audit-tools 0.34.42 → 0.35.1

package/dist/remediate/steps/nextStep.js

@@ -3,7 +3,18 @@ import { existsSync, statSync } from "node:fs";
 import { mkdir, readFile, rename } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { StateStore } from "../state/store.js";
-import { discardOnSchemaVersionMismatch, readConfirmedDispatchPolicy, readConfirmedCapabilityRanks, resolveDispatchExclusion, readOptionalJsonFile, readValidatedRepoSessionIntent, stagedAndUntracked, writeJsonFile, writeTextFile, buildAuditDeliverablePair, formatValidationIssues, isRecord, withFsRetry, RunLogger, DISPATCH_PROMPT_HANDOFF_NOTE, renderHostScratchNote, hostScratchDir, renderQuotaCoverageNudge, renderTokenBudgetView, coerceJsonObjectArg, driveRolling, resolveLedgerBudgets, setQuotaStateDir, detectHostDispatchWall, admissionBlockedOnBudget, classifyEmptyGrantCause, reconcileAdmissionLeasesFromQuotaFile, buildQuotaPausedTerminal, interpretFreeFormIntent, advance, decideFrictionTriage, buildFrictionTriageBlock, planHybridDispatch, readSettledPools, addSettledPool, isPoolSettlingOutcome, isInProcessWorkerProvider, sourceByPoolId, classifyProvider, selectDispatchDriver, renderDispatchDriverInstruction, HostSessionQuotaSource, quotaPoolKey, captureStepBoundaryFriction, captureZeroCapacityFriction, captureCostDriftFriction, captureCreditExhaustionFriction, captureQuotaUnclassifiedFriction, captureModelUnavailableFriction, capturePacketTooLargeFriction, createDispatchDecisionLog, LENSES, SEVERITIES, resolveHostProviderName, resolveHostDispatchProviderName, resolveHostDispatchCapability as sharedResolveHostDispatchCapability, resolveAutonomousMode, resolveRollingEngineFlag, DEFAULT_CONTEXT_TOKENS } from "audit-tools/shared";
+// IO / validation / rendering helpers
+import { discardOnSchemaVersionMismatch, buildSelfSpawnExclusion, readOptionalJsonFile, readValidatedRepoSessionIntent, stagedAndUntracked, writeJsonFile, writeTextFile, buildAuditDeliverablePair, formatValidationIssues, isRecord, withFsRetry, RunLogger, DISPATCH_PROMPT_HANDOFF_NOTE, renderHostScratchNote, hostScratchDir, renderQuotaCoverageNudge, renderTokenBudgetView, coerceJsonObjectArg, 
+// rolling engine + quota
+driveRolling, resolveLedgerBudgets, setQuotaStateDir, detectHostDispatchWall, admissionBlockedOnBudget, classifyEmptyGrantCause, reconcileAdmissionLeasesFromQuotaFile, buildQuotaPausedTerminal, HostSessionQuotaSource, quotaPoolKey, 
+// obligation engine + intent
+interpretFreeFormIntent, advance, decideFrictionTriage, buildFrictionTriageBlock, 
+// dispatch planning / provider classification
+planHybridDispatch, readSettledPools, addSettledPool, isPoolSettlingOutcome, isInProcessWorkerProvider, sourceByPoolId, classifyProvider, selectDispatchDriver, renderDispatchDriverInstruction, resolveHostProviderName, resolveHostDispatchProviderName, resolveHostDispatchCapability as sharedResolveHostDispatchCapability, resolveAutonomousMode, resolveRollingEngineFlag, 
+// friction capture
+captureStepBoundaryFriction, captureZeroCapacityFriction, captureCostDriftFriction, captureCreditExhaustionFriction, captureQuotaUnclassifiedFriction, captureModelUnavailableFriction, capturePacketTooLargeFriction, createDispatchDecisionLog, 
+// domain constants
+LENSES, SEVERITIES, } from "audit-tools/shared";
 import { readRemediationAccessMemory, computeBlockContinuityScores } from "../state/accessMemory.js";
 import { applyPlanPipeline, buildCoverageLedger } from "../phases/plan.js";
 import { groundExtractedFindings } from "../phases/grounding.js";
@@ -71,19 +82,15 @@ export function resolveRollingEngineEnabled(options) {
         env: options.env,
     });
 }
-/** Conservative context-window floor, applied ONLY at true first contact (nothing persisted). */
-const HOST_CONTEXT_TOKENS_FLOOR = DEFAULT_CONTEXT_TOKENS;
 function finiteOrUndefined(value) {
     return typeof value === "number" && Number.isFinite(value) ? value : undefined;
 }
 /**
  * Pure per-field host-capability resolver (C1). Each field resolves as
- * `explicit ?? persisted ?? floor` — a per-field merge, never a whole-object
- * clobber that would drop fields the current call omitted. The 32k context
- * floor applies ONLY at true first contact (no persisted handshake at all);
- * once a handshake exists, an omitted field reuses the persisted value rather
- * than re-flooring. Corrupt / non-finite persisted numbers degrade to undefined
- * without throwing.
+ * `explicit ?? persisted` — a per-field merge, never a whole-object
+ * clobber that would drop fields the current call omitted. Corrupt / non-finite
+ * persisted numbers degrade to undefined without throwing; missing capability
+ * stays missing and is handled by the dispatch/plan refusal seam.
  *
  * Returns:
  *  - `resolved` — the merged capabilities to drive downstream dispatch sizing;
@@ -93,11 +100,9 @@ function finiteOrUndefined(value) {
 export function resolveHostCapabilities(explicit, persisted) {
     const exp = explicit ?? {};
     const per = persisted && typeof persisted === "object" ? persisted : undefined;
-    const firstContact = per === undefined;
     const pick = (e, p) => e ?? p ?? undefined;
     const context_tokens = finiteOrUndefined(exp.context_tokens) ??
-        finiteOrUndefined(per?.context_tokens) ??
-        (firstContact ? HOST_CONTEXT_TOKENS_FLOOR : undefined);
+        finiteOrUndefined(per?.context_tokens);
     const resolved = {
         can_dispatch_subagents: pick(exp.can_dispatch_subagents, per?.can_dispatch_subagents),
         max_concurrent: finiteOrUndefined(exp.max_concurrent) ?? finiteOrUndefined(per?.max_concurrent),
@@ -106,8 +111,7 @@ export function resolveHostCapabilities(explicit, persisted) {
         model_id: pick(exp.model_id, per?.model_id),
         models: exp.models ?? per?.models,
     };
-    // Persist ONLY the explicitly-supplied fields (the delta) — never the floor,
-    // never an omitted field.
+    // Persist ONLY the explicitly-supplied fields (the delta), never an omitted field.
     const toPersist = {};
     if (exp.can_dispatch_subagents !== undefined)
         toPersist.can_dispatch_subagents = exp.can_dispatch_subagents;
@@ -592,7 +596,7 @@ export async function driveRollingDispatch(levels, options) {
     };
 }
 /**
- * Whether a confirmed pool is one the orchestrator launches IN-PROCESS this cycle
+ * Whether an eligible pool is one the orchestrator launches IN-PROCESS this cycle
  * (vs. the conversation host's subagent pool) — the shared
  * `isInProcessWorkerProvider` predicate (H3), same remediate policy.
  */
@@ -698,7 +702,7 @@ export async function driveRollingImplementDispatch(options) {
             }, "remediate-code");
         },
     });
-    // Confirmed pools: quota-derived concurrency, never the raw host flag (INV-QD-11).
+    // Eligible pools: quota-derived concurrency, never the raw host flag (INV-QD-11).
     // A partition-scoped caller supplies its coordinator's already-built set instead.
     const builtPools = options.poolsOverride
         ? null
@@ -709,13 +713,10 @@ export async function driveRollingImplementDispatch(options) {
             hostOutputTokens: options.waveOptions?.hostOutputTokens,
             hostModels: options.waveOptions?.hostModels,
             hostModelId: options.waveOptions?.hostModelId,
-            capabilityRanks: await readConfirmedCapabilityRanks(options.root),
+            capabilityRanks: null,
             hostSession,
-            // The operator's Gate-0 exclusions, applied as a set-difference over freshly
-            // gathered reach. Read here because this layer owns `root`; self-spawn-blocked is
-            // recomputed against THIS process's env rather than inherited from the auditor
-            // that wrote the confirmation.
-            excludedBackends: resolveDispatchExclusion(await readConfirmedDispatchPolicy(options.root)),
+            // Mechanical self-spawn exclusion, recomputed from this process's environment.
+            excludedBackends: buildSelfSpawnExclusion(),
         });
     const confirmedPools = options.poolsOverride ?? builtPools.pools;
     // The operator's own policy left this dispatch with no capacity at all. Loud, not
@@ -1029,12 +1030,12 @@ function normalizeExtractedPlan(value) {
 }
 async function saveStateForPlan(artifactsDir, existing, plan, planCoverage) {
     const items = {};
+    const blockIds = blockIdsByFinding(plan);
     for (const finding of plan.findings) {
-        const block = plan.blocks.find((candidate) => candidate.items.includes(finding.id));
         items[finding.id] = {
             finding_id: finding.id,
             status: "pending",
-            block_id: block?.block_id ?? "UNKNOWN",
+            block_id: blockIds.get(finding.id) ?? "UNKNOWN",
         };
     }
     const state = {
@@ -1073,11 +1074,20 @@ function stripPlanTimeBookkeeping(value) {
 function findingCarryForwardKey(finding) {
     return JSON.stringify(stripPlanTimeBookkeeping(finding));
 }
+// FIRST-wins on multi-block membership: `fixupBlocksAfterDedup` can leave a
+// dedup survivor in more than one block's items, and historically the two
+// consumers disagreed (saveStateForPlan scanned blocks first-wins while this
+// map overwrote last-wins), so the same plan could yield different block_ids
+// per path. First-wins is pinned as the single semantic. The root question —
+// whether a finding should ever belong to two blocks at all — is tracked in
+// docs/backlog/open-bugs.md.
 function blockIdsByFinding(plan) {
     const byFinding = new Map();
     for (const block of plan.blocks) {
         for (const id of block.items) {
-            byFinding.set(id, block.block_id);
+            if (!byFinding.has(id)) {
+                byFinding.set(id, block.block_id);
+            }
         }
     }
     return byFinding;
@@ -1245,6 +1255,9 @@ async function buildImplementDispatchStep(ctx) {
         hostOutputTokens: resolvedHostOutputTokens,
         hostModels: resolvedHostModels,
         hostModelId: resolvedHostModelId,
+        // An attended host is the dispatch authority. Headless/in-process paths
+        // leave this false and retain the shared admission engine.
+        hostOwnedDispatch: canDispatchImpl,
     };
     // H2+H4 collapse: ONE fan-out over the eligible pool set. `buildConfirmedPools`
     // folds the configured primary in-process backend in as a source pool
@@ -1270,27 +1283,33 @@ async function buildImplementDispatchStep(ctx) {
         const hybridHostSession = new HostSessionQuotaSource({
             providerModelKey: hybridHostSessionModelKey,
         });
-        const { pools: confirmedPools, zeroedByExclusion } = await buildConfirmedPools({
+        const { pools: confirmedPools, zeroedByExclusion, sourcePoolIds } = await buildConfirmedPools({
             sessionConfig: sessionConfigImpl ?? null,
             hostMaxConcurrent: resolvedHostMaxConcurrent,
             hostContextTokens: resolvedHostContextTokens,
             hostOutputTokens: resolvedHostOutputTokens,
             hostModels: resolvedHostModels,
             hostModelId: resolvedHostModelId,
-            capabilityRanks: await readConfirmedCapabilityRanks(root),
+            capabilityRanks: null,
             hostSession: hybridHostSession,
             // Attendance IS pool-set membership: headless ⇒ no host pool in the set.
             hostCanDispatch: canDispatchImpl,
-            // The operator's Gate-0 exclusions, applied as a set-difference over freshly
-            // gathered reach; self-spawn-blocked recomputed against THIS process's env.
-            excludedBackends: resolveDispatchExclusion(await readConfirmedDispatchPolicy(root)),
+            // Mechanical self-spawn exclusion uses the same resolved driver identity as quota.
+            excludedBackends: buildSelfSpawnExclusion({
+                activeHostProvider: canDispatchImpl ? hybridProviderName : null,
+            }),
         });
         // Loud, not silent: on the headless branch below there is no host pool to fall
         // back to, so a policy-zeroed set means this dispatch does nothing at all.
         if (zeroedByExclusion) {
             await captureZeroCapacityFriction(artifactsDir, runId, zeroedByExclusion, "remediate-code");
         }
-        const backendPools = confirmedPools.filter(isInProcessPool);
+        // Engine-drivable backends are SOURCE pools only, by declared class — never
+        // re-derived from the provider name. The neutral worker-command host identity
+        // name-collides with the in-process worker class, so a name-only test would
+        // hand the HOST's own pool to the engine as a spawnable worker.
+        const isEngineDrivableId = (poolId, providerName) => sourcePoolIds.has(poolId) && isInProcessPool({ providerName });
+        const backendPools = confirmedPools.filter((p) => isEngineDrivableId(p.id, p.providerName));
         if (!canDispatchImpl) {
             // Headless: no host pool in the eligible set — when any dispatchable
             // backend pool is confirmed, the engine drives the FULL rolling implement
@@ -1381,7 +1400,7 @@ async function buildImplementDispatchStep(ctx) {
                         settled.add(id);
                         await addSettledPool(settledPath, id);
                     },
-                    isInProcess: isInProcessPool,
+                    isInProcess: (a) => isEngineDrivableId(a.poolId, a.providerName),
                 });
                 // Drive the in-process partition through the ROLLING ENGINE (H2 plan D2 —
                 // `executeInProcessPartition`'s direct Promise.all executor is deleted; one
@@ -1516,7 +1535,9 @@ async function buildImplementDispatchStep(ctx) {
             // nodes stay PENDING and re-dispatch on resume. The in-process partition (above)
             // already ran on its own cooldown-safe pool, so its work still lands.
             if (rolling.wall) {
-                await reconcileAdmissionLeasesFromQuotaFile(rolling.quotaPath);
+                if (rolling.quotaPath) {
+                    await reconcileAdmissionLeasesFromQuotaFile(rolling.quotaPath);
+                }
                 const paused = await store.loadState();
                 if (paused) {
                     paused.partial_completion_terminal = buildQuotaPausedTerminal(rolling.wall.strandedBlockIds, rolling.wall.detected.earliestResetAt, rolling.wall.detected.emptyGrantCause);
@@ -1536,7 +1557,9 @@ async function buildImplementDispatchStep(ctx) {
             if (rolling.session.frontier.length === 0) {
                 const structuralRefusal = detectStructuralRefusalPause(await readOptionalJsonFile(rolling.quotaPath));
                 if (structuralRefusal.pause) {
-                    await reconcileAdmissionLeasesFromQuotaFile(rolling.quotaPath);
+                    if (rolling.quotaPath) {
+                        await reconcileAdmissionLeasesFromQuotaFile(rolling.quotaPath);
+                    }
                     const paused = await store.loadState();
                     if (paused) {
                         paused.partial_completion_terminal = buildQuotaPausedTerminal(structuralRefusal.refusedIds, null, "no_capable_pool");
@@ -1565,6 +1588,16 @@ async function buildImplementDispatchStep(ctx) {
             const rollNext = loaderCommand("next-step");
             const acceptCmd = loaderCommand(`accept-node --id <BLOCK_ID> --run-id ${runId}`);
             const reverifyCmd = loaderCommand(`reverify-node --id <BLOCK_ID> --run-id ${runId}`);
+            const hostOwnedRolling = rolling.quotaPath === null;
+            const dispatchAuthorityNote = hostOwnedRolling
+                ? `The attended host and llm-relay own provider selection, failover, quota, and
+concurrency. Dispatch the COMPLETE eligible set of ${rolling.session.frontier.length}
+node(s) below; audit-tools imposes no admission subset, cold-start wall, or concurrency
+cap. When they are all accepted, merge and re-invoke next-step.`
+                : `The tool admitted this set against the live budget (and any declared in-flight cap):
+dispatch EXACTLY the ${rolling.session.frontier.length} node(s) below and no more.
+Their count is the whole grant — there is no separate concurrency cap. When they are
+all accepted, merge and re-invoke next-step; the tool re-grants the pending remainder.`;
             const nodeLines = rolling.initial
                 .map((n) => `- \`${n.block_id}\` — prompt: \`${n.prompt_path}\` — worktree (subagent cwd): \`${n.worktree_root}\``)
                 .join("\n");
@@ -1581,19 +1614,16 @@ Each granted node runs in its OWN git worktree (hard isolation between nodes). T
 TOOL owns commit -> verify -> merge + write-scope; you only spawn a subagent per
 node and call \`accept-node\` as each finishes.
 
-The tool ADMITTED this set against the live budget (and any declared in-flight cap):
-dispatch EXACTLY the ${rolling.session.frontier.length} node(s) below and no more.
-Their count is the whole grant — there is no separate concurrency cap. When they are
-all accepted, merge and re-invoke next-step; the tool re-grants the pending remainder.
+ ${dispatchAuthorityNote}
 
-${renderDispatchDriverInstruction(driverSelection, `the ${rolling.session.frontier.length} granted node(s)`)}
+${renderDispatchDriverInstruction(driverSelection, `the ${rolling.session.frontier.length} ${hostOwnedRolling ? "eligible" : "granted"} node(s)`)}
 
 Spawn ONE subagent for EACH granted node below. Give the subagent that node's
 \`prompt\`, and set its working directory to the node's **worktree** path. The
 subagent edits source files INSIDE that worktree and writes ONLY its result file.
 Do NOT let any subagent edit the main repository tree.
 
-Granted nodes (worktrees already created):
+ ${hostOwnedRolling ? "Eligible" : "Granted"} nodes (worktrees already created):
 ${nodeLines}
 
 As EACH subagent finishes, run (substituting the finished node's block id):
@@ -1642,7 +1672,10 @@ ${renderHostScratchNote(hostScratchDir(artifactsDir, runId))}
 `,
                     allowedCommands: [acceptCmd, reverifyCmd, rollMerge, rollNext],
                     stopCondition: "Stop after every node has reached a terminal accept (accept-node returns done), results merged, and next-step has been run.",
-                    artifactPaths: { dispatch_plan: rolling.planPath, dispatch_quota: rolling.quotaPath },
+                    artifactPaths: {
+                        dispatch_plan: rolling.planPath,
+                        ...(rolling.quotaPath ? { dispatch_quota: rolling.quotaPath } : {}),
+                    },
                 }) };
         }
     }
@@ -1716,40 +1749,43 @@ Then run:
     // of `implementing`) emits the resumable `quota_paused` step this same advance; the
     // ungranted nodes stay PENDING and re-dispatch on resume (never abandoned to partial
     // coverage — the remediate divergence from audit's read-only bound-and-give-up).
-    const implQuota = await readOptionalJsonFile(implQuotaPath);
-    // D1 parity: the binding budget window (from the host pool's capacity summary) so an
-    // empty_grant wall derives a reset time instead of the bare `earliestResetAt: null` —
-    // but ONLY on a genuine BUDGET block, not a `cap_reached` ledger-contention wall
-    // (frees in seconds; the window reset may be days out).
-    const implBudgetBound = admissionBlockedOnBudget(implQuota?.admission?.explains ?? []);
-    const implBindingWindow = implBudgetBound
-        ? implQuota?.capacity_pools?.find((p) => p.is_conversation_host)?.binding_window ??
-            implQuota?.capacity_pools?.[0]?.binding_window ??
-            null
-        : null;
-    const implWall = detectHostDispatchWall({
-        grantedCount: implQuota?.admission?.granted_packet_ids?.length ?? 0,
-        cooldownUntil: implQuota?.cooldown_until ?? null,
-        bindingWindow: implBindingWindow,
-        // Step E parity: classify the zero-grant cause so the quota_paused terminal's
-        // reset semantics stay honest (a no_capable_pool wall has no reset to wait for).
-        explains: implQuota?.admission?.explains ?? [],
-        now: Date.now(),
-    });
-    if (implWall.atWall) {
-        // Release the leases the grant just reserved — pausing skips the merge that would
-        // reconcile them, so without this they leak until TTL and mis-size the resume grant.
-        await reconcileAdmissionLeasesFromQuotaFile(implQuotaPath);
-        const strandedIds = dispatchPlan.items
-            .map((item) => item.block_id)
-            .filter((id) => typeof id === "string");
-        const paused = await store.loadState();
-        if (paused) {
-            paused.partial_completion_terminal = buildQuotaPausedTerminal(strandedIds, implWall.earliestResetAt, implWall.emptyGrantCause);
-            await store.saveState(paused);
+    if (!waveOptsImpl.hostOwnedDispatch) {
+        const implQuota = await readOptionalJsonFile(implQuotaPath);
+        // D1 parity: the binding budget window (from the host pool's capacity summary) so an
+        // empty_grant wall derives a reset time instead of the bare `earliestResetAt: null` —
+        // but ONLY on a genuine BUDGET block, not a `cap_reached` ledger-contention wall
+        // (frees in seconds; the window reset may be days out).
+        const implBudgetBound = admissionBlockedOnBudget(implQuota?.admission?.explains ?? []);
+        const implBindingWindow = implBudgetBound
+            ? implQuota?.capacity_pools?.find((p) => p.is_conversation_host)?.binding_window ??
+                implQuota?.capacity_pools?.[0]?.binding_window ??
+                null
+            : null;
+        const implWall = detectHostDispatchWall({
+            grantedCount: implQuota?.admission?.granted_packet_ids?.length ?? 0,
+            cooldownUntil: implQuota?.cooldown_until ?? null,
+            bindingWindow: implBindingWindow,
+            // Step E parity: classify the zero-grant cause so the quota_paused terminal's
+            // reset semantics stay honest (a no_capable_pool wall has no reset to wait for).
+            explains: implQuota?.admission?.explains ?? [],
+            now: Date.now(),
+        });
+        if (implWall.atWall) {
+            // Release the leases the grant just reserved — pausing skips the merge that would
+            // reconcile them, so without this they leak until TTL and mis-size the resume grant.
+            await reconcileAdmissionLeasesFromQuotaFile(implQuotaPath);
+            const strandedIds = dispatchPlan.items
+                .map((item) => item.block_id)
+                .filter((id) => typeof id === "string");
+            const paused = await store.loadState();
+            if (paused) {
+                paused.partial_completion_terminal = buildQuotaPausedTerminal(strandedIds, implWall.earliestResetAt, implWall.emptyGrantCause);
+                await store.saveState(paused);
+            }
+            return { kind: "transition", state: paused };
         }
-        return { kind: "transition", state: paused };
     }
+    const hostOwnedLegacy = waveOptsImpl.hostOwnedDispatch === true;
     return { kind: "emit", step: await writeCurrentStep({
             stepKind: "dispatch_implement",
             status: "ready",
@@ -1759,29 +1795,28 @@ Then run:
             prompt: `
 # Dispatch Implementation Work (rolling)
 
-Read the dispatch plan and quota JSONs:
+Read the dispatch plan${hostOwnedLegacy ? "" : " and quota JSONs"}:
 
 \`${planPath}\`
-\`${implQuotaPath}\`
+${hostOwnedLegacy ? "" : `\`${implQuotaPath}\``}
 
 Every item in \`items\` is a node whose dependencies are all VERIFIED-COMPLETE
-(INV-RS-01). The tool admitted a budget-bounded subset: dispatch EXACTLY the block
-ids in the quota file's \`admission.granted_packet_ids\` and no others — that granted
-set is the whole grant (there is no separate concurrency cap). Each item's
+(INV-RS-01). ${hostOwnedLegacy
+                ? "The attended host and llm-relay own provider selection, failover, quota, and concurrency. Dispatch every item in this complete eligible plan; audit-tools imposes no admission subset, cold-start wall, or concurrency cap."
+                : "The tool admitted a budget-bounded subset: dispatch EXACTLY the block ids in the quota file's `admission.granted_packet_ids` and no others — that granted set is the whole grant (there is no separate concurrency cap)."} Each item's
 \`model_hint.tier\` suggests which model to use (small/standard/deep). If your
 provider has rate limits, pace launches accordingly.
 
-For each GRANTED item in \`items\` (its \`block_id\` in \`admission.granted_packet_ids\`),
+For each ${hostOwnedLegacy ? "eligible" : "GRANTED"} item in \`items\`${hostOwnedLegacy ? "" : " (its `block_id` in `admission.granted_packet_ids`)"},
 dispatch one subagent with that item's \`prompt_path\`. Each subagent may edit source
 files needed for that bounded block and must write only its assigned \`result_path\`.
-After the granted set is merged and you run next-step, the tool re-grants the pending
-remainder.
+${hostOwnedLegacy ? "After the complete plan is merged, run next-step." : "After the granted set is merged and you run next-step, the tool re-grants the pending remainder."}
 
 ${SHARED_REBUILD_BETWEEN_LEVELS_NOTE}
 
-${renderQuotaCoverageNudge(implQuotaPath, artifactsDir)}
+${renderQuotaCoverageNudge(hostOwnedLegacy ? null : implQuotaPath, artifactsDir)}
 
-${renderTokenBudgetView(implQuotaPath)}
+${renderTokenBudgetView(hostOwnedLegacy ? null : implQuotaPath)}
 
 ${DISPATCH_PROMPT_HANDOFF_NOTE}
 
@@ -1797,7 +1832,10 @@ Then run:
 `,
             allowedCommands: [mergeCommand, nextCommand],
             stopCondition: "Stop after all implementation results have been merged and next-step has been run.",
-            artifactPaths: { dispatch_plan: planPath, dispatch_quota: implQuotaPath },
+            artifactPaths: {
+                dispatch_plan: planPath,
+                ...(hostOwnedLegacy ? {} : { dispatch_quota: implQuotaPath }),
+            },
         }) };
 }
 /**
@@ -1971,6 +2009,7 @@ async function handlePendingExtractedPlan(root, artifactsDir, existing, extracte
         // way declined findings are recorded; their payloads recover at close from the
         // unfiltered intake source.
         const filterDisp = await readOptionalJsonFile(reviewFilterDispositionsPath(artifactsDir));
+        const pipelinedBlockIds = blockIdsByFinding(pipelined);
         const coverage = filterDisp
             ? buildCoverageLedger({
                 planId: pipelined.plan_id,
@@ -1997,8 +2036,7 @@ async function handlePendingExtractedPlan(root, artifactsDir, existing, extracte
                     {
                         finding_id: finding.id,
                         status: "pending",
-                        block_id: pipelined.blocks.find((b) => b.items.includes(finding.id))
-                            ?.block_id ?? "UNKNOWN",
+                        block_id: pipelinedBlockIds.get(finding.id) ?? "UNKNOWN",
                     },
                 ])),
             });
@@ -2352,31 +2390,49 @@ async function handleReadyIntakeContractPipeline(root, artifactsDir, options) {
     if (!intake.summary || !isIntakeReady(intake.summary)) {
         return null;
     }
+    // Resolve the manifest sources ONCE for the whole step (risk signal, Path A,
+    // and the pipeline source inputs all consume the same snapshot), and read the
+    // structured-audit source file at most once via a memoized reader (an
+    // unreadable source memoizes `undefined`; extractAuditFindings on undefined
+    // yields the empty set, so consumers degrade exactly as before).
+    const manifestSources = intake.manifest
+        ? resolveManifestSources(root, intake.manifest).resolved
+        : [];
+    const auditSource = intake.summary.source_type === "structured_audit"
+        ? manifestSources.find((s) => s.type === "structured_audit")
+        : undefined;
+    let auditFindingsCache;
+    const readAuditFindingsOnce = async () => {
+        if (!auditSource) {
+            return undefined;
+        }
+        if (!auditFindingsCache) {
+            let value;
+            try {
+                value = JSON.parse(await readFile(auditSource.path, "utf8"));
+            }
+            catch {
+                value = undefined;
+            }
+            auditFindingsCache = { value };
+        }
+        return auditFindingsCache.value;
+    };
     // Slice 2 — compute & persist the shared intake risk/complexity signal the
     // self-scaling dials (Slices 3/4) will read. Idempotent: recorded once from
     // intake-available data only (affected_files + goals + path-risk patterns), so
-    // a later escalate-on-evidence raise is never clobbered. The input is gathered
-    // lazily (only on the run that actually computes), and for structured_audit —
-    // where the top-level summary.affected_files is legitimately empty (paths live
-    // per-finding) — it unions the per-finding affected files so the path-risk
-    // patterns actually fire (fail-closed: a risky-subsystem audit must not land
-    // `low`). No behavior keys on it yet — this establishes the source of truth.
+    // a later escalate-on-evidence raise is never clobbered. The audit-source read
+    // happens only on the run that actually computes (memoized above), and for
+    // structured_audit — where the top-level summary.affected_files is
+    // legitimately empty (paths live per-finding) — it unions the per-finding
+    // affected files so the path-risk patterns actually fire (fail-closed: a
+    // risky-subsystem audit must not land `low`). No behavior keys on it yet —
+    // this establishes the source of truth.
     await ensureIntakeRiskSignal(artifactsDir, async () => {
         const summary = intake.summary;
         const affectedFiles = summary.affected_files.map((f) => f.path);
-        if (summary.source_type === "structured_audit" && intake.manifest) {
-            const auditSource = resolveManifestSources(root, intake.manifest).resolved.find((s) => s.type === "structured_audit");
-            if (auditSource) {
-                try {
-                    const parsed = JSON.parse(await readFile(auditSource.path, "utf8"));
-                    affectedFiles.push(...distinctAffectedFiles(extractAuditFindings(parsed)));
-                }
-                catch {
-                    // Unreadable audit source — leave the summary-derived list; an empty
-                    // list with non-empty goals still rates conservatively via intent.
-                }
-            }
-        }
+        const parsed = await readAuditFindingsOnce();
+        affectedFiles.push(...distinctAffectedFiles(extractAuditFindings(parsed)));
         return { affectedFiles, goals: summary.goals };
     });
     const pipeline = shouldEnterContractPipeline(artifactsDir, intake.summary.source_type);
@@ -2401,118 +2457,109 @@ async function handleReadyIntakeContractPipeline(root, artifactsDir, options) {
     // ledger is built over the originals (every audit finding → exactly one
     // disposition). The gate may halt to collect the user's decision.
     let reviewSourceSwap;
-    if (intake.summary.source_type === "structured_audit" && intake.manifest) {
-        const auditSource = resolveManifestSources(root, intake.manifest).resolved.find((s) => s.type === "structured_audit");
-        if (auditSource) {
-            let auditFindings;
-            try {
-                auditFindings = JSON.parse(await readFile(auditSource.path, "utf8"));
+    if (auditSource) {
+        const auditFindings = await readAuditFindingsOnce();
+        const originals = extractAuditFindings(auditFindings);
+        if (originals.length > 0) {
+            const checkpoint = await readOptionalJsonFile(join(artifactsDir, "intent_checkpoint.json"));
+            const filter = await runFindingFilterPass(originals, {
+                root,
+                checkpoint: checkpoint ?? undefined,
+                evidenceGrounding: true,
+            });
+            const gate = await runReviewApprovalGate(root, artifactsDir, filter.survivors, 
+            // Autonomy resolves from the PERSISTED session config (hoisted load
+            // above) → env → attended default, never from the bare CLI options.
+            resolveAutonomousMode({ sessionConfig: sessionConfigForDispatch }));
+            if (gate.kind === "halt") {
+                return gate.step;
             }
-            catch {
-                auditFindings = undefined;
+            // Persist the filter dispositions so coverage is built over the originals.
+            await persistReviewFilterDispositions(artifactsDir, originals, filter);
+            // Lean path = the `low` risk tier's realization (D-68 — the standalone lean
+            // fast-path folded into the self-scaling dial; its two mechanisms now live in
+            // `riskSignal.ts` (light-review) + `contractPipeline.ts` (lean plan builder)).
+            // A run skips the heavy contract DESIGN loop and
+            // synthesizes the extracted plan directly IFF its effective risk tier is `low`;
+            // the plan→implement→close machinery (per-node verify-before-merge + the final
+            // whole-repo gate) is the retained safety net. Runs only here — on Path A
+            // (structured_audit), the only intake with a pre-existing finding set to judge.
+            //
+            // First fold the APPROVED set's finding-level risk (grounding / confidence /
+            // coupling / systemic / architecture / count — the finding-QUALITY dimension the
+            // intake path/breadth/intent signal doesn't see) INTO the shared risk signal as
+            // escalate-on-evidence. This makes the tier the SINGLE classifier: there is no
+            // separate fast-path boolean that can DISAGREE with it (a grounded handful
+            // touching a risk subsystem stays `high` and takes the full pipeline, instead of
+            // bypassing it as the old parallel `evaluateFastPath` allowed).
+            const findingEvidence = findingRiskEvidence(gate.approved);
+            let riskSignal = await readIntakeRiskSignal(artifactsDir);
+            if (findingEvidence && riskSignal) {
+                const raised = escalateRiskSignal(riskSignal, findingEvidence);
+                // escalateRiskSignal returns the SAME reference when the evidence does not
+                // raise the tier — only persist on an actual change (no byte-identical rewrite).
+                if (raised !== riskSignal) {
+                    riskSignal = raised;
+                    await writeIntakeRiskSignal(artifactsDir, riskSignal);
+                }
             }
-            const originals = extractAuditFindings(auditFindings);
-            if (originals.length > 0) {
-                const checkpoint = await readOptionalJsonFile(join(artifactsDir, "intent_checkpoint.json"));
-                const filter = await runFindingFilterPass(originals, {
-                    root,
-                    checkpoint: checkpoint ?? undefined,
-                    evidenceGrounding: true,
-                });
-                const gate = await runReviewApprovalGate(root, artifactsDir, filter.survivors, 
-                // Autonomy resolves from the PERSISTED session config (hoisted load
-                // above) → env → attended default, never from the bare CLI options.
-                resolveAutonomousMode({ sessionConfig: sessionConfigForDispatch }));
-                if (gate.kind === "halt") {
-                    return gate.step;
+            // T1 slice 3b — the lean tier is NOT zero-scrutiny: a `low`-tier run first runs
+            // a bounded LIGHT adversarial review over the approved findings (the floor,
+            // never off — `adversarialDepthForTier("low") === "light"`). A clear verdict
+            // proceeds to the lean plan; a verdict that surfaces a real concern escalates
+            // the risk signal and routes to the full pipeline below.
+            if (gate.approved.length > 0 && riskSignal?.tier === "low") {
+                const review = await runLeanLightReviewGate(root, artifactsDir, gate.approved);
+                if (review.kind === "halt") {
+                    return review.step;
                 }
-                // Persist the filter dispositions so coverage is built over the originals.
-                await persistReviewFilterDispositions(artifactsDir, originals, filter);
-                // Lean path = the `low` risk tier's realization (D-68 — the standalone lean
-                // fast-path folded into the self-scaling dial; its two mechanisms now live in
-                // `riskSignal.ts` (light-review) + `contractPipeline.ts` (lean plan builder)).
-                // A run skips the heavy contract DESIGN loop and
-                // synthesizes the extracted plan directly IFF its effective risk tier is `low`;
-                // the plan→implement→close machinery (per-node verify-before-merge + the final
-                // whole-repo gate) is the retained safety net. Runs only here — on Path A
-                // (structured_audit), the only intake with a pre-existing finding set to judge.
-                //
-                // First fold the APPROVED set's finding-level risk (grounding / confidence /
-                // coupling / systemic / architecture / count — the finding-QUALITY dimension the
-                // intake path/breadth/intent signal doesn't see) INTO the shared risk signal as
-                // escalate-on-evidence. This makes the tier the SINGLE classifier: there is no
-                // separate fast-path boolean that can DISAGREE with it (a grounded handful
-                // touching a risk subsystem stays `high` and takes the full pipeline, instead of
-                // bypassing it as the old parallel `evaluateFastPath` allowed).
-                const findingEvidence = findingRiskEvidence(gate.approved);
-                let riskSignal = await readIntakeRiskSignal(artifactsDir);
-                if (findingEvidence && riskSignal) {
-                    const raised = escalateRiskSignal(riskSignal, findingEvidence);
-                    // escalateRiskSignal returns the SAME reference when the evidence does not
-                    // raise the tier — only persist on an actual change (no byte-identical rewrite).
-                    if (raised !== riskSignal) {
-                        riskSignal = raised;
-                        await writeIntakeRiskSignal(artifactsDir, riskSignal);
-                    }
+                if (review.kind === "escalate") {
+                    // Escalate-on-evidence: raise the signal to at least `medium` so the
+                    // full pipeline's adversarial depth is `full` (see slice 3a), then
+                    // fall through to the full pipeline.
+                    await writeIntakeRiskSignal(artifactsDir, escalateRiskSignal(riskSignal, {
+                        tier: "medium",
+                        reason: `lean light review surfaced a concern: ${review.concerns.join("; ")}`,
+                    }));
+                    process.stderr.write(`[remediate-code] Lean light review escalated (${review.concerns.join("; ")}); routing to the full contract pipeline.\n`);
                 }
-                // T1 slice 3b — the lean tier is NOT zero-scrutiny: a `low`-tier run first runs
-                // a bounded LIGHT adversarial review over the approved findings (the floor,
-                // never off — `adversarialDepthForTier("low") === "light"`). A clear verdict
-                // proceeds to the lean plan; a verdict that surfaces a real concern escalates
-                // the risk signal and routes to the full pipeline below.
-                if (gate.approved.length > 0 && riskSignal?.tier === "low") {
-                    const review = await runLeanLightReviewGate(root, artifactsDir, gate.approved);
-                    if (review.kind === "halt") {
-                        return review.step;
+                else {
+                    // Clear verdict → proceed with the lean plan.
+                    const leanPlan = buildLeanExtractedPlan(gate.approved, randomRunId("LEAN"));
+                    await writeJsonFile(intakePaths(artifactsDir).extractedPlan, leanPlan);
+                    process.stderr.write(`[remediate-code] Lean fast path (risk tier low): ${riskSignal.rationale.join("; ")}; light review clear. Routing to plan→implement.\n`);
+                    const planned = await handlePendingExtractedPlan(root, artifactsDir, { status: "pending" }, leanPlan);
+                    if (planned) {
+                        return planned;
                     }
-                    if (review.kind === "escalate") {
-                        // Escalate-on-evidence: raise the signal to at least `medium` so the
-                        // full pipeline's adversarial depth is `full` (see slice 3a), then
-                        // fall through to the full pipeline.
-                        await writeIntakeRiskSignal(artifactsDir, escalateRiskSignal(riskSignal, {
-                            tier: "medium",
-                            reason: `lean light review surfaced a concern: ${review.concerns.join("; ")}`,
-                        }));
-                        process.stderr.write(`[remediate-code] Lean light review escalated (${review.concerns.join("; ")}); routing to the full contract pipeline.\n`);
-                    }
-                    else {
-                        // Clear verdict → proceed with the lean plan.
-                        const leanPlan = buildLeanExtractedPlan(gate.approved, randomRunId("LEAN"));
-                        await writeJsonFile(intakePaths(artifactsDir).extractedPlan, leanPlan);
-                        process.stderr.write(`[remediate-code] Lean fast path (risk tier low): ${riskSignal.rationale.join("; ")}; light review clear. Routing to plan→implement.\n`);
-                        const planned = await handlePendingExtractedPlan(root, artifactsDir, { status: "pending" }, leanPlan);
-                        if (planned) {
-                            return planned;
-                        }
-                        // Defensive: a deterministically-built lean plan should always
-                        // normalize. If it somehow didn't, handlePendingExtractedPlan removed
-                        // the file; fall through to the full pipeline (the safety net) rather
-                        // than stalling the run.
-                        process.stderr.write("[remediate-code] Lean fast-path plan failed to materialize; falling back to the contract pipeline.\n");
-                    }
-                }
-                // Seed the pipeline with the approved survivors only. When that set is
-                // narrower than the originals (anything filtered or declined), route the
-                // seed AND the pipeline's source inputs at a filtered file so a removed
-                // finding can never re-enter via the raw audit-findings.json (tool-enforced).
-                const approvedPayload = isRecord(auditFindings)
-                    ? { ...auditFindings, findings: gate.approved }
-                    : { findings: gate.approved };
-                let seedSourcePath = auditSource.path;
-                if (gate.approved.length < originals.length) {
-                    await mkdir(contractPipelineDir(artifactsDir), { recursive: true });
-                    seedSourcePath = join(contractPipelineDir(artifactsDir), "approved-findings.json");
-                    await writeJsonFile(seedSourcePath, approvedPayload);
-                    reviewSourceSwap = { from: auditSource.path, to: seedSourcePath };
-                }
-                try {
-                    await writePathASeedFromFindings(artifactsDir, seedSourcePath, approvedPayload);
-                }
-                catch {
-                    // If the seed cannot be written, the pipeline still runs; the LLM
-                    // phases use the source files from sourcePaths.
+                    // Defensive: a deterministically-built lean plan should always
+                    // normalize. If it somehow didn't, handlePendingExtractedPlan removed
+                    // the file; fall through to the full pipeline (the safety net) rather
+                    // than stalling the run.
+                    process.stderr.write("[remediate-code] Lean fast-path plan failed to materialize; falling back to the contract pipeline.\n");
                 }
             }
+            // Seed the pipeline with the approved survivors only. When that set is
+            // narrower than the originals (anything filtered or declined), route the
+            // seed AND the pipeline's source inputs at a filtered file so a removed
+            // finding can never re-enter via the raw audit-findings.json (tool-enforced).
+            const approvedPayload = isRecord(auditFindings)
+                ? { ...auditFindings, findings: gate.approved }
+                : { findings: gate.approved };
+            let seedSourcePath = auditSource.path;
+            if (gate.approved.length < originals.length) {
+                await mkdir(contractPipelineDir(artifactsDir), { recursive: true });
+                seedSourcePath = join(contractPipelineDir(artifactsDir), "approved-findings.json");
+                await writeJsonFile(seedSourcePath, approvedPayload);
+                reviewSourceSwap = { from: auditSource.path, to: seedSourcePath };
+            }
+            try {
+                await writePathASeedFromFindings(artifactsDir, seedSourcePath, approvedPayload);
+            }
+            catch {
+                // If the seed cannot be written, the pipeline still runs; the LLM
+                // phases use the source files from sourcePaths.
+            }
         }
     }
     const paths = intakePaths(artifactsDir);
@@ -2520,14 +2567,12 @@ async function handleReadyIntakeContractPipeline(root, artifactsDir, options) {
     if (existsSync(paths.brief)) {
         sourcePaths.add(paths.brief);
     }
-    if (intake.manifest) {
-        for (const source of resolveManifestSources(root, intake.manifest).resolved) {
-            // Swap the raw audit-findings.json for the approved-only filtered file so a
-            // declined finding can never re-enter the pipeline as a source input.
-            sourcePaths.add(reviewSourceSwap && source.path === reviewSourceSwap.from
-                ? reviewSourceSwap.to
-                : source.path);
-        }
+    for (const source of manifestSources) {
+        // Swap the raw audit-findings.json for the approved-only filtered file so a
+        // declined finding can never re-enter the pipeline as a source input.
+        sourcePaths.add(reviewSourceSwap && source.path === reviewSourceSwap.from
+            ? reviewSourceSwap.to
+            : source.path);
     }
     // Resolve the independent-critic dispatch capability from the SAME handshake
     // (`resolveHostDispatchCapability`) implement dispatch uses — never a manual
@@ -4057,7 +4102,7 @@ async function decideNextStepLoop(options, runLogger) {
     // When the fold ran only inside the implement-dispatch step builder, a
     // next-step call carrying the flags that landed on any other obligation (a
     // triage re-drive — the 2026-07-22 dogfood wall) silently dropped them and
-    // dispatch capability stayed at the conservative floor.
+    // dispatch capability stayed unknown and produced a resumable refusal.
     if (state) {
         const { toPersist } = resolveHostCapabilities({
             can_dispatch_subagents: options.hostCanDispatchSubagents,