDriftFriction, captureCreditExhaustionFriction, captureQuotaUnclassifiedFriction, captureModelUnavailableFriction, capturePacketTooLargeFriction, LENSES, SEVERITIES, resolveHostProviderName, resolveHostDispatchProviderName, resolveHostDispatchCapability as sharedResolveHostDispatchCapability, resolveAutonomousMode, resolveRollingEngineFlag, DEFAULT_CONTEXT_TOKENS } from "audit-tools/shared";
 import { readRemediationAccessMemory, computeBlockContinuityScores } from "../state/accessMemory.js";
 import { applyPlanPipeline, buildCoverageLedger } from "../phases/plan.js";
 import { groundExtractedFindings } from "../phases/grounding.js";
 import { runTriagePhase } from "../phases/triage.js";
 import { runClosePhase } from "../phases/close.js";
 import { validateRemediationPlan } from "../validation/remediationState.js";
-import { mergeImplementResults, prepareImplementDispatch, readExtractedPlanIfPresent, buildConfirmedPools, executeNodeInWorktree, blockScopesFromPlan, declaredPathsFromPlan, targetedCommandsForBlock, } from "./dispatch.js";
+import { mergeImplementResults, prepareImplementDispatch, readExtractedPlanIfPresent, buildConfirmedPools, executeNodeInWorktree, blockScopesFromPlan, targetedCommandsForBlock, } from "./dispatch.js";
 import { makeProviderNodeDispatcher } from "./providerNodeDispatch.js";
 import { prepareHostRollingDispatch, nodeClaimRegistry, nodeSettledPoolsPath } from "./rollingSession.js";
 import { ClaimRegistry } from "../../shared/quota/claimRegistry.js";
@@ -509,12 +509,16 @@ export async function driveRollingDispatch(levels, options) {
                 ...(continuity > 0 ? { continuity } : {}),
             };
         },
-        toPacket: (b) => ({
-            id: b.block_id,
-            payload: { block_id: b.block_id },
-            estimatedTokens: estimateTokens(b),
-            complexity: 0.5,
-        }),
+        toPacket: (b) => {
+            const requiredTier = options.tierForBlock?.(b);
+            return {
+                id: b.block_id,
+                payload: { block_id: b.block_id },
+                estimatedTokens: estimateTokens(b),
+                complexity: 0.5,
+                ...(requiredTier ? { requiredTier } : {}),
+            };
+        },
         dispatchPacket: async (packet, slot) => options.dispatchNode(blockById.get(packet.payload.block_id), slot),
         ...(options.root !== undefined ? { root: options.root } : {}),
         ...(options.onCostDrift ? { onCostDrift: options.onCostDrift } : {}),
@@ -538,18 +542,9 @@ export async function driveRollingDispatch(levels, options) {
         levels: run.levels.map((l) => ({ blockIds: l.nodeIds, results: l.results })),
         rebuilds: run.rebuilds,
         ...(run.terminal ? { terminal: run.terminal } : {}),
+        exhaustedPoolIds: run.exhaustedPoolIds,
     };
 }
-/**
- * Whether session config names an EXPLICIT backend the orchestrator self-drives as
- * the per-node implement worker — the shared `isHeadlessPrimaryProvider` predicate
- * (H3), remediate policy: command-shaped primaries allowed (implement nodes carry
- * per-node worker commands). The conversation host (claude-code) and IDE-bound
- * providers stay excluded; "auto" stays on the conversation host-subagent default.
- */
-function resolvesToInProcessDispatchProvider(sessionConfig) {
-    return isHeadlessPrimaryProvider(sessionConfig?.provider, { commandWorkers: true });
-}
 /**
  * Whether a confirmed pool is one the orchestrator launches IN-PROCESS this cycle
  * (vs. the conversation host's subagent pool) — the shared
@@ -588,21 +583,23 @@ export async function driveRollingImplementDispatch(options) {
     const { root, artifactsDir, runId } = options;
     // Prepare the dispatch plan (eligible verified-complete frontier) with the SAME
     // quota-derived sizing the wave path uses. This writes per-node prompts +
-    // dispatch-plan.json + dispatch-quota.json.
-    const plan = await prepareImplementDispatch({ root, artifactsDir }, runId, undefined, {
-        hostMaxConcurrent: options.waveOptions?.hostMaxConcurrent,
-        sessionConfig: options.sessionConfig,
-        hostContextTokens: options.waveOptions?.hostContextTokens,
-        hostOutputTokens: options.waveOptions?.hostOutputTokens,
-        hostModels: options.waveOptions?.hostModels,
-        hostModelId: options.waveOptions?.hostModelId,
-        // Each node runs in its own worktree, so its prompt is rooted there.
-        worktreeRootedPrompts: true,
-        // The in-process rolling engine admits + leases per-packet itself, so the
-        // dispatch-quota grant here must NOT lease (a host grant lease would
-        // double-count the same work against the shared account budget).
-        grantLeases: false,
-    });
+    // dispatch-plan.json + dispatch-quota.json. A partition-scoped hybrid caller
+    // supplies its already-prepared plan instead (planOverride — see its docblock).
+    const plan = options.planOverride ??
+        (await prepareImplementDispatch({ root, artifactsDir }, runId, undefined, {
+            hostMaxConcurrent: options.waveOptions?.hostMaxConcurrent,
+            sessionConfig: options.sessionConfig,
+            hostContextTokens: options.waveOptions?.hostContextTokens,
+            hostOutputTokens: options.waveOptions?.hostOutputTokens,
+            hostModels: options.waveOptions?.hostModels,
+            hostModelId: options.waveOptions?.hostModelId,
+            // Each node runs in its own worktree, so its prompt is rooted there.
+            worktreeRootedPrompts: true,
+            // The in-process rolling engine admits + leases per-packet itself, so the
+            // dispatch-quota grant here must NOT lease (a host grant lease would
+            // double-count the same work against the shared account budget).
+            grantLeases: false,
+        }));
     if (plan.items.length === 0) {
         return null;
     }
@@ -625,6 +622,12 @@ export async function driveRollingImplementDispatch(options) {
     const referencedFilesByBlock = new Map(plan.items
         .filter((i) => typeof i.block_id === "string")
         .map((i) => [i.block_id, i.access?.read_paths ?? []]));
+    // Per-block capability floor from the plan's model hints (F4) — the same tier
+    // the contract's admission packets carry, so the engine's packet→pool
+    // selection enforces what the contract displays.
+    const tierByBlock = new Map(plan.items
+        .filter((i) => typeof i.block_id === "string")
+        .flatMap((i) => (i.model_hint ? [[i.block_id, i.model_hint.tier]] : [])));
     // The RETAINED host-session source: threaded through pool sizing AND the
     // dispatcher's escalation hooks so the bounded re-limit chain (recordLimit →
     // escalate → strand → quota_escalation friction) is fed end-to-end. Its
@@ -650,20 +653,22 @@ export async function driveRollingImplementDispatch(options) {
         },
     });
     // Confirmed pools: quota-derived concurrency, never the raw host flag (INV-QD-11).
-    const confirmedPools = await buildConfirmedPools({
-        sessionConfig: options.sessionConfig,
-        hostMaxConcurrent: options.waveOptions?.hostMaxConcurrent,
-        hostContextTokens: options.waveOptions?.hostContextTokens,
-        hostOutputTokens: options.waveOptions?.hostOutputTokens,
-        hostModels: options.waveOptions?.hostModels,
-        hostModelId: options.waveOptions?.hostModelId,
-        hostSession,
-        // The operator's Gate-0 exclusions, applied as a set-difference over freshly
-        // gathered reach. Read here because this layer owns `root`; self-spawn-blocked is
-        // recomputed against THIS process's env rather than inherited from the auditor
-        // that wrote the confirmation.
-        excludedBackends: resolveDispatchExclusion(await readConfirmedDispatchPolicy(options.root)),
-    });
+    // A partition-scoped caller supplies its coordinator's already-built set instead.
+    const confirmedPools = options.poolsOverride ??
+        (await buildConfirmedPools({
+            sessionConfig: options.sessionConfig,
+            hostMaxConcurrent: options.waveOptions?.hostMaxConcurrent,
+            hostContextTokens: options.waveOptions?.hostContextTokens,
+            hostOutputTokens: options.waveOptions?.hostOutputTokens,
+            hostModels: options.waveOptions?.hostModels,
+            hostModelId: options.waveOptions?.hostModelId,
+            hostSession,
+            // The operator's Gate-0 exclusions, applied as a set-difference over freshly
+            // gathered reach. Read here because this layer owns `root`; self-spawn-blocked is
+            // recomputed against THIS process's env rather than inherited from the auditor
+            // that wrote the confirmation.
+            excludedBackends: resolveDispatchExclusion(await readConfirmedDispatchPolicy(options.root)),
+        }));
     // The live per-node worker: the configured provider, launched with the node's
     // worktree-rooted prompt and cwd = its worktree. Tests inject `options.dispatchNode`
     // to exercise the engine without spawning a real worker. A node on a source-backed
@@ -683,11 +688,22 @@ export async function driveRollingImplementDispatch(options) {
     if (!state)
         return null;
     const plannedBlockIds = new Set(resultPathByBlock.keys());
+    // Partition scope (H2): when the caller assigned this driver a coordinator
+    // partition, only those planned blocks are driven — everything else stays
+    // pending for the caller's other pools (the host share included).
+    const partitionIds = options.blocksOverride !== undefined ? new Set(options.blocksOverride) : null;
     const allLevels = rollingDependencyLevels(state);
     // Keep only the blocks that were actually planned this dispatch (eligible now).
     const levels = allLevels
-        .map((level) => level.filter((b) => plannedBlockIds.has(b.block_id)))
+        .map((level) => level.filter((b) => plannedBlockIds.has(b.block_id) && (partitionIds === null || partitionIds.has(b.block_id))))
         .filter((level) => level.length > 0);
+    // Empty partition → an empty-but-SHAPED result, never null: `null` means "no
+    // eligible work, run the merge" to existing callers, and a partition caller
+    // following that recipe against the just-written full-frontier plan would
+    // terminal-block every undriven block (review h2c2 F1).
+    if (partitionIds !== null && levels.length === 0) {
+        return { nodes: [], rebuilds: 0, state_status: state.status, exhausted_pool_ids: [] };
+    }
     const nodeOutcomes = [];
     // The SAME file-backed claim registry the host-subagent driver claims through
     // (`nodeClaimRegistry`, keyed only to run + artifacts dir). Claiming a node here
@@ -697,7 +713,9 @@ export async function driveRollingImplementDispatch(options) {
     // life of this run: a `rate_limited` re-queue re-enters for the same block, so a
     // node already claimed by THIS driver reuses its token rather than self-colliding.
     const registry = nodeClaimRegistry(artifactsDir, runId);
-    const claimTokens = new Map();
+    // Seeded with any coordinator-held claims the caller hands off (hybrid partition
+    // drive) — an adopted node skips self-claiming and releases with the adopted token.
+    const claimTokens = new Map(options.claimOwnerTokens ?? []);
     // Per-node worktree dispatch + verify-before-accept, wrapped so the rolling
     // engine's dispatchNode callback always RESOLVES (never rejects).
     const dispatchNodeWithWorktree = async (block, slot) => {
@@ -710,7 +728,7 @@ export async function driveRollingImplementDispatch(options) {
         if (!claimTokens.has(block.block_id)) {
             const claim = await registry.claim(block.block_id, "in-process");
             if (!claim.acquired) {
-                nodeOutcomes.push({ block_id: block.block_id, outcome: "success", verify_passed: false, merged: false });
+                nodeOutcomes.push({ block_id: block.block_id, outcome: "success", verify_passed: false, merged: false, pool_id: slot.poolId });
                 return {
                     packet: { id: block.block_id, payload: { block_id: block.block_id }, estimatedTokens: 0, complexity: 0.5 },
                     outcome: "success",
@@ -743,6 +761,9 @@ export async function driveRollingImplementDispatch(options) {
             outcome: accept.outcome,
             verify_passed: accept.verifyPassed,
             merged: accept.merged,
+            // Real per-node pool attribution (H2 plan D2) — the slot the engine bound,
+            // so a partition caller can settle the RIGHT pool from a node's outcome.
+            pool_id: slot.poolId,
         });
         // Release the claim ONLY on a terminal accept. A `rate_limited`,
         // `credit_exhausted`, or `quota_unclassified` worker re-queues (still owned
@@ -775,6 +796,7 @@ export async function driveRollingImplementDispatch(options) {
         hostSession,
         continuityScores,
         scopeForBlock: (block) => writePathsByBlock.get(block.block_id) ?? block.touched_files ?? [],
+        tierForBlock: (block) => tierByBlock.get(block.block_id),
         // Reactive cost verification: a declared-free source pool observed charging has
         // been demoted by the engine; surface it as reviewable friction so the operator
         // reconciles the stale `cost_per_mtok:0` (single step-boundary chokepoint).
@@ -808,6 +830,22 @@ export async function driveRollingImplementDispatch(options) {
             capturePacketTooLargeFriction(artifactsDir, runId, info, "remediate-code");
         },
     });
+    // Partition-scoped drive (H2): run-level lifecycle belongs to the CALLER — the
+    // engine terminal is surfaced on the result but never persisted (a backend-only
+    // wall must not pause the whole run while the host share proceeds), and the
+    // deterministic merge is the caller's, run once over ALL partitions.
+    if (partitionIds !== null) {
+        // Freshly persisted status; falls back to the pre-drive snapshot only if
+        // state.json vanished mid-drive (review h2c2 F4 — documented, not silent).
+        const current = await new StateStore(artifactsDir).loadState();
+        return {
+            nodes: nodeOutcomes,
+            rebuilds: Math.max(0, levels.length - 1),
+            state_status: (current ?? state).status,
+            exhausted_pool_ids: driven.exhaustedPoolIds,
+            ...(driven.terminal ? { terminal: driven.terminal } : {}),
+        };
+    }
     // Piece D — persist the rolling engine's partial-completion terminal onto state
     // BEFORE the merge, so the merge can SKIP-block the quota_paused stranded nodes
     // (their worker rate-limited → no result file, but they must stay PENDING for a
@@ -829,6 +867,8 @@ export async function driveRollingImplementDispatch(options) {
         nodes: nodeOutcomes,
         rebuilds: Math.max(0, levels.length - 1),
         state_status: merged.status,
+        exhausted_pool_ids: driven.exhaustedPoolIds,
+        ...(driven.terminal ? { terminal: driven.terminal } : {}),
     };
 }
 /**
@@ -838,85 +878,6 @@ export async function driveRollingImplementDispatch(options) {
  * uses (`driveRollingDispatch`'s `() => 2000`), keeping the two paths consistent.
  */
 const HYBRID_NODE_TOKEN_ESTIMATE = 2000;
-/**
- * Run the A-8 coordinator's IN-PROCESS partition this cycle. Each node was already
- * claimed by the coordinator and assigned to a backend pool (NIM / codex / …), so it
- * is launched on THAT pool's provider — binding the slot's providerName to the
- * per-node assignment is what routes a node to its assigned backend — cwd-confined to
- * its worktree, through the shared `executeNodeInWorktree` lifecycle (commit → verify
- * → write-scope → merge); then the coordinator's claim is released.
- *
- * Nodes run concurrently: the coordinator's proactive split already bounded the
- * partition to the backend pools' capacity, so the partition size IS the safe
- * concurrency. The host partition runs in parallel via the host-subagent driver;
- * both write accept-outcome sidecars the run-level `mergeImplementResults` reconciles.
- *
- * Run-once (no in-pass re-queue): a node whose worker rate-limits or errors is not
- * merged (its worktree drops) and is routed to triage by the deterministic merge —
- * bounded, never a livelock. (Cross-cycle settled-pool re-balancing is a follow-up.)
- */
-export async function executeInProcessPartition(params) {
-    const { root, artifactsDir, runId, sessionConfig, partition, plan, coordinator, registry } = params;
-    if (partition.length === 0)
-        return { nodes: [] };
-    const allBlockScopes = blockScopesFromPlan(plan);
-    const withBlockId = plan.items.filter((i) => typeof i.block_id === "string");
-    const promptPathByBlock = new Map(withBlockId.map((i) => [i.block_id, i.prompt_path]));
-    const referencedFilesByBlock = new Map(withBlockId.map((i) => [i.block_id, i.access?.read_paths ?? []]));
-    const resultPathByBlock = new Map(withBlockId.map((i) => [i.block_id, i.result_path]));
-    const state = await new StateStore(artifactsDir).loadState();
-    const blockById = new Map((state?.plan?.blocks ?? []).map((b) => [b.block_id, b]));
-    const dispatchNode = params.dispatchNode ??
-        makeProviderNodeDispatcher({
-            root,
-            artifactsDir,
-            runId,
-            sessionConfig,
-            promptPathByBlock,
-            referencedFilesByBlock,
-            sourceByPoolId: params.sourceByPoolId,
-        });
-    const nodes = await Promise.all(partition.map(async (a) => {
-        // `a` IS the coordinator's NodeAssignment — release it directly on terminal.
-        const resultPath = resultPathByBlock.get(a.nodeId);
-        if (!resultPath) {
-            // No prepared prompt/result for this node — release + mark error (the merge
-            // routes it to triage); never silently drop a claimed node.
-            await coordinator.release(a);
-            return { block_id: a.nodeId, outcome: "error", verify_passed: false, merged: false };
-        }
-        const block = blockById.get(a.nodeId) ?? { block_id: a.nodeId };
-        const slot = {
-            providerName: a.providerName,
-            hostModel: a.hostModel,
-            poolId: a.poolId,
-        };
-        const { accept } = await executeNodeInWorktree({
-            block,
-            slot,
-            root,
-            artifactsDir,
-            runId,
-            resultPath,
-            seedPaths: declaredPathsFromPlan(plan, a.nodeId),
-            allBlockScopes,
-            additionalVerifyCommands: state ? targetedCommandsForBlock(state, a.nodeId) : [],
-            dispatchNode,
-            // Merge-time ownership gate (OD3 layer 2): the SAME lease the coordinator
-            // claimed `a` under. Omitted when the caller didn't supply a registry.
-            ...(registry ? { ownership: { registry, nodeId: a.nodeId, ownerToken: a.ownerToken } } : {}),
-        });
-        // Run-once → terminal; free the coordinator claim (token-checked).
-        await coordinator.release(a);
-        return {
-            block_id: a.nodeId,
-            outcome: accept.outcome,
-            verify_passed: accept.verifyPassed,
-            merged: accept.merged,
-        };
-    }));
-    return { nodes };
-}
 // ---------------------------------------------------------------------------
 // Tool-owned final completion gate (INV-RS-10) + coarse re-block (INV-RS-09)
 // ---------------------------------------------------------------------------
@@ -1225,80 +1186,23 @@ async function buildImplementDispatchStep(ctx) {
         hostModels: resolvedHostModels,
         hostModelId: resolvedHostModelId,
     };
-    // A8 in-process provider driver: when the rolling engine is enabled, the run is
-    // HEADLESS (no attended host that can dispatch subagents), AND the operator
-    // EXPLICITLY configured a programmatic backend provider (openai-compatible / codex /
-    // opencode / …), the orchestrator drives the FULL rolling implement dispatch ITSELF —
-    // the configured provider is the per-node worker, cwd-confined to each node's
-    // worktree, sharing the same `acceptNodeWorktree` core (commit → verify → merge,
-    // verify-fail → triage) as the host-subagent driver. Defect-1: gated on `!canDispatchImpl`
-    // so an ATTENDED host demotes the backend to a source pool (the hybrid branch below,
-    // host + backend + NIM concurrent) rather than the backend monopolizing the frontier;
-    // only a truly headless run (e.g. a NIM pool for headless autonomy, host_can_dispatch:false)
-    // lets the backend self-drive.
-    // Defect-1: DEMOTE (attended concurrent fan-out) applies only to the demotable
-    // backends (codex/opencode/openai-compatible). A non-demotable in-process provider
-    // (subprocess-template/worker-command — no standalone source pool) keeps
-    // self-driving regardless of attendance, so the monopoly branch still fires for it.
-    // B1 same-agent guard: suppress the demote when the conversation host IS the
-    // primary backend provider (one account ⇒ host self-drives as a single pool),
-    // else host + demoted-source pools double-book that one meter.
-    const demoteBackendToSource = shouldDemotePrimaryInProcess({
-        sessionConfig: sessionConfigImpl,
-        hostCanDispatch: canDispatchImpl,
-    });
-    if (rollingEngineEnabled &&
-        !demoteBackendToSource &&
-        resolvesToInProcessDispatchProvider(sessionConfigImpl)) {
-        const driven = await driveRollingImplementDispatch({
-            root,
-            artifactsDir,
-            runId,
-            sessionConfig: sessionConfigImpl ?? null,
-            // Per-node verify (targeted_commands) owns each node's build/test; an
-            // inter-level "shared surface" rebuild is a monorepo-self-remediation concern
-            // the host-driven paths handle, not a generic target-repo step → no-op here.
-            rebuildSharedBetweenLevels: async () => { },
-            waveOptions: {
-                hostMaxConcurrent: resolvedHostMaxConcurrent,
-                hostContextTokens: resolvedHostContextTokens,
-                hostOutputTokens: resolvedHostOutputTokens,
-                hostModels: resolvedHostModels,
-                hostModelId: resolvedHostModelId,
-            },
+    // H2+H4 collapse: ONE fan-out over the eligible pool set. `buildConfirmedPools`
+    // folds the configured primary in-process backend in as a source pool
+    // UNCONDITIONALLY (no demote flag; command-shaped primaries included under
+    // remediate's policy — plan D3) and includes the conversation host as a member
+    // pool iff it can dispatch subagents. Headless is the degenerate "no host pool
+    // in the set" case: the engine drives the whole frontier itself. The same-agent
+    // case (conversation host IS the primary backend) is the shared cross-class
+    // dedup's D1 collision rule — the engine/source pool survives, so one account is
+    // never double-booked across a host pool and a folded source.
+    if (rollingEngineEnabled) {
+        // D5: the host-session quota key follows the DRIVER identity — an in-process
+        // worker primary keys to the conversation host; an explicit IDE/host provider
+        // passes through verbatim (never re-keyed to the literal claude-code, the
+        // founding-bug misattribution class [[capability-is-per-auditor-not-per-audit]]).
+        const hybridProviderName = resolveHostDispatchProviderName(sessionConfigImpl, {
+            commandWorkers: true,
         });
-        // null = no eligible pending work this pass; the engine merges internally once
-        // it has run, so only the empty-frontier case needs a merge here. Either way the
-        // implement frontier is resolved — transition on the freshly-merged state so the
-        // engine re-scans (triage / closing) without recursion.
-        if (driven === null) {
-            const merged = await mergeImplementResults({ root, artifactsDir }, runId);
-            return { kind: "transition", state: merged };
-        }
-        return { kind: "transition", state: await store.loadState() };
-    }
-    if (rollingEngineEnabled && canDispatchImpl) {
-        // A-8 hybrid spill: when an in-process backend pool is ALSO confirmed (a
-        // configured NIM/openai-compatible endpoint alongside the conversation host),
-        // split the eligible frontier across BOTH pool classes via the shared
-        // HybridSpillCoordinator (single claimant, proactive capacity split) — the
-        // orchestrator runs the in-process partition THIS cycle while the host spawns
-        // subagents for its partition. Pure host-subagent dispatch falls out when no
-        // backend pool is confirmed (the coordinator has nothing to split against).
-        // Retained host-session source for the hybrid pool-sizing pre-wall throttle
-        // (this branch previously sized pools with no account-wall awareness at all,
-        // unlike the primary path above). This branch has its own already-working,
-        // bounded rate-limited/settle mechanism below (DC-4) rather than routing
-        // through HostSessionQuotaSource.recordLimit/isEscalated, so onEscalation is
-        // unused here — the source only feeds buildConfirmedPools' sizing.
-        // Defect-1: the host-session quota key must follow the CONVERSATION HOST, not a
-        // demoted backend — key it to the auto-detected conversation host (B1: codex
-        // when inside a Codex session, else claude-code; --host-provider overrides)
-        // when the configured primary is a demotable backend that this attended run is
-        // fanning out onto as a source.
-        const hybridProviderName = demoteBackendToSource
-            ? resolveConversationHostProvider({ sessionConfig: sessionConfigImpl })
-            : resolveHostProviderName(sessionConfigImpl);
         const hybridHostSessionModelKey = buildProviderModelKey(hybridProviderName, sessionConfigImpl
             ?.block_quota?.host_model ??
             resolvedHostModelId ??
@@ -1314,187 +1218,248 @@ async function buildImplementDispatchStep(ctx) {
             hostModels: resolvedHostModels,
             hostModelId: resolvedHostModelId,
             hostSession: hybridHostSession,
-            // Defect-1: reached here because the headless in-process branch above was
-            // skipped (attended host) — demote the configured primary backend into the
-            // source-pool set so the split fans across host + backend + NIM.
-            demotePrimaryInProcess: demoteBackendToSource,
+            // Attendance IS pool-set membership: headless ⇒ no host pool in the set.
+            hostCanDispatch: canDispatchImpl,
             // The operator's Gate-0 exclusions, applied as a set-difference over freshly
             // gathered reach; self-spawn-blocked recomputed against THIS process's env.
             excludedBackends: resolveDispatchExclusion(await readConfirmedDispatchPolicy(root)),
         });
         const backendPools = confirmedPools.filter(isInProcessPool);
-        let rolling;
-        if (backendPools.length > 0) {
-            // Prepare the frontier ONCE (worktree-rooted prompts) so the coordinator
-            // split, the in-process executor, and the host driver all read the same plan.
-            const plan = await prepareImplementDispatch({ root, artifactsDir }, runId, undefined, {
-                ...waveOptsImpl,
-                worktreeRootedPrompts: true,
-            });
-            const frontier = plan.items
-                .filter((i) => typeof i.block_id === "string")
-                .map((i) => ({ id: i.block_id, estimatedTokens: HYBRID_NODE_TOKEN_ESTIMATE }));
-            if (frontier.length === 0) {
-                const merged = await mergeImplementResults({ root, artifactsDir }, runId);
-                return { kind: "transition", state: merged };
+        if (!canDispatchImpl) {
+            // Headless: no host pool in the eligible set — when any dispatchable
+            // backend pool is confirmed, the engine drives the FULL rolling implement
+            // dispatch itself (no blocksOverride: the driver's full path owns terminal
+            // persistence + the final merge), cwd-confined to each node's worktree,
+            // sharing the same `acceptNodeWorktree` core as the host-subagent driver.
+            // No pool at all ⇒ fall through to the sequential host step below.
+            if (backendPools.length > 0) {
+                const driven = await driveRollingImplementDispatch({
+                    root,
+                    artifactsDir,
+                    runId,
+                    sessionConfig: sessionConfigImpl ?? null,
+                    // Per-node verify (targeted_commands) owns each node's build/test; an
+                    // inter-level "shared surface" rebuild is a monorepo-self-remediation concern
+                    // the host-driven paths handle, not a generic target-repo step → no-op here.
+                    rebuildSharedBetweenLevels: async () => { },
+                    waveOptions: {
+                        hostMaxConcurrent: resolvedHostMaxConcurrent,
+                        hostContextTokens: resolvedHostContextTokens,
+                        hostOutputTokens: resolvedHostOutputTokens,
+                        hostModels: resolvedHostModels,
+                        hostModelId: resolvedHostModelId,
+                    },
+                    // The eligible pool set built above (source pools only — headless),
+                    // so the drive routes across every confirmed backend pool.
+                    poolsOverride: backendPools,
+                });
+                // null = no eligible pending work this pass; the engine merges internally once
+                // it has run, so only the empty-frontier case needs a merge here. Either way the
+                // implement frontier is resolved — transition on the freshly-merged state so the
+                // engine re-scans (triage / closing) without recursion.
+                if (driven === null) {
+                    const merged = await mergeImplementResults({ root, artifactsDir }, runId);
+                    return { kind: "transition", state: merged };
+                }
+                return { kind: "transition", state: await store.loadState() };
             }
-            // One coordinator over the shared claim registry splits + claims each node to
-            // exactly one pool. DC-4: the settled set is cross-cycle (persisted) — a backend
-            // pool that exhausted on a prior cycle is excluded here, so its work falls to the
-            // host-subagent pool instead of re-looping on a dead backend.
-            const settledPath = nodeSettledPoolsPath(artifactsDir, runId);
-            const settled = await readSettledPools(settledPath);
-            // Hoisted so the coordinator's claim registry and the ownership gate's
-            // heartbeat probe are the SAME file-backed instance — never independently
-            // re-derived by path (the coordinator's own `claimRegistry` field is private).
-            const hybridClaimRegistry = nodeClaimRegistry(artifactsDir, runId);
-            const partition = await planHybridDispatch({
-                frontier,
-                pools: confirmedPools,
-                sessionConfig: sessionConfigImpl ?? {},
-                claimRegistry: hybridClaimRegistry,
-                readSettled: () => settled,
-                onSettle: async (id) => {
-                    settled.add(id);
-                    await addSettledPool(settledPath, id);
-                },
-                isInProcess: isInProcessPool,
-            });
-            // Run the in-process partition now (each node on its assigned backend pool,
-            // launched FROM that pool's source config — A-8 generic dispatchable sources).
-            const inProcessOutcome = await executeInProcessPartition({
-                root,
-                artifactsDir,
-                runId,
-                sessionConfig: sessionConfigImpl ?? null,
-                partition: partition.inProcess,
-                plan,
-                coordinator: partition.coordinator,
-                registry: hybridClaimRegistry,
-                sourceByPoolId: sourceByPoolId(confirmedPools),
-            });
-            // DC-4: a backend pool whose node rate-limited, credit-exhausted, OR
-            // returned a quota_unclassified death → settle it (cross-cycle) so the next
-            // cycle routes its share to the host pool. This partition spans multiple
-            // cycles, each with its own fresh in-process dispatcher (a fresh in-memory
-            // exhaustedPoolIds AND pausedPoolResetAt), so the rolling engine's own
-            // reversible pause evaporates at the cycle boundary — without settling here,
-            // credit_exhausted (no reset timer) and a chronically-quota_unclassified pool
-            // alike would be RE-OFFERED next cycle and re-die on the same pool. Settling
-            // in the hybrid path is the cross-cycle analog of the rolling path's pause.
-            // NOTE: the verbatim-message harvest (captureQuotaUnclassifiedFriction /
-            // captureCreditExhaustionFriction) rides the rolling engine's hooks, which
-            // this direct-Promise.all partition does not invoke; here every settled node
-            // still surfaces as a quota_escalation friction (below), but without the
-            // verbatim text. Threading verbatim capture into executeInProcessPartition is
-            // a documented follow-up (affects credit_exhausted identically — not new to A2b).
-            // `packet_too_large` is deliberately NOT a settle trigger (unified-routing
-            // step D): a 413 is a per-(node,pool) sizing fact — one oversized node must
-            // never kill the pool for every other node; settling it would collapse
-            // capacity the run still has. NOTE: this frontier is sized with a FLAT
-            // per-node estimate (HYBRID_NODE_TOKEN_ESTIMATE), so the claim-time fit gate
-            // cannot pre-skip a genuinely-oversized node — a chronic (node,pool) 413 re-
-            // offers each cycle, bounded by item-level triage, and is surfaced as
-            // friction below (per-node real estimates are the step-G follow-up).
-            const settledOutcomeBlocks = new Set(inProcessOutcome.nodes
-                .filter((n) => isPoolSettlingOutcome(n.outcome))
-                .map((n) => n.block_id));
-            const exhaustedPools = new Set(partition.inProcess.filter((a) => settledOutcomeBlocks.has(a.nodeId)).map((a) => a.poolId));
-            for (const poolId of exhaustedPools) {
-                await partition.coordinator.settlePool(poolId);
+        }
+        if (canDispatchImpl) {
+            // A-8 hybrid spill: when an in-process backend pool is ALSO confirmed (a
+            // configured NIM/openai-compatible endpoint alongside the conversation host),
+            // split the eligible frontier across BOTH pool classes via the shared
+            // HybridSpillCoordinator (single claimant, proactive capacity split) — the
+            // orchestrator runs the in-process partition THIS cycle while the host spawns
+            // subagents for its partition. Pure host-subagent dispatch falls out when no
+            // backend pool is confirmed (the coordinator has nothing to split against).
+            // The hybrid host-session source above fed `buildConfirmedPools`' pool-sizing
+            // pre-wall throttle; this branch has its own bounded rate-limited/settle
+            // mechanism below (DC-4) rather than routing through
+            // HostSessionQuotaSource.recordLimit/isEscalated.
+            let rolling;
+            if (backendPools.length > 0) {
+                // Prepare the frontier ONCE (worktree-rooted prompts) so the coordinator
+                // split, the partition drive (via planOverride), and the host driver all
+                // read the same plan — the partition drive deliberately does NOT re-prepare
+                // (see DriveRollingImplementDispatchOptions.planOverride for the lease
+                // overlap this shape carries and why a re-prepare would clobber the
+                // host-share dispatch-quota).
+                const plan = await prepareImplementDispatch({ root, artifactsDir }, runId, undefined, {
+                    ...waveOptsImpl,
+                    worktreeRootedPrompts: true,
+                });
+                const frontier = plan.items
+                    .filter((i) => typeof i.block_id === "string")
+                    .map((i) => ({ id: i.block_id, estimatedTokens: HYBRID_NODE_TOKEN_ESTIMATE }));
+                if (frontier.length === 0) {
+                    const merged = await mergeImplementResults({ root, artifactsDir }, runId);
+                    return { kind: "transition", state: merged };
+                }
+                // One coordinator over the shared claim registry splits + claims each node to
+                // exactly one pool. DC-4: the settled set is cross-cycle (persisted) — a backend
+                // pool that exhausted on a prior cycle is excluded here, so its work falls to the
+                // host-subagent pool instead of re-looping on a dead backend.
+                const settledPath = nodeSettledPoolsPath(artifactsDir, runId);
+                const settled = await readSettledPools(settledPath);
+                // Hoisted so the coordinator's claim registry and the ownership gate's
+                // heartbeat probe are the SAME file-backed instance — never independently
+                // re-derived by path (the coordinator's own `claimRegistry` field is private).
+                const hybridClaimRegistry = nodeClaimRegistry(artifactsDir, runId);
+                const partition = await planHybridDispatch({
+                    frontier,
+                    pools: confirmedPools,
+                    sessionConfig: sessionConfigImpl ?? {},
+                    claimRegistry: hybridClaimRegistry,
+                    readSettled: () => settled,
+                    onSettle: async (id) => {
+                        settled.add(id);
+                        await addSettledPool(settledPath, id);
+                    },
+                    isInProcess: isInProcessPool,
+                });
+                // Drive the in-process partition through the ROLLING ENGINE (H2 plan D2 —
+                // `executeInProcessPartition`'s direct Promise.all executor is deleted; one
+                // core, one driver): each node runs on a coordinator-claimed backend pool,
+                // launched FROM that pool's source config, with the engine's full hook set
+                // live (413 → packet_too_large re-queue + friction, verbatim quota harvest,
+                // cost-drift / credit-exhaustion / model-unavailable capture) instead of the
+                // hand-replicated friction blocks this replaces. The coordinator's claims
+                // are ADOPTED (claimOwnerTokens) — same registry, no self-collision — and
+                // run-level lifecycle stays HERE: the drive is partition-scoped
+                // (blocksOverride), so a backend-only wall never persists a run terminal and
+                // the final merge remains this caller's.
+                if (partition.inProcess.length > 0) {
+                    // DC-4 (review h2c3 F1): the engine's per-packet selection binds freely
+                    // across `poolsOverride`, so a pool settled on a PRIOR cycle must be
+                    // filtered out here — the coordinator's claim walk already excluded it,
+                    // and re-offering it would re-die on the same dead pool every cycle.
+                    const liveBackendPools = backendPools.filter((p) => !settled.has(p.id));
+                    const driven = await driveRollingImplementDispatch({
+                        root,
+                        artifactsDir,
+                        runId,
+                        sessionConfig: sessionConfigImpl ?? null,
+                        rebuildSharedBetweenLevels: async () => { },
+                        waveOptions: {
+                            hostMaxConcurrent: resolvedHostMaxConcurrent,
+                            hostContextTokens: resolvedHostContextTokens,
+                            hostOutputTokens: resolvedHostOutputTokens,
+                            hostModels: resolvedHostModels,
+                            hostModelId: resolvedHostModelId,
+                        },
+                        blocksOverride: partition.inProcess.map((a) => a.nodeId),
+                        poolsOverride: liveBackendPools,
+                        planOverride: plan,
+                        claimOwnerTokens: new Map(partition.inProcess.map((a) => [a.nodeId, a.ownerToken])),
+                    });
+                    // Free any coordinator claim still held (a non-terminal outcome keeps its
+                    // claim through the drive); terminal accepts already released in-driver,
+                    // so this is a token-checked no-op for them.
+                    for (const a of partition.inProcess) {
+                        await partition.coordinator.release(a);
+                    }
+                    // DC-4 cross-cycle settle (D2 iii — PRESERVED across the engine
+                    // migration): a backend pool whose node rate-limited, credit-exhausted,
+                    // went model-unavailable, or died quota-unclassified → settle it
+                    // (cross-cycle) so the next cycle routes its share to the host pool. This
+                    // partition spans multiple cycles, each with a fresh in-process dispatcher
+                    // (fresh in-memory exhaustedPoolIds AND pausedPoolResetAt), so the
+                    // engine's reversible pause evaporates at the cycle boundary — the BROAD
+                    // `isPoolSettlingOutcome` predicate (incl. reset-bearing 429 +
+                    // quota_unclassified; see settledPools.ts for the divergence rationale)
+                    // therefore applies over the drive's real per-node pool attribution, plus
+                    // the engine's own terminal-exhaustion set. `packet_too_large` is
+                    // deliberately NOT a settle trigger (step D): a 413 is a per-(node,pool)
+                    // sizing fact, surfaced via the engine's onPacketTooLarge friction hook.
+                    // `driven` is null only when the plan/state vanished mid-cycle (nothing was
+                    // dispatched) — no outcomes ⇒ nothing to settle.
+                    const settlingPoolIds = new Set((driven?.nodes ?? [])
+                        .filter((n) => isPoolSettlingOutcome(n.outcome))
+                        .map((n) => n.pool_id));
+                    for (const poolId of driven?.exhausted_pool_ids ?? []) {
+                        settlingPoolIds.add(poolId);
+                    }
+                    const liveBackendPoolIds = new Set(liveBackendPools.map((p) => p.id));
+                    for (const poolId of settlingPoolIds) {
+                        if (liveBackendPoolIds.has(poolId)) {
+                            await partition.coordinator.settlePool(poolId);
+                            // The settle FACT itself is reviewable friction (review h2c3 F2):
+                            // the engine hooks capture the per-death evidence (verbatim 429
+                            // text, credit exhaustion, 404), but reset-bearing rate limits have
+                            // no engine hook, and no hook records "this pool is now settled for
+                            // the run". One record per (run, pool) via the dedupe chokepoint.
+                            void captureStepBoundaryFriction(artifactsDir, runId, {
+                                eventType: "quota_escalation",
+                                discriminator: `pool-settled:${poolId}`,
+                                note: "Hybrid in-process backend pool settled for this run (rate-limited / credit-exhausted / model-unavailable / quota-unclassified); its remaining share routes to the host on later cycles.",
+                                severity: "high",
+                                category: "trap",
+                                area: "dispatch/quota",
+                            }, "remediate-code");
+                        }
+                    }
+                }
+                // The backend carried the whole batch (or every host node was contested by a
+                // peer driver) → nothing for the host this cycle; merge what landed + transition.
+                if (partition.host.length === 0) {
+                    const merged = await mergeImplementResults({ root, artifactsDir }, runId);
+                    return { kind: "transition", state: merged };
+                }
+                // Hand the host partition (pre-claimed) to the host-subagent driver.
+                rolling = await prepareHostRollingDispatch({ root, artifactsDir }, runId, waveOptsImpl, {
+                    plan,
+                    partition: partition.host.map((a) => ({ block_id: a.nodeId, ownerToken: a.ownerToken })),
+                });
             }
-            // Surface each settled node as reviewable friction (not just the settle
-            // side-effect above). The shared step-boundary chokepoint dedupes on
-            // {eventType, runId, discriminator}, so a chronically-exhausted backend pool
-            // re-hitting the same block_id across cycles collapses to one record.
-            for (const blockId of settledOutcomeBlocks) {
-                void captureStepBoundaryFriction(artifactsDir, runId, {
-                    eventType: "quota_escalation",
-                    discriminator: blockId,
-                    note: "A-8 hybrid in-process node rate-limited / credit-exhausted / model-unavailable / quota-unclassified; its backend pool was settled for this run.",
-                    severity: "high",
-                    category: "trap",
-                    area: "dispatch/quota",
-                }, "remediate-code");
+            else {
+                rolling = await prepareHostRollingDispatch({ root, artifactsDir }, runId, waveOptsImpl);
             }
-            // A 413 no longer settles its pool (step D), but it must stay OBSERVABLE —
-            // this direct partition never invokes the rolling engine's onPacketTooLarge
-            // hook, so without this record a hybrid 413 would vanish entirely (D+E
-            // review F4). Same dedupe chokepoint; medium severity (a sizing fact to
-            // reconcile at partition time, not a dead pool).
-            for (const node of inProcessOutcome.nodes) {
-                if (node.outcome !== "packet_too_large")
-                    continue;
-                void captureStepBoundaryFriction(artifactsDir, runId, {
-                    eventType: "quota_escalation",
-                    discriminator: `packet-too-large:${node.block_id}`,
-                    note: "A-8 hybrid in-process node hit 413 packet-too-large on its assigned pool; the pool was NOT settled (per-node sizing fact) — reconcile node sizing or route the node to a larger pool.",
-                    severity: "medium",
-                    category: "trap",
-                    area: "dispatch/quota",
-                }, "remediate-code");
+            // Increment B residual (a): the hybrid host-subagent driver hit the cooldown wall
+            // (admission over-granted the throttled set). Reconcile the reserved leases (the
+            // pause skips the merge that would) and set the resumable `quota_paused` terminal
+            // so the `partial_terminal` obligation emits it this same advance; the ungranted
+            // nodes stay PENDING and re-dispatch on resume. The in-process partition (above)
+            // already ran on its own cooldown-safe pool, so its work still lands.
+            if (rolling.wall) {
+                await reconcileAdmissionLeasesFromQuotaFile(rolling.quotaPath);
+                const paused = await store.loadState();
+                if (paused) {
+                    paused.partial_completion_terminal = buildQuotaPausedTerminal(rolling.wall.strandedBlockIds, rolling.wall.detected.earliestResetAt);
+                    await store.saveState(paused);
+                }
+                return { kind: "transition", state: paused };
             }
-            // The backend carried the whole batch (or every host node was contested by a
-            // peer driver) → nothing for the host this cycle; merge what landed + transition.
-            if (partition.host.length === 0) {
-                const merged = await mergeImplementResults({ root, artifactsDir }, runId);
-                return { kind: "transition", state: merged };
+            // Everything eligible may already be done/skipped — fold straight to merge
+            // rather than emitting a dispatch step with zero nodes.
+            if (rolling.session.frontier.length === 0) {
+                await mergeImplementResults({ root, artifactsDir }, runId);
+                return { kind: "transition", state: await store.loadState() };
             }
-            // Hand the host partition (pre-claimed) to the host-subagent driver.
-            rolling = await prepareHostRollingDispatch({ root, artifactsDir }, runId, waveOptsImpl, {
-                plan,
-                partition: partition.host.map((a) => ({ block_id: a.nodeId, ownerToken: a.ownerToken })),
+            // S-BROKER-WIRING: pick the dispatch DRIVER (delegate the rolling loop to a
+            // dedicated dispatcher subagent vs. drive it from the top host) off the
+            // single classification + the live frontier/slot count — not host prose.
+            const hostProvider = resolveHostProviderName(sessionConfigImpl);
+            const driverSelection = selectDispatchDriver({
+                classification: classifyProvider(hostProvider),
+                eligibleItemCount: rolling.session.frontier.length,
+                // The granted set's size IS the instantaneous admission width — there is no
+                // separate concurrency number. The whole granted set runs at once, so the
+                // driver-selection "slots" is the granted-set size.
+                slots: rolling.session.frontier.length,
             });
-        }
-        else {
-            rolling = await prepareHostRollingDispatch({ root, artifactsDir }, runId, waveOptsImpl);
-        }
-        // Increment B residual (a): the hybrid host-subagent driver hit the cooldown wall
-        // (admission over-granted the throttled set). Reconcile the reserved leases (the
-        // pause skips the merge that would) and set the resumable `quota_paused` terminal
-        // so the `partial_terminal` obligation emits it this same advance; the ungranted
-        // nodes stay PENDING and re-dispatch on resume. The in-process partition (above)
-        // already ran on its own cooldown-safe pool, so its work still lands.
-        if (rolling.wall) {
-            await reconcileAdmissionLeasesFromQuotaFile(rolling.quotaPath);
-            const paused = await store.loadState();
-            if (paused) {
-                paused.partial_completion_terminal = buildQuotaPausedTerminal(rolling.wall.strandedBlockIds, rolling.wall.detected.earliestResetAt);
-                await store.saveState(paused);
-            }
-            return { kind: "transition", state: paused };
-        }
-        // Everything eligible may already be done/skipped — fold straight to merge
-        // rather than emitting a dispatch step with zero nodes.
-        if (rolling.session.frontier.length === 0) {
-            await mergeImplementResults({ root, artifactsDir }, runId);
-            return { kind: "transition", state: await store.loadState() };
-        }
-        // S-BROKER-WIRING: pick the dispatch DRIVER (delegate the rolling loop to a
-        // dedicated dispatcher subagent vs. drive it from the top host) off the
-        // single classification + the live frontier/slot count — not host prose.
-        const hostProvider = resolveHostProviderName(sessionConfigImpl);
-        const driverSelection = selectDispatchDriver({
-            classification: classifyProvider(hostProvider),
-            eligibleItemCount: rolling.session.frontier.length,
-            // The granted set's size IS the instantaneous admission width — there is no
-            // separate concurrency number. The whole granted set runs at once, so the
-            // driver-selection "slots" is the granted-set size.
-            slots: rolling.session.frontier.length,
-        });
-        const rollMerge = loaderCommand(`merge-implement-results --run-id ${runId}`);
-        const rollNext = loaderCommand("next-step");
-        const acceptCmd = loaderCommand(`accept-node --id <BLOCK_ID> --run-id ${runId}`);
-        const nodeLines = rolling.initial
-            .map((n) => `- \`${n.block_id}\` — prompt: \`${n.prompt_path}\` — worktree (subagent cwd): \`${n.worktree_root}\``)
-            .join("\n");
-        return { kind: "emit", step: await writeCurrentStep({
-                stepKind: "dispatch_implement_rolling",
-                status: "ready",
-                runId,
-                repoRoot: root,
-                artifactsDir,
-                prompt: `
+            const rollMerge = loaderCommand(`merge-implement-results --run-id ${runId}`);
+            const rollNext = loaderCommand("next-step");
+            const acceptCmd = loaderCommand(`accept-node --id <BLOCK_ID> --run-id ${runId}`);
+            const nodeLines = rolling.initial
+                .map((n) => `- \`${n.block_id}\` — prompt: \`${n.prompt_path}\` — worktree (subagent cwd): \`${n.worktree_root}\``)
+                .join("\n");
+            return { kind: "emit", step: await writeCurrentStep({
+                    stepKind: "dispatch_implement_rolling",
+                    status: "ready",
+                    runId,
+                    repoRoot: root,
+                    artifactsDir,
+                    prompt: `
 # Dispatch Implementation Work (host-subagent rolling, worktree-isolated)
 
 Each granted node runs in its OWN git worktree (hard isolation between nodes). The
@@ -1539,10 +1504,11 @@ ${DISPATCH_PROMPT_HANDOFF_NOTE}
 
 ${renderHostScratchNote(hostScratchDir(artifactsDir, runId))}
 `,
-                allowedCommands: [acceptCmd, rollMerge, rollNext],
-                stopCondition: "Stop after every node has been accepted (accept-node returns done), results merged, and next-step has been run.",
-                artifactPaths: { dispatch_plan: rolling.planPath, dispatch_quota: rolling.quotaPath },
-            }) };
+                    allowedCommands: [acceptCmd, rollMerge, rollNext],
+                    stopCondition: "Stop after every node has been accepted (accept-node returns done), results merged, and next-step has been run.",
+                    artifactPaths: { dispatch_plan: rolling.planPath, dispatch_quota: rolling.quotaPath },
+                }) };
+        }
     }
     // Rolling per-node dispatch: prepare EVERY currently-eligible node (deps all
     // verified-complete), never a single artificially-serialized block. There is