cascade-ai 0.68.0 → 0.70.0

package/dist/index.cjs

@@ -1908,7 +1908,7 @@ function reconcilePrice(model, live) {
 }
 
 // src/constants.ts
-var CASCADE_VERSION = "0.68.0";
+var CASCADE_VERSION = "0.70.0";
 var CASCADE_CONFIG_DIR = ".cascade";
 var CASCADE_MD_FILE = "CASCADE.md";
 var CASCADE_IGNORE_FILE = ".cascadeignore";
@@ -6070,6 +6070,21 @@ var BaseTier = class extends EventEmitter__default.default {
    * which node (Cockpit node panel / Why panel).
    */
   servingModel;
+  /**
+   * This tier's identity IN THE TASK GRAPH — the section or subtask id the
+   * planner assigned — plus where it sat in the dependency order.
+   *
+   * `id` and `graphNodeId` are deliberately different id spaces, and both are
+   * needed. `id` identifies this tier INSTANCE ("T2_a1b2c3d4", minted per
+   * construction); `graphNodeId` identifies the WORK ("s1"), which is what
+   * dependency edges point at. Without the distinction a graph view cannot be
+   * drawn at all: `dependsOn` lists section ids, while every running tier
+   * reports a generated tier id, so every edge would name a node that never
+   * appears in the stream.
+   */
+  graphNodeId;
+  graphDependsOn;
+  graphWave;
   constructor(role, id, parentId) {
     super();
     this.role = role;
@@ -6081,6 +6096,33 @@ var BaseTier = class extends EventEmitter__default.default {
   setPresenter(on = true) {
     this.isPresenter = on;
   }
+  /**
+   * Record where this tier sits in the compiled task graph.
+   *
+   * Called by whichever tier scheduled this one: the id and edges are known at
+   * construction, the wave only once the scheduler reaches it, so the fields
+   * are set independently rather than all at once.
+   */
+  setGraphPosition(position) {
+    if (position.nodeId !== void 0) this.graphNodeId = position.nodeId;
+    if (position.dependsOn !== void 0) this.graphDependsOn = [...position.dependsOn];
+    if (position.wave !== void 0) this.graphWave = position.wave;
+  }
+  /**
+   * The graph fields, for spreading into a status payload.
+   *
+   * One helper rather than two literals because `tier:status` is emitted from
+   * two different call sites with two different payload shapes; adding a field
+   * to only one of them makes it arrive intermittently, which is worse for a
+   * consumer than never arriving at all.
+   */
+  graphFields() {
+    return {
+      nodeId: this.graphNodeId,
+      dependsOn: this.graphDependsOn ? [...this.graphDependsOn] : void 0,
+      waveId: this.graphWave
+    };
+  }
   getStatus() {
     return this.status;
   }
@@ -6095,7 +6137,8 @@ var BaseTier = class extends EventEmitter__default.default {
       status,
       timestamp,
       output,
-      model: this.servingModel
+      model: this.servingModel,
+      ...this.graphFields()
     };
     this.emit("status", event);
     this.emit("tier:status", event);
@@ -6135,7 +6178,8 @@ var BaseTier = class extends EventEmitter__default.default {
       progressPct: update.progressPct,
       timestamp,
       output: update.output,
-      model: this.servingModel
+      model: this.servingModel,
+      ...this.graphFields()
     });
   }
   buildMessage(type, to, payload) {
@@ -7037,7 +7081,8 @@ Now execute your subtask using this context where relevant.`
         if (result2.verdict === "passed") passed.push(result2.criterion);
       }
       this.sendStatusUpdate({ progressPct: 70, currentAction: "Self-testing output", status: "IN_PROGRESS" });
-      const testResult = await this.selfTest(assignment, output, undecided(acceptanceResults));
+      const pendingAcceptance = undecided(acceptanceResults);
+      const testResult = await this.selfTest(assignment, output, pendingAcceptance);
       checksRun.push(...testResult.checksRun);
       passed.push(...testResult.passed);
       failed.push(...testResult.failed);
@@ -7046,7 +7091,7 @@ Now execute your subtask using this context where relevant.`
         issues.push(`Initial check failed: ${testResult.failed.join(", ")}`);
         const corrected = await this.correctOutput(output, testResult.failed);
         output = corrected;
-        const retest = await this.selfTest(assignment, output);
+        const retest = await this.selfTest(assignment, output, pendingAcceptance);
         passed.push(...retest.passed);
         if (retest.failed.length > 0) {
           failed.push(...retest.failed);
@@ -8970,6 +9015,7 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : ""),
     for (const a of assignments) {
       const worker = new T3Worker(this.router, this.toolRegistry, this.id);
       if (this.store) worker.setStore(this.store, taskId);
+      worker.setGraphPosition({ nodeId: a.subtaskId, dependsOn: a.dependsOn ?? [] });
       worker.setPeerBus(this.t3PeerBus);
       if (this.permissionEscalator) worker.setPermissionEscalator(this.permissionEscalator);
       if (this.toolCreator) worker.setToolCreator(this.toolCreator);
@@ -9090,6 +9136,7 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : ""),
         runnableIds.push(fallbackId);
       }
       wave++;
+      for (const id of runnableIds) workerMap.get(id)?.setGraphPosition({ wave });
       this.log(`Wave ${wave}: running ${runnableIds.length} subtask(s) in parallel`);
       this.sendStatusUpdate({
         progressPct: 20 + Math.min(wave * 10, 60),
@@ -9417,23 +9464,63 @@ var DependencyScheduler = class {
         dependents.get(dependencyId)?.push(node.id);
       }
     }
-    const completed = /* @__PURE__ */ new Set();
+    const policy = this.options.onUpstreamFailure ?? "continue";
+    const settled = /* @__PURE__ */ new Set();
     const results = /* @__PURE__ */ new Map();
+    const blocked = /* @__PURE__ */ new Map();
     const waves = [];
     let wave = 0;
-    while (completed.size < nodes.length) {
-      const ready = nodes.filter((node) => !completed.has(node.id) && (inDegree.get(node.id) ?? 0) === 0);
+    const blockDescendants = async (failedIds) => {
+      const rootsFor = /* @__PURE__ */ new Map();
+      const queue = [];
+      for (const rootId of failedIds) {
+        for (const childId of dependents.get(rootId) ?? []) queue.push({ id: childId, root: rootId });
+      }
+      while (queue.length > 0) {
+        const { id, root } = queue.shift();
+        if (settled.has(id)) continue;
+        const known = rootsFor.get(id);
+        if (known) {
+          if (!known.has(root)) known.add(root);
+          continue;
+        }
+        rootsFor.set(id, /* @__PURE__ */ new Set([root]));
+        for (const childId of dependents.get(id) ?? []) queue.push({ id: childId, root });
+      }
+      for (const node of nodes) {
+        const roots = rootsFor.get(node.id);
+        if (!roots || settled.has(node.id)) continue;
+        const causes = nodes.filter((n) => roots.has(n.id));
+        const blockedBy = causes.map((n) => n.id);
+        const blockedByTitles = causes.map((n) => n.title || n.id);
+        const record = {
+          blockedBy,
+          blockedByTitles,
+          reason: blockedByTitles.length === 1 ? `Required upstream work "${blockedByTitles[0]}" failed` : `Required upstream work ${blockedByTitles.map((t) => `"${t}"`).join(", ")} failed`
+        };
+        blocked.set(node.id, record);
+        settled.add(node.id);
+        await this.hooks.onNodeBlocked?.(node, record);
+      }
+    };
+    while (settled.size < nodes.length) {
+      const ready = nodes.filter((node) => !settled.has(node.id) && (inDegree.get(node.id) ?? 0) === 0);
       if (ready.length === 0) {
         throw new Error("Dependency scheduler received a cyclic or incomplete task graph");
       }
       waves.push(ready.map((node) => node.id));
       await this.hooks.onWaveStart?.(ready, wave);
+      const outcomes = /* @__PURE__ */ new Map();
       const runOne = async (node) => {
         const result = await this.hooks.execute(node);
         results.set(node.id, result);
-        completed.add(node.id);
-        for (const dependentId of dependents.get(node.id) ?? []) {
-          inDegree.set(dependentId, Math.max(0, (inDegree.get(dependentId) ?? 1) - 1));
+        settled.add(node.id);
+        const outcome = this.hooks.classify?.(node, result) ?? "succeeded";
+        outcomes.set(node.id, outcome);
+        if (outcome === "failed" && policy === "block") ; else {
+          for (const dependentId of dependents.get(node.id) ?? []) {
+            inDegree.set(dependentId, Math.max(0, (inDegree.get(dependentId) ?? 1) - 1));
+          }
         }
         await this.hooks.onNodeComplete?.(node, result);
       };
@@ -9442,9 +9529,13 @@ var DependencyScheduler = class {
       } else {
         await Promise.all(ready.map(runOne));
       }
+      const failedThisWave = ready.filter((node) => outcomes.get(node.id) === "failed").map((node) => node.id);
+      if (policy === "block" && failedThisWave.length > 0) {
+        await blockDescendants(failedThisWave);
+      }
       wave++;
     }
-    return { results, waves };
+    return { results, waves, blocked };
   }
 };
 
@@ -9545,6 +9636,9 @@ QUALITY RULES:
 
 ${generation}` : ""}`;
 }
+function producedOutput(result) {
+  return result.status === "COMPLETED" || result.status === "PARTIAL";
+}
 var T1Administrator = class extends BaseTier {
   router;
   toolRegistry;
@@ -9679,7 +9773,7 @@ Board guidance (must be followed in the plan): ${decision.note}`,
     let allT2Results = await this.dispatchT2Managers(plan.sections);
     let pass = 1;
     const maxReplanPasses = this.config.maxReplanPasses ?? 2;
-    const okCount = (rs) => rs.filter((r) => r.status === "COMPLETED" || r.status === "PARTIAL").length;
+    const okCount = (rs) => rs.filter(producedOutput).length;
     while (pass <= maxReplanPasses) {
       const reviewResult = await this.reviewT2Outputs(enrichedPrompt, plan, allT2Results);
       if (reviewResult.approved) {
@@ -9810,7 +9904,7 @@ In 3-5 terse bullets, flag the most important RISKS, GAPS, or over-/under-decomp
   /** Structured, grounded summary of what's already done — used to keep
    * corrective replan passes from re-emitting completed sections. */
   summarizeCompletedSections(results) {
-    const done = results.filter((r) => r.status === "COMPLETED" || r.status === "PARTIAL");
+    const done = results.filter(producedOutput);
     if (done.length === 0) return "";
     const lines = done.map((r) => `- "${r.sectionTitle}" [${r.status}]: ${(r.sectionSummary || "(no summary)").slice(0, 300)}`);
     return `ALREADY COMPLETED SECTIONS (do not redo these \u2014 plan only what's still missing):
@@ -9955,6 +10049,7 @@ SPEC RULES \u2014 each subtask is a self-contained spec slice (workers execute f
       if (this.runBreaker) manager.setRunBreaker(this.runBreaker);
       if (this.escalationCallback) manager.setEscalationCallback(this.escalationCallback);
       manager.setHierarchyContext(`You are a T2 Manager for the section "${section.sectionTitle}". You are part of a COMPLEX task overseen by T1 Administrator.`);
+      manager.setGraphPosition({ nodeId: section.sectionId, dependsOn: section.dependsOn ?? [] });
       if (this.store) {
         manager.setStore(this.store);
       }
@@ -10081,6 +10176,13 @@ SPEC RULES \u2014 each subtask is a self-contained spec slice (workers execute f
     const scheduler = new DependencyScheduler(
       compiled.graph,
       {
+        // The wave is the scheduler's own counter, and it is the only place the
+        // parallelism is visible: nodes sharing a wave ran at the same time.
+        // Stamped before the wave executes so the first status event a node
+        // emits already carries it.
+        onWaveStart: (nodes, wave) => {
+          for (const node of nodes) managers[node.ordinal]?.setGraphPosition({ wave });
+        },
         execute: async (node) => {
           const section = node.payload;
           const manager = managers[node.ordinal];
@@ -10115,6 +10217,62 @@ SPEC RULES \u2014 each subtask is a self-contained spec slice (workers execute f
             };
           }
         },
+        // PARTIAL is deliberately not a failure: a degraded-but-real section
+        // can still feed the one after it, and cancelling that work would cost
+        // the user more than letting it try.
+        // BLOCKED cannot reach here today — the scheduler settles blocked nodes
+        // through onNodeBlocked and never executes them, so classify only ever
+        // sees results that ran. It is listed anyway because the failure mode if
+        // that ever changes is silent and expensive: a blocked section would
+        // classify as 'succeeded' and release its own dependents, so work that
+        // should have been skipped would run and be billed.
+        classify: (_node, result) => result.status === "FAILED" || result.status === "BLOCKED" ? "failed" : "succeeded",
+        onNodeBlocked: (node, blockedInfo) => {
+          const section = node.payload;
+          this.log(`\u292B Skipped "${section.sectionTitle}" \u2014 ${blockedInfo.reason}`);
+          resultMap.set(node.id, {
+            sectionId: section.sectionId,
+            sectionTitle: section.sectionTitle,
+            // BLOCKED, not FAILED. This section was never attempted — saying it
+            // failed reports a breakage that did not happen, and hides the one
+            // that did (the upstream section named below).
+            status: "BLOCKED",
+            t3Results: [],
+            sectionSummary: "",
+            issues: [
+              `${blockedInfo.reason}. This section was not attempted, so no tokens were spent on it.`
+            ],
+            blockedBy: { ids: [...blockedInfo.blockedBy], titles: [...blockedInfo.blockedByTitles] }
+          });
+          completedSections++;
+          this.sendStatusUpdate({
+            progressPct: 10 + Math.floor(completedSections / totalSections * 85),
+            currentAction: `Skipped: ${section.sectionTitle} (blocked by an upstream failure)`,
+            status: "IN_PROGRESS"
+          });
+          this.emit("tier:status", {
+            tierId: section.sectionId,
+            // A blocked section has no tier instance — it was never
+            // constructed — so its runtime id and its graph id are the same
+            // thing here. Emitting nodeId anyway keeps every node in the
+            // stream addressable in the graph's id space, which is what
+            // dependsOn edges point at.
+            nodeId: section.sectionId,
+            dependsOn: [...section.dependsOn ?? []],
+            role: "T2",
+            label: section.sectionTitle,
+            status: "BLOCKED",
+            blockedBy: [...blockedInfo.blockedByTitles],
+            output: blockedInfo.reason
+          });
+          this.emit("section:complete", {
+            id: node.id,
+            title: section.sectionTitle,
+            status: "BLOCKED",
+            blockedBy: [...blockedInfo.blockedByTitles],
+            output: ""
+          });
+        },
         onNodeComplete: (node, result) => {
           resultMap.set(node.id, result);
           completedSections++;
@@ -10131,14 +10289,18 @@ SPEC RULES \u2014 each subtask is a self-contained spec slice (workers execute f
         // intra-section T3 wave (t2-manager.ts) — 'sequential' otherwise only
         // serialized T3 workers within a single section while every section's
         // T2Manager (and its T3 workers) still ran in parallel here.
-        mode: this.router.getT3ExecutionMode?.() === "sequential" ? "sequential" : "parallel"
+        mode: this.router.getT3ExecutionMode?.() === "sequential" ? "sequential" : "parallel",
+        // A section that declared `dependsOn` said it needs that section's
+        // output. Running it after the dependency failed produces a second
+        // failure, billed, whose cause is the first one — so don't.
+        onUpstreamFailure: "block"
       }
     );
     await scheduler.run();
     return sections.map((s) => resultMap.get(s.sectionId)).filter(Boolean);
   }
   async compileFinalOutput(originalPrompt, plan, t2Results) {
-    const completedSections = t2Results.filter((r) => r.status !== "FAILED");
+    const completedSections = t2Results.filter(producedOutput);
     if (!completedSections.length) {
       const allIssues = [
         ...t2Results.flatMap((r) => r.issues ?? []),
@@ -10158,7 +10320,6 @@ ${r.sectionSummary}
 Outputs:
 ${r.t3Results.filter((t) => t.status === "COMPLETED").map((t) => `\u2022 ${typeof t.output === "string" ? t.output : JSON.stringify(t.output)}`).join("\n")}`).join("\n\n---\n\n");
     const openIssues = t2Results.flatMap((r) => r.issues).filter(Boolean);
-    t2Results.filter((r) => r.status === "FAILED" || r.status === "PARTIAL");
     const compilePrompt = `Compile a final, coherent response to the user's original request.
 
 Original request: ${originalPrompt}
@@ -10650,6 +10811,7 @@ Model: ${asset.modelId} \u2014 ${r.selected.reason}`;
 };
 var DEFAULT_VIDEO_SECONDS = 5;
 var MAX_VIDEO_SECONDS = 8;
+var MIN_VIDEO_SECONDS = 4;
 var GenerateVideoTool = class extends BaseTool {
   constructor(deps) {
     super();
@@ -10666,7 +10828,7 @@ var GenerateVideoTool = class extends BaseTool {
     type: "object",
     properties: {
       prompt: { type: "string", description: "What the video should show: subject, action, camera movement, style." },
-      seconds: { type: "number", description: `Clip length, 1-${MAX_VIDEO_SECONDS} seconds (default ${DEFAULT_VIDEO_SECONDS}). Billed per second \u2014 keep it short.` },
+      seconds: { type: "number", description: `Clip length, ${MIN_VIDEO_SECONDS}-${MAX_VIDEO_SECONDS} seconds (default ${DEFAULT_VIDEO_SECONDS}). Billed per second \u2014 keep it short.` },
       aspectRatio: { type: "string", description: 'Frame shape: "16:9" (default) or "9:16" for vertical.' },
       model: { type: "string", description: "Optional: force a specific video model." }
     },
@@ -10678,7 +10840,7 @@ var GenerateVideoTool = class extends BaseTool {
     const r = resolve(this.deps, "video", input["model"] ? String(input["model"]) : void 0);
     if (!r.ok) return r.error;
     const asked = typeof input["seconds"] === "number" ? input["seconds"] : DEFAULT_VIDEO_SECONDS;
-    const seconds = Math.max(1, Math.min(MAX_VIDEO_SECONDS, Math.round(asked)));
+    const seconds = Math.max(MIN_VIDEO_SECONDS, Math.min(MAX_VIDEO_SECONDS, Math.round(asked)));
     const asset = await generateVideo(
       r.selected.capability,
       r.cfg,
@@ -10695,7 +10857,7 @@ var GenerateVideoTool = class extends BaseTool {
     const location = await this.deps.sink(asset);
     const unit = r.selected.cost;
     const estimate = unit ? ` Estimated cost: $${(unit.amount * seconds).toFixed(2)} (${seconds}s x ${unit.label}).` : "";
-    const clamped = seconds !== Math.round(asked) ? ` Duration was clamped to ${seconds}s (max ${MAX_VIDEO_SECONDS}).` : "";
+    const clamped = seconds !== Math.round(asked) ? ` Duration was clamped to ${seconds}s (allowed ${MIN_VIDEO_SECONDS}-${MAX_VIDEO_SECONDS}).` : "";
     return `Video generated and saved to ${location}.
 Model: ${asset.modelId}.${estimate}${clamped}`;
   }
@@ -14449,7 +14611,24 @@ var TaskAnalyzer = class {
   feedback;
   bias;
   lastProfile = null;
-  lastSelectedModels = /* @__PURE__ */ new Map();
+  /** Models chosen by the run currently in flight. Cleared when it completes. */
+  currentRunSelections = /* @__PURE__ */ new Map();
+  /**
+   * Immutable snapshot of the last COMPLETED run: its selections AND the task
+   * type they were chosen for.
+   *
+   * The task type has to travel WITH the selections. `lastProfile` is overwritten
+   * by the next analyze(), so if run B started before the user rated run A, A's
+   * models were credited under B's task type — teaching the router that a coding
+   * model is good at creative writing, from a rating that never said so.
+   *
+   * Explicit ratings arrive after the run finishes — rateLastRun() is by nature
+   * a reaction to a finished answer — but the run finalizer calls
+   * recordRunOutcome() first, and that used to clear the only map there was. So
+   * every explicit rating iterated an empty map, recorded nothing, and returned
+   * false: the 3x-weighted user signal never reached the tracker at all.
+   */
+  lastCompletedRun;
   constructor(tracker, bias = "balanced") {
     this.tracker = tracker;
     this.bias = bias;
@@ -14496,11 +14675,15 @@ var TaskAnalyzer = class {
    */
   async selectModel(prompt, tier, selector, opts) {
     const profile = await this.analyze(prompt);
+    const recordSelection = (model) => {
+      if (model) this.currentRunSelections.set(tier, model);
+      return model;
+    };
     if (profile.requiresVision) {
-      return selector.selectVisionModel();
+      return recordSelection(selector.selectVisionModel());
     }
     let candidates = selector.getCandidatesForTier(tier);
-    if (candidates.length === 0) return selector.selectForTier(tier);
+    if (candidates.length === 0) return recordSelection(selector.selectForTier(tier));
     if (opts?.requiresToolUse) {
       const toolCapable = candidates.filter((m) => m.supportsToolUse !== false);
       if (toolCapable.length > 0) candidates = toolCapable;
@@ -14510,9 +14693,7 @@ var TaskAnalyzer = class {
       score: this.scoreModel(m, profile)
     }));
     scored.sort((a, b) => b.score - a.score);
-    const best = scored[0]?.model ?? selector.selectForTier(tier);
-    if (best) this.lastSelectedModels.set(tier, best);
-    return best;
+    return recordSelection(scored[0]?.model ?? selector.selectForTier(tier));
   }
   /**
    * Record the outcome of a completed run across all tiers that were selected
@@ -14521,25 +14702,38 @@ var TaskAnalyzer = class {
   recordRunOutcome(outcome, costByTier, contextTokens = 0) {
     if (!this.tracker || !this.lastProfile) return;
     const taskType = this.lastProfile.type;
-    for (const [tier, model] of this.lastSelectedModels) {
+    for (const [tier, model] of this.currentRunSelections) {
       const cost = costByTier[tier] ?? 0;
       this.tracker.record(model.id, taskType, outcome, 0, cost, contextTokens);
     }
-    this.lastSelectedModels.clear();
+    this.lastCompletedRun = { selections: new Map(this.currentRunSelections), taskType };
+    this.currentRunSelections.clear();
     void this.tracker.save();
   }
   /**
-   * Record an explicit user rating (good/bad) for the last run's selected models.
+   * Record an explicit user rating (good/bad) for the last COMPLETED run's models.
    * Explicit ratings carry 3× the weight of auto-detected outcomes.
-   * Does NOT clear lastSelectedModels — the auto record already did that.
+   *
+   * Reads the completed-run snapshot, not the in-flight map: by the time a user
+   * can rate an answer, the finalizer has already run and the in-flight map is
+   * empty.
+   *
+   * The snapshot is CONSUMED. recordExplicit() weights a rating 3x by recording
+   * three samples, so a double submit would inject six — a stutter on the
+   * button would count as two opinions. Consuming makes a second call a no-op
+   * that reports false, which is what "rate this run" should mean.
    */
   recordExplicitRating(rating) {
-    if (!this.tracker || !this.lastProfile) return false;
-    const taskType = this.lastProfile.type;
-    for (const [, model] of this.lastSelectedModels) {
-      this.tracker.recordExplicit(model.id, taskType, rating, 0);
-    }
-    return this.lastSelectedModels.size > 0;
+    const snapshot = this.lastCompletedRun;
+    if (!this.tracker || !snapshot || snapshot.selections.size === 0) return false;
+    const ratedModels = /* @__PURE__ */ new Set();
+    for (const [, model] of snapshot.selections) {
+      if (ratedModels.has(model.id)) continue;
+      ratedModels.add(model.id);
+      this.tracker.recordExplicit(model.id, snapshot.taskType, rating, 0);
+    }
+    this.lastCompletedRun = void 0;
+    return true;
   }
   scoreModel(model, profile) {
     const perf = this.tracker?.performanceScore(model.id, profile.type) ?? 0.5;
@@ -15577,6 +15771,8 @@ var RESUME_SCHEMA_VERSION = 1;
 var DEFAULT_MAX_CHECKPOINTS = 5;
 var DEFAULT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1e3;
 var FILE_PATTERN = /^(\d+)-(.+)\.json$/;
+var CLAIM_SUFFIX = ".claimed";
+var DEFAULT_CLAIM_TIMEOUT_MS = 10 * 60 * 1e3;
 function safeId(taskId) {
   const cleaned = taskId.replace(/[^A-Za-z0-9._-]/g, "_").replace(/\.{2,}/g, "_");
   return cleaned.slice(0, 100) || "run";
@@ -15591,16 +15787,24 @@ var ResumeStore = class {
   maxCheckpoints;
   maxAgeMs;
   now;
+  claimTimeoutMs;
   constructor(options) {
     this.dir = options.dir;
     this.maxCheckpoints = options.maxCheckpoints ?? DEFAULT_MAX_CHECKPOINTS;
     this.maxAgeMs = options.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
     this.now = options.now ?? Date.now;
+    this.claimTimeoutMs = options.claimTimeoutMs ?? DEFAULT_CLAIM_TIMEOUT_MS;
   }
   /**
-   * Persist a checkpoint and prune. Never throws: failing to save a resume file
-   * must not turn a recoverable stop into a crash, which would be a strictly
-   * worse outcome than the one this store exists to improve.
+   * Persist a checkpoint and prune.
+   *
+   * Never throws — failing to save a resume file must not turn a recoverable
+   * stop into a crash — but DOES report whether the atomic rename landed.
+   * Callers decide whether an original claim is safe to discard based on that
+   * answer, so "I swallowed the error" and "the checkpoint is on disk" must not
+   * look alike to them.
+   *
+   * @returns true only when the checkpoint is durably on disk.
    */
   async save(checkpoint) {
     try {
@@ -15616,7 +15820,9 @@ var ResumeStore = class {
       await fs25.promises.writeFile(tempPath, JSON.stringify(record, null, 2), "utf-8");
       await fs25.promises.rename(tempPath, finalPath);
       await this.prune();
+      return true;
     } catch {
+      return false;
     }
   }
   /** Valid, unexpired checkpoints, newest first. */
@@ -15646,15 +15852,87 @@ var ResumeStore = class {
     return (await this.list())[0] ?? null;
   }
   /**
-   * Load a checkpoint and delete it in the same step. Resuming twice from one
-   * checkpoint would re-run restored work, so consumption is part of reading.
+   * Claim a checkpoint for a resume attempt.
+   *
+   * This used to DELETE the file and return it, which opened a window with no
+   * recovery record at all: between preparing the continuation and the resumed
+   * run writing its own checkpoint, a crash lost the only copy — and a crash is
+   * precisely what this store exists to survive. Deleting on read optimised for
+   * "never resume twice" at the cost of "never lose the work", which is the
+   * wrong trade for a recovery mechanism.
+   *
+   * Instead the file is RENAMED to `.claimed`, which still hides it from
+   * `list()` (so a concurrent resume cannot take the same work) but keeps it on
+   * disk. The caller then either `release`s it — restoring it for another
+   * attempt — or `settle`s it once the resumed run is safely under way. A claim
+   * abandoned by a dead process is reclaimed after `claimTimeoutMs`.
    */
-  async consume(taskId) {
+  async claim(taskId) {
     const all = await this.list();
     const target = taskId ? all.find((c) => c.taskId === taskId) : all[0];
     if (!target) return null;
-    await this.delete(target.taskId);
-    return target;
+    try {
+      const entries = await fs25.promises.readdir(this.dir);
+      const wanted = safeId(target.taskId);
+      const source = entries.find((name) => FILE_PATTERN.exec(name)?.[2] === wanted);
+      if (!source) return null;
+      const claimId = `${this.now()}-${safeId(target.taskId)}`;
+      await fs25.promises.rename(path26__default.default.join(this.dir, source), path26__default.default.join(this.dir, `${claimId}${CLAIM_SUFFIX}`));
+      return { checkpoint: target, claimId };
+    } catch {
+      return null;
+    }
+  }
+  /** Give a claim back, so the work stays recoverable after a failed start. */
+  async release(claimId) {
+    try {
+      await fs25.promises.rename(
+        path26__default.default.join(this.dir, `${claimId}${CLAIM_SUFFIX}`),
+        path26__default.default.join(this.dir, `${claimId}.json`)
+      );
+    } catch {
+    }
+  }
+  /** Discard a claim for good — the resumed run has taken ownership. */
+  async settle(claimId) {
+    try {
+      await fs25.promises.rm(path26__default.default.join(this.dir, `${claimId}${CLAIM_SUFFIX}`), { force: true });
+    } catch {
+    }
+  }
+  /**
+   * Claim-and-discard in one step. Kept for callers that genuinely want the old
+   * semantics; prefer claim/settle so a crash mid-resume stays recoverable.
+   */
+  async consume(taskId) {
+    const claimed = await this.claim(taskId);
+    if (!claimed) return null;
+    await this.settle(claimed.claimId);
+    return claimed.checkpoint;
+  }
+  /**
+   * Return claims abandoned by a process that died mid-resume. Without this a
+   * crash between claim and settle would strand the checkpoint invisibly —
+   * trading one loss window for another.
+   */
+  async reclaimStale() {
+    let reclaimed = 0;
+    try {
+      const entries = await fs25.promises.readdir(this.dir);
+      const cutoff = this.now() - this.claimTimeoutMs;
+      for (const name of entries) {
+        if (!name.endsWith(CLAIM_SUFFIX)) continue;
+        const stamp2 = Number(/^(\d+)-/.exec(name)?.[1]);
+        if (!Number.isFinite(stamp2) || stamp2 >= cutoff) continue;
+        await fs25.promises.rename(
+          path26__default.default.join(this.dir, name),
+          path26__default.default.join(this.dir, `${name.slice(0, -CLAIM_SUFFIX.length)}.json`)
+        );
+        reclaimed++;
+      }
+    } catch {
+    }
+    return reclaimed;
   }
   /** Remove every checkpoint for a task id. */
   async delete(taskId) {
@@ -16710,6 +16988,25 @@ var Cascade = class _Cascade extends EventEmitter__default.default {
   lastInterruptedRun;
   /** Durable resume checkpoints. See core/orchestration/resume-store.ts. */
   resumeStore;
+  /** Claim held by an in-flight resume, settled once the run owns the work. */
+  claimedResumeId;
+  /**
+   * Facts inherited from the checkpoint this run is resuming, so its own
+   * checkpoint is cumulative rather than only covering this attempt.
+   */
+  resumedFrom;
+  /** Whether THIS run persisted a checkpoint of its own. Drives settle-vs-release. */
+  wroteCheckpointThisRun = false;
+  /**
+   * Whether the run reached the end of its normal path.
+   *
+   * NOT the same as `runError == null`: the cancellation and budget handlers
+   * both null `runError` deliberately (an intentional stop is not a telemetry
+   * error) and the breaker path never sets it at all. Treating that as success
+   * meant an immediate cancel — no output, no replacement checkpoint — deleted
+   * the original claim and the finished sections with it.
+   */
+  completedNormally = false;
   /** Section results of the CURRENT run, so an interruption can checkpoint them. */
   currentRunCompleted = [];
   initPromise;
@@ -17227,17 +17524,31 @@ ${input}` }],
    * worse. Nothing here is allowed to throw.
    */
   async checkpointRun(taskId, prompt, partialOutput, reason, detail) {
-    if (!this.currentRunCompleted.length && !partialOutput) return;
+    const inherited = this.resumedFrom?.completed ?? [];
+    const merged = /* @__PURE__ */ new Map();
+    for (const node of inherited) merged.set(node.id, node);
+    for (const node of this.currentRunCompleted) {
+      const existing = merged.get(node.id);
+      if (existing?.status === "COMPLETED" && node.status !== "COMPLETED") continue;
+      merged.set(node.id, node);
+    }
+    const completed = [...merged.values()];
+    const canonicalPrompt = this.resumedFrom?.prompt ?? prompt;
+    const carriedPartial = partialOutput || (this.resumedFrom?.partialOutput ?? "");
+    if (!completed.length && !carriedPartial) return false;
     try {
-      await this.resumeStore?.save({
+      const saved = await this.resumeStore?.save({
         taskId,
-        prompt,
+        prompt: canonicalPrompt,
         reason,
         ...detail ? { detail } : {},
-        partialOutput,
-        completed: [...this.currentRunCompleted]
+        partialOutput: carriedPartial,
+        completed
       });
+      this.wroteCheckpointThisRun = saved === true;
+      return saved === true;
     } catch {
+      return false;
     }
   }
   /** True when a task can be resumed via /continue (this process or a previous one). */
@@ -17275,11 +17586,55 @@ ${input}` }],
    * checkpoint, so the same finished work is never restored into two runs.
    */
   async prepareDurableResume(opts = {}) {
-    const checkpoint = await this.resumeStore?.consume(opts.taskId);
-    if (!checkpoint) return null;
-    this.lastInterruptedRun = void 0;
-    this.raiseBudgetForResume(opts.maxTokens);
-    return this.buildResumePrompt(checkpoint.prompt, checkpoint.partialOutput, checkpoint.completed);
+    await this.resumeStore?.reclaimStale();
+    const claimed = await this.resumeStore?.claim(opts.taskId);
+    if (!claimed) return null;
+    try {
+      this.lastInterruptedRun = void 0;
+      this.raiseBudgetForResume(opts.maxTokens);
+      const prompt = this.buildResumePrompt(
+        claimed.checkpoint.prompt,
+        claimed.checkpoint.partialOutput,
+        claimed.checkpoint.completed
+      );
+      this.resumedFrom = {
+        prompt: claimed.checkpoint.prompt,
+        completed: claimed.checkpoint.completed,
+        partialOutput: claimed.checkpoint.partialOutput
+      };
+      this.claimedResumeId = claimed.claimId;
+      return prompt;
+    } catch (err) {
+      await this.resumeStore?.release(claimed.claimId);
+      throw err;
+    }
+  }
+  /**
+   * Discard the claimed checkpoint once the resumed run has taken ownership of
+   * the work (it has produced its own checkpoint, or finished). Called by the
+   * run loop; safe to call when nothing is claimed.
+   */
+  async settleClaimedResume(succeeded) {
+    const claimId = this.claimedResumeId;
+    if (!claimId) return;
+    this.claimedResumeId = void 0;
+    if (succeeded || this.wroteCheckpointThisRun) {
+      await this.resumeStore?.settle(claimId);
+    } else {
+      await this.resumeStore?.release(claimId);
+    }
+  }
+  /**
+   * Hand back a claim taken by prepareDurableResume() when the caller never
+   * gets as far as run(). The REPL prepares the continuation and submits it
+   * separately, so a failure in between would otherwise strand the checkpoint
+   * for the whole lease timeout before reclaimStale() could recover it.
+   */
+  async releaseClaimedResume() {
+    const claimId = this.claimedResumeId;
+    if (!claimId) return;
+    this.claimedResumeId = void 0;
+    await this.resumeStore?.release(claimId);
   }
   /** A resume gets a bigger budget — the previous attempt exhausted the old one. */
   raiseBudgetForResume(maxTokens) {
@@ -17315,7 +17670,12 @@ ${partialOutput}` : ""
   async resumeRun(opts = {}) {
     const prompt = await this.prepareDurableResume(opts) ?? this.prepareResume(opts);
     if (!prompt) return null;
-    return this.run({ prompt });
+    try {
+      return await this.run({ prompt });
+    } catch (err) {
+      await this.releaseClaimedResume();
+      throw err;
+    }
   }
   getWorkspacePath() {
     return this.workspacePath;
@@ -17685,6 +18045,9 @@ ${prompt}` : prompt;
     const taskId = crypto4.randomUUID();
     this.decisionLog = [];
     this.currentRunCompleted = [];
+    this.wroteCheckpointThisRun = false;
+    this.completedNormally = false;
+    if (!this.claimedResumeId) this.resumedFrom = void 0;
     if (options.fastAnswer) {
       return this.runFastAnswer(options, startMs, taskId);
     }
@@ -17963,6 +18326,7 @@ _(incomplete: ${reasons.join("; ")})_` : partial;
 ${finalOutput}` : ""
         ].join("\n").trimEnd();
       }
+      this.completedNormally = trip == null;
     } catch (err) {
       if (err instanceof CascadeCancelledError || err instanceof Error && err.name === "AbortError" || options.signal?.aborted) {
         this.emit("run:cancelled", {
@@ -18004,6 +18368,10 @@ ${finalOutput}` : ""
         escalator.cancelAllPending();
       } catch {
       }
+      try {
+        await this.settleClaimedResume(this.completedNormally);
+      } catch {
+      }
       try {
         this.releasePendingEscalations();
       } catch {
@@ -19632,8 +20000,14 @@ var DashboardSocket = class {
   emitCascadeEvent(ev) {
     this.io.emit("cascade:event", ev);
   }
-  emitTierStatus(tierId, role, status, sessionId, action) {
-    const payload = { tierId, role, status, action, timestamp: (/* @__PURE__ */ new Date()).toISOString(), sessionId };
+  /**
+   * `extra` exists because this signature is positional: every field the tier
+   * emits that is not named here is silently dropped on this path, while the
+   * other two forwarders spread the whole event through. That asymmetry is how
+   * a field can reach the web dashboard from one code path and not another.
+   */
+  emitTierStatus(tierId, role, status, sessionId, action, extra) {
+    const payload = { tierId, role, status, action, timestamp: (/* @__PURE__ */ new Date()).toISOString(), sessionId, ...extra };
     this.io.emit("tier:status", payload);
     this.io.to(`session:${sessionId}`).emit("tier:status", payload);
   }