cool-workflow 0.2.2 → 0.2.4

package/dist/shell/report-cli.js

@@ -43,9 +43,11 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.reportBundleCli = reportBundleCli;
 exports.reportVerifyBundleCli = reportVerifyBundleCli;
+exports.formatReportVerifyBundle = formatReportVerifyBundle;
 const path = __importStar(require("node:path"));
 const run_export_1 = require("./run-export");
 const run_store_1 = require("./run-store");
+const term_1 = require("./term");
 function optionalString(value) {
     return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }
@@ -99,3 +101,46 @@ function reportVerifyBundleCli(args) {
         requireSignatures: Boolean(args["require-signatures"] || args.requireSignatures || args.requireSigs),
     });
 }
+/** `cw report verify-bundle`'s human render (default; `--json` prints
+ *  `ReportBundleVerification` verbatim instead). Mirrors `doctor`'s
+ *  checks-list-then-verdict shape (`shell/doctor.ts`'s
+ *  `formatDoctorReport`) rather than `demo bundle`'s narrative one
+ *  (`shell/telemetry-demo.ts`'s `formatBundleDemo`) — verify-bundle is a
+ *  flat set of pass/fail checks on one already-sealed archive, not a
+ *  multi-step forge-and-catch demonstration. */
+function formatReportVerifyBundle(r) {
+    const lines = [(0, term_1.bold)(`cw report verify-bundle ${r.archivePath}`), ""];
+    const checks = [
+        [r.archiveOk, "archive intact — file digests match, no tamper"],
+        [r.telemetryVerified, "telemetry hash chain verifies"],
+        [r.trustAuditVerified, "trust-audit chain verifies"],
+        [r.reportFindingsVerified, "report.md matches every signed result"],
+    ];
+    for (const [ok, label] of checks)
+        lines.push(`  ${(0, term_1.doctorGlyph)(ok ? "ok" : "fail")} ${label}`);
+    const sigDetail = r.signatureKeyProvided
+        ? `${r.signaturesReverified}/${r.signaturesChecked} signature(s) reverified (key source: ${r.trustKeySource})`
+        : "no public key available — signatures not checked";
+    lines.push(`  trust: ${r.trustLevel} — ${sigDetail}`);
+    if (r.reportExtractedTo)
+        lines.push(`  report.md extracted to: ${r.reportExtractedTo}`);
+    if (r.failedChecks.length > 0) {
+        lines.push("");
+        lines.push("  Failed checks");
+        for (const c of r.failedChecks) {
+            // Most check sites in run-export.ts's verifyReportBundle set `code`
+            // to a short slug (e.g. "digest-mismatch"); the top-level restore
+            // catch-all sets it to the caught error's full message instead
+            // (run-export.ts's "restore" failedChecks.push) — too long/sentence-
+            // shaped to cram into "name [code]" without reading as a run-on.
+            // Give it its own indented line instead.
+            const isSlug = c.code !== undefined && c.code.length <= 40 && !c.code.includes(" ");
+            lines.push(`    - ${c.name}${isSlug ? ` [${c.code}]` : ""}`);
+            if (c.code !== undefined && !isSlug)
+                lines.push(`      ${c.code}`);
+        }
+    }
+    lines.push("");
+    lines.push(`${(0, term_1.doctorGlyph)(r.ok ? "ok" : "fail")} ${r.ok ? "bundle verifies" : "bundle verification FAILED"}`);
+    return lines.join("\n");
+}

package/dist/shell/report.js

@@ -338,7 +338,8 @@ function writeReport(run) {
         "| Phase | Status | Completed | Total |",
         "| --- | --- | ---: | ---: |",
         ...run.phases.map((phase) => {
-            const phaseTasks = run.tasks.filter((t) => phase.taskIds.includes(t.id));
+            const taskIds = new Set(phase.taskIds);
+            const phaseTasks = run.tasks.filter((t) => taskIds.has(t.id));
             const completed = phaseTasks.filter((t) => t.status === "completed").length;
             return `| ${phase.name} | ${phase.status} | ${completed} | ${phaseTasks.length} |`;
         }),

package/dist/shell/run-registry-io.js

@@ -87,6 +87,7 @@ exports.DEFAULT_RUN_REGISTRY_POLICY = {
     reclaimStates: ["completed", "failed"],
     keepSnapshots: false,
     keepScratch: false,
+    keepCommits: false,
     maxReclaimRuns: 0,
     maxReclaimBytes: 0,
 };
@@ -207,10 +208,25 @@ function clampInt(value, fallback, min) {
     return Math.max(min, Math.floor(n));
 }
 let queueCounter = 0;
-function queueId() {
-    queueCounter += 1;
+/** Byte format is `q-${stamp14}-${NNN}` (SPEC/scheduling-registry.md "Id
+ *  formats"), unchanged. `queueCounter` alone is not enough to keep ids
+ *  unique: it resets to 0 for every fresh `cw` process, so two SEPARATE
+ *  processes calling `queue add` within the same second both compute
+ *  `queueCounter === 1` and mint the IDENTICAL id — `sched lease` then
+ *  keys grants by id, so both queue entries get treated as one, breaking
+ *  through `maxConcurrent`. `existingIds` is the current queue file's ids
+ *  (read inside queueAdd's own file lock, so this sees every entry any
+ *  earlier-completed `queue add` — same process or not — has already
+ *  saved); bumping past any collision against that real, shared state
+ *  keeps ids unique across processes without changing the format. */
+function queueId(existingIds) {
     const stamp = new Date().toISOString().replace(/[-:.TZ]/g, "").slice(0, 14);
-    return `q-${stamp}-${String(queueCounter).padStart(3, "0")}`;
+    let candidate;
+    do {
+        queueCounter += 1;
+        candidate = `q-${stamp}-${String(queueCounter).padStart(3, "0")}`;
+    } while (existingIds && existingIds.has(candidate));
+    return candidate;
 }
 function isRunLifecycleState(value) {
     return (typeof value === "string" &&
@@ -397,7 +413,7 @@ class RunRegistry {
             const entries = this.loadQueueEntries();
             const entry = {
                 schemaVersion: 1,
-                id: options.id || queueId(),
+                id: options.id || queueId(new Set(entries.map((e) => e.id))),
                 runId: options.runId,
                 appId: options.appId,
                 workflowId: options.workflowId,
@@ -462,6 +478,13 @@ class RunRegistry {
             const result = (0, run_store_1.loadRunStateFile)(statePath, { dryRun: true });
             if (result.report.status === "unsupported")
                 return null;
+            // Bulk scans (refreshRegistry, below) call deriveRecord directly and
+            // tolerate a null the same way as missing/unsupported — one bad run
+            // must not stop a listing of everything else. Single-run lookups
+            // (deriveRecordForRun, below) re-check this same condition WITHOUT
+            // swallowing it, so `cw run show`/`archive`/`rerun` on THIS run
+            // specifically get a clear reason instead of a misleading "not found."
+            (0, run_store_1.assertNotSuspectedDataLoss)(path.basename(runDir), result);
             run = result.run;
         }
         catch {
@@ -609,7 +632,7 @@ class RunRegistry {
             if (staleRuns.length || missingRuns.length)
                 status = "stale";
         }
-        const refreshCmd = scope === "home" ? "node scripts/cw.js registry refresh --scope home" : "node scripts/cw.js registry refresh";
+        const refreshCmd = scope === "home" ? "cw registry refresh --scope home" : "cw registry refresh";
         return {
             schemaVersion: 1,
             scope,
@@ -624,7 +647,7 @@ class RunRegistry {
             },
             index: current,
             counts: current.counts,
-            nextAction: status === "valid" ? "node scripts/cw.js run search" : refreshCmd,
+            nextAction: status === "valid" ? "cw run search" : refreshCmd,
         };
     }
     search(raw = {}) {
@@ -657,7 +680,7 @@ class RunRegistry {
             offset: query.offset,
             limit: query.limit,
             records: page,
-            nextAction: report.freshness.status === "valid" ? "node scripts/cw.js run show <run-id>" : "node scripts/cw.js registry refresh",
+            nextAction: report.freshness.status === "valid" ? "cw run show <run-id>" : "cw registry refresh",
         };
     }
     list(options = {}) {
@@ -680,7 +703,7 @@ class RunRegistry {
                 resolvedFrom: located.from,
                 repo: located.record.repo,
                 record: located.record,
-                nextAction: located.record.archived ? "node scripts/cw.js run resume " + runId : "node scripts/cw.js run show " + runId,
+                nextAction: located.record.archived ? "cw run resume " + runId : "cw run show " + runId,
             };
         }
         const persisted = this.findPersisted(runId, scope);
@@ -691,10 +714,11 @@ class RunRegistry {
             freshness: "missing",
             repo: persisted?.repo,
             persisted,
-            nextAction: "node scripts/cw.js registry refresh" + (scope === "home" ? " --scope home" : ""),
+            nextAction: "cw registry refresh" + (scope === "home" ? " --scope home" : ""),
         };
     }
     locate(runId, scope) {
+        (0, fs_atomic_1.assertSafeRunId)(runId);
         const here = this.deriveRecordForRun(this.repoRoot, runId);
         if (here)
             return { record: here, from: "repo" };
@@ -711,9 +735,35 @@ class RunRegistry {
     }
     deriveRecordForRun(repo, runId) {
         const runDir = path.join(this.repoRunsDir(repo), runId);
-        if (!fs.existsSync(path.join(runDir, "state.json")))
+        const statePath = path.join(runDir, "state.json");
+        if (!fs.existsSync(statePath))
             return null;
-        return this.deriveRecord(repo, runDir);
+        const record = this.deriveRecord(repo, runDir);
+        if (record)
+            return record;
+        // deriveRecord returned null even though state.json existed a moment
+        // ago: it failed to parse, was flagged unsupported, tripped
+        // suspected-data-loss corroboration, or (a narrow race) a concurrent
+        // process deleted it in between. Re-derive without swallowing so a
+        // genuine corruption reaches THIS single-run lookup (backing `cw run
+        // show`/`archive`/`rerun`) instead of the misleading "not found" a bulk
+        // scan is content with — but if the file is ACTUALLY gone by the time
+        // we check again, that is genuinely missing, not corrupt, and must
+        // resolve to null like everywhere else, never a raw "File not found"
+        // exception surfacing from this fallback re-read.
+        try {
+            const result = (0, run_store_1.loadRunStateFile)(statePath, { dryRun: true });
+            if (result.report.status === "unsupported") {
+                throw new Error(`Run state for ${runId} is corrupt (fail closed): ${result.report.errors.join("; ") || "unsupported run state"}. Restore ${statePath} from a backup, or remove the run directory to start over.`);
+            }
+            (0, run_store_1.assertNotSuspectedDataLoss)(runId, result);
+            return record;
+        }
+        catch (error) {
+            if (!fs.existsSync(statePath))
+                return null;
+            throw error;
+        }
     }
     findPersisted(runId, scope) {
         for (const s of scope === "home" ? ["home", "repo"] : ["repo"]) {
@@ -725,6 +775,7 @@ class RunRegistry {
         return undefined;
     }
     loadRun(repo, runId) {
+        (0, fs_atomic_1.assertSafeRunId)(runId);
         const statePath = path.join(this.repoRunsDir(repo), runId, "state.json");
         if (!fs.existsSync(statePath))
             throw new Error(`Run not found: ${runId}`);
@@ -732,6 +783,7 @@ class RunRegistry {
         if (result.report.status === "unsupported") {
             throw new Error(`Unsupported run state for ${runId}: ${result.report.errors.join("; ")}`);
         }
+        (0, run_store_1.assertNotSuspectedDataLoss)(runId, result);
         return result.run;
     }
     resume(runId, options = {}) {
@@ -752,23 +804,23 @@ class RunRegistry {
         const nextActions = [];
         if (nextTasks.length) {
             nextActions.push({
-                command: `node scripts/cw.js dispatch ${runId} --cwd ${record.repo}`,
+                command: `cw dispatch ${runId} --cwd ${record.repo}`,
                 reason: `Continue ${nextTasks.length} pending/running task(s) from durable state.`,
             });
             nextActions.push({
-                command: `node scripts/cw.js multi-agent step ${runId} --cwd ${record.repo}`,
+                command: `cw multi-agent step ${runId} --cwd ${record.repo}`,
                 reason: "Take one deterministic host step without spawning agents.",
             });
         }
         else if (record.derivedLifecycle === "failed") {
             nextActions.push({
-                command: `node scripts/cw.js run rerun ${runId}`,
+                command: `cw run rerun ${runId}`,
                 reason: "Run terminated as failed with no runnable tasks; rerun as a new linked run.",
             });
         }
         else {
             nextActions.push({
-                command: `node scripts/cw.js status ${runId} --cwd ${record.repo} --json`,
+                command: `cw status ${runId} --cwd ${record.repo} --json`,
                 reason: "No runnable tasks remain; inspect status.",
             });
         }
@@ -807,7 +859,14 @@ class RunRegistry {
             }
             (0, fs_atomic_1.writeJson)(file, overlay, { durable: true });
         });
-        const record = this.deriveRecord(repo, located.record.runDir);
+        // deriveRecordForRun (not a bare deriveRecord(...)!) so a run that
+        // became corrupt/unsupported/suspected-data-loss in the narrow window
+        // between locate() above and this re-fetch gets the same clear,
+        // specific error every other single-run lookup gets, instead of a raw
+        // TypeError from a non-null assertion on a surprise null.
+        const record = this.deriveRecordForRun(repo, runId);
+        if (!record)
+            throw new Error(`Cannot archive: run ${runId} state became unavailable while archiving (fail closed).`);
         return {
             runId,
             repo,
@@ -877,8 +936,8 @@ class RunRegistry {
             pendingTasks: newRun.tasks.filter((t) => t.status === "pending").length,
             provenance,
             nextActions: [
-                { command: `node scripts/cw.js run resume ${newRun.id}`, reason: "Continue the new linked run." },
-                { command: `node scripts/cw.js run show ${runId}`, reason: "The original failed run is preserved for audit." },
+                { command: `cw run resume ${newRun.id}`, reason: "Continue the new linked run." },
+                { command: `cw run show ${runId}`, reason: "The original failed run is preserved for audit." },
             ],
         };
     }
@@ -918,7 +977,7 @@ class RunRegistry {
             limit,
             repos: index.repos,
             entries,
-            nextAction: report.freshness.status === "valid" ? "node scripts/cw.js run show <run-id>" : "node scripts/cw.js registry refresh --scope home",
+            nextAction: report.freshness.status === "valid" ? "cw run show <run-id>" : "cw registry refresh --scope home",
         };
     }
 }

package/dist/shell/run-store.js

@@ -49,6 +49,7 @@ exports.hashArtifactFile = hashArtifactFile;
 exports.loadRunStateFile = loadRunStateFile;
 exports.checkRunStateFile = checkRunStateFile;
 exports.migrateRunStateFile = migrateRunStateFile;
+exports.assertNotSuspectedDataLoss = assertNotSuspectedDataLoss;
 exports.loadRunFromCwd = loadRunFromCwd;
 exports.withRunStateLock = withRunStateLock;
 exports.saveCheckpoint = saveCheckpoint;
@@ -98,19 +99,90 @@ function migrateRunStateFile(statePath, options = {}) {
     }
     return result;
 }
+/** ONLY tasksDir/commitsDir (plus the audit event log, checked separately
+ *  below) — deliberately NOT every directory a run's `paths` can carry.
+ *  Verified empirically (via test/run-fixture-compat-smoke.js's real
+ *  fixtures) that several other candidate directories are unsafe signals:
+ *  a plain `cw status`/`cw graph` READ already writes cache/derived files
+ *  as a side effect — `audit/summary.json` + `audit/index.json`
+ *  (summarizeTrustAudit, called from the status/report path) are non-empty
+ *  the moment ANY read touches the run, and `blackboard/`/`candidates/`/
+ *  `topologies/` subdirectories get created (though left empty) the same
+ *  way. Using those as "real content" signals would refuse to load a
+ *  perfectly healthy, merely-already-viewed-once run — report.md is the
+ *  same story (a derived rendering of state, not independent evidence).
+ *  tasksDir/commitsDir are the two directories confirmed to hold content
+ *  ONLY from genuine task-dispatch/commit actions, never from an
+ *  otherwise-read-only command. */
+function contentDirs(paths) {
+    return [paths.tasksDir, paths.commitsDir];
+}
+/** True when the run directory already holds real task/commit files, or a
+ *  non-empty audit event log — i.e. this was NOT a brand-new run dir. Used
+ *  only to corroborate `report.suspectedDataLoss`: a bare
+ *  `{workflow, paths}`-less state.json is unremarkable for a run dir that
+ *  has nothing else in it either (e.g. a run whose creation crashed before
+ *  anything else was written), but is a strong corruption signal when real
+ *  content already sits next to it. A directory entry must not START WITH
+ *  "." to count — cw never writes dot-prefixed names into these
+ *  directories, so incidental filesystem debris (a stray `.DS_Store`) never
+ *  by itself makes a genuinely fresh run look corrupted. */
+function hasPreexistingRunContent(run) {
+    for (const dir of contentDirs(run.paths)) {
+        try {
+            if (fs.readdirSync(dir).some((name) => !name.startsWith(".")))
+                return true;
+        }
+        catch {
+            /* missing dir — not a signal either way */
+        }
+    }
+    try {
+        const eventLogPath = run.audit?.eventLogPath;
+        if (eventLogPath && fs.statSync(eventLogPath).size > 0)
+            return true;
+    }
+    catch {
+        /* missing/empty audit log — not a signal */
+    }
+    return false;
+}
+/** Throws when `result.report.suspectedDataLoss` is true AND the run
+ *  directory already has real content on disk — see
+ *  `hasPreexistingRunContent`. Shared by every state.json reader
+ *  (`loadRunFromCwd` here, `RunRegistry.loadRun` in run-registry-io.ts) so
+ *  a corrupted/wiped state.json is refused the same way regardless of
+ *  which entry point reached it. */
+function assertNotSuspectedDataLoss(runId, result) {
+    if (result.report.suspectedDataLoss && hasPreexistingRunContent(result.run)) {
+        throw new Error(`Refusing to load run ${runId}: state.json is missing its core fields (workflow, paths), but the run directory already has task, commit, or other content on disk. This looks like state.json was corrupted, truncated, or replaced by something outside cw, not a new run. Restore state.json from a backup, or remove the run directory to start over.`);
+    }
+}
 /** Refuses an empty id with `Missing run id`; loads
  *  `<cwd>/.cw/runs/<runId>/state.json` (dry-run — never writes); throws
- *  `Unsupported CW run state: <errors joined by "; ">` on an unsupported
- *  verdict; else returns the migrated WorkflowRun in memory. */
+ *  `Run not found: <runId>` when no such run directory has a state.json
+ *  (every caller — report, status, audit, eval snapshot, and more — used
+ *  to leak the raw `readJson` message, "File not found: <absolute
+ *  path>/state.json", which named neither the run nor a next step, and
+ *  didn't contain any of the words `cli/entry.ts`'s `recoveryHint` scans
+ *  for, so no `Try: cw run list` line ever appeared); throws `Unsupported
+ *  CW run state: <errors joined by "; ">` on an unsupported verdict;
+ *  refuses a state.json that lost its core fields (workflow, paths) while
+ *  the run dir still has real content next to it, rather than silently
+ *  returning it as a fresh empty run; else returns the migrated
+ *  WorkflowRun in memory. */
 function loadRunFromCwd(runId, cwd = process.cwd()) {
     if (!runId)
         throw new Error("Missing run id");
     (0, fs_atomic_1.assertSafeRunId)(runId);
     const statePath = path.join(cwd, ".cw", "runs", runId, "state.json");
+    if (!fs.existsSync(statePath))
+        throw new Error(`Run not found: ${runId}`);
     const result = loadRunStateFile(statePath, { dryRun: true });
     if (result.report.status === "unsupported") {
         throw new Error(`Unsupported CW run state: ${result.report.errors.join("; ")}`);
     }
+    assertNotSuspectedDataLoss(runId, result);
     return result.run;
 }
 /** Hold the state.json lock over a WHOLE load -> change -> save cycle.

package/dist/shell/scheduling-io.js

@@ -67,6 +67,7 @@ const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const fs_atomic_1 = require("./fs-atomic");
 const run_registry_io_1 = require("./run-registry-io");
+const numeric_flag_1 = require("../core/util/numeric-flag");
 exports.SCHEDULING_SCHEMA_VERSION = 1;
 /** Conservative fail-closed defaults: serial, bounded retries, exponential backoff. */
 exports.DEFAULT_SCHEDULING_POLICY = {
@@ -232,14 +233,7 @@ function loadSchedulingPolicy(registry) {
     return { schemaVersion: 1, policy: normalizeSchedulingPolicy(parsed), source: "file" };
 }
 function numericFlag(options, key) {
-    if (!(key in options))
-        return undefined;
-    const raw = options[key];
-    const n = Number(raw);
-    if (!Number.isFinite(n)) {
-        throw new Error(`Invalid --${key} "${raw}": expected a number (e.g. --${key} 4)`);
-    }
-    return n;
+    return (0, numeric_flag_1.requiredNumberFlag)(options[key], `--${key}`);
 }
 function schedPlanCli(options = {}) {
     const registry = new run_registry_io_1.RunRegistry(resolveCwd(options));
@@ -250,7 +244,7 @@ function schedLeaseCli(options = {}) {
     const registry = new run_registry_io_1.RunRegistry(resolveCwd(options));
     const now = nowIso(options);
     const policy = loadSchedulingPolicy(registry).policy;
-    const limit = options.limit === undefined ? undefined : Number(options.limit);
+    const limit = (0, numeric_flag_1.requiredNumberFlag)(options.limit, "--limit");
     return (0, fs_atomic_1.withFileLock)(registry.queueFilePath(), () => {
         const { entries, leases } = applyLease(registry.loadQueueEntries(), policy, now, limit);
         registry.saveQueueEntries(entries);
@@ -305,16 +299,21 @@ function schedPolicyShowCli(options = {}) {
 }
 function schedPolicySetCli(options = {}) {
     const registry = new run_registry_io_1.RunRegistry(resolveCwd(options));
-    const current = loadSchedulingPolicy(registry).policy;
     const patch = {};
     for (const key of ["maxConcurrent", "maxAttempts", "leaseTtlMs", "backoffBaseMs", "backoffFactor", "backoffCapMs"]) {
         const value = numericFlag(options, key);
         if (value !== undefined)
             patch[key] = value;
     }
-    const policy = normalizeSchedulingPolicy({ ...current, ...patch });
-    (0, fs_atomic_1.writeJson)(registry.schedulingPolicyPath(), policy);
-    return { schemaVersion: 1, policy, source: "file" };
+    // Read-modify-write under the policy file's own lock: two concurrent
+    // `sched policy set` calls patching different fields must not drop each
+    // other's write.
+    return (0, fs_atomic_1.withFileLock)(registry.schedulingPolicyPath(), () => {
+        const current = loadSchedulingPolicy(registry).policy;
+        const policy = normalizeSchedulingPolicy({ ...current, ...patch });
+        (0, fs_atomic_1.writeJson)(registry.schedulingPolicyPath(), policy);
+        return { schemaVersion: 1, policy, source: "file" };
+    });
 }
 function isTrue(value) {
     return value === true || value === "true" || value === "1";

package/dist/shell/state-cli.js

@@ -65,6 +65,7 @@ const node_store_1 = require("./node-store");
 const contract_migration_1 = require("../core/state/contract-migration");
 const node_snapshot_1 = require("../core/state/node-snapshot");
 const dispatch_1 = require("../core/pipeline/dispatch");
+const numeric_flag_1 = require("../core/util/numeric-flag");
 function optionalStringArg(value) {
     return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }
@@ -128,12 +129,6 @@ function loadRun(runId, options = {}) {
     const cwd = options.cwd ? path.resolve(String(options.cwd)) : process.cwd();
     return (0, run_store_1.loadRunFromCwd)(runId, cwd);
 }
-function numberOption(value) {
-    if (value === undefined || value === null || value === true)
-        return undefined;
-    const n = Number(value);
-    return Number.isFinite(n) ? n : undefined;
-}
 /** `cw next <run-id> [--limit N]` — the read-only "what would dispatch next"
  *  preview: the runnable tasks the next `cw dispatch` would pick, in order,
  *  without mutating state. A byte-behavior port of the old build's
@@ -141,7 +136,7 @@ function numberOption(value) {
  *  the cw_next MCP tool render this same DispatchTask[] value, so their
  *  payloads stay identical. */
 function nextCli(runId, options = {}) {
-    return (0, dispatch_1.nextDispatchTasks)(loadRun(runId, options), numberOption(options.limit));
+    return (0, dispatch_1.nextDispatchTasks)(loadRun(runId, options), (0, numeric_flag_1.requiredNumberFlag)(options.limit, "--limit"));
 }
 function listNodes(runId, options = {}) {
     return loadRun(runId, options).nodes || [];

package/dist/shell/state-explosion-cli.js

@@ -134,7 +134,7 @@ function refreshStateExplosionSummaries(run, options = {}) {
         generatedAt: now,
         status: "valid",
         deterministic: true,
-        nextAction: `node scripts/cw.js summary show ${run.id}`,
+        nextAction: `cw summary show ${run.id}`,
         entries: entries.sort((a, b) => (0, collate_1.stableCompare)(a.id, b.id)),
         views,
         paths: { summariesDir: dir, indexPath: path.join(dir, "index.json"), reportPath },
@@ -184,15 +184,23 @@ function loadRun(runId, options = {}) {
  *  only (the run-state checkpoint write is real and load-bearing today;
  *  report.md rendering is not). */
 function summaryRefreshCli(runId, options = {}) {
-    const run = loadRun(runId, options);
-    const index = refreshStateExplosionSummaries(run);
-    (0, run_store_1.saveCheckpoint)(run);
-    return index;
+    // Hold the state.json lock across the whole load -> refresh -> save so a
+    // concurrent run mutation cannot drop this summary refresh (lost-update class).
+    const cwd = options.cwd ? path.resolve(String(options.cwd)) : process.cwd();
+    return (0, run_store_1.withRunStateLock)(runId, cwd, (run) => {
+        const index = refreshStateExplosionSummaries(run);
+        (0, run_store_1.saveCheckpoint)(run);
+        return index;
+    });
 }
-/** `cw summary show <run-id> [--json]` — also runs `saveCheckpoint`. */
+/** `cw summary show <run-id> [--json]` — a plain read: `showStateExplosionSummary`
+ *  only loads the persisted summary index and builds a report from it, it
+ *  never mutates `run`, so there is nothing here for a checkpoint write to
+ *  durably persist. No `saveCheckpoint` call (dropped one, see ITERATION_LOG
+ *  — it used to durably rewrite the whole unchanged state.json on every
+ *  `summary show`, only bumping `run.updatedAt` as a side effect of a
+ *  command whose whole job is to look, not touch). */
 function summaryShowCli(runId, options = {}) {
     const run = loadRun(runId, options);
-    const report = showStateExplosionSummary(run);
-    (0, run_store_1.saveCheckpoint)(run);
-    return report;
+    return showStateExplosionSummary(run);
 }

package/dist/shell/topology-io.js

@@ -71,6 +71,23 @@ function topologyRunPath(run, id) {
     const safe = id.replace(/[^a-zA-Z0-9_.:-]+/g, "_");
     return path.join(topologyRoot(run), "runs", `${safe}.json`);
 }
+// Dirty-id tracking for persistTopologyState, mirroring coordinator-io.ts's
+// blackboard dirty tracking: without it, every persist call rewrote every
+// topology run's OWN file (topologyRunPath), even ones untouched this call —
+// O(N) writes per call, O(N^2) across N applyTopology calls. Kept off the
+// serialized TopologyState itself (a WeakMap keyed by the state object) so it
+// can never leak into state.json's bytes. applyTopology is the only place
+// state.runs is pushed to or an existing record mutated, so it is the only
+// call site that needs to mark a run id dirty.
+const topologyDirtyIds = new WeakMap();
+function dirtyTopologyIds(state) {
+    let ids = topologyDirtyIds.get(state);
+    if (!ids) {
+        ids = new Set();
+        topologyDirtyIds.set(state, ids);
+    }
+    return ids;
+}
 function ensureTopologyState(run) {
     run.paths.topologiesDir = topologyRoot(run);
     fs.mkdirSync(run.paths.topologiesDir, { recursive: true });
@@ -90,8 +107,13 @@ function persistTopologyState(run) {
         counts: { runs: state.runs.length },
         runs: state.runs.map((record) => ({ id: record.id, topologyId: record.topologyId, status: record.status, updatedAt: record.updatedAt })),
     });
-    for (const record of state.runs)
-        (0, fs_atomic_1.writeJson)(topologyRunPath(run, record.id), record);
+    const dirty = dirtyTopologyIds(state);
+    for (const id of dirty) {
+        const record = state.runs.find((entry) => entry.id === id);
+        if (record)
+            (0, fs_atomic_1.writeJson)(topologyRunPath(run, id), record);
+    }
+    dirty.clear();
 }
 function now() {
     return new Date().toISOString();
@@ -238,6 +260,7 @@ function applyTopology(run, topologyId, input = {}) {
         metadata: compact({ ...(input.metadata || {}), topology: definition }),
     };
     state.runs.push(record);
+    dirtyTopologyIds(state).add(record.id);
     appendTopologyNode(run, record, topo.statusToNodeStatus(record.status));
     (0, trust_audit_1.recordTrustAuditEvent)(run, {
         kind: "topology.verdict",
@@ -272,7 +295,15 @@ function summarizeTopologies(run) {
     const multi = run.multiAgent || {};
     const fanins = multi.fanins || [];
     const active = state.runs.map((record) => {
-        const inferredFanins = fanins.filter((fanin) => record.groupIds.includes(fanin.groupId) || record.fanoutIds.includes(fanin.fanoutId || ""));
+        // `fanins` (multi.fanins) grows with total fan-in activity across the
+        // whole run, re-scanned here once per topology record -- Sets built
+        // from each record's own small groupIds/fanoutIds replace an
+        // O(fanins) `.includes()` scan per fanin with an O(1) lookup (the
+        // same array-scan-per-item shape 024b007 fixed for phase/task
+        // selection).
+        const groupIdSet = new Set(record.groupIds);
+        const fanoutIdSet = new Set(record.fanoutIds);
+        const inferredFanins = fanins.filter((fanin) => groupIdSet.has(fanin.groupId) || fanoutIdSet.has(fanin.fanoutId || ""));
         const allFaninIds = topo.unique([...record.faninIds, ...inferredFanins.map((fanin) => fanin.id)]);
         const blocked = inferredFanins.filter((fanin) => fanin.status === "blocked" || !fanin.verifierReady);
         const ready = inferredFanins.some((fanin) => fanin.verifierReady);
@@ -291,7 +322,7 @@ function summarizeTopologies(run) {
             missingEvidence,
             conflicts: record.conflicts,
             readiness: ready ? "fanin ready" : missingEvidence.length ? "missing evidence" : "awaiting worker output",
-            nextActions: ready ? [`node scripts/cw.js candidate register ${run.id} --result-node <reducer-or-panel-result>`] : record.nextActions,
+            nextActions: ready ? [`cw candidate register ${run.id} --result-node <reducer-or-panel-result>`] : record.nextActions,
         };
     });
     return {
@@ -300,7 +331,7 @@ function summarizeTopologies(run) {
         runsByStatus: countBy(active, (record) => record.status),
         officialTopologies: topo.listTopologyDefinitions().map((definition) => definition.id),
         active,
-        nextAction: active.find((record) => record.nextActions.length)?.nextActions[0] || `node scripts/cw.js topology apply ${run.id} map-reduce --task <task-id>`,
+        nextAction: active.find((record) => record.nextActions.length)?.nextActions[0] || `cw topology apply ${run.id} map-reduce --task <task-id>`,
     };
 }
 function buildTopologyGraph(run) {