harnery 0.29.0 → 0.31.0

package/dist/core/governor/adapter-spread.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Preflight: would every specialist on this team land on the same adapter?
+ *
+ * Harnery does not auto-spread. A specialist without an `adapter` pin inherits
+ * the run's default, so a team whose profiles all omit the pin puts every child
+ * on one adapter. That is legal and sometimes intended. It is a problem when the
+ * host is also `subscriptionOnly`, because then the concentration lands on one
+ * seat's session meter rather than on metered per-token billing: the seat hits
+ * its limit, and every specialist stops at once rather than the team degrading.
+ *
+ * The check is deliberately narrow, because a false refusal here is worse than
+ * the miss it prevents. It fires only when all four hold:
+ *
+ *   1. more than one specialist (a solo team cannot spread),
+ *   2. every specialist resolves to the same adapter,
+ *   3. `subscriptionOnly` is on (otherwise concentration is a cost curve, not a
+ *      cliff), and
+ *   4. more than one adapter is ATTESTED REACHABLE.
+ *
+ * Condition 4 is the one worth insisting on. Counting *declared* adapters would
+ * suggest spreading onto a seat that cannot run — a dead adapter passes a
+ * declaration check and then fails every child it is handed. Only an
+ * attestation records that the adapter actually completed a turn on this
+ * machine, so only an attestation is grounds for telling someone to use it.
+ */
+export interface AdapterSpreadInput {
+    /** Specialist id → its optional adapter pin. */
+    specialists: Readonly<Record<string, {
+        adapter?: string;
+    }>>;
+    /** The adapter an unpinned specialist inherits. */
+    defaultAdapter: string;
+    /** Adapters with a live attestation on this machine — proven to run, not
+     * merely registered. */
+    reachable: readonly string[];
+    /** Whether children are confined to subscription (logged-in) auth. */
+    subscriptionOnly: boolean;
+}
+export interface AdapterSpreadVerdict {
+    /** True when the team would put every child on one adapter AND that is worth
+     * refusing over. False both when the team spreads and when concentrating is
+     * unremarkable (single specialist, one reachable adapter, metered billing). */
+    concentrated: boolean;
+    /** The adapter everything would land on, when concentrated. */
+    adapter?: string;
+    /** Operator-facing explanation, present exactly when concentrated. */
+    reason?: string;
+    /** Attested-reachable adapters this team is not using. */
+    unused: string[];
+}
+export declare function inspectAdapterSpread(input: AdapterSpreadInput): AdapterSpreadVerdict;
+//# sourceMappingURL=adapter-spread.d.ts.map

package/dist/core/governor/adapter-spread.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-spread.d.ts","sourceRoot":"","sources":["../../../src/core/governor/adapter-spread.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAC5D,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB;4BACwB;IACxB,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,sEAAsE;IACtE,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC;;mFAE+E;IAC/E,YAAY,EAAE,OAAO,CAAC;IACtB,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,GAAG,oBAAoB,CA8BpF"}

package/dist/core/governor/adapter-spread.js

@@ -0,0 +1,52 @@
+/**
+ * Preflight: would every specialist on this team land on the same adapter?
+ *
+ * Harnery does not auto-spread. A specialist without an `adapter` pin inherits
+ * the run's default, so a team whose profiles all omit the pin puts every child
+ * on one adapter. That is legal and sometimes intended. It is a problem when the
+ * host is also `subscriptionOnly`, because then the concentration lands on one
+ * seat's session meter rather than on metered per-token billing: the seat hits
+ * its limit, and every specialist stops at once rather than the team degrading.
+ *
+ * The check is deliberately narrow, because a false refusal here is worse than
+ * the miss it prevents. It fires only when all four hold:
+ *
+ *   1. more than one specialist (a solo team cannot spread),
+ *   2. every specialist resolves to the same adapter,
+ *   3. `subscriptionOnly` is on (otherwise concentration is a cost curve, not a
+ *      cliff), and
+ *   4. more than one adapter is ATTESTED REACHABLE.
+ *
+ * Condition 4 is the one worth insisting on. Counting *declared* adapters would
+ * suggest spreading onto a seat that cannot run — a dead adapter passes a
+ * declaration check and then fails every child it is handed. Only an
+ * attestation records that the adapter actually completed a turn on this
+ * machine, so only an attestation is grounds for telling someone to use it.
+ */
+export function inspectAdapterSpread(input) {
+    const ids = Object.keys(input.specialists);
+    const resolved = ids.map((id) => input.specialists[id]?.adapter ?? input.defaultAdapter);
+    const distinct = [...new Set(resolved)];
+    const unused = input.reachable.filter((a) => !distinct.includes(a));
+    if (ids.length < 2 || distinct.length !== 1 || !input.subscriptionOnly || unused.length === 0) {
+        return { concentrated: false, unused };
+    }
+    const adapter = distinct[0];
+    const pinned = ids.filter((id) => input.specialists[id]?.adapter).length;
+    // Say which of the two shapes this is. "You wrote no pins" and "you pinned
+    // them all to one" need different corrections, and a single generic message
+    // would send half the readers looking in the wrong place.
+    const how = pinned === 0
+        ? `no specialist pins an adapter, so all ${ids.length} inherit the default (${adapter})`
+        : `all ${ids.length} specialists resolve to ${adapter}`;
+    return {
+        concentrated: true,
+        adapter,
+        unused,
+        reason: `${how}, and children are confined to subscription auth — so one seat carries the whole ` +
+            `team and every specialist stops together when it hits its limit. ` +
+            `${unused.length === 1 ? "This adapter is" : "These adapters are"} attested and idle: ` +
+            `${unused.join(", ")}. Pin some specialists onto ${unused.length === 1 ? "it" : "them"}, ` +
+            `or pass --allow-single-adapter if one seat is what you want.`,
+    };
+}

package/dist/core/governor/index.d.ts

@@ -0,0 +1,7 @@
+export { approveGovernorPlan, findCompletedMissionGoverning, rejectGovernorPlan, reopenGovernorMission, retryGovernorPlan, } from "./plan-api.js";
+export { readGovernorPlan, readGovernorPlanReviewReceipt, readGovernorPlans, } from "./plan-read.js";
+export { type CreateGovernorPlanTemplateInput, type CreateGovernorReplanningInput, GOVERNOR_PLAN_SCHEMA_VERSION, type GovernorPlanEvent, type GovernorPlanEventType, type GovernorPlanHistory, type GovernorPlanMilestone, type GovernorPlanOutcome, type GovernorPlanProposal, type GovernorPlanRecord, type GovernorPlanRequest, type GovernorPlanReviewFinding, type GovernorPlanReviewReceipt, type GovernorPlanReviewReviewer, type GovernorPlanReviewRound, type GovernorPlanReviewStatus, type GovernorPlanReviewSummary, type GovernorPlanReviewVerdict, type GovernorPlanStatus, type GovernorPlanTemplate, type GovernorPlanWorkSpec, type GovernorReplanningPolicy, MAX_GOVERNOR_PLAN_REVIEWERS, MAX_GOVERNOR_PLAN_REVISION_ROUNDS, } from "./plan-types.js";
+export { type GovernorDispatchOutcome, type GovernorRunReport, type GovernorStopReason, type RunGovernorInput, runGovernor, } from "./runner.js";
+export { type ConfigureGovernorServiceInput, configureGovernorService, GOVERNOR_SERVICE_CONFIG_SCHEMA_VERSION, GOVERNOR_SERVICE_RUNTIME_SCHEMA_VERSION, GOVERNOR_SERVICE_STATUS_SCHEMA_VERSION, type GovernorServiceConfig, type GovernorServiceEngineConfig, type GovernorServiceGoalRuntime, type GovernorServiceGoalState, type GovernorServiceProcessState, type GovernorServiceRuntime, type GovernorServiceStatus, type GovernorServiceStatusRecord, type GovernorServiceSweepOutcome, type GovernorServiceSweepReport, governorServiceLogPath, type RunGovernorServiceDaemonInput, type RunGovernorServiceSweepInput, readGovernorServiceConfig, readGovernorServiceRuntime, readGovernorServiceStatus, requestGovernorServiceStop, runGovernorServiceDaemon, runGovernorServiceSweep, spawnGovernorService, } from "./service.js";
+export { assertGovernorId, type CreateGovernorInput, type CreateGovernorMissionInput, collectGovernorWork, createGovernor, GOVERNOR_INTENT_SCHEMA_VERSION, type GovernorAutomationPolicy, type GovernorIntent, type GovernorLimits, type GovernorMission, type GovernorNextAction, type GovernorProjection, type GovernorRecord, type GovernorState, listGovernors, newGovernorId, readGovernor, } from "./state.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/core/governor/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/governor/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,gBAAgB,EAChB,6BAA6B,EAC7B,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,EAClC,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,2BAA2B,EAC3B,iCAAiC,GAClC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,sCAAsC,EACtC,uCAAuC,EACvC,sCAAsC,EACtC,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,sBAAsB,EACtB,KAAK,6BAA6B,EAClC,KAAK,4BAA4B,EACjC,yBAAyB,EACzB,0BAA0B,EAC1B,yBAAyB,EACzB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,gBAAgB,EAChB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,mBAAmB,EACnB,cAAc,EACd,8BAA8B,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,aAAa,EACb,aAAa,EACb,YAAY,GACb,MAAM,YAAY,CAAC"}

package/dist/core/governor/index.js

@@ -0,0 +1,6 @@
+export { approveGovernorPlan, findCompletedMissionGoverning, rejectGovernorPlan, reopenGovernorMission, retryGovernorPlan, } from "./plan-api.js";
+export { readGovernorPlan, readGovernorPlanReviewReceipt, readGovernorPlans, } from "./plan-read.js";
+export { GOVERNOR_PLAN_SCHEMA_VERSION, MAX_GOVERNOR_PLAN_REVIEWERS, MAX_GOVERNOR_PLAN_REVISION_ROUNDS, } from "./plan-types.js";
+export { runGovernor, } from "./runner.js";
+export { configureGovernorService, GOVERNOR_SERVICE_CONFIG_SCHEMA_VERSION, GOVERNOR_SERVICE_RUNTIME_SCHEMA_VERSION, GOVERNOR_SERVICE_STATUS_SCHEMA_VERSION, governorServiceLogPath, readGovernorServiceConfig, readGovernorServiceRuntime, readGovernorServiceStatus, requestGovernorServiceStop, runGovernorServiceDaemon, runGovernorServiceSweep, spawnGovernorService, } from "./service.js";
+export { assertGovernorId, collectGovernorWork, createGovernor, GOVERNOR_INTENT_SCHEMA_VERSION, listGovernors, newGovernorId, readGovernor, } from "./state.js";

package/dist/core/governor/plan-api.d.ts

@@ -0,0 +1,38 @@
+import type { GovernorPlanOutcome } from "./plan-types.js";
+export declare function approveGovernorPlan(input: {
+    coordRoot: string;
+    goalId: string;
+    planId: string;
+    actor?: string;
+    reason?: string;
+}): GovernorPlanOutcome;
+export declare function rejectGovernorPlan(input: {
+    coordRoot: string;
+    goalId: string;
+    planId: string;
+    actor?: string;
+    reason: string;
+}): GovernorPlanOutcome;
+/** The goal of a succeeded mission that governs this work item, if there is one.
+ *
+ * A work item holds no back-reference to its goal, so this is a scan. It exists so
+ * `work reopen` can tell the difference between an item nothing is watching and one
+ * whose mission has already been declared complete — the case where reopening the
+ * item alone leaves it in `ready_work` that the governor will never dispatch. */
+export declare function findCompletedMissionGoverning(coordRoot: string, workId: string): string | undefined;
+/** ADR 0050: reopen an accepted mission completion by appending to the plan log.
+ * Held under the goal lease so it cannot race a foreground governor run. */
+export declare function reopenGovernorMission(input: {
+    coordRoot: string;
+    goalId: string;
+    actor?: string;
+    reason: string;
+}): GovernorPlanOutcome;
+export declare function retryGovernorPlan(input: {
+    coordRoot: string;
+    goalId: string;
+    planId: string;
+    actor?: string;
+    reason: string;
+}): GovernorPlanOutcome;
+//# sourceMappingURL=plan-api.d.ts.map

package/dist/core/governor/plan-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-api.d.ts","sourceRoot":"","sources":["../../../src/core/governor/plan-api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAS3D,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,mBAAmB,CActB;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,mBAAmB,CActB;AAED;;;;;iFAKiF;AACjF,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,SAAS,CAQpB;AAED;4EAC4E;AAC5E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,mBAAmB,CAatB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,mBAAmB,CActB"}

package/dist/core/governor/plan-api.js

@@ -0,0 +1,83 @@
+import { applyGovernorPlanProposal, rejectGovernorPlanProposal, reopenGovernorMissionPlan, retryGovernorPlanProposal, } from "./planning.js";
+import { acquireGovernorLease, listGovernors, readGovernorIgnoringLease } from "./state.js";
+export function approveGovernorPlan(input) {
+    const actor = input.actor?.trim() || `governor:${input.goalId}`;
+    const release = acquireGovernorLease(input.coordRoot, input.goalId);
+    try {
+        return applyGovernorPlanProposal({
+            coordRoot: input.coordRoot,
+            record: readGovernorIgnoringLease(input.coordRoot, input.goalId),
+            planId: input.planId,
+            actor,
+            reason: input.reason,
+        });
+    }
+    finally {
+        release();
+    }
+}
+export function rejectGovernorPlan(input) {
+    const actor = input.actor?.trim() || `governor:${input.goalId}`;
+    const release = acquireGovernorLease(input.coordRoot, input.goalId);
+    try {
+        return rejectGovernorPlanProposal({
+            coordRoot: input.coordRoot,
+            goalId: input.goalId,
+            planId: input.planId,
+            actor,
+            reason: input.reason,
+        });
+    }
+    finally {
+        release();
+    }
+}
+/** The goal of a succeeded mission that governs this work item, if there is one.
+ *
+ * A work item holds no back-reference to its goal, so this is a scan. It exists so
+ * `work reopen` can tell the difference between an item nothing is watching and one
+ * whose mission has already been declared complete — the case where reopening the
+ * item alone leaves it in `ready_work` that the governor will never dispatch. */
+export function findCompletedMissionGoverning(coordRoot, workId) {
+    for (const record of listGovernors(coordRoot)) {
+        if (record.projection.state !== "succeeded" || !record.intent.mission)
+            continue;
+        if (record.projection.root_work_id === workId || record.projection.work_ids.includes(workId)) {
+            return record.intent.id;
+        }
+    }
+    return undefined;
+}
+/** ADR 0050: reopen an accepted mission completion by appending to the plan log.
+ * Held under the goal lease so it cannot race a foreground governor run. */
+export function reopenGovernorMission(input) {
+    const actor = input.actor?.trim() || `governor:${input.goalId}`;
+    const release = acquireGovernorLease(input.coordRoot, input.goalId);
+    try {
+        return reopenGovernorMissionPlan({
+            coordRoot: input.coordRoot,
+            record: readGovernorIgnoringLease(input.coordRoot, input.goalId),
+            actor,
+            reason: input.reason,
+        });
+    }
+    finally {
+        release();
+    }
+}
+export function retryGovernorPlan(input) {
+    const actor = input.actor?.trim() || `governor:${input.goalId}`;
+    const release = acquireGovernorLease(input.coordRoot, input.goalId);
+    try {
+        return retryGovernorPlanProposal({
+            coordRoot: input.coordRoot,
+            record: readGovernorIgnoringLease(input.coordRoot, input.goalId),
+            planId: input.planId,
+            actor,
+            reason: input.reason,
+        });
+    }
+    finally {
+        release();
+    }
+}

package/dist/core/governor/plan-read.d.ts

@@ -0,0 +1,5 @@
+import { type GovernorPlanHistory, type GovernorPlanRecord, type GovernorPlanReviewReceipt } from "./plan-types.js";
+export declare function readGovernorPlans(coordRootRaw: string, goalId: string, originalRootWorkId: string): GovernorPlanHistory;
+export declare function readGovernorPlan(coordRootRaw: string, goalId: string, planId: string): GovernorPlanRecord;
+export declare function readGovernorPlanReviewReceipt(coordRootRaw: string, goalId: string, planId: string): GovernorPlanReviewReceipt | undefined;
+//# sourceMappingURL=plan-read.d.ts.map

package/dist/core/governor/plan-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-read.d.ts","sourceRoot":"","sources":["../../../src/core/governor/plan-read.ts"],"names":[],"mappings":"AAIA,OAAO,EAIL,KAAK,mBAAmB,EAExB,KAAK,kBAAkB,EAGvB,KAAK,yBAAyB,EAQ/B,MAAM,iBAAiB,CAAC;AA0BzB,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACd,kBAAkB,EAAE,MAAM,GACzB,mBAAmB,CAwErB;AAED,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,kBAAkB,CAsBpB;AAED,wBAAgB,6BAA6B,CAC3C,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,yBAAyB,GAAG,SAAS,CAWvC"}

package/dist/core/{supervisor → governor}/plan-read.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { readWorkItem } from "../work/read.js";
-import { MAX_SUPERVISOR_PLAN_REVIEWERS, MAX_SUPERVISOR_PLAN_REVISION_ROUNDS, SUPERVISOR_PLAN_SCHEMA_VERSION, } from "./plan-types.js";
+import { GOVERNOR_PLAN_SCHEMA_VERSION, MAX_GOVERNOR_PLAN_REVIEWERS, MAX_GOVERNOR_PLAN_REVISION_ROUNDS, } from "./plan-types.js";
 const PLAN_ID = /^plan-[0-9]{4}-[a-f0-9]{8}$/;
 const GOAL_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;
 const WORK_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;
@@ -24,9 +24,10 @@ const EVENT_TYPES = new Set([
     "plan.retry_requested",
     "plan.attention",
     "plan.failed",
+    "plan.reopened",
 ]);
-export function readSupervisorPlans(coordRootRaw, goalId, originalRootWorkId) {
-    assertId(goalId, GOAL_ID, "supervisor id");
+export function readGovernorPlans(coordRootRaw, goalId, originalRootWorkId) {
+    assertId(goalId, GOAL_ID, "governor id");
     assertId(originalRootWorkId, WORK_ID, "work id");
     const coordRoot = resolve(coordRootRaw);
     const root = plansRoot(coordRoot, goalId);
@@ -45,14 +46,14 @@ export function readSupervisorPlans(coordRootRaw, goalId, originalRootWorkId) {
         .filter((entry) => entry.isDirectory() && PLAN_ID.test(entry.name))
         .map((entry) => entry.name);
     if (entries.length > MAX_PLANS)
-        throw new Error(`supervisor plan history exceeds ${MAX_PLANS}`);
+        throw new Error(`governor plan history exceeds ${MAX_PLANS}`);
     const plans = entries
-        .map((planId) => readSupervisorPlan(coordRootRaw, goalId, planId))
+        .map((planId) => readGovernorPlan(coordRootRaw, goalId, planId))
         .sort((left, right) => left.request.sequence - right.request.sequence);
     const sequences = new Set();
     for (const plan of plans) {
         if (sequences.has(plan.request.sequence)) {
-            throw new Error(`supervisor ${goalId} has duplicate plan sequence ${plan.request.sequence}`);
+            throw new Error(`governor ${goalId} has duplicate plan sequence ${plan.request.sequence}`);
         }
         sequences.add(plan.request.sequence);
     }
@@ -83,7 +84,7 @@ export function readSupervisorPlans(coordRootRaw, goalId, originalRootWorkId) {
     const completedPlans = plans.filter((plan) => plan.status === "completed");
     if (completedPlans.length > 1 ||
         (completedPlans.length === 1 && completedPlans[0] !== plans.at(-1))) {
-        throw new Error(`supervisor ${goalId} has invalid completion history`);
+        throw new Error(`governor ${goalId} has invalid completion history`);
     }
     completed = completedPlans.length === 1;
     return {
@@ -97,9 +98,9 @@ export function readSupervisorPlans(coordRootRaw, goalId, originalRootWorkId) {
         latest: plans.at(-1),
     };
 }
-export function readSupervisorPlan(coordRootRaw, goalId, planId) {
-    assertId(goalId, GOAL_ID, "supervisor id");
-    assertId(planId, PLAN_ID, "supervisor plan id");
+export function readGovernorPlan(coordRootRaw, goalId, planId) {
+    assertId(goalId, GOAL_ID, "governor id");
+    assertId(planId, PLAN_ID, "governor plan id");
     const coordRoot = resolve(coordRootRaw);
     const dir = planDir(coordRoot, goalId, planId);
     const request = readJson(join(dir, "request.json"), "plan request");
@@ -110,7 +111,7 @@ export function readSupervisorPlan(coordRootRaw, goalId, planId) {
         : undefined;
     if (proposal)
         validateProposalEnvelope(proposal, planId);
-    const review = readSupervisorPlanReviewReceipt(coordRootRaw, goalId, planId);
+    const review = readGovernorPlanReviewReceipt(coordRootRaw, goalId, planId);
     const events = readEvents(join(dir, "events.jsonl"), planId);
     const derived = deriveStatus(coordRoot, events, proposal);
     return {
@@ -121,9 +122,9 @@ export function readSupervisorPlan(coordRootRaw, goalId, planId) {
         ...derived,
     };
 }
-export function readSupervisorPlanReviewReceipt(coordRootRaw, goalId, planId) {
-    assertId(goalId, GOAL_ID, "supervisor id");
-    assertId(planId, PLAN_ID, "supervisor plan id");
+export function readGovernorPlanReviewReceipt(coordRootRaw, goalId, planId) {
+    assertId(goalId, GOAL_ID, "governor id");
+    assertId(planId, PLAN_ID, "governor plan id");
     const coordRoot = resolve(coordRootRaw);
     const path = join(planDir(coordRoot, goalId, planId), "review.json");
     if (!existsSync(path))
@@ -139,6 +140,16 @@ function deriveStatus(coordRoot, events, proposal) {
     const latest = events.at(-1);
     const completed = [...events].reverse().find((event) => event.event === "plan.completed");
     if (completed) {
+        // ADR 0050: an operator finding on work beneath a completed mission reopens
+        // the mission by APPENDING, never by rewriting. The accepted completion stays
+        // in the log verbatim; a later `plan.reopened` supersedes it, which is what
+        // drops `plans.completed` and lets the projection dispatch again.
+        const reopened = [...events]
+            .reverse()
+            .find((event) => event.event === "plan.reopened" && event.seq > completed.seq);
+        if (reopened) {
+            return { status: "reopened", work_ids: [], reason: reopened.reason };
+        }
         return { status: "completed", work_ids: [], reason: completed.reason };
     }
     const applied = [...events].reverse().find((event) => event.event === "plan.applied");
@@ -160,7 +171,10 @@ function deriveStatus(coordRoot, events, proposal) {
         return { status: "attention", work_ids: [], reason: latest.reason };
     }
     if (latest?.event === "plan.failed") {
-        return { status: "failed", work_ids: [], reason: latest.reason };
+        // ADR 0046: carry the planner run's failure class so the projection can stop
+        // an environment failure and bound consecutive upstream ones, rather than
+        // replanning an unchanged environment to budget exhaustion.
+        return { status: "failed", work_ids: [], reason: latest.reason, class: latest.class };
     }
     const parked = [...events].reverse().find((event) => event.event === "plan.awaiting_approval");
     const resumedAfterPark = parked !== undefined &&
@@ -182,27 +196,27 @@ function readEvents(path, planId) {
         return [];
     const size = statSync(path).size;
     if (size > MAX_EVENTS_BYTES)
-        throw new Error("supervisor plan events exceed their byte limit");
+        throw new Error("governor plan events exceed their byte limit");
     const body = readFileSync(path, "utf8");
     if (body && !body.endsWith("\n"))
-        throw new Error(`supervisor plan ${planId} has a partial event`);
+        throw new Error(`governor plan ${planId} has a partial event`);
     const lines = body.split("\n").filter(Boolean);
     if (lines.length > MAX_EVENTS)
-        throw new Error(`supervisor plan exceeds ${MAX_EVENTS} events`);
+        throw new Error(`governor plan exceeds ${MAX_EVENTS} events`);
     return lines.map((line, index) => {
         let event;
         try {
             event = JSON.parse(line);
         }
         catch (error) {
-            throw new Error(`cannot parse supervisor plan ${planId} event ${index + 1}: ${error.message}`);
+            throw new Error(`cannot parse governor plan ${planId} event ${index + 1}: ${error.message}`);
         }
         validateEvent(event, planId, index + 1);
         return event;
     });
 }
 function validateRequest(request, goalId, planId) {
-    if (request.schema_version !== SUPERVISOR_PLAN_SCHEMA_VERSION ||
+    if (request.schema_version !== GOVERNOR_PLAN_SCHEMA_VERSION ||
         request.id !== planId ||
         request.goal_id !== goalId ||
         !Number.isSafeInteger(request.sequence) ||
@@ -216,11 +230,11 @@ function validateRequest(request, goalId, planId) {
         !WORK_ID.test(request.prior_root_work_id) ||
         !/^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/.test(request.workflow_run_id) ||
         !validTimestamp(request.created_at)) {
-        throw new Error(`supervisor plan request ${planId} has an unsupported schema`);
+        throw new Error(`governor plan request ${planId} has an unsupported schema`);
     }
 }
 function validateProposalEnvelope(proposal, planId) {
-    if (proposal.schema_version !== SUPERVISOR_PLAN_SCHEMA_VERSION ||
+    if (proposal.schema_version !== GOVERNOR_PLAN_SCHEMA_VERSION ||
         proposal.plan_id !== planId ||
         !["apply", "complete", "attention"].includes(proposal.decision) ||
         typeof proposal.rationale !== "string" ||
@@ -231,7 +245,7 @@ function validateProposalEnvelope(proposal, planId) {
         typeof proposal.root !== "string" ||
         proposal.root.length > 32 ||
         !validTimestamp(proposal.proposed_at)) {
-        throw new Error(`supervisor plan proposal ${planId} has an unsupported schema`);
+        throw new Error(`governor plan proposal ${planId} has an unsupported schema`);
     }
     if (proposal.milestone !== undefined) {
         const milestone = proposal.milestone;
@@ -248,12 +262,12 @@ function validateProposalEnvelope(proposal, planId) {
             milestone.acceptance.length < 1 ||
             milestone.acceptance.length > 50 ||
             milestone.acceptance.some((criterion) => typeof criterion !== "string" || criterion.length < 1 || criterion.length > 500)) {
-            throw new Error(`supervisor plan proposal ${planId} milestone is invalid`);
+            throw new Error(`governor plan proposal ${planId} milestone is invalid`);
         }
     }
     if ((proposal.decision === "attention" || proposal.decision === "complete") &&
         (proposal.root !== "" || proposal.work.length > 0 || proposal.milestone !== undefined)) {
-        throw new Error(`supervisor plan proposal ${planId} terminal decision contains work`);
+        throw new Error(`governor plan proposal ${planId} terminal decision contains work`);
     }
     for (const [index, spec] of proposal.work.entries()) {
         if (!spec ||
@@ -272,71 +286,71 @@ function validateProposalEnvelope(proposal, planId) {
             spec.dependencies.length > 50 ||
             spec.dependencies.some((value) => typeof value !== "string" || value.length > 100) ||
             !TEMPLATE_ID.test(spec.template)) {
-            throw new Error(`supervisor plan proposal ${planId} work[${index}] is invalid`);
+            throw new Error(`governor plan proposal ${planId} work[${index}] is invalid`);
         }
     }
 }
 function validateReviewReceipt(receipt, planId) {
     if (!receipt ||
         typeof receipt !== "object" ||
-        receipt.schema_version !== SUPERVISOR_PLAN_SCHEMA_VERSION ||
+        receipt.schema_version !== GOVERNOR_PLAN_SCHEMA_VERSION ||
         receipt.plan_id !== planId ||
         !["passed", "revision_exhausted", "attention", "failed"].includes(receipt.status) ||
         !/^[a-f0-9]{64}$/.test(receipt.candidate_sha256) ||
         !Array.isArray(receipt.rounds) ||
         receipt.rounds.length < 1 ||
-        receipt.rounds.length > MAX_SUPERVISOR_PLAN_REVISION_ROUNDS + 1) {
-        throw new Error(`supervisor plan review ${planId} has an unsupported schema`);
+        receipt.rounds.length > MAX_GOVERNOR_PLAN_REVISION_ROUNDS + 1) {
+        throw new Error(`governor plan review ${planId} has an unsupported schema`);
     }
     validateProposalEnvelope(receipt.final_candidate, planId);
     if (receipt.candidate_sha256 !== candidateDigest(receipt.final_candidate)) {
-        throw new Error(`supervisor plan review ${planId} has invalid candidate digest`);
+        throw new Error(`governor plan review ${planId} has invalid candidate digest`);
     }
     receipt.rounds.forEach((round, index) => {
         validateReviewRound(round, planId, index + 1);
     });
     const finalRound = receipt.rounds.at(-1);
     if (finalRound?.candidate_sha256 !== receipt.candidate_sha256) {
-        throw new Error(`supervisor plan review ${planId} final round does not match its candidate`);
+        throw new Error(`governor plan review ${planId} final round does not match its candidate`);
     }
     if (receipt.status === "passed" && finalRound?.outcome !== "approved") {
-        throw new Error(`supervisor plan review ${planId} passed without approval`);
+        throw new Error(`governor plan review ${planId} passed without approval`);
     }
     if (receipt.status === "attention" && finalRound?.outcome === "approved") {
-        throw new Error(`supervisor plan review ${planId} attention conflicts with approval`);
+        throw new Error(`governor plan review ${planId} attention conflicts with approval`);
     }
 }
 function readFrozenReviewPolicy(coordRoot, goalId) {
-    const path = join(coordRoot, ".harnery", "supervisors", goalId, "intent.json");
+    const path = join(coordRoot, ".harnery", "governors", goalId, "intent.json");
     if (!existsSync(path))
         return undefined;
-    const intent = readJson(path, "supervisor intent");
+    const intent = readJson(path, "governor intent");
     return intent.replanning?.review;
 }
 function validateReviewReceiptMatchesPolicy(receipt, planId, review) {
     if (receipt.rounds.length > review.max_revision_rounds + 1) {
-        throw new Error(`supervisor plan review ${planId} exceeds the frozen review policy`);
+        throw new Error(`governor plan review ${planId} exceeds the frozen review policy`);
     }
     for (const round of receipt.rounds) {
         if (round.reviewers.length !== review.reviewer_specialists.length) {
-            throw new Error(`supervisor plan review ${planId} does not match the frozen review policy`);
+            throw new Error(`governor plan review ${planId} does not match the frozen review policy`);
         }
         round.reviewers.forEach((reviewer, index) => {
             if (reviewer.specialist !== review.reviewer_specialists[index]) {
-                throw new Error(`supervisor plan review ${planId} does not match the frozen review policy`);
+                throw new Error(`governor plan review ${planId} does not match the frozen review policy`);
             }
         });
         const outcome = aggregateReviewers(round.reviewers);
         if (round.outcome !== outcome) {
-            throw new Error(`supervisor plan review ${planId} has an invalid reviewer outcome`);
+            throw new Error(`governor plan review ${planId} has an invalid reviewer outcome`);
         }
     }
     const finalRound = receipt.rounds.at(-1);
     if (receipt.status === "passed" && finalRound.outcome !== "approved") {
-        throw new Error(`supervisor plan review ${planId} passed without policy approval`);
+        throw new Error(`governor plan review ${planId} passed without policy approval`);
     }
     if (receipt.status === "revision_exhausted" && finalRound.round <= review.max_revision_rounds) {
-        throw new Error(`supervisor plan review ${planId} exhausted before the frozen review limit`);
+        throw new Error(`governor plan review ${planId} exhausted before the frozen review limit`);
     }
 }
 function aggregateReviewers(reviewers) {
@@ -373,11 +387,11 @@ function validateReviewRound(round, planId, sequence) {
         !/^[a-f0-9]{64}$/.test(round.candidate_sha256) ||
         !Array.isArray(round.reviewers) ||
         round.reviewers.length < 1 ||
-        round.reviewers.length > MAX_SUPERVISOR_PLAN_REVIEWERS ||
+        round.reviewers.length > MAX_GOVERNOR_PLAN_REVIEWERS ||
         !["approved", "revise", "attention", "failed"].includes(round.outcome) ||
         (round.revision_workflow_run_id !== undefined &&
             !/^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/.test(round.revision_workflow_run_id))) {
-        throw new Error(`supervisor plan review ${planId} round ${sequence} is invalid`);
+        throw new Error(`governor plan review ${planId} round ${sequence} is invalid`);
     }
     round.reviewers.forEach((reviewer, index) => {
         validateReviewReviewer(reviewer, planId, sequence, index);
@@ -395,7 +409,7 @@ function validateReviewReviewer(reviewer, planId, round, index) {
         reviewer.rationale.length > 2_000 ||
         !Array.isArray(reviewer.findings) ||
         reviewer.findings.length > 50) {
-        throw new Error(`supervisor plan review ${planId} round ${round} reviewer ${index} is invalid`);
+        throw new Error(`governor plan review ${planId} round ${round} reviewer ${index} is invalid`);
     }
     reviewer.findings.forEach((finding, findingIndex) => {
         validateReviewFinding(finding, planId, round, index, findingIndex);
@@ -413,7 +427,7 @@ function validateReviewFinding(finding, planId, round, reviewerIndex, findingInd
         typeof finding.recommendation !== "string" ||
         finding.recommendation.length < 1 ||
         finding.recommendation.length > 1_000) {
-        throw new Error(`supervisor plan review ${planId} round ${round} reviewer ${reviewerIndex} finding ${findingIndex} is invalid`);
+        throw new Error(`governor plan review ${planId} round ${round} reviewer ${reviewerIndex} finding ${findingIndex} is invalid`);
     }
 }
 function summarizeReview(receipt) {
@@ -427,7 +441,7 @@ function summarizeReview(receipt) {
     };
 }
 function validateEvent(event, planId, sequence) {
-    if (event.schema_version !== SUPERVISOR_PLAN_SCHEMA_VERSION ||
+    if (event.schema_version !== GOVERNOR_PLAN_SCHEMA_VERSION ||
         event.plan_id !== planId ||
         event.seq !== sequence ||
         !EVENT_TYPES.has(event.event) ||
@@ -438,19 +452,25 @@ function validateEvent(event, planId, sequence) {
         typeof event.reason !== "string" ||
         event.reason.length < 1 ||
         event.reason.length > 2_000) {
-        throw new Error(`supervisor plan ${planId} event ${sequence} has an unsupported schema`);
+        throw new Error(`governor plan ${planId} event ${sequence} has an unsupported schema`);
     }
     if (event.approval_id !== undefined && !APPROVAL_ID.test(event.approval_id)) {
-        throw new Error(`supervisor plan ${planId} event ${sequence} has an invalid approval id`);
+        throw new Error(`governor plan ${planId} event ${sequence} has an invalid approval id`);
     }
     if (event.root_work_id !== undefined && !WORK_ID.test(event.root_work_id)) {
-        throw new Error(`supervisor plan ${planId} event ${sequence} has an invalid root work id`);
+        throw new Error(`governor plan ${planId} event ${sequence} has an invalid root work id`);
     }
     if (event.work_ids !== undefined) {
         if (!Array.isArray(event.work_ids) || event.work_ids.some((id) => !WORK_ID.test(id))) {
-            throw new Error(`supervisor plan ${planId} event ${sequence} has invalid work ids`);
+            throw new Error(`governor plan ${planId} event ${sequence} has invalid work ids`);
         }
     }
+    if (event.class !== undefined &&
+        event.class !== "environment" &&
+        event.class !== "upstream" &&
+        event.class !== "decision") {
+        throw new Error(`governor plan ${planId} event ${sequence} has an unknown failure class`);
+    }
 }
 function approvalIsResolved(coordRoot, approvalId) {
     const path = join(coordRoot, ".harnery", "approvals", approvalId, "decision.json");
@@ -478,7 +498,7 @@ function readJson(path, label) {
     }
 }
 function plansRoot(coordRoot, goalId) {
-    return join(coordRoot, ".harnery", "supervisors", goalId, "plans");
+    return join(coordRoot, ".harnery", "governors", goalId, "plans");
 }
 function planDir(coordRoot, goalId, planId) {
     return join(plansRoot(coordRoot, goalId), planId);