harnery 0.29.0 → 0.31.0

package/src/commands/tunnel.ts

@@ -7,10 +7,11 @@ function cachePath(tool: string, filename: string): string {
   return resolve(dir, filename);
 }
 
-import { spawn, spawnSync } from "node:child_process";
+import { type ChildProcess, spawn, spawnSync } from "node:child_process";
 import { existsSync, openSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 
+import { resolveBinName } from "../core/config.ts";
 import {
   clearState,
   DEFAULT_INSTANCE,
@@ -62,6 +63,11 @@ interface DownOpts {
   all?: boolean;
 }
 
+interface ReloadOpts {
+  name?: string;
+  all?: boolean;
+}
+
 interface StatusOpts {
   name?: string;
 }
@@ -393,6 +399,49 @@ function tunnelIsAlive(state: TunnelState): boolean {
   return isProcessAlive(state.gate_pid) && providerIsAlive(state);
 }
 
+interface GateSpawnOpts {
+  name: string;
+  gatePort: number;
+  target: string;
+  vhost: string;
+  provider: TunnelProvider;
+  allowedIps: string[];
+  gateLogPath: string;
+}
+
+/**
+ * Spawn the detached gate worker.
+ *
+ * Shared by `up` (fresh start) and `reload` (in-place restart) so both hand the
+ * gate an identical environment and record the same kind of PID. The allowlist
+ * is passed as an env var, which the gate snapshots at module load and never
+ * re-reads — that snapshot is precisely why `reload` has to exist.
+ */
+function spawnGate(o: GateSpawnOpts): ChildProcess {
+  const gateFd = openSync(o.gateLogPath, "a");
+  // `--name`/`--port` on argv mirror the env vars; they're what makes the gate
+  // process distinguishable per-instance in `pgrep -f` (see sweepStrays).
+  const gateProc = spawn(
+    "bun",
+    ["run", gateScriptPath(), "--name", o.name, "--port", String(o.gatePort)],
+    {
+      detached: true,
+      stdio: ["ignore", gateFd, gateFd],
+      env: {
+        ...process.env,
+        HARNERY_TUNNEL_ALLOW: o.allowedIps.join(","),
+        HARNERY_TUNNEL_ACCESS:
+          o.provider === "cloudflare" ? "cloudflare-allowlist" : "trusted-local-proxy",
+        HARNERY_TUNNEL_TARGET: o.target,
+        HARNERY_TUNNEL_VHOST: o.vhost,
+        HARNERY_TUNNEL_PORT: String(o.gatePort),
+      },
+    },
+  );
+  gateProc.unref();
+  return gateProc;
+}
+
 async function up(opts: UpOpts): Promise<void> {
   if (!bunAvailable()) {
     emit.error({
@@ -463,27 +512,15 @@ async function up(opts: UpOpts): Promise<void> {
   writeFileSync(gateLogPath, "");
   writeFileSync(providerLogPath, "");
 
-  const gateFd = openSync(gateLogPath, "a");
-  // `--name`/`--port` on argv mirror the env vars; they're what makes the gate
-  // process distinguishable per-instance in `pgrep -f` (see sweepStrays).
-  const gateProc = spawn(
-    "bun",
-    ["run", gateScriptPath(), "--name", name, "--port", String(gatePort)],
-    {
-      detached: true,
-      stdio: ["ignore", gateFd, gateFd],
-      env: {
-        ...process.env,
-        HARNERY_TUNNEL_ALLOW: cfg.allowed_ips.join(","),
-        HARNERY_TUNNEL_ACCESS:
-          provider === "cloudflare" ? "cloudflare-allowlist" : "trusted-local-proxy",
-        HARNERY_TUNNEL_TARGET: target,
-        HARNERY_TUNNEL_VHOST: vhost,
-        HARNERY_TUNNEL_PORT: String(gatePort),
-      },
-    },
-  );
-  gateProc.unref();
+  const gateProc = spawnGate({
+    name,
+    gatePort,
+    target,
+    vhost,
+    provider,
+    allowedIps: cfg.allowed_ips,
+    gateLogPath,
+  });
 
   await sleep(800);
 
@@ -658,6 +695,156 @@ function down(opts: DownOpts): void {
   );
 }
 
+/** Poll until `port` has no LISTEN socket (or the deadline passes). */
+async function waitForPortFree(port: number, timeoutMs: number): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (!listeningPorts().has(port)) return true;
+    await sleep(100);
+  }
+  return !listeningPorts().has(port);
+}
+
+/** Poll until `port` has a LISTEN socket (or the deadline passes). */
+async function waitForPortBound(port: number, timeoutMs: number): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (listeningPorts().has(port)) return true;
+    await sleep(100);
+  }
+  return listeningPorts().has(port);
+}
+
+/**
+ * Restart ONE instance's gate in place, deliberately leaving the provider
+ * process running.
+ *
+ * That asymmetry is the whole point. A Cloudflare quick tunnel's hostname is
+ * minted by cloudflared at startup, so a full `down`/`up` hands back a NEW
+ * random *.trycloudflare.com URL and breaks every link already shared — a
+ * miserable trade for adding one IP. cloudflared only ever forwards to
+ * `localhost:<gate_port>`, so the gate beneath it can be swapped out and the
+ * edge reconnects without noticing.
+ */
+export async function reloadOne(state: TunnelState): Promise<{ ok: boolean; message: string }> {
+  const bin = resolveBinName();
+  const name = state.name;
+  const gatePort = state.gate_port;
+
+  if (!providerIsAlive(state)) {
+    return {
+      ok: false,
+      message:
+        `[${name}] the provider process is gone, so the public URL is already dead. ` +
+        `Reloading the gate can't bring it back — run \`${bin} tunnel up --name ${name}\`.`,
+    };
+  }
+  if (!bunAvailable()) {
+    return { ok: false, message: `[${name}] bun is not on PATH, so the gate can't be respawned.` };
+  }
+
+  // Kill ONLY the gate. sweepStrays() is deliberately avoided here: it also
+  // matches `--url http://localhost:<port>`, which is the provider process we
+  // are going out of our way to keep alive.
+  const killed = new Set<number>();
+  if (isProcessAlive(state.gate_pid)) {
+    try {
+      process.kill(state.gate_pid);
+      killed.add(state.gate_pid);
+    } catch {
+      /* race: already gone */
+    }
+  }
+  killByPattern(`gate\\.ts.*--port ${gatePort}( |$)`, killed);
+
+  if (!(await waitForPortFree(gatePort, 5_000))) {
+    return {
+      ok: false,
+      message:
+        `[${name}] port ${gatePort} never released, so the old gate looks wedged. ` +
+        `Tunnel is down; check \`${bin} tunnel status\`.`,
+    };
+  }
+
+  const cfg = readConfig();
+  const gateProc = spawnGate({
+    name,
+    gatePort,
+    target: state.target,
+    vhost: state.vhost,
+    provider: state.provider,
+    allowedIps: cfg.allowed_ips,
+    gateLogPath: cachePath("tunnel", gateLogFile(name)),
+  });
+
+  await sleep(800);
+  const pid = gateProc.pid;
+  if (
+    typeof pid !== "number" ||
+    !isProcessAlive(pid) ||
+    !(await waitForPortBound(gatePort, 5_000))
+  ) {
+    return {
+      ok: false,
+      message:
+        `[${name}] the gate did not come back on port ${gatePort}. ` +
+        `Tunnel is down; check \`${bin} tunnel logs --name ${name}\`.`,
+    };
+  }
+
+  writeState({ ...state, gate_pid: pid });
+  const allowNote =
+    state.provider === "cloudflare" ? ` Allowlist: ${cfg.allowed_ips.length} IP(s).` : "";
+  return { ok: true, message: `[${name}] gate reloaded, URL unchanged: ${state.url}.${allowNote}` };
+}
+
+async function reload(opts: ReloadOpts): Promise<void> {
+  const bin = resolveBinName();
+
+  if (opts.all) {
+    const all = listStates();
+    // Only live tunnels are reloadable, and a box commonly accumulates stale
+    // state files from long-dead runs. Reporting those as failures would make
+    // the common post-`allow add` path exit non-zero for no real reason.
+    const live = all.filter((s) => providerIsAlive(s));
+    const stale = all.length - live.length;
+    if (live.length === 0) {
+      emit.text(
+        all.length === 0
+          ? "No tunnels up. Nothing to reload.\n"
+          : `No live tunnels to reload (${all.length} stale). Start one with \`${bin} tunnel up\`.\n`,
+      );
+      return;
+    }
+    let failed = 0;
+    for (const s of live) {
+      const r = await reloadOne(s);
+      emit.text(`${r.ok ? "ok  " : "FAIL"} ${r.message}\n`);
+      if (!r.ok) failed++;
+    }
+    emit.text(
+      `Reloaded ${live.length - failed} of ${live.length} live tunnel(s)` +
+        (stale > 0 ? `; skipped ${stale} stale.\n` : ".\n"),
+    );
+    if (failed > 0) process.exitCode = 1;
+    return;
+  }
+
+  const name = resolveName(opts.name);
+  const state = readState(name);
+  if (!state) {
+    emit.error({
+      code: "tunnel_not_found",
+      message: `No tunnel state for [${name}]. Start it with \`${bin} tunnel up --name ${name}\`.`,
+    });
+    process.exit(1);
+    return;
+  }
+  const r = await reloadOne(state);
+  emit.text(`${r.message}\n`);
+  if (!r.ok) process.exit(1);
+}
+
 function instanceState(state: TunnelState): "up" | "stale" {
   return tunnelIsAlive(state) ? "up" : "stale";
 }
@@ -772,6 +959,23 @@ function allowList(): void {
   for (const ip of cfg.allowed_ips) emit.text(`${ip}\n`);
 }
 
+/**
+ * Trailer for `allow add`/`allow rm`. Each gate snapshots the allowlist at
+ * spawn, so a config edit alone changes nothing until the gates restart.
+ * Only LIVE tunnels are listed — stale state files pile up on a long-running
+ * box, and naming nine dead instances made the old hint read like nine
+ * restarts were owed.
+ */
+function allowChangedHint(): void {
+  const live = listStates().filter((s) => s.provider === "cloudflare" && providerIsAlive(s));
+  if (live.length === 0) return;
+  emit.text(
+    `Each gate reads the allowlist once at start, so this applies on reload ` +
+      `(${live.map((s) => s.name).join(", ")}):\n` +
+      `  ${resolveBinName()} tunnel reload --all\n`,
+  );
+}
+
 function allowAdd(ip: string): void {
   const cfg = readConfig();
   if (cfg.allowed_ips.includes(ip)) {
@@ -781,12 +985,7 @@ function allowAdd(ip: string): void {
   cfg.allowed_ips.push(ip);
   writeConfig(cfg);
   emit.text(`Added ${ip}.\n`);
-  const up = listStates().filter((s) => s.provider === "cloudflare");
-  if (up.length > 0) {
-    emit.text(
-      `Cloudflare allowlist is shared across Cloudflare tunnels; restart each to apply (${up.map((s) => s.name).join(", ")}).\n`,
-    );
-  }
+  allowChangedHint();
 }
 
 function allowRm(ip: string): void {
@@ -799,12 +998,7 @@ function allowRm(ip: string): void {
   cfg.allowed_ips.splice(idx, 1);
   writeConfig(cfg);
   emit.text(`Removed ${ip}.\n`);
-  const up = listStates().filter((s) => s.provider === "cloudflare");
-  if (up.length > 0) {
-    emit.text(
-      `Cloudflare allowlist is shared across Cloudflare tunnels; restart each to apply (${up.map((s) => s.name).join(", ")}).\n`,
-    );
-  }
+  allowChangedHint();
 }
 
 let emit: EmitContext;
@@ -858,6 +1052,15 @@ export function registerTunnelCommand(
     .option("--all", "stop every running tunnel")
     .action(down);
 
+  cmd
+    .command("reload")
+    .description(
+      "Restart an instance's gate in place to pick up allowlist changes, keeping the public URL",
+    )
+    .option("--name <name>", "instance to reload", DEFAULT_INSTANCE)
+    .option("--all", "reload every live tunnel")
+    .action(reload);
+
   cmd
     .command("status")
     .description("Show tunnel state: a table of all instances, or detail for one via --name")

package/src/commands/web-fetch.ts

@@ -16,7 +16,7 @@ import type { EmitContext } from "../commander.ts";
  * harnery repo at the *matching version tag* into a cache dir and install the
  * web app's deps. Subsequent runs reuse the cache.
  *
- * The only thing `web/` pulls from `src/` is `harnery/core/scratch` (a single,
+ * The only thing `web/` pulls from `src/` is `harnery/core/journal` (a single,
  * dependency-free module), so the install is `web/` deps only: no root install,
  * no Playwright browser download.
  */

package/src/commands/web.ts

@@ -32,6 +32,41 @@ function webRoot(): string {
   return path.resolve(here, "..", "..", "web");
 }
 
+/** Default V8 old-space ceiling (MB) for the dashboard server. */
+const DEFAULT_MAX_OLD_SPACE_MB = 2048;
+
+/**
+ * Resolve the V8 old-space ceiling for the dashboard process.
+ *
+ * Next sizes `--max-old-space-size` to roughly half of system RAM when the
+ * flag is absent, which on a large machine hands a long-lived dashboard a
+ * ceiling it will never approach — so V8 never feels enough pressure to run a
+ * major GC and the process settles at a multi-gigabyte working set made mostly
+ * of collectable garbage. Pinning a modest ceiling restores that pressure.
+ *
+ * Precedence: explicit flag → `HARNERY_WEB_MAX_OLD_SPACE` → the default.
+ * `0` (or any non-positive value) opts out and restores Next's own sizing.
+ */
+export function resolveMaxOldSpaceMb(flag?: string): number {
+  const raw = flag ?? process.env.HARNERY_WEB_MAX_OLD_SPACE;
+  if (raw === undefined || raw === "") return DEFAULT_MAX_OLD_SPACE_MB;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n <= 0) return 0;
+  return Math.floor(n);
+}
+
+/**
+ * Append the heap ceiling to any inherited `NODE_OPTIONS`. Next only supplies
+ * its own `--max-old-space-size` when the flag is absent, so appending here
+ * wins without clobbering flags the caller set (source maps, inspector, …).
+ */
+export function nodeOptionsWithHeapCap(mb: number): string | undefined {
+  const inherited = process.env.NODE_OPTIONS ?? "";
+  if (mb <= 0) return inherited || undefined;
+  if (/--max-old-space-size[=\s]/.test(inherited)) return inherited;
+  return `${inherited} --max-old-space-size=${mb}`.trim();
+}
+
 /**
  * Resolve the web app root. A local `web/` (source checkout / submodule) wins.
  * Otherwise, on an npm install, lazy-fetch it (clone + install) unless the
@@ -57,6 +92,7 @@ interface UpOpts {
   coordRoot?: string;
   prod?: boolean;
   fetch?: boolean;
+  maxOldSpace?: string;
 }
 
 export function registerWebCommand(program: Command, emit: EmitContext): void {
@@ -77,6 +113,10 @@ export function registerWebCommand(program: Command, emit: EmitContext): void {
     )
     .option("--prod", "Use next start instead of next dev (requires prior build)")
     .option("--no-fetch", "Don't auto-fetch the dashboard if it's missing (npm installs)")
+    .option(
+      "--max-old-space <mb>",
+      `V8 old-space ceiling in MB; 0 restores Next's own sizing (default ${DEFAULT_MAX_OLD_SPACE_MB}, env HARNERY_WEB_MAX_OLD_SPACE)`,
+    )
     .action(async (opts: UpOpts) => {
       const root = resolveWebRoot(emit, opts.fetch !== false);
       if (!root) {
@@ -101,8 +141,11 @@ export function registerWebCommand(program: Command, emit: EmitContext): void {
         }
       }
 
+      const heapMb = resolveMaxOldSpaceMb(opts.maxOldSpace);
       emit.log(`harn web · http://localhost:${port} (${mode})`, "info");
+      emit.log(`files origin · http://harnery-files.localhost:${port}`, "info");
       emit.log(`reading .harnery/ from: ${coordRoot}`, "info");
+      if (heapMb > 0) emit.log(`heap ceiling · ${heapMb} MB`, "info");
 
       const child = spawn(webRunner(), ["run", mode], {
         cwd: root,
@@ -110,6 +153,9 @@ export function registerWebCommand(program: Command, emit: EmitContext): void {
           ...process.env,
           HARNERY_COORD_ROOT: coordRoot,
           HARNERY_WEB_PORT: port,
+          ...(nodeOptionsWithHeapCap(heapMb)
+            ? { NODE_OPTIONS: nodeOptionsWithHeapCap(heapMb) as string }
+            : {}),
         },
         stdio: "inherit",
       });
@@ -154,7 +200,11 @@ export function registerWebCommand(program: Command, emit: EmitContext): void {
     .option("-p, --port <port>", "Listen port", "9000")
     .option("--coord-root <dir>", "Override the coord root")
     .option("--no-fetch", "Don't auto-fetch the dashboard if it's missing (npm installs)")
-    .action((opts: { port: string; coordRoot?: string; fetch?: boolean }) => {
+    .option(
+      "--max-old-space <mb>",
+      `V8 old-space ceiling in MB; 0 restores Next's own sizing (default ${DEFAULT_MAX_OLD_SPACE_MB}, env HARNERY_WEB_MAX_OLD_SPACE)`,
+    )
+    .action((opts: { port: string; coordRoot?: string; fetch?: boolean; maxOldSpace?: string }) => {
       const root = resolveWebRoot(emit, opts.fetch !== false);
       if (!root) {
         process.exitCode = 1;
@@ -172,8 +222,10 @@ export function registerWebCommand(program: Command, emit: EmitContext): void {
       }
       const coordRoot = opts.coordRoot ?? process.cwd();
       const port = String(opts.port);
+      const heapMb = resolveMaxOldSpaceMb(opts.maxOldSpace);
       emit.log(`harn web · http://localhost:${port} (start)`, "info");
       emit.log(`reading .harnery/ from: ${coordRoot}`, "info");
+      if (heapMb > 0) emit.log(`heap ceiling · ${heapMb} MB`, "info");
 
       const child = spawn(webRunner(), ["run", "start"], {
         cwd: root,
@@ -181,6 +233,9 @@ export function registerWebCommand(program: Command, emit: EmitContext): void {
           ...process.env,
           HARNERY_COORD_ROOT: coordRoot,
           HARNERY_WEB_PORT: port,
+          ...(nodeOptionsWithHeapCap(heapMb)
+            ? { NODE_OPTIONS: nodeOptionsWithHeapCap(heapMb) as string }
+            : {}),
         },
         stdio: "inherit",
       });

package/src/commands/work.ts

@@ -1,12 +1,13 @@
 import { resolve } from "node:path";
 import type { Command } from "commander";
 import type { EmitContext } from "../commander.ts";
-import { workflowSubscriptionOnly } from "../core/config.ts";
 import {
-  createBuiltinHarnessRegistry,
-  harnessProofInputs,
+  adapterProofInputs,
+  createBuiltinAdapterRegistry,
   probeBinaryVersion,
-} from "../core/harnesses/index.ts";
+} from "../core/adapters/index.ts";
+import { workflowSubscriptionOnly } from "../core/config.ts";
+import { findCompletedMissionGoverning, reopenGovernorMission } from "../core/governor/index.ts";
 import { findCoordRoot } from "../core/hooks/resolve/coord-root.ts";
 import type { PolicyIsolation } from "../core/policy/index.ts";
 import { loadPolicyFile } from "../core/policy/index.ts";
@@ -30,6 +31,7 @@ interface WorkCreateOpts {
   accept?: string[];
   dependsOn?: string;
   maxAttempts?: string;
+  maxUnchargedAttempts?: string;
   sourceKind?: "human" | "workflow" | "external";
   sourceRef?: string;
   actor?: string;
@@ -37,7 +39,7 @@ interface WorkCreateOpts {
 }
 
 interface WorkRunOpts {
-  harness?: string;
+  adapter?: string;
   maxAgents?: string;
   concurrency?: string;
   cwd?: string;
@@ -59,11 +61,11 @@ interface GovernanceOpts {
   dispose?: string[];
 }
 
-const MAX_ATTEMPT_JOURNAL_ERROR_RENDER = 240;
+const MAX_ATTEMPT_TRANSCRIPT_ERROR_RENDER = 240;
 
 export function registerWorkCommand(program: Command, emit: EmitContext): void {
-  const registry = createBuiltinHarnessRegistry();
-  const harnesses = registry.ids();
+  const registry = createBuiltinAdapterRegistry();
+  const adapters = registry.ids();
   const work = program
     .command("work")
     .description("Track durable objectives across bounded workflow attempts.");
@@ -75,7 +77,11 @@ export function registerWorkCommand(program: Command, emit: EmitContext): void {
     .option("--id <work-id>", "Stable work id (generated by default)")
     .option("--accept <text>", "Acceptance statement; repeat for more than one", collect, [])
     .option("--depends-on <ids>", "Comma-separated prerequisite work ids")
-    .option("--max-attempts <n>", "Attempt ceiling (default 3)")
+    .option("--max-attempts <n>", "Charged-attempt ceiling (default 3)")
+    .option(
+      "--max-uncharged-attempts <n>",
+      "Ceiling on consecutive uncharged upstream attempts (default 3)",
+    )
     .option("--source-kind <kind>", "human | workflow | external", "human")
     .option("--source-ref <ref>", "Bounded source reference")
     .option("--actor <name>", "Actor recorded in the creation receipt")
@@ -91,6 +97,9 @@ export function registerWorkCommand(program: Command, emit: EmitContext): void {
           acceptance: opts.accept,
           dependencies: splitIds(opts.dependsOn),
           maxAttempts: opts.maxAttempts ? Number.parseInt(opts.maxAttempts, 10) : undefined,
+          maxUnchargedAttempts: opts.maxUnchargedAttempts
+            ? Number.parseInt(opts.maxUnchargedAttempts, 10)
+            : undefined,
           source: opts.sourceKind ? { kind: opts.sourceKind, ref: opts.sourceRef } : undefined,
           actor: opts.actor,
         });
@@ -150,8 +159,8 @@ export function registerWorkCommand(program: Command, emit: EmitContext): void {
       });
     });
 
-  registerRunCommand(work, "run", false, registry, harnesses, emit);
-  registerRunCommand(work, "retry", true, registry, harnesses, emit);
+  registerRunCommand(work, "run", false, registry, adapters, emit);
+  registerRunCommand(work, "retry", true, registry, adapters, emit);
   registerGovernanceCommand(work, "accept", emit);
   registerGovernanceCommand(work, "cancel", emit);
   registerGovernanceCommand(work, "reopen", emit);
@@ -161,8 +170,8 @@ function registerRunCommand(
   work: Command,
   name: "run" | "retry",
   retry: boolean,
-  registry: ReturnType<typeof createBuiltinHarnessRegistry>,
-  harnesses: string[],
+  registry: ReturnType<typeof createBuiltinAdapterRegistry>,
+  adapters: string[],
   emit: EmitContext,
 ): void {
   work
@@ -175,8 +184,8 @@ function registerRunCommand(
     .option("--max-agents <n>", "Total-agent ceiling for the workflow")
     .option("--concurrency <n>", "Concurrent-subagent cap")
     .option("--cwd <dir>", "Working directory children spawn in")
-    .option("--harness <name>", `Default harness: ${harnesses.join(" | ")}`)
-    .option("--subscription-only", "Require stored harness-login billing")
+    .option("--adapter <name>", `Default adapter: ${adapters.join(" | ")}`)
+    .option("--subscription-only", "Require stored adapter-login billing")
     .option("--allow-api-billing", "Permit API-key override billing")
     .option("--policy <file>", "Host policy JSON/JSONC")
     .option("--isolation <mode>", "shared | worktree | sandbox | remote")
@@ -186,8 +195,8 @@ function registerRunCommand(
     .option("--json", "Emit the workflow report or parked result as JSON")
     .action(async (workId: string, opts: WorkRunOpts) => {
       await withWorkRootAsync(emit, async (coordRoot) => {
-        if (opts.harness && !registry.get(opts.harness)) {
-          throw new Error(`unknown harness ${JSON.stringify(opts.harness)}`);
+        if (opts.adapter && !registry.get(opts.adapter)) {
+          throw new Error(`unknown adapter ${JSON.stringify(opts.adapter)}`);
         }
         if (opts.workspaceRoot && opts.isolation !== "worktree") {
           throw new Error("--workspace-root requires --isolation worktree");
@@ -211,14 +220,14 @@ function registerRunCommand(
             actor: opts.actor,
             engine: {
               spawners: registry.spawners(),
-              defaultHarness: opts.harness,
+              defaultAdapter: opts.adapter,
               maxAgents: opts.maxAgents ? Number.parseInt(opts.maxAgents, 10) : undefined,
               concurrency: opts.concurrency ? Number.parseInt(opts.concurrency, 10) : undefined,
               cwd: opts.cwd,
               subscriptionOnly:
                 opts.subscriptionOnly === true ? true : workflowSubscriptionOnly(coordRoot),
               allowApiBilling: opts.allowApiBilling,
-              ...harnessProofInputs(
+              ...adapterProofInputs(
                 registry.list().map((adapter) => adapter.profile),
                 { versionProbe: probeBinaryVersion },
               ),
@@ -258,7 +267,7 @@ function registerRunCommand(
                 workId,
                 runId: error.runId,
                 approvalId: error.approvalId,
-                journalPath: error.journalPath,
+                transcriptPath: error.transcriptPath,
               });
             } else {
               emit.text(
@@ -312,16 +321,30 @@ function registerGovernanceCommand(
     withWorkRoot(emit, (coordRoot) => {
       const fn =
         name === "accept" ? acceptWorkItem : name === "cancel" ? cancelWorkItem : reopenWorkItem;
-      emitWork(
-        fn(coordRoot, workId, {
-          ...opts,
-          ...(opts.finding?.length ? { findings: opts.finding } : {}),
-          ...(opts.dispose?.length ? { dispositions: opts.dispose.map(parseDisposition) } : {}),
-        }),
-        opts.json,
-        emit,
-        true,
-      );
+      // ADR 0050: a reopen under a mission that already succeeded has to reopen the
+      // mission too, or the item lands in ready_work that the governor will never
+      // dispatch. Resolve the goal BEFORE touching the work item so a refusal leaves
+      // nothing half-done.
+      const goalId =
+        name === "reopen" ? findCompletedMissionGoverning(coordRoot, workId) : undefined;
+      const record = fn(coordRoot, workId, {
+        ...opts,
+        ...(opts.finding?.length ? { findings: opts.finding } : {}),
+        ...(opts.dispose?.length ? { dispositions: opts.dispose.map(parseDisposition) } : {}),
+      });
+      if (goalId) {
+        reopenGovernorMission({
+          coordRoot,
+          goalId,
+          actor: opts.actor,
+          reason: opts.reason?.trim() || `work ${workId} was reopened after mission completion`,
+        });
+        emit.log(
+          `mission ${goalId} had completed; its completion was reopened so ${workId} can be dispatched`,
+          "warn",
+        );
+      }
+      emitWork(record, opts.json, emit, true);
     });
   });
 }
@@ -374,7 +397,7 @@ function emitWork(
     `objective: ${record.intent.objective}`,
     `reason: ${projection.reason}`,
     `next: ${projection.next_action}`,
-    `attempts: ${projection.attempts_used}/${record.intent.max_attempts}`,
+    `attempts: ${renderAttemptBudget(record)}`,
   ];
   if (record.intent.dependencies.length)
     lines.push(`depends on: ${record.intent.dependencies.join(", ")}`);
@@ -391,22 +414,33 @@ function emitWork(
 
 export function renderAttemptRow(attempt: WorkAttempt): string {
   const statusDetail =
-    attempt.status === "journal_unreadable"
-      ? `: ${renderAttemptJournalError(attempt.journal_error)}`
+    attempt.status === "transcript_unreadable"
+      ? `: ${renderAttemptTranscriptError(attempt.transcript_error)}`
       : "";
   return `  ${attempt.number}. ${attempt.run_id}  ${attempt.status}${statusDetail}`;
 }
 
-function renderAttemptJournalError(error: string | undefined): string {
+function renderAttemptTranscriptError(error: string | undefined): string {
   const normalized = (error ?? "").replace(/\s+/g, " ").trim();
-  const value = normalized || "unknown journal read error";
-  if (value.length <= MAX_ATTEMPT_JOURNAL_ERROR_RENDER) return value;
-  return `${value.slice(0, MAX_ATTEMPT_JOURNAL_ERROR_RENDER - 3).trimEnd()}...`;
+  const value = normalized || "unknown transcript read error";
+  if (value.length <= MAX_ATTEMPT_TRANSCRIPT_ERROR_RENDER) return value;
+  return `${value.slice(0, MAX_ATTEMPT_TRANSCRIPT_ERROR_RENDER - 3).trimEnd()}...`;
 }
 
 function renderWorkRow(record: WorkRecord): string {
   const projection = record.projection;
-  return `${record.intent.id}  ${projection.state.padEnd(17)}  ${projection.attempts_used}/${record.intent.max_attempts}  ${projection.next_action.padEnd(21)}  ${record.intent.title}`;
+  return `${record.intent.id}  ${projection.state.padEnd(17)}  ${renderAttemptBudget(record).padEnd(18)}  ${projection.next_action.padEnd(21)}  ${record.intent.title}`;
+}
+
+// `max_attempts` budgets CHARGED attempts (ADR 0046), so the budget is
+// charged/max, not the raw attempt count. When uncharged environment/upstream
+// attempts happened, surface them as a suffix rather than folding them into the
+// numerator, where they would read as spent budget the item still has.
+export function renderAttemptBudget(record: WorkRecord): string {
+  const { charged_attempts, attempts_used } = record.projection;
+  const uncharged = attempts_used - charged_attempts;
+  const base = `${charged_attempts}/${record.intent.max_attempts}`;
+  return uncharged > 0 ? `${base} (+${uncharged} uncharged)` : base;
 }
 
 function withWorkRoot(emit: EmitContext, fn: (coordRoot: string) => void): void {