codecartographer-pi 0.22.0 → 0.22.2

package/.codecarto/broadside/SKILL.md

@@ -95,11 +95,14 @@ OpenRouter advertises a `:batch` variant for, and many of those variants do not
 exist — submitting one returns `does not have a :batch endpoint`, with nothing in
 the catalog to distinguish it beforehand. A rejected batch costs nothing, so
 probe a candidate on a single lens first. And reasoning competes with the answer for
-`max_tokens`: Broad-Side caps thinking at a quarter of each lens's output budget
-so three quarters remain for the JSON, which is the split the cost estimate
-already assumes. It caps rather than disables because some endpoints refuse to
-be switched off entirely. Override with `reasoning:` in `config.yaml` only
-alongside a raised output budget.
+`max_tokens`: Broad-Side asks every model for low reasoning effort so the output
+budget stays with the JSON, which is the split the cost estimate already
+assumes. An effort level rather than a token cap, because Gemini 3.x ignores a
+cap (measured: 11,518 thinking tokens under a 5,800 cap) and honours the level;
+a level rather than off, because some endpoints refuse to be switched off. A
+slice that still truncates is retried once with a doubled budget at low effort.
+Override with `reasoning:` in `config.yaml` only alongside a raised output
+budget, and set `effort` or `max_tokens`, never both.
 
 Lenses do not all have to run on the same model. `lens_models` in `config.yaml`
 routes individual lenses to their own batch model — the usual reason being that

package/.codecarto/broadside/config.yaml

@@ -72,29 +72,50 @@
 
 # Reasoning control, sent on every lens request.
 #
-# By default Broad-Side caps thinking at a quarter of the lens's output budget,
-# leaving the other three quarters for the answer — which is exactly the split
-# the cost estimate already assumes.
-#
-# The cap exists because reasoning competes with the answer for `max_tokens`.
-# One measured run spent 5,758 of a 6,000-token budget thinking and left ~230
-# tokens for the JSON, which truncated mid-structure on 11 of 13 slices; those
-# tokens bill at the full output rate, so it paid for ~6,000 output tokens per
-# slice to receive ~230 usable ones. The shipped default model does the same
-# thing less consistently — reasoning from 0 to 5,757 tokens across 13 slices,
-# three of them cut off — so this is not something only exotic models do.
-#
-# It is a cap rather than an off switch on purpose. Some endpoints refuse to be
-# switched off: `google/gemini-3.8-flash:batch` rejects the entire batch with
-# "Reasoning is mandatory for this endpoint and cannot be disabled", which turns
-# a partial result into none at all. Capping works either way.
-#
-# Override only with a raised lens output budget, or the JSON truncates exactly
-# as above.
+# By default Broad-Side asks every model for low reasoning effort
+# (`effort: low`), leaving the output budget for the answer — which is the
+# split the cost estimate already assumes.
+#
+# The control exists because reasoning competes with the answer for
+# `max_tokens`. One measured run spent 5,758 of a 6,000-token budget thinking
+# and left ~230 tokens for the JSON, which truncated mid-structure on 11 of 13
+# slices; those tokens bill at the full output rate, so it paid for ~6,000
+# output tokens per slice to receive ~230 usable ones. The shipped default
+# model does the same thing less consistently — reasoning from 0 to 5,757
+# tokens across 13 slices, three of them cut off — so this is not something
+# only exotic models do.
+#
+# It is an effort level rather than a token cap because a cap is not honoured
+# everywhere. Gemini 3.x models take a thinking *level*, not a budget: under
+# `max_tokens: 5800`, google/gemini-3.8-flash:batch reasoned 5,218 tokens on
+# the first pass and 11,518 on the doubled-budget retry — the cap changed
+# nothing, both results truncated, and the retry cost twice the original for
+# no JSON. The same lens at `effort: low` reasoned 0 tokens, returned valid
+# JSON, and cost a twelfth as much. `effort` is what OpenRouter can translate
+# for every provider; a token cap reaches only the providers that take one.
+#
+# And it is a level rather than an off switch on purpose. Some endpoints refuse
+# to be switched off: `google/gemini-3.8-flash:batch` rejects the entire batch
+# with "Reasoning is mandatory for this endpoint and cannot be disabled", which
+# turns a partial result into none at all. Low effort works either way.
+#
+# A slice that still truncates is re-submitted once with a doubled `max_tokens`
+# and, whatever this block says, low effort — the cutoff is usually thinking.
+#
+# Set `effort` OR `max_tokens`, not both: OpenRouter refuses a request that
+# carries both ("Only one of reasoning.effort and reasoning.max_tokens can be
+# specified") — per request, after the batch is accepted, so every lens fails
+# at $0. Submit refuses a config.yaml that sets both. Raise the effort only
+# together with a raised lens output budget, or the JSON truncates exactly as
+# above.
 #
 # reasoning:
 #   effort: low        # minimal | low | medium | high
-#   max_tokens: 2000   # or set the thinking budget directly
+#
+# reasoning:
+#   max_tokens: 2000   # a thinking budget, where the provider honours one
+#
+# reasoning:
 #   enabled: false     # only where the provider allows it
 
 # Approximate run expense limit in USD. The default is 1.00, and it applies

package/.codecarto/workflow/scaffold-version.yaml

@@ -3,4 +3,4 @@
 # workspace's framework-owned files (GUIDE.md, templates/, workflow/ pipelines
 # and VALIDATE.md) predate the running release. Written at release time and
 # copied verbatim by init — never edit by hand.
-scaffold_version: 0.22.0
+scaffold_version: 0.22.2

package/README.md

@@ -396,7 +396,7 @@ codecarto_broadside {cwd, action: "status"}                   # what is in fligh
 codecarto_broadside {cwd, action: "collect"}                  # poll, save, synthesize, triage
 ```
 
-Submit and collect are separate because batch jobs routinely take tens of minutes; collect is resumable and picks up whatever is still in flight (`wait_seconds: 0`, the default, polls once and returns). Submit prices the run from the collected file sizes against the model's live per-token pricing (cached 24h) and refuses when the estimate exceeds `max_cost` — $1.00 unless the config or the call sets another value, `0` for no limit — unless `force: true` is passed — a pre-flight estimate, not a runtime stop. Actual spend lands in each run's `run-meta.json`.
+Submit and collect are separate because batch jobs routinely take tens of minutes; collect is resumable and picks up whatever is still in flight (`wait_seconds: 0`, the default, polls once and returns), and two collects on one run — a retried tool call, a second session — never pay for the synthesis, triage, or truncation retry twice: each is claimed in the run's state before it is submitted, and a collect whose client has gone away stops polling and submits nothing further. Submit prices the run from the collected file sizes against the model's live per-token pricing (cached 24h) and refuses when the estimate exceeds `max_cost` — $1.00 unless the config or the call sets another value, `0` for no limit — unless `force: true` is passed — a pre-flight estimate, not a runtime stop. Actual spend lands in each run's `run-meta.json`.
 
 Repository defaults live in `.codecarto/broadside/config.yaml` (`model`, `api_key`, `default_lenses`, `max_cost`, `pricing` overrides, `lens_models`, `incremental`, `retry_truncated`, `include_synthesis`, `include_triage`, `wait_seconds`); an explicit tool parameter always wins. `lens_models` routes individual lenses to their own batch model — a stronger model changes security and defect findings far more than it changes an architecture map — and each override is priced, capability-checked, and clamped exactly like the default, with the estimate broken out per lens so a mixed-model run cannot be approved without seeing which lens costs what. CodeCartographer ships no stronger default: which model earns its price depends on your repository and budget, so compare candidates with the `models` action and choose — for one run with the `model` and `lens_models` parameters (Pi: `--model=ID`, `--lens-model=LENS:ID`), or for the repository in `config.yaml`. The `models` listing is advisory: OpenRouter's catalog returns a `:batch` id for some models its Batch API then refuses (`does not have a :batch endpoint`), at no cost, and nothing in the catalog tells them apart — so the listing tags the ids this repository's own submits have seen accepted or refused, and a refused lens says why in the submit report. `codecarto_skill {cwd, name: "broadside"}` returns the reading guide for a completed run, and unlike post-pipeline skills it is not gated on a finished pipeline.
 

package/dist/core/broadside.d.ts

@@ -137,31 +137,43 @@ export type BroadsideReasoning = {
     max_tokens?: number;
 };
 /**
- * The share of a lens's output budget reasoning may spend.
+ * The reasoning control every lens request carries: low effort.
  *
- * `estimateCost` already budgets output at 75% of `maxTokens`; capping thinking
- * at the remaining quarter makes that assumption true by construction and
- * guarantees the answer has room. A floor keeps the cap sane for a small lens.
+ * It used to be a token cap — `max_tokens` at a quarter of the lens's output
+ * budget, so three quarters stayed for the answer. Measured live on
+ * `google/gemini-3.8-flash:batch` (0.22.0 verification, defect lens, cap
+ * 5,800 of a 6,000 budget): the model reasoned 5,218 tokens on the first
+ * pass and **11,518 under the same cap** on the doubled-budget retry —
+ * thinking scaled with `max_tokens` and the cap changed nothing, both
+ * results truncated, and the retry cost twice the original for no JSON.
+ * The same lens with `effort: "low"` reasoned 0 tokens, finished with
+ * `stop`, returned valid JSON, and cost a twelfth as much. Gemini 3.x
+ * models take a thinking *level*, not a budget, and OpenRouter forwards a
+ * `max_tokens` cap to them as nothing at all; `effort` is what it can
+ * translate for every provider (a level where the provider has levels, a
+ * fraction of the budget where it takes a budget). So the default asks for
+ * little thinking in the one vocabulary that reaches everyone.
+ *
+ * Deliberately not `enabled: false`: `google/gemini-3.8-flash:batch` refuses
+ * the whole batch with *"Reasoning is mandatory for this endpoint and cannot
+ * be disabled"*, turning a partial result into none at all. Low effort works
+ * whether or not a provider allows reasoning to be switched off.
  */
-export declare const BROADSIDE_REASONING_BUDGET_FRACTION = 0.25;
-export declare const BROADSIDE_MIN_REASONING_TOKENS = 512;
+export declare const BROADSIDE_DEFAULT_REASONING: Readonly<BroadsideReasoning>;
+/** The reasoning control a lens request carries when config.yaml sets none. */
+export declare function defaultReasoningFor(): BroadsideReasoning;
 /**
- * Cap reasoning for a lens request — deliberately a cap, not an off switch.
- *
- * Disabling outright is not portable: `google/gemini-3.8-flash:batch` refuses
- * the whole batch with *"Reasoning is mandatory for this endpoint and cannot be
- * disabled"*, turning a partial result into none at all. Capping works whether
- * or not a provider allows reasoning to be switched off.
+ * The reasoning control a truncated slice is re-submitted with.
  *
- * The failure this prevents is the budget being spent thinking rather than
- * answering. Measured on one run: 5,758 of a 6,000-token budget went to
- * reasoning, leaving ~230 tokens for JSON that truncated mid-structure — and
- * those tokens bill at the full output rate. The shipped default model does the
- * same thing less consistently (reasoning tokens from 0 to 5,757 across 13
- * slices, three of them cut off at `finish_reason: length`), so this is not a
- * multi-model concern.
+ * A truncation on a reasoning-capable model is usually thinking that ate the
+ * answer's budget, and doubling `max_tokens` doubles the thinking where the
+ * provider ignores a token cap (see {@link BROADSIDE_DEFAULT_REASONING}). The
+ * retry therefore asks for low effort as well, replacing a `max_tokens` cap
+ * (OpenRouter refuses a request carrying both) and lowering a higher effort.
+ * An explicit `enabled: false` and an effort already at or below low are left
+ * as they are.
  */
-export declare function defaultReasoningFor(maxTokens: number): BroadsideReasoning;
+export declare function retryReasoningFor(original: BroadsideReasoning | undefined): BroadsideReasoning;
 export type BatchRequest = {
     custom_id: string;
     body: {
@@ -189,6 +201,8 @@ export type BroadsideBatchEntry = {
     cost?: number;
     resultCount?: number;
     error?: unknown;
+    /** Why a `skipped` lens had nothing to submit: the globs that matched no file. */
+    reason?: string;
     /** Set when this lens used a model other than the run default. */
     model?: string;
     /** The completion ceiling of this lens's model; bounds the truncation retry. */
@@ -216,7 +230,24 @@ export type BroadsideTriageEntry = {
     batchId?: string;
     status: "pending" | "submitted" | "completed" | "failed";
     cost?: number;
+    error?: string;
+};
+/** The truncation retry pass of one run: one batch per model (#206). */
+export type BroadsideRetryEntry = {
+    status: "submitted" | "completed" | "failed";
+    batches: Array<{
+        model: string;
+        batchId: string;
+    }>;
+    /** When the owning collect claimed the pass (#322). */
+    claimedAt: string;
 };
+/**
+ * The parts of a run that cost money to submit and that exactly one collect
+ * may own: the two post-passes and the truncation retry (#322).
+ */
+export type BroadsideRunSlot = "synthesis" | "triage" | "retry";
+export declare const BROADSIDE_RUN_SLOTS: readonly BroadsideRunSlot[];
 export type BroadsideRun = {
     id: string;
     createdAt: string;
@@ -227,6 +258,11 @@ export type BroadsideRun = {
     batches: Partial<Record<BroadsideLensId, BroadsideBatchEntry>>;
     synthesis: BroadsideSynthesisEntry;
     triage: BroadsideTriageEntry;
+    /**
+     * The truncation retry pass (#133), recorded so that two collects on one
+     * run cannot both submit it (#322). Absent until a collect claims it.
+     */
+    retry?: BroadsideRetryEntry;
     totalCost?: number;
     pricing?: ModelPricing;
     maxCost?: number;
@@ -424,6 +460,8 @@ export type BroadsideCollectResult = {
     truncatedCount: number;
     /** Truncated slices recovered by the automatic re-submit pass (#133). */
     retriedCount: number;
+    /** Another collect on this run owns the retry pass; its result lands on a later collect (#322). */
+    retryElsewhere?: boolean;
     lensOutcomes: Partial<Record<BroadsideLensId, {
         status: string;
         cost?: number;
@@ -541,6 +579,35 @@ export declare function updateBroadsideStateAtomically(broadsideDir: string, mut
  * restored the next time its own operation checkpoints.
  */
 export declare function persistBroadsideRun(broadsideDir: string, run: BroadsideRun): Promise<BroadsideStateFile>;
+/**
+ * Record a collect's view of its run, keeping whatever is further along on
+ * disk (#322).
+ *
+ * Two collects on one run each hold the run in memory and each used to write
+ * the whole thing back, so the last writer replaced the other's post-pass
+ * entries with its own — and both had submitted their own post-passes, since
+ * each decided from the copy it loaded at entry. This writer merges slot by
+ * slot: a post-pass or retry entry that is further along on disk (claimed
+ * over pending, submitted over claimed, settled over submitted) wins and is
+ * copied into `run`, so the caller reports what is true; a lens entry never
+ * goes backwards from terminal to polling. A tie keeps this collect's copy,
+ * so the collect that settled a pass records its cost. Submitting is guarded
+ * separately by {@link claimRunSlot}.
+ */
+export declare function persistBroadsideRunMerging(broadsideDir: string, run: BroadsideRun): Promise<BroadsideStateFile>;
+/**
+ * Claim one spending slot of a run for this collect (#322).
+ *
+ * Read-modify-write under the state lock: if the slot on disk is still
+ * unclaimed (`pending`, or absent for the retry), it is marked `submitted`
+ * with no batch id *before* any network call and `true` comes back — this
+ * collect owns it and may submit. Otherwise another collect got there first:
+ * its entry is copied into `run` and `false` comes back. An adopted entry
+ * with a batch id can be polled (polling is idempotent); one without an id
+ * is a claim whose owner has not recorded the id yet, and is reported as in
+ * flight elsewhere.
+ */
+export declare function claimRunSlot(broadsideDir: string, run: BroadsideRun, slot: BroadsideRunSlot): Promise<boolean>;
 export declare function loadBroadsideConfig(broadsideDir: string): Promise<BroadsideConfig>;
 /** The shipped defaults: what an absent config.yaml means. */
 export declare function defaultBroadsideConfig(): BroadsideConfig;
@@ -610,6 +677,12 @@ export declare function pollBatchUntilTerminal(batchId: string, apiKey: string,
     onStatus?: (status: string, counts: Record<string, unknown>) => void;
     fetcher?: FetchLike;
     pollIntervalMs?: number;
+    /**
+     * Stops polling early with the same synthetic `timeout` a spent budget
+     * returns: the batch keeps running server-side and a later collect
+     * claims it. The MCP server aborts when its client disconnects (#322).
+     */
+    signal?: AbortSignal;
 }): Promise<Record<string, unknown>>;
 /**
  * Poll several batch ids in parallel against one shared deadline. Collect
@@ -625,6 +698,7 @@ export declare function pollBatchesConcurrently(entries: Array<{
     deadlineMs?: number;
     fetcher?: FetchLike;
     pollIntervalMs?: number;
+    signal?: AbortSignal;
     onStatus?: (lensId: string, status: string, counts: Record<string, unknown>) => void;
 }): Promise<Map<string, Record<string, unknown>>>;
 export declare function runBroadsideSubmit(cwd: string, apiKey: string, opts?: {
@@ -699,11 +773,20 @@ export declare function runBroadsideCollect(cwd: string, apiKey: string, opts?:
      * once a newer submit existed (#268). `status` lists the ids.
      */
     runId?: string;
+    /**
+     * Stops polling and submits nothing further once fired; what was
+     * already submitted keeps running server-side for a later collect to
+     * claim. The MCP server fires it when its client disconnects (#322).
+     */
+    signal?: AbortSignal;
+    /** Poll cadence override; tests drive the loop faster than 15 s. */
+    pollIntervalMs?: number;
 }): Promise<BroadsideCollectResult>;
 export declare function runBroadsideStatus(cwd: string): Promise<{
     state: BroadsideStateFile;
 }>;
 export declare function renderFindingsMarkdown(content: string): string;
+export declare function describeIncrementalFallback(reason: BroadsideIncrementalOutcome["reason"]): string;
 export declare function estimateSubmitText(result: BroadsideSubmitResult, lenses: LensDefinition[]): string;
 export declare function modelsText(entries: CatalogEntry[], opts: {
     benchmarks: CodingBenchmarks | null;
@@ -724,5 +807,12 @@ export declare function modelsText(entries: CatalogEntry[], opts: {
  */
 export declare function explainBatchError(error: unknown): string | null;
 export declare function collectResultText(result: BroadsideCollectResult): string;
+/**
+ * An `onStatus` callback that appends one line to `lines` per *change* of a
+ * lens's polled status. Every poll used to append a line, so a four-minute
+ * wait returned twenty-six identical "in_progress (0/1)" lines per lens
+ * before the result (0.22.0 live run).
+ */
+export declare function statusLineWriter(lines: string[]): (lensId: string, status: string, counts: Record<string, unknown>) => void;
 export declare function statusText(state: BroadsideStateFile): string;
 export {};

package/dist/core/broadside.js

@@ -94,33 +94,53 @@ export const BROADSIDE_DEFAULT_POLL_BUDGET_MS = 25 * 60 * 1000;
  */
 export const BROADSIDE_DEFAULT_MAX_COST = 1;
 /**
- * The share of a lens's output budget reasoning may spend.
+ * The reasoning control every lens request carries: low effort.
  *
- * `estimateCost` already budgets output at 75% of `maxTokens`; capping thinking
- * at the remaining quarter makes that assumption true by construction and
- * guarantees the answer has room. A floor keeps the cap sane for a small lens.
+ * It used to be a token cap — `max_tokens` at a quarter of the lens's output
+ * budget, so three quarters stayed for the answer. Measured live on
+ * `google/gemini-3.8-flash:batch` (0.22.0 verification, defect lens, cap
+ * 5,800 of a 6,000 budget): the model reasoned 5,218 tokens on the first
+ * pass and **11,518 under the same cap** on the doubled-budget retry —
+ * thinking scaled with `max_tokens` and the cap changed nothing, both
+ * results truncated, and the retry cost twice the original for no JSON.
+ * The same lens with `effort: "low"` reasoned 0 tokens, finished with
+ * `stop`, returned valid JSON, and cost a twelfth as much. Gemini 3.x
+ * models take a thinking *level*, not a budget, and OpenRouter forwards a
+ * `max_tokens` cap to them as nothing at all; `effort` is what it can
+ * translate for every provider (a level where the provider has levels, a
+ * fraction of the budget where it takes a budget). So the default asks for
+ * little thinking in the one vocabulary that reaches everyone.
+ *
+ * Deliberately not `enabled: false`: `google/gemini-3.8-flash:batch` refuses
+ * the whole batch with *"Reasoning is mandatory for this endpoint and cannot
+ * be disabled"*, turning a partial result into none at all. Low effort works
+ * whether or not a provider allows reasoning to be switched off.
  */
-export const BROADSIDE_REASONING_BUDGET_FRACTION = 0.25;
-export const BROADSIDE_MIN_REASONING_TOKENS = 512;
+export const BROADSIDE_DEFAULT_REASONING = Object.freeze({ effort: "low" });
+/** The reasoning control a lens request carries when config.yaml sets none. */
+export function defaultReasoningFor() {
+    return { ...BROADSIDE_DEFAULT_REASONING };
+}
 /**
- * Cap reasoning for a lens request — deliberately a cap, not an off switch.
- *
- * Disabling outright is not portable: `google/gemini-3.8-flash:batch` refuses
- * the whole batch with *"Reasoning is mandatory for this endpoint and cannot be
- * disabled"*, turning a partial result into none at all. Capping works whether
- * or not a provider allows reasoning to be switched off.
+ * The reasoning control a truncated slice is re-submitted with.
  *
- * The failure this prevents is the budget being spent thinking rather than
- * answering. Measured on one run: 5,758 of a 6,000-token budget went to
- * reasoning, leaving ~230 tokens for JSON that truncated mid-structure — and
- * those tokens bill at the full output rate. The shipped default model does the
- * same thing less consistently (reasoning tokens from 0 to 5,757 across 13
- * slices, three of them cut off at `finish_reason: length`), so this is not a
- * multi-model concern.
+ * A truncation on a reasoning-capable model is usually thinking that ate the
+ * answer's budget, and doubling `max_tokens` doubles the thinking where the
+ * provider ignores a token cap (see {@link BROADSIDE_DEFAULT_REASONING}). The
+ * retry therefore asks for low effort as well, replacing a `max_tokens` cap
+ * (OpenRouter refuses a request carrying both) and lowering a higher effort.
+ * An explicit `enabled: false` and an effort already at or below low are left
+ * as they are.
  */
-export function defaultReasoningFor(maxTokens) {
-    return { max_tokens: Math.max(BROADSIDE_MIN_REASONING_TOKENS, Math.floor(maxTokens * BROADSIDE_REASONING_BUDGET_FRACTION)) };
-}
+export function retryReasoningFor(original) {
+    if (original?.enabled === false)
+        return { ...original };
+    if (original?.effort === "minimal" || original?.effort === "low")
+        return { ...original };
+    const { max_tokens: _cap, effort: _effort, ...rest } = original ?? {};
+    return { ...rest, effort: "low" };
+}
+export const BROADSIDE_RUN_SLOTS = ["synthesis", "triage", "retry"];
 /**
  * OpenRouter rejected the API key (HTTP 401/403). Thrown from the catalog
  * lookup rather than swallowed into "could not price" or a silent built-in
@@ -1348,7 +1368,7 @@ export function buildBatchRequest(lens, info, slice, index, sliceCount, model =
             max_tokens: maxTokensOverride ?? lens.maxTokens,
             // Always sent, never inherited: an absent field means the model's
             // own default, and that default is what truncated the JSON.
-            reasoning: reasoningOverride ?? lens.reasoning ?? defaultReasoningFor(maxTokensOverride ?? lens.maxTokens),
+            reasoning: reasoningOverride ?? lens.reasoning ?? defaultReasoningFor(),
         },
     };
 }
@@ -1515,6 +1535,110 @@ export async function persistBroadsideRun(broadsideDir, run) {
             state.runs[index] = run;
     });
 }
+/** Where a lens batch entry stands, for keeping the more advanced of two. */
+function batchEntryRank(entry) {
+    if (!entry)
+        return -1;
+    if (BROADSIDE_TERMINAL_ENTRY_STATUSES.includes(entry.status))
+        return 2;
+    if (entry.batchId)
+        return 1;
+    return 0;
+}
+/** Where a post-pass entry stands: unclaimed, claimed, submitted, settled. */
+function passEntryRank(entry) {
+    if (!entry || entry.status === "pending")
+        return 0;
+    if (entry.status === "submitted")
+        return entry.batchId ? 2 : 1;
+    return 3;
+}
+/** Where the retry pass stands: absent, claimed, submitted, settled. */
+function retryEntryRank(entry) {
+    if (!entry)
+        return 0;
+    if (entry.status === "submitted")
+        return entry.batches.length > 0 ? 2 : 1;
+    return 3;
+}
+/**
+ * Record a collect's view of its run, keeping whatever is further along on
+ * disk (#322).
+ *
+ * Two collects on one run each hold the run in memory and each used to write
+ * the whole thing back, so the last writer replaced the other's post-pass
+ * entries with its own — and both had submitted their own post-passes, since
+ * each decided from the copy it loaded at entry. This writer merges slot by
+ * slot: a post-pass or retry entry that is further along on disk (claimed
+ * over pending, submitted over claimed, settled over submitted) wins and is
+ * copied into `run`, so the caller reports what is true; a lens entry never
+ * goes backwards from terminal to polling. A tie keeps this collect's copy,
+ * so the collect that settled a pass records its cost. Submitting is guarded
+ * separately by {@link claimRunSlot}.
+ */
+export async function persistBroadsideRunMerging(broadsideDir, run) {
+    return updateBroadsideStateAtomically(broadsideDir, (state) => {
+        const index = state.runs.findIndex((candidate) => candidate.id === run.id);
+        const onDisk = index === -1 ? undefined : state.runs[index];
+        if (onDisk) {
+            if (passEntryRank(onDisk.synthesis) > passEntryRank(run.synthesis))
+                run.synthesis = onDisk.synthesis;
+            if (passEntryRank(onDisk.triage) > passEntryRank(run.triage))
+                run.triage = onDisk.triage;
+            if (retryEntryRank(onDisk.retry) > retryEntryRank(run.retry))
+                run.retry = onDisk.retry;
+            for (const [lensId, theirs] of Object.entries(onDisk.batches)) {
+                if (theirs && batchEntryRank(theirs) > batchEntryRank(run.batches[lensId]))
+                    run.batches[lensId] = theirs;
+            }
+        }
+        if (index === -1)
+            state.runs.push(run);
+        else
+            state.runs[index] = run;
+    });
+}
+/**
+ * Claim one spending slot of a run for this collect (#322).
+ *
+ * Read-modify-write under the state lock: if the slot on disk is still
+ * unclaimed (`pending`, or absent for the retry), it is marked `submitted`
+ * with no batch id *before* any network call and `true` comes back — this
+ * collect owns it and may submit. Otherwise another collect got there first:
+ * its entry is copied into `run` and `false` comes back. An adopted entry
+ * with a batch id can be polled (polling is idempotent); one without an id
+ * is a claim whose owner has not recorded the id yet, and is reported as in
+ * flight elsewhere.
+ */
+export async function claimRunSlot(broadsideDir, run, slot) {
+    let owned = false;
+    const claimedAt = new Date().toISOString();
+    await updateBroadsideStateAtomically(broadsideDir, (state) => {
+        const index = state.runs.findIndex((candidate) => candidate.id === run.id);
+        const onDisk = index === -1 ? undefined : state.runs[index];
+        const theirs = onDisk?.[slot];
+        const unclaimed = slot === "retry" ? theirs === undefined : theirs?.status === "pending";
+        if (onDisk && !unclaimed) {
+            run[slot] = theirs;
+            owned = false;
+            return;
+        }
+        owned = true;
+        if (slot === "retry") {
+            run.retry = { status: "submitted", batches: [], claimedAt };
+        }
+        else {
+            run[slot] = { ...run[slot], status: "submitted", batchId: undefined };
+        }
+        if (!onDisk) {
+            state.runs.push(run);
+        }
+        else {
+            onDisk[slot] = run[slot];
+        }
+    });
+    return owned;
+}
 /** Read a `reasoning:` block from config.yaml, ignoring anything malformed. */
 function parseReasoningConfig(raw) {
     if (raw === false)
@@ -1549,6 +1673,21 @@ export async function loadBroadsideConfig(broadsideDir) {
                 throw new BroadsideConfigError(configPath, "is not a YAML mapping");
             raw = parsed;
         }
+        // OpenRouter accepts `reasoning.effort` or `reasoning.max_tokens`, not
+        // both: a request carrying both is refused per request *after* the batch
+        // is accepted, so every lens fails at $0 with the reason in each
+        // result's error. Seen live on 0.22.0 with the two keys set together.
+        // Refuse here, where the file can be fixed, rather than submit a run
+        // that cannot produce a result.
+        const reasoning = raw.reasoning;
+        if (reasoning && typeof reasoning === "object" && !Array.isArray(reasoning)) {
+            const value = reasoning;
+            const hasEffort = typeof value.effort === "string";
+            const hasBudget = typeof value.max_tokens === "number" && value.max_tokens > 0;
+            if (hasEffort && hasBudget) {
+                throw new BroadsideConfigError(configPath, 'sets both reasoning.effort and reasoning.max_tokens; OpenRouter accepts one or the other ("Only one of reasoning.effort and reasoning.max_tokens can be specified"), and every lens request would fail after the batch is accepted. Keep one');
+            }
+        }
     }
     return buildBroadsideConfig(raw);
 }
@@ -1991,6 +2130,8 @@ export async function pollBatchUntilTerminal(batchId, apiKey, opts = {}) {
         ...(lastError && sawBatch && { last_error: lastError }),
     });
     for (;;) {
+        if (opts.signal?.aborted)
+            return { ...timedOut(), aborted: true };
         let batch;
         try {
             batch = await fetchBatch(batchId, apiKey, fetcher);
@@ -2023,8 +2164,26 @@ export async function pollBatchUntilTerminal(batchId, apiKey, opts = {}) {
             return batch;
         if (Date.now() >= deadline)
             return timedOut();
-        await sleep(intervalMs);
-    }
+        await sleepUnlessAborted(intervalMs, opts.signal);
+    }
+}
+/** Sleep, but wake at once when the signal fires so an abort is not a poll interval late. */
+function sleepUnlessAborted(ms, signal) {
+    if (!signal)
+        return sleep(ms);
+    if (signal.aborted)
+        return Promise.resolve();
+    return new Promise((resolve) => {
+        const timer = setTimeout(() => {
+            signal.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        const onAbort = () => {
+            clearTimeout(timer);
+            resolve();
+        };
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
 }
 /**
  * Poll several batch ids in parallel against one shared deadline. Collect
@@ -2041,6 +2200,7 @@ export async function pollBatchesConcurrently(entries, apiKey, opts = {}) {
             deadlineMs,
             fetcher: opts.fetcher,
             pollIntervalMs: opts.pollIntervalMs,
+            signal: opts.signal,
             onStatus: (status, counts) => opts.onStatus?.(lensId, status, counts),
         });
         results.set(batchId, batch);
@@ -2132,6 +2292,8 @@ export async function runBroadsideSubmit(cwd, apiKey, opts = {}) {
     }
     // Slice offline first so the estimate covers every request we would send.
     const slicesByLens = new Map();
+    // Why a lens ended up with nothing to submit, for the report (see below).
+    const skipReasons = new Map();
     let estimatedInputTokens = 0;
     let estimatedOutputTokens = 0;
     let estimatedTotalCost = 0;
@@ -2149,12 +2311,21 @@ export async function runBroadsideSubmit(cwd, apiKey, opts = {}) {
             for (const file of slice.redactedFiles ?? [])
                 redactedFiles.add(file);
         }
+        const matchedBeforeIncremental = slices.length;
         if (changed) {
             // Repo-info slices (empty files, e.g. architecture) always run;
             // file-backed slices run only when one of their files changed.
             slices = slices.filter((s) => s.files.length === 0 || s.files.some((f) => changed.has(f)));
         }
         slicesByLens.set(lensId, slices);
+        if (slices.length === 0) {
+            const globs = lens.globsFor(info).filter(Boolean);
+            skipReasons.set(lensId, globs.length === 0
+                ? "the lens has no file patterns for this language"
+                : matchedBeforeIncremental > 0
+                    ? "incremental: none of this lens's files changed since the previous run"
+                    : `no files matched ${globs.join(", ")}${lens.skipTestFiles ? " (test files excluded)" : ""}`);
+        }
         const lensModel = modelForLens(lensId);
         const { pricing: lensPricing, outputCap: lensOutputCap } = resolved.get(lensModel);
         const maxTokens = lensOutputCap ? Math.min(lens.maxTokens, lensOutputCap) : lens.maxTokens;
@@ -2263,7 +2434,15 @@ export async function runBroadsideSubmit(cwd, apiKey, opts = {}) {
         if (requests.length === 0) {
             // No files matched the lens's globs. That is a coverage gap to
             // report, not a batch to submit — the API rejects empty batches.
+            // Name the globs: a JavaScript service whose server lives at
+            // src/server.js gets no security review (that lens reads server/**,
+            // **/auth*, **/middleware/**), and "skipped (0 request(s))" alone
+            // read as an empty repository rather than a lens that looked in
+            // the wrong place.
             entry.status = "skipped";
+            const reason = skipReasons.get(lensId);
+            if (reason)
+                entry.reason = reason;
             continue;
         }
         submissions.push((async () => {
@@ -2284,6 +2463,12 @@ export async function runBroadsideSubmit(cwd, apiKey, opts = {}) {
         })());
     }
     await Promise.allSettled(submissions);
+    // A run with no batch behind it has nothing in flight. Every lens was
+    // skipped or refused, so no poll will ever complete it; leaving it
+    // "in-flight" had status listing a refused run above the completed ones
+    // with synthesis and triage "pending" forever.
+    if (!Object.values(run.batches).some((entry) => entry.batchId))
+        run.status = "failed";
     await persistBroadsideRun(broadsideDir, run);
     // What the provider just said about each model's batch endpoint outlives
     // the run: the `models` action reads it back (#141).
@@ -2547,6 +2732,12 @@ export async function runBroadsideCollect(cwd, apiKey, opts = {}) {
     }
     const runDir = join(broadsideDir, run.outputDir);
     await mkdir(runDir, { recursive: true });
+    // The spending slots this collect has claimed (#322); only a claimed slot
+    // is ever submitted from here. Every write-back merges with the file, so a
+    // slot another collect has moved further along is never overwritten.
+    const owned = new Set();
+    const persist = () => persistBroadsideRunMerging(broadsideDir, run);
+    const aborted = () => opts.signal?.aborted === true;
     const deadline = Date.now() + (opts.waitMs ?? BROADSIDE_DEFAULT_POLL_BUDGET_MS);
     let totalCost = 0;
     let resultCount = 0;
@@ -2574,6 +2765,8 @@ export async function runBroadsideCollect(cwd, apiKey, opts = {}) {
     const polled = await pollBatchesConcurrently(inFlight, apiKey, {
         deadlineMs: Math.max(0, deadline - Date.now()),
         fetcher: opts.fetcher,
+        pollIntervalMs: opts.pollIntervalMs,
+        signal: opts.signal,
         onStatus: opts.onStatus,
     });
     for (const { lensId } of inFlight) {
@@ -2623,11 +2816,14 @@ export async function runBroadsideCollect(cwd, apiKey, opts = {}) {
             const error = explainBatchError(batch.error);
             lensOutcomes[lensId] = { status, cost: entry.cost, resultCount: entry.resultCount, ...(error && { error }) };
         }
-        await persistBroadsideRun(broadsideDir, run);
+        await persist();
     }
-    // #133: re-submit truncated slices once with a bumped output cap. Batch
-    // requests are pure, so re-running is always safe; the aim is to recover
-    // coverage the first pass lost to a max_tokens cutoff, not to loop forever.
+    // #133: re-submit truncated slices once with a bumped output cap and low
+    // reasoning effort. Batch requests are pure, so re-running is always safe;
+    // the aim is to recover coverage the first pass lost to a max_tokens
+    // cutoff, not to loop forever. Low effort because the cutoff is usually
+    // thinking, and a doubled budget doubled the thinking where a token cap
+    // was ignored (see retryReasoningFor).
     //
     // All bumped requests for one model go out as ONE batch, and the batches
     // (one per model, since a batch carries a single model) are polled
@@ -2638,7 +2834,36 @@ export async function runBroadsideCollect(cwd, apiKey, opts = {}) {
     // lens pass, still present here (#206). Grouping also keeps the retry to
     // one job per model against OpenRouter's 16-concurrent-job quota.
     let retriedCount = 0;
-    if (opts.retryTruncated !== false && truncatedCount > 0) {
+    let retryElsewhere = false;
+    // A collect that polled nothing — every lens already terminal — still owes
+    // the retry if the collect that saved the results never got to it (it
+    // died, or its client did: #322). Read the saved results back and let the
+    // claim decide; a recovered slice re-parses clean, so this costs nothing
+    // once the retry has run.
+    if (opts.retryTruncated !== false && allLensResults.length === 0 && !aborted()) {
+        const everyLensTerminal = run.lenses.every((lensId) => {
+            const entry = run.batches[lensId];
+            return entry && BROADSIDE_TERMINAL_ENTRY_STATUSES.includes(entry.status);
+        });
+        if (everyLensTerminal) {
+            const restored = await loadSavedLensResults(runDir, run.lenses);
+            if (restored.some((s) => s.truncated)) {
+                allLensResults.push(...restored);
+                truncatedCount = restored.filter((s) => s.truncated).length;
+            }
+        }
+    }
+    if (opts.retryTruncated !== false && truncatedCount > 0 && !aborted()) {
+        // Claim the pass before spending: a second collect on this run finds the
+        // claim and leaves the retry to the first (#322). A retry another
+        // collect has already settled is not run again — its truncation is
+        // what it is.
+        if (await claimRunSlot(broadsideDir, run, "retry"))
+            owned.add("retry");
+        else if (run.retry?.status === "submitted")
+            retryElsewhere = true;
+    }
+    if (opts.retryTruncated !== false && truncatedCount > 0 && owned.has("retry")) {
         const requestsByCustomId = await loadStoredRequests(runDir);
         const byModel = new Map();
         for (const stored of allLensResults) {
@@ -2658,13 +2883,18 @@ export async function runBroadsideCollect(cwd, apiKey, opts = {}) {
             if (bumpedMax <= previousMax)
                 continue; // already at the ceiling
             const group = byModel.get(lensModel) ?? { requests: [], slices: new Map() };
-            group.requests.push({ ...original, body: { ...original.body, max_tokens: bumpedMax } });
+            group.requests.push({
+                ...original,
+                body: { ...original.body, max_tokens: bumpedMax, reasoning: retryReasoningFor(original.body.reasoning) },
+            });
             group.slices.set(stored.customId, stored);
             byModel.set(lensModel, group);
         }
         // Submit every group, then poll whatever was accepted, together.
         const submitted = [];
         for (const [model, group] of byModel) {
+            if (aborted())
+                break;
             try {
                 const { batchId, error } = await submitBatch(group.requests, apiKey, opts.fetcher, model);
                 if (!error && batchId)
@@ -2675,6 +2905,15 @@ export async function runBroadsideCollect(cwd, apiKey, opts = {}) {
                 // truncated results in place — nothing is lost.
             }
         }
+        // Record the ids under the claim so a later collect can see what was
+        // paid for, even if this one never returns. No group at all means every
+        // truncated slice was already at its model's ceiling: nothing to retry.
+        run.retry = {
+            ...run.retry,
+            batches: submitted,
+            status: submitted.length > 0 ? "submitted" : byModel.size === 0 ? "completed" : "failed",
+        };
+        await persist();
         const polled = await pollBatchesConcurrently(submitted.map(({ model, batchId }) => ({ lensId: `retry:${model}`, batchId })), apiKey, {
             // Share the caller's deadline. Each of these polls used to start a
             // fresh 25-minute budget, so `wait_seconds` bounded only the lens
@@ -2682,6 +2921,8 @@ export async function runBroadsideCollect(cwd, apiKey, opts = {}) {
             // minutes.
             deadlineMs: Math.max(0, deadline - Date.now()),
             fetcher: opts.fetcher,
+            pollIntervalMs: opts.pollIntervalMs,
+            signal: opts.signal,
             onStatus: opts.onStatus,
         });
         for (const { model, batchId } of submitted) {
@@ -2709,13 +2950,17 @@ export async function runBroadsideCollect(cwd, apiKey, opts = {}) {
                 retriedCount += 1;
             }
         }
+        // Every retry batch reached a terminal status, or the poll ran out.
+        if (submitted.length > 0 && submitted.every(({ batchId }) => polled.get(batchId)?.status === "completed")) {
+            run.retry = { ...run.retry, status: "completed" };
+        }
         truncatedCount = allLensResults.filter((s) => s.truncated).length;
         for (const [lensId, outcome] of Object.entries(lensOutcomes)) {
             if (outcome.truncated !== undefined) {
                 outcome.truncated = allLensResults.filter((s) => s.lensId === lensId && s.truncated).length;
             }
         }
-        await persistBroadsideRun(broadsideDir, run);
+        await persist();
     }
     // Synthesis + triage: cross-lens post-passes, only after every lens batch
     // is terminal. Triage turns the leads into a prioritized work order.
@@ -2754,22 +2999,27 @@ export async function runBroadsideCollect(cwd, apiKey, opts = {}) {
             // Both post-passes consume the same findings; they run as two
             // batches (different response_format schemas cannot share one)
             // submitted together and polled in turn.
-            const passes = [
-                ...(wantSynthesis && run.synthesis.status === "pending"
-                    ? [{
-                            kind: "synthesis",
-                            request: buildSynthesisRequest(findingsText, truncatedNote, run.model),
-                            entry: run.synthesis,
-                        }]
-                    : []),
-                ...(wantTriage && run.triage.status === "pending"
-                    ? [{
-                            kind: "triage",
-                            request: buildTriageRequest(findingsText, truncatedNote, run.model),
-                            entry: run.triage,
-                        }]
-                    : []),
-            ];
+            // Claim each wanted, still-pending pass before building its request:
+            // a second collect on this run adopts the first one's entry instead
+            // of submitting its own (#322). An abort submits nothing further.
+            const passes = [];
+            for (const kind of ["synthesis", "triage"]) {
+                const want = kind === "synthesis" ? wantSynthesis : wantTriage;
+                if (!want || aborted())
+                    continue;
+                if ((kind === "synthesis" ? run.synthesis : run.triage).status !== "pending")
+                    continue;
+                if (!(await claimRunSlot(broadsideDir, run, kind)))
+                    continue;
+                owned.add(kind);
+                passes.push({
+                    kind,
+                    request: kind === "synthesis"
+                        ? buildSynthesisRequest(findingsText, truncatedNote, run.model)
+                        : buildTriageRequest(findingsText, truncatedNote, run.model),
+                    entry: kind === "synthesis" ? run.synthesis : run.triage,
+                });
+            }
             const submitted = new Map();
             // A pass can be left at "submitted" when an earlier collect returned
             // before its batch reached a terminal status — the batch still runs
@@ -2804,16 +3054,22 @@ export async function runBroadsideCollect(cwd, apiKey, opts = {}) {
                     pass.entry.status = "failed";
                 }
             }));
-            await persistBroadsideRun(broadsideDir, run);
+            await persist();
+            // Poll both passes together against the shared deadline. Polled in
+            // turn, the first pass could spend the whole budget and leave the
+            // second a single poll (0.22.1 live run: triage settled, synthesis
+            // left running though it had been submitted at the same moment).
+            // A pass whose poll runs out stays `submitted`, so the batch is
+            // already paid for and a later collect claims its result.
+            const polledPasses = await pollBatchesConcurrently([...submitted.values()].map(({ batchId, pass }) => ({ lensId: pass.kind, batchId })), apiKey, {
+                deadlineMs: Math.max(0, deadline - Date.now()),
+                fetcher: opts.fetcher,
+                pollIntervalMs: opts.pollIntervalMs,
+                signal: opts.signal,
+                onStatus: opts.onStatus,
+            });
             for (const { batchId, pass } of submitted.values()) {
-                const batch = await pollBatchUntilTerminal(batchId, apiKey, {
-                    // Shares the caller's deadline, as the retry poll above does.
-                    // A pass whose poll runs out stays `submitted`, so the batch
-                    // is already paid for and a later collect claims its result.
-                    deadlineMs: Math.max(0, deadline - Date.now()),
-                    onStatus: (status, counts) => opts.onStatus?.(pass.kind, status, counts),
-                    fetcher: opts.fetcher,
-                });
+                const batch = polledPasses.get(batchId) ?? { id: batchId, status: "timeout" };
                 if (batch.status === "completed") {
                     const usage = (batch.usage ?? {});
                     const cost = typeof usage.cost === "number" ? usage.cost : undefined;
@@ -2846,7 +3102,7 @@ export async function runBroadsideCollect(cwd, apiKey, opts = {}) {
                 // A "timeout" is deliberately left at "submitted": the batch is
                 // still running server-side and has already been paid for, so a
                 // later collect should claim its result rather than discard it.
-                await persistBroadsideRun(broadsideDir, run);
+                await persist();
             }
         }
     }
@@ -2856,7 +3112,7 @@ export async function runBroadsideCollect(cwd, apiKey, opts = {}) {
     });
     run.status = terminal ? (resultCount > 0 ? "completed" : "failed") : "partial";
     run.totalCost = totalCost;
-    await persistBroadsideRun(broadsideDir, run);
+    await persist();
     await writeFile(join(runDir, "run-meta.json"), `${JSON.stringify({
         experimental: true,
         method: "Broad-Side (OpenRouter Batch API)",
@@ -2888,6 +3144,7 @@ export async function runBroadsideCollect(cwd, apiKey, opts = {}) {
         resultCount,
         truncatedCount,
         retriedCount,
+        ...(retryElsewhere && { retryElsewhere: true }),
         lensOutcomes,
         synthesis: run.synthesis,
         triage: run.triage,
@@ -2959,7 +3216,7 @@ function parseSynthesisTopFindings(content) {
     }
 }
 // ---------- formatting helpers for tool output ----------
-function describeIncrementalFallback(reason) {
+export function describeIncrementalFallback(reason) {
     switch (reason) {
         case "dirty-worktree":
             return "the working tree has uncommitted changes, so there is no committed state to diff against";
@@ -2993,8 +3250,13 @@ export function estimateSubmitText(result, lenses) {
         const override = entry.model ? ` on ${entry.model}` : "";
         // A rejected lens says why: the message is the only way to tell a
         // catalog id with no batch endpoint from a full job quota, and both
-        // used to read as a bare "rejected".
-        const reason = !entry.batchId && entry.error ? ` — ${explainBatchError(entry.error)}` : "";
+        // used to read as a bare "rejected". A skipped lens names the globs
+        // that matched nothing.
+        const reason = !entry.batchId && entry.error
+            ? ` — ${explainBatchError(entry.error)}`
+            : !entry.batchId && entry.reason
+                ? ` — ${entry.reason}`
+                : "";
         lines.push(`  ${lens.name}: ${status} (${entry.requests} request(s), ~$${entry.estimatedCost.toFixed(4)})${override}${reason}`);
     }
     if (result.repo) {
@@ -3150,9 +3412,24 @@ export function collectResultText(result) {
     if (result.retriedCount > 0) {
         lines.push(`  ↻ ${result.retriedCount} truncated result(s) recovered by re-submission with a doubled output cap.`);
     }
+    if (result.retryElsewhere) {
+        lines.push("  ↻ The truncation retry is in flight in another collect on this run; collect again for its result.");
+    }
     if (result.truncatedCount > 0) {
         lines.push(`  ⚠ ${result.truncatedCount} result(s) still truncated after retry — their modules are unscouted, not clean.`);
     }
+    // A pass still in flight or retired must appear: a run reported
+    // "completed" with no synthesis line read as "no synthesis was run",
+    // when the batch was running and a later collect would have claimed it
+    // (0.22.1 live run — the collect's wait ran out during the pass).
+    const passInFlight = (kind, entry) => {
+        if (entry.status === "submitted") {
+            lines.push(`  ${kind}: ${entry.batchId ? "still running" : "in flight in another collect"} — collect again for its result.`);
+        }
+        else if (entry.status === "failed") {
+            lines.push(`  ${kind}: failed${entry.error ? ` — ${explainBatchError(entry.error)}` : ""}`);
+        }
+    };
     if (result.synthesis.status === "completed") {
         lines.push(`  synthesis: completed, $${(result.synthesis.cost ?? 0).toFixed(6)}`);
         if (result.topFindings.length > 0) {
@@ -3162,6 +3439,9 @@ export function collectResultText(result) {
             }
         }
     }
+    else {
+        passInFlight("synthesis", result.synthesis);
+    }
     if (result.triage.status === "completed") {
         lines.push(`  triage: completed, $${(result.triage.cost ?? 0).toFixed(6)}`);
         if (result.topTriageItems.length > 0) {
@@ -3172,12 +3452,28 @@ export function collectResultText(result) {
             }
         }
     }
-    else if (result.triage.status === "failed") {
-        lines.push("  triage: failed");
+    else {
+        passInFlight("triage", result.triage);
     }
     lines.push("", "Disclaimer: Broad-Side findings are unverified scouting signals from a batch model, not validated claims.");
     return lines.join("\n");
 }
+/**
+ * An `onStatus` callback that appends one line to `lines` per *change* of a
+ * lens's polled status. Every poll used to append a line, so a four-minute
+ * wait returned twenty-six identical "in_progress (0/1)" lines per lens
+ * before the result (0.22.0 live run).
+ */
+export function statusLineWriter(lines) {
+    const last = new Map();
+    return (lensId, status, counts) => {
+        const line = `  ${lensId}: ${status} (${counts.completed ?? 0}/${counts.total ?? "?"})`;
+        if (last.get(lensId) === line)
+            return;
+        last.set(lensId, line);
+        lines.push(line);
+    };
+}
 export function statusText(state) {
     if (state.runs.length === 0) {
         return "No Broad-Side runs recorded. Call codecarto_broadside with action 'submit' first.";
@@ -3195,7 +3491,8 @@ export function statusText(state) {
             const entry = run.batches[lensId];
             if (!entry)
                 continue;
-            lines.push(`  ${lensId}: ${entry.status}${entry.batchId ? ` (${entry.batchId})` : ""}${entry.cost !== undefined ? `, $${entry.cost.toFixed(6)}` : ""}`);
+            lines.push(`  ${lensId}: ${entry.status}${entry.batchId ? ` (${entry.batchId})` : ""}${entry.cost !== undefined ? `, $${entry.cost.toFixed(6)}` : ""}` +
+                (entry.status === "skipped" && entry.reason ? ` — ${entry.reason}` : ""));
         }
         lines.push(`  synthesis: ${run.synthesis.status}`);
         lines.push(`  triage: ${run.triage?.status ?? "pending"}`);

package/dist/extensions/codecarto/index.js

@@ -9,7 +9,7 @@ import { parseNextFlags } from "./next-flags.js";
 import { buildPiGuideMessage } from "./guide-framing.js";
 import { isCtxLive, notifyCtx } from "./notify.js";
 import { phaseCompactionExtension } from "./phase-compaction.js";
-import { applyAmendment, buildPhasePrompt, buildSkillPrompt, buildValidationSummary, backupWorkspaceState, canonicalPath, copyPackagedWorkspace, computePerPhaseTotals, computeTotals, ConfidentialityMismatchError, createEmptyStatus, DEFAULT_PIPELINE_PATH, describeScaffoldStaleness, deriveSlug, discoverLibrary, describeDanglingCarryForward, describeMissingCompletedOutputs, describeStuckPipeline, expandTilde, getPipelineLabel, getWorkspaceState, isWithinPath, resolveExistingPrefix, BROADSIDE_LENS_IDS, BROADSIDE_SKILL_NAME, BroadsideConfigError, defaultBroadsideConfig, BroadsideCancelledError, broadsideDirFor, collectResultText, estimateSubmitText, getLens, listAmendmentNames, listBatchModels, listGuideTopics, listScaffoldRefreshFiles, listMissingCompletedOutputs, listSkillNames, resolvePipelineOutcome, resolveSkillName, loadAmendmentFile, loadBroadsideConfig, modelsText, runBroadsideCollect, runBroadsideStatus, runBroadsideSubmit, statusText, describeConfigProblems, loadCodecartoConfig, loadUsage, loadYamlFile, normalizeForComparison, packagedWorkspaceDir, pathExists, PACKAGE_VERSION, readBroadsideSkill, readGuide, refreshScaffold, PhasePreflightError, PIPELINE_ALIASES, publishEntry, resolvePhase, resolvePipelineChoice, resolvePublishSourceRepo, SourceRepoMismatchError, runPhasePreflight, SCAFFOLD_REFRESH_PROTECTED, seedOrchestratorFiles, stringifySimpleYaml, switchPipeline, validatePhaseOutput, writeLibraryConfig, writeDashboard, } from "../../core/index.js";
+import { applyAmendment, buildPhasePrompt, buildSkillPrompt, buildValidationSummary, backupWorkspaceState, canonicalPath, copyPackagedWorkspace, computePerPhaseTotals, computeTotals, ConfidentialityMismatchError, createEmptyStatus, DEFAULT_PIPELINE_PATH, describeScaffoldStaleness, deriveSlug, discoverLibrary, describeDanglingCarryForward, describeMissingCompletedOutputs, describeStuckPipeline, expandTilde, getPipelineLabel, getWorkspaceState, isWithinPath, resolveExistingPrefix, BROADSIDE_LENS_IDS, BROADSIDE_SKILL_NAME, BroadsideConfigError, defaultBroadsideConfig, BroadsideCancelledError, broadsideDirFor, collectResultText, estimateSubmitText, getLens, listAmendmentNames, listBatchModels, listGuideTopics, listScaffoldRefreshFiles, listMissingCompletedOutputs, listSkillNames, resolvePipelineOutcome, resolveSkillName, loadAmendmentFile, loadBroadsideConfig, modelsText, runBroadsideCollect, runBroadsideStatus, runBroadsideSubmit, statusText, describeConfigProblems, describeIncrementalFallback, loadCodecartoConfig, loadUsage, loadYamlFile, normalizeForComparison, packagedWorkspaceDir, pathExists, PACKAGE_VERSION, readBroadsideSkill, readGuide, refreshScaffold, PhasePreflightError, PIPELINE_ALIASES, publishEntry, resolvePhase, resolvePipelineChoice, resolvePublishSourceRepo, SourceRepoMismatchError, runPhasePreflight, SCAFFOLD_REFRESH_PROTECTED, seedOrchestratorFiles, stringifySimpleYaml, switchPipeline, validatePhaseOutput, writeLibraryConfig, writeDashboard, } from "../../core/index.js";
 import { initLibrary } from "../../core/library.js";
 import { resolveUserConfigPath } from "../../core/orchestrator-config.js";
 const STATUS_WIDGET_ID = "codecarto-widget";
@@ -144,11 +144,14 @@ function describeBroadsideEstimate(estimate) {
             ? `This EXCEEDS the configured max_cost of $${estimate.maxCost.toFixed(2)}. Approving here overrides it for this run.`
             : `Within the configured max_cost of $${estimate.maxCost.toFixed(2)}.`);
     }
-    if (estimate.baseHead) {
-        lines.push(`Incremental: only modules changed since ${estimate.baseHead.slice(0, 8)} are included.`);
-    }
-    else if (estimate.sourceDirty) {
-        lines.push("Incremental was requested but the tree is dirty — this is a full scan.");
+    // Only a requested incremental run has anything to say here. The dialog
+    // used to print "Incremental was requested but the tree is dirty" on every
+    // dirty tree, requested or not — a full scan that nobody asked to shrink
+    // read as a fallback.
+    if (estimate.incremental?.requested) {
+        lines.push(estimate.incremental.applied
+            ? `Incremental: only modules changed since ${(estimate.baseHead ?? "").slice(0, 8)} are included.`
+            : `Incremental was requested but NOT applied — ${describeIncrementalFallback(estimate.incremental.reason)}. This is a full scan.`);
     }
     lines.push("", "The estimate is a pre-flight prediction from file sizes; OpenRouter bills actual usage.");
     return lines.join("\n");
@@ -1114,6 +1117,9 @@ export default function codeCartographerExtension(pi) {
                 const lenses = flags.lenses.length > 0 ? flags.lenses : config.defaultLenses;
                 renderProgress("Slicing the repository and pricing the run…");
                 let submit;
+                // Set when a headless run was refused over max_cost, so the cancel
+                // message says so instead of reading as a user's "no".
+                let headlessRefusal = null;
                 try {
                     submit = await runBroadsideSubmit(ctx.cwd, apiKey, {
                         lenses,
@@ -1128,14 +1134,32 @@ export default function codeCartographerExtension(pi) {
                         incremental: flags.incremental ?? config.incremental,
                         // Pi can ask, so it asks instead of refusing over max_cost the
                         // way MCP has to. An approval here IS the force flag.
-                        confirm: (estimate) => ctx.ui.confirm(`Broad-Side will spend about $${estimate.totalCost.toFixed(4)}`, describeBroadsideEstimate(estimate)),
+                        confirm: (estimate) => {
+                            if (ctx.hasUI) {
+                                return ctx.ui.confirm(`Broad-Side will spend about $${estimate.totalCost.toFixed(4)}`, describeBroadsideEstimate(estimate));
+                            }
+                            // No dialog under `pi -p`: the stub answered "no" to every
+                            // estimate, so a headless submit could never fire. Behave as
+                            // the MCP surface does — an estimate within max_cost is
+                            // approved by the cap itself; one over it is refused, since
+                            // nobody is here to say yes — and print the breakdown either
+                            // way, because the dialog was the only place it showed.
+                            notifyCtx(ctx, describeBroadsideEstimate(estimate), "info");
+                            if (estimate.exceedsLimit) {
+                                headlessRefusal =
+                                    `Broad-Side refused: the estimate ~$${estimate.totalCost.toFixed(4)} exceeds max_cost $${estimate.maxCost.toFixed(2)} ` +
+                                        "and there is no dialog to approve it in a headless run. Raise --max-cost (0 for no limit) or run interactively.";
+                                return false;
+                            }
+                            return true;
+                        },
                     });
                 }
                 catch (error) {
                     if (ctx.hasUI)
                         ctx.ui.setWidget(BROADSIDE_WIDGET_ID, undefined);
                     if (error instanceof BroadsideCancelledError) {
-                        notifyCtx(ctx, "Broad-Side cancelled. Nothing was submitted.", "info");
+                        notifyCtx(ctx, headlessRefusal ?? "Broad-Side cancelled. Nothing was submitted.", headlessRefusal ? "error" : "info");
                         return;
                     }
                     notifyCtx(ctx, `Broad-Side submit failed: ${error instanceof Error ? error.message : String(error)}`, "error");

package/dist/mcp-server/server.js

@@ -17,7 +17,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { CallToolRequestSchema, ErrorCode, ListToolsRequestSchema, McpError, } from "@modelcontextprotocol/sdk/types.js";
 import { mkdir, readFile, readdir, rename, writeFile } from "node:fs/promises";
 import { basename, isAbsolute, join } from "node:path";
-import { buildPhasePrompt, buildSkillPrompt, buildValidationSummary, BROADSIDE_DIR, broadsideDirFor, BROADSIDE_LENS_IDS, BROADSIDE_SKILL_NAME, BroadsideConfigError, defaultBroadsideConfig, backupWorkspaceState, canonicalPath, copyPackagedWorkspace, collectResultText, completeValidatedPhase, computePerPhaseTotals, computeTotals, createEmptyStatus, DEFAULT_PIPELINE_PATH, deriveSlug, discoverLibrary, describeScaffoldStaleness, detectProvenanceConflicts, estimateSubmitText, getLens, describeDanglingCarryForward, describeMissingCompletedOutputs, describeStuckPipeline, getPipelineLabel, getWorkspaceState, isValidSlug, isWithinPathResolved, listBatchModels, listEntries, listGuideTopics, loadBroadsideConfig, modelsText, readGuide, listMissingCompletedOutputs, listSkillNames, resolvePipelineOutcome, resolveSkillName, loadCodecartoConfig, loadUsage, loadYamlFile, normalizeForComparison, PACKAGE_VERSION, packagedWorkspaceDir, pathExists, PhasePreflightError, previewPublishVersion, publishEntry, reindex as libraryReindex, refreshScaffold, resolvePhase, resolvePipelineChoice, readBroadsideSkill, runBroadsideCollect, runBroadsideStatus, runBroadsideSubmit, seedOrchestratorFiles, statusText, stringifySimpleYaml, switchPipeline, validatePhaseOutput, writeLibraryConfig, writeDashboard, } from "../core/index.js";
+import { buildPhasePrompt, buildSkillPrompt, buildValidationSummary, BROADSIDE_DIR, broadsideDirFor, BROADSIDE_LENS_IDS, BROADSIDE_SKILL_NAME, BroadsideConfigError, defaultBroadsideConfig, backupWorkspaceState, canonicalPath, copyPackagedWorkspace, collectResultText, completeValidatedPhase, computePerPhaseTotals, computeTotals, createEmptyStatus, DEFAULT_PIPELINE_PATH, deriveSlug, discoverLibrary, describeScaffoldStaleness, detectProvenanceConflicts, estimateSubmitText, getLens, describeDanglingCarryForward, describeMissingCompletedOutputs, describeStuckPipeline, getPipelineLabel, getWorkspaceState, isValidSlug, isWithinPathResolved, listBatchModels, listEntries, listGuideTopics, loadBroadsideConfig, modelsText, readGuide, listMissingCompletedOutputs, listSkillNames, resolvePipelineOutcome, resolveSkillName, loadCodecartoConfig, loadUsage, loadYamlFile, normalizeForComparison, PACKAGE_VERSION, packagedWorkspaceDir, pathExists, PhasePreflightError, previewPublishVersion, publishEntry, reindex as libraryReindex, refreshScaffold, resolvePhase, resolvePipelineChoice, readBroadsideSkill, runBroadsideCollect, runBroadsideStatus, runBroadsideSubmit, seedOrchestratorFiles, statusLineWriter, statusText, stringifySimpleYaml, switchPipeline, validatePhaseOutput, writeLibraryConfig, writeDashboard, } from "../core/index.js";
 import { applyAmendment } from "../core/amendment.js";
 import { appendUsageRun } from "../core/usage.js";
 import { initLibrary } from "../core/library.js";
@@ -1151,7 +1151,11 @@ export async function handleBroadside(args) {
                 includeSynthesis,
                 includeTriage,
                 retryTruncated,
-                onStatus: (lensId, status, counts) => lines.push(`  ${lensId}: ${status} (${counts.completed ?? 0}/${counts.total ?? "?"})`),
+                signal: serverLifetime?.signal,
+                // One line per *change* of a lens's status. Every poll used to
+                // append a line, so a four-minute wait returned twenty-six
+                // "in_progress (0/1)" lines before the result (0.22.0 live run).
+                onStatus: statusLineWriter(lines),
             }).catch((error) => {
                 // The `collect` action normalizes this same call; without it here,
                 // a failure during submit-with-wait reached the client as an
@@ -1176,6 +1180,7 @@ export async function handleBroadside(args) {
         includeSynthesis,
         includeTriage,
         retryTruncated,
+        signal: serverLifetime?.signal,
         ...(runId && { runId }),
     }).catch((error) => {
         throw new McpError(ErrorCode.InvalidRequest, error instanceof Error ? error.message : String(error));
@@ -1515,7 +1520,7 @@ const TOOLS = [
                 },
                 wait_seconds: {
                     type: "number",
-                    description: "For submit: after submitting, poll up to this many seconds before returning. For collect: poll up to this many seconds before returning with partial state. 0 polls each in-flight batch once and returns without waiting. Falls back to wait_seconds in .codecarto/broadside/config.yaml (default 0).",
+                    description: "For submit: after submitting, poll up to this many seconds before returning. For collect: poll up to this many seconds before returning with partial state. 0 polls each in-flight batch once and returns without waiting. Falls back to wait_seconds in .codecarto/broadside/config.yaml (default 0). The wait is also bounded by the host's own tool-call timeout: if the host gives up first, the server stops polling and submits nothing further, the batches keep running server-side, and the next collect claims them — so prefer submit, then collect later, over a wait longer than the host allows.",
                 },
                 include_synthesis: {
                     type: "boolean",
@@ -1614,8 +1619,27 @@ export function buildServer() {
     });
     return server;
 }
+/**
+ * Fires when the stdio client goes away, so a Broad-Side wait that outlived
+ * the request that asked for it stops polling and submits nothing further
+ * (#322). Batches already accepted keep running server-side; the next collect
+ * claims them. Set only by {@link startStdioServer}; handlers driven directly
+ * (tests, in-process callers) see no signal.
+ */
+let serverLifetime = null;
 export async function startStdioServer() {
     const server = buildServer();
     const transport = new StdioServerTransport();
+    serverLifetime = new AbortController();
+    const lifetime = serverLifetime;
+    server.onclose = () => lifetime.abort();
+    // The SDK's stdio transport listens for stdin `data` and `error` only — it
+    // never sees the end of the stream — so a client that exits mid-request
+    // leaves the server polling with nobody to answer to (#322, observed: a
+    // server outlived its client by fifteen minutes and submitted two paid
+    // post-passes on its own). End of stdin is the client going away.
+    const gone = () => lifetime.abort();
+    process.stdin.once("end", gone);
+    process.stdin.once("close", gone);
     await server.connect(transport);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codecartographer-pi",
-  "version": "0.22.0",
+  "version": "0.22.2",
   "mcpName": "io.github.HuginnIndustries/codecartographer",
   "description": "Turn an unfamiliar codebase into a validated reimplementation spec, then synthesize confirmed specs and a product vision into a traceable plan.",
   "type": "module",