nccgs 2.1.1 → 3.0.0-rc.2

package/.claude/nccgs/tools/orchestration.mjs

@@ -1,680 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import crypto from "node:crypto";
-import { spawnSync } from "node:child_process";
-import { artifact, atomicJson, contained, hash, json, loadPipeline, resolveExecution, verifyArtifact } from "./policy.mjs";
-import { snapshot, taskPath, check } from "./gates.mjs";
-import { acquireLock } from "./process-lock.mjs";
-import { deliveryBudget, requireDeliveryRoom, dispatchPurpose, requireEarlyCheckpoint } from "./delivery-budget.mjs";
-import { pinRepairPacket, verifyRepairPacket, repairPrompt, repairToolScope } from "./repair-packet.mjs";
-import { requireDesignReady } from "./design-readiness.mjs";
-import { handoffTemplate } from "./review-handoff.mjs";
-import { activeSessionBudget } from "./session-budget.mjs";
-import { plannedDispatchBudget } from "./review-budget.mjs";
-import { captureUnityRepairScope, verifyUnityRepairScope, unityEditorInvocation, blockedUnityScene } from "./unity-repair.mjs";
-import { validateSlicePlan, readSlicePlan, validateSliceRevision, sliceProgress, bindSlice, slicePromptContext, nextSliceRequest, sliceHash, sameSlice } from "./task-slices.mjs";
-
-const ledgerPath = ".nccgs/orchestration.json";
-const ledgerMarker = ".nccgs/orchestration.initialized.json";
-const kinds = ["implementation", "analysis", "review"];
-const states = ["reserved", "running", "uncertain", "completed", "failed", "cancelled"];
-const active = item => ["reserved", "running", "uncertain"].includes(item.status);
-const need = (condition, message) => { if (!condition) throw new Error(message); };
-const now = () => new Date().toISOString();
-const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
-function taskRecord(project, id) {
-  const task = json(taskPath(project, id));
-  need(task.schemaVersion === 2 && task.id === id, "Managed dispatch requires a standalone schema-2 task");
-  need(typeof task.contractHash === "string" && task.contractHash.length > 0, "Task contract hash missing");
-  return task;
-}
-function load(project) {
-  const file = contained(project, ledgerPath);
-  if (!fs.existsSync(file)) {
-    need(!fs.existsSync(contained(project, ledgerMarker)), "Orchestration ledger missing after initialization; restore history, never reset budgets");
-    return { schemaVersion: 1, tasks: {}, dispatches: {}, events: [] };
-  }
-  const ledger = json(file);
-  need(ledger.schemaVersion === 1 && ledger.tasks && ledger.dispatches && Array.isArray(ledger.events), "Invalid orchestration ledger; do not reset missing/corrupt history");
-  for (const [id, d] of Object.entries(ledger.dispatches))
-    need(d.id === id && ledger.tasks[d.taskId] && kinds.includes(d.kind) && states.includes(d.status) && d.requestKey && d.requestHash, "Corrupt dispatch ledger");
-  const reserved = ledger.events.filter(event => event.action === "reserve");
-  need(reserved.length === Object.keys(ledger.dispatches).length && new Set(reserved.map(e => e.dispatchId)).size === reserved.length, "Corrupt ledger reservation history");
-  for (const event of ledger.events) if (event.dispatchId) need(ledger.dispatches[event.dispatchId], "Corrupt ledger: event refers to missing dispatch");
-  for (const event of reserved) need(ledger.dispatches[event.dispatchId]?.taskId === event.taskId, "Corrupt ledger reservation identity");
-  const plans = new Map();
-  for (const event of ledger.events.filter(e => e.action === "slice-plan")) {
-    need(ledger.tasks[event.taskId] && event.planId && event.requestHash && event.reference?.path?.startsWith(".nccgs/evidence/slices/"), "Corrupt slice-plan history");
-    verifyArtifact(project, event.reference); plans.set(event.taskId, event);
-  }
-  for (const [id, entry] of Object.entries(ledger.tasks)) {
-    const latest = plans.get(id);
-    need(Boolean(entry.slicePlan) === Boolean(latest) && (!latest || same(entry.slicePlan, { planId: latest.planId, requestHash: latest.requestHash, reference: latest.reference })), "Slice-plan history missing or detached; restore it, never reset planned work");
-  }
-  return ledger;
-}
-function transaction(project, action) {
-  const lock = acquireLock(contained(project, ".nccgs/orchestration.lock"));
-  try {
-    const ledger = load(project), result = action(ledger);
-    // Marker first: a crash between these writes fails closed until recovery.
-    if (!fs.existsSync(contained(project, ledgerMarker))) atomicJson(contained(project, ledgerMarker), { schemaVersion: 1, initializedAt: now() });
-    atomicJson(contained(project, ledgerPath), ledger);
-    return result;
-  } finally { lock.release(); }
-}
-function chain(project, id, ledger, request = {}) {
-  const ids = [], seen = new Set();
-  for (let cursor = id; cursor;) {
-    need(!seen.has(cursor), "Task parent cycle"); seen.add(cursor);
-    const task = taskRecord(project, cursor);
-    need(task.parentId == null || typeof task.parentId === "string", "Invalid task parent");
-    const existing = Object.hasOwn(ledger.tasks, cursor) ? ledger.tasks[cursor] : null;
-    if (existing) {
-      need((existing.parentId ?? null) === (task.parentId ?? null), "Task parent changed; cannot detach spent budget");
-      if (cursor === id && request.limits) {
-        for (const [key, value] of Object.entries(request.limits)) need(existing.limits[key] === value, "Dispatch limits are pinned; do not reset/increase budget through a new request");
-      }
-    } else {
-      const limits = { maxDispatches: { FAST: task.contract?.deliveryReserve ? 6 : 4, STANDARD: 12, CONTROLLED: 24 }[task.risk] ?? 12, maxDurationMs: null, maxCostUsd: null,
-        ...(cursor === id ? request.limits : {}) };
-      need(Object.keys(limits).every(k => ["maxDispatches", "maxDurationMs", "maxCostUsd"].includes(k)), "Unknown dispatch budget field");
-      need(Number.isSafeInteger(limits.maxDispatches) && limits.maxDispatches > 0 && limits.maxDispatches <= 1000, "Invalid maxDispatches budget");
-      for (const key of ["maxDurationMs", "maxCostUsd"]) need(limits[key] === null || (Number.isFinite(limits[key]) && limits[key] > 0), `Invalid ${key} budget`);
-      const deliveryReserve = task.contract?.deliveryReserve ?? null;
-      if (deliveryReserve) need(limits.maxDispatches > Object.values(deliveryReserve).reduce((a, b) => a + b, 0), "Dispatch budget cannot fit delivery plus protected repair/QA/review slots");
-      ledger.tasks[cursor] = { parentId: task.parentId ?? null, limits, deliveryReserve, registeredAt: now() };
-    }
-    ids.push(cursor); cursor = task.parentId ?? null;
-  }
-  return ids;
-}
-function belongs(ledger, candidate, ancestor) {
-  const seen = new Set();
-  for (let id = candidate; id; id = ledger.tasks[id]?.parentId) {
-    need(!seen.has(id), "Ledger parent cycle"); seen.add(id);
-    if (id === ancestor) return true;
-  }
-  return false;
-}
-function metric(items, name) {
-  const values = items.map(d => d.telemetry?.[name]).filter(v => Number.isFinite(v) && v >= 0);
-  return { total: items.length > 0 && values.length === items.length ? values.reduce((a, b) => a + b, 0) : null,
-    knownSubtotal: values.reduce((a, b) => a + b, 0), measured: values.length, expected: items.length,
-    coverage: items.length ? values.length / items.length : null };
-}
-function telemetryFrom(ledger, id, project) {
-  const items = Object.values(ledger.dispatches).filter(d => belongs(ledger, d.taskId, id));
-  for (const d of items) if (d.runtime) {
-    const trace = json(verifyArtifact(project, d.runtime));
-    verifyArtifact(project, trace.observationSource);
-  }
-  const started = items.filter(d => d.startedAt);
-  return { taskId: id, reservations: items.length, attempts: started.length,
-    metrics: Object.fromEntries(["durationMs", "toolUseCount", "totalTokens", "costUsd"].map(name => [name, metric(started, name)])),
-    outcomes: Object.fromEntries(states.map(name => [name, items.filter(d => d.status === name).length])) };
-}
-function overlap(a, b) { a = a.toLowerCase(); b = b.toLowerCase(); return a === b || a.startsWith(b + "/") || b.startsWith(a + "/"); }
-function validPaths(project, paths) {
-  need(Array.isArray(paths) && paths.every(p => typeof p === "string"), "writePaths must be an explicit array");
-  for (const p of paths) {
-    contained(project, p);
-    need(!/^\.(?:nccgs|claude)(?:\/|$)/i.test(p), "Dispatch cannot own framework governance state; use task CLI and evidence artifacts");
-  }
-  return [...new Set(paths)].sort();
-}
-
-function sliceCapacity(project, ledger, ancestors) {
-  return ancestors.map(ancestor => {
-    const entry = ledger.tasks[ancestor], items = Object.values(ledger.dispatches).filter(d => belongs(ledger, d.taskId, ancestor));
-    let pending = 0, minimumReviews = 0;
-    for (const [id] of Object.entries(ledger.tasks).filter(([id, e]) => e.slicePlan && belongs(ledger, id, ancestor))) {
-      const task = taskRecord(project, id), progress = sliceProgress(project, task, ledger);
-      pending += progress.minimumRemainingDispatches;
-      const own = items.filter(d => d.taskId === id), reviews = own.filter(d => d.kind === "review");
-      const consumed = new Set([...Object.values(task.stages ?? {}), ...(task.history ?? []).flatMap(h => Object.values(h.stages ?? {}))].map(s => s.dispatchId).filter(Boolean));
-      const lastWork = own.filter(d => d.kind === "implementation" && d.status === "completed").at(-1);
-      const reviewed = progress.slices.every(s => s.state === "DELIVERED") && lastWork && task.stages.review?.verdict === "PASS"
-        && task.stages.implementation?.dispatchId === lastWork.id && task.stages.review.contractHash === task.contractHash
-        && task.stages.review.snapshot === lastWork.completedSnapshot && Date.parse(task.stages.review.recordedAt) >= Date.parse(lastWork.finishedAt);
-      const awaiting = progress.slices.every(s => s.state === "DELIVERED") && reviews.some(d => active(d) || (d.status === "completed"
-        && d.completedSnapshot === lastWork?.completedSnapshot && Date.parse(d.finishedAt) >= Date.parse(lastWork.finishedAt) && !consumed.has(d.id)));
-      if (!reviewed && !awaiting) {
-        const used = Math.max(0, task.reviewBudget.used - reviews.filter(d => consumed.has(d.id)).length) + reviews.length;
-        need(used < task.reviewBudget.limit, `Task slices: independent-review budget exhausted for ${id}; splitting cannot create new review rounds`);
-        minimumReviews++;
-      }
-    }
-    const protectedBudget = deliveryBudget(entry, items);
-    const protectedSlots = (protectedBudget?.protectedSlots ?? 0) + Math.max(0, minimumReviews - (protectedBudget?.remaining.review ?? 0));
-    need(items.length + pending + protectedSlots <= entry.limits.maxDispatches,
-      `Task slices: aggregate budget for ${ancestor} cannot fit ${pending} remaining delivery slices plus ${protectedSlots} protected slots; preserve spent attempts and replan unattempted work or use an externally authorized extension`);
-    return { taskId: ancestor, limits: entry.limits, spentDispatches: items.length, minimumRemainingSlices: pending, minimumIndependentReviews: minimumReviews, protectedSlots,
-      spareDispatches: entry.limits.maxDispatches - items.length - pending - protectedSlots };
-  });
-}
-
-export function planTaskSlices(project, id, relative, commit = false) {
-  const prepare = ledger => {
-    const task = taskRecord(project, id);
-    need(task.mode === "implement" && !task.closed, "Task slices require an open implementation task");
-    const state = check(project, task, "implementation"); need(state.allowed, state.message);
-    need(typeof relative === "string" && relative.startsWith(".nccgs/evidence/slice-plans/") && relative.endsWith(".json"), "Slice plan draft must be JSON under .nccgs/evidence/slice-plans/");
-    const input = artifact(project, relative);
-    need(fs.statSync(verifyArtifact(project, input)).size <= 65536, "Slice plan exceeds 64 KiB; narrow the assignments");
-    const plan = json(verifyArtifact(project, input)), requestHash = sliceHash(plan);
-    validateSlicePlan(project, task, plan);
-    const existing = ledger.events.find(e => e.action === "slice-plan" && e.taskId === id && e.planId === plan.planId);
-    if (existing) {
-      need(existing.requestHash === requestHash, "Slice planId reused with different content");
-      return { status: ledger.tasks[id].slicePlan.planId === plan.planId ? "ALREADY_REGISTERED" : "SUPERSEDED", reference: existing.reference,
-        scope: "Original plan retained; no reactivation, attempt, budget or task change." };
-    }
-    need(plan.sourceSnapshot === state.snapshot, "Slice plan source snapshot is stale");
-    need(!Object.values(ledger.dispatches).some(d => belongs(ledger, d.taskId, id) && active(d)), "Settle active task/descendant attempts before registering another plan");
-    const ancestors = chain(project, id, ledger);
-    const old = ledger.tasks[id].slicePlan;
-    const previous = old ? { plan: json(verifyArtifact(project, old.reference)), reference: old.reference } : null;
-    validateSliceRevision(previous, plan, Object.values(ledger.dispatches).filter(d => d.taskId === id));
-    // Preview mutates only this in-memory ledger. No task/contract/approval is
-    // rewritten and no dispatch is reserved. Commit pins the normal budget once.
-    ledger.tasks[id].slicePlan = { planId: plan.planId, requestHash, reference: input };
-    const budgets = sliceCapacity(project, ledger, ancestors);
-    verifyArtifact(project, input);
-    let reference = input;
-    if (commit) {
-      const output = `.nccgs/evidence/slices/${crypto.randomUUID()}.json`;
-      atomicJson(contained(project, output), plan); reference = artifact(project, output);
-      ledger.tasks[id].slicePlan.reference = reference;
-      ledger.events.push({ action: "slice-plan", at: now(), taskId: id, planId: plan.planId, requestHash, reference,
-        supersedes: old?.reference ?? null, reason: plan.reason });
-    }
-    return { status: commit ? "REGISTERED" : "PREVIEW", taskId: id, planId: plan.planId, reference, budgets,
-      scope: "Same task, original criteria and shared budgets. Capacity is a dispatch lower bound, not a duration/cost estimate or approval." };
-  };
-  return commit ? transaction(project, prepare) : prepare(load(project));
-}
-
-export function taskSliceStatus(project, id) {
-  const task = taskRecord(project, id), ledger = load(project), stored = readSlicePlan(project, task, ledger);
-  if (!stored) return { taskId: id, status: "UNPLANNED", next: null };
-  const progress = sliceProgress(project, task, ledger, stored);
-  let budgets = null, capacityError = null;
-  try { budgets = sliceCapacity(project, ledger, chain(project, id, ledger)); } catch (error) { capacityError = error.message; }
-  return { taskId: id, ...progress, budgets, capacityError, next: capacityError ? null : nextSliceRequest(task, ledger, stored, progress),
-    history: ledger.events.filter(e => e.action === "slice-plan" && e.taskId === id) };
-}
-export function reserve(project, id, request) {
-  return transaction(project, ledger => {
-    const task = taskRecord(project, id), policy = resolveExecution(project);
-    if (task.executionHash) need(task.executionHash === hash(JSON.stringify(policy)), "Task execution policy changed; restore pinned policy before dispatch");
-    if (task.pipelineHash) need(task.pipelineHash === hash(JSON.stringify(loadPipeline(project))), "Task pipeline changed; restore pinned policy before dispatch");
-    need(policy.name === "standalone", "Managed dispatch requires standalone execution policy");
-    need(request && typeof request === "object" && kinds.includes(request.kind), "Invalid dispatch kind");
-    if (request.kind === "implementation") requireDesignReady(project, task);
-    need(typeof request.requestKey === "string" && /^[\w-]{1,100}$/.test(request.requestKey), "Stable requestKey required for idempotent reservation");
-    need(request.reason?.trim() && typeof request.agent === "string" && /^[\w-]+$/.test(request.agent), "Dispatch needs a named agent and concrete reason");
-    const registry = json(contained(project, ".claude/nccgs/studio.json"));
-    const role = registry.agents.find(agent => agent.name === request.agent);
-    need(role, "Unknown studio agent");
-    need(request.kind !== "implementation" || !["nccgs-task-scout", "nccgs-adversarial-reviewer"].includes(request.agent), "Read-only agent cannot implement");
-    need(request.kind !== "review" || role.modelClass === "review", "Independent review requires a reviewer role");
-    const writePaths = validPaths(project, request.writePaths ?? []);
-    const handoffPaths = request.handoffPaths ?? [];
-    need(Array.isArray(handoffPaths) && handoffPaths.every(p => typeof p === "string" && p.startsWith(".nccgs/evidence/analysis/")), "Handoff paths must be explicit analysis artifact paths");
-    for (const p of handoffPaths) contained(project, p);
-    need(request.handoffTransport === undefined || ["file", "native-result"].includes(request.handoffTransport), "Unknown handoff transport");
-    if (request.handoffTransport === "native-result")
-      need(request.kind !== "implementation" && handoffPaths.length === 1, "Native result handoff requires one declared read-only artifact");
-    if (request.kind !== "implementation") for (const p of handoffPaths)
-      need(task.contract.analysisArtifacts?.includes(p), "Read-only handoff must be a declared analysis artifact");
-    need(request.kind === "implementation" || writePaths.length === 0, "Review/analysis dispatch is read-only");
-    need(task.mode === "implement" || request.kind !== "implementation", "Audit/plan tasks cannot dispatch implementation");
-    need(request.kind !== "implementation" || writePaths.length > 0, "Implementation requires owned write paths");
-    if (request.parentId !== undefined) need(request.parentId === task.parentId, "Parent must be declared in the task contract");
-    const normalized = { ...request, writePaths }, requestHash = hash(JSON.stringify(normalized));
-    const previous = Object.values(ledger.dispatches).find(d => d.taskId === id && d.requestKey === request.requestKey);
-    if (previous) { need(previous.requestHash === requestHash, "requestKey reused for different dispatch"); return previous; }
-    for (const p of handoffPaths) need(!fs.existsSync(contained(project, p)), "Handoff artifact must be fresh for this dispatch");
-    const ancestors = chain(project, id, ledger, request);
-    const protectedAllocation = plannedDispatchBudget(project, id, request);
-    const source = snapshot(project, task, { includeFiles: Boolean(request.workPacket) }), snap = source.sha256;
-    const repair = Object.values(ledger.dispatches).filter(d => d.taskId === id && d.purpose === "repair" && d.status === "completed" && d.contractHash === task.contractHash).at(-1);
-    const { purpose, feedback } = dispatchPurpose(project, task, { ...request, repairFeedback: repair?.feedback ?? null }, snap);
-    const slice = bindSlice(project, task, ledger, { ...request, writePaths }, purpose);
-    if (ledger.tasks[id].slicePlan) {
-      const state = check(project, task, "implementation"); need(state.allowed, state.message);
-      if (slice) need(!Object.values(ledger.dispatches).some(d => belongs(ledger, d.taskId, id) && active(d)), "Planned slices use sequential foreground dispatch; finish existing task/descendant work first");
-    }
-    const workPacket = purpose === "repair" ? pinRepairPacket(project, task, { ...request, writePaths }, snap) : null;
-    need(purpose === "repair" || request.workPacket === undefined, "workPacket is only supported for repair dispatches");
-    const budgetEvidence = [];
-    for (const ancestor of ancestors) {
-      const items = Object.values(ledger.dispatches).filter(d => belongs(ledger, d.taskId, ancestor)), limits = ledger.tasks[ancestor].limits;
-      need(items.length < limits.maxDispatches, `Aggregate dispatch budget exhausted for ${ancestor}; cancellation/reclassification never refunds attempts`);
-      requireDeliveryRoom(ledger.tasks[ancestor], items, purpose, ancestor);
-      requireEarlyCheckpoint(project, taskRecord(project, ancestor), ledger.tasks[ancestor], items, purpose, request.kind, snap);
-      const measured = telemetryFrom(ledger, ancestor, project);
-      for (const [limit, field] of [["maxDurationMs", "durationMs"], ["maxCostUsd", "costUsd"]]) if (limits[limit] !== null) {
-        const data = measured.metrics[field];
-        if (field === "costUsd" && (data.expected !== data.measured || process.env.NCCGS_SUPERVISED_RUN)) {
-          budgetEvidence.push(activeSessionBudget(project, ancestor, items, limits[limit]));
-          continue;
-        }
-        need(data.expected === data.measured, `Cannot enforce ${limit}: missing ${field} telemetry; reconcile measurements or stop`);
-        need(data.knownSubtotal < limits[limit], `${limit} budget exhausted for ${ancestor}`);
-      }
-    }
-    const records = Object.values(ledger.dispatches), live = records.filter(active);
-    need(!live.some(d => d.workPacket?.schemaVersion === 2), "Typed Unity repair owns the project until completion or external reconciliation");
-    if (workPacket?.schemaVersion === 2) need(live.length === 0, "Typed Unity repair requires exclusive project ownership");
-    if (request.kind === "review") {
-      const reviewAttempts = records.filter(d => d.taskId === id && d.kind === "review");
-      const consumed = new Set([...Object.values(task.stages ?? {}), ...(task.history ?? []).flatMap(h => Object.values(h.stages ?? {}))].map(s => s.dispatchId).filter(Boolean));
-      const linked = reviewAttempts.filter(d => consumed.has(d.id)).length;
-      const used = Math.max(0, task.reviewBudget.used - linked) + reviewAttempts.length;
-      need(used < task.reviewBudget.limit, "Review dispatch budget exhausted");
-      need(!live.some(d => d.taskId === id && d.kind === "review"), "Only one reviewer may be reserved or running per task");
-      const readiness = check(project, task, "review");
-      need(readiness.allowed, readiness.message);
-    }
-    if (request.kind === "implementation") {
-      need(live.filter(d => d.kind === "implementation").length < policy.maxParallelWorkers, "Implementation concurrency limit reached");
-      need(!live.some(d => d.kind !== "implementation"), "Read-only review/analysis snapshot is reserved; finish it before writing");
-      for (const item of live) need(!item.writePaths.some(a => writePaths.some(b => overlap(a, b))), "Write ownership conflicts with another active dispatch");
-    } else need(!live.some(d => d.kind === "implementation"), "Cannot review/analyze a snapshot while implementation is active");
-    const reservation = { id: crypto.randomUUID(), taskId: id, kind: request.kind, agent: request.agent, reason: request.reason.trim(),
-      requestKey: request.requestKey, requestHash, writePaths, handoffPaths, handoffProtocol: 1,
-      ...(request.handoffTransport ? { handoffTransport: request.handoffTransport } : {}), purpose, feedback, status: "reserved", createdAt: now(),
-      snapshot: snap, contractHash: task.contractHash, sessionId: null, toolUseId: null, agentId: null, telemetry: null,
-      ...(budgetEvidence.length ? { budgetEvidence } : {}),
-      ...(protectedAllocation ? { protectedAllocation } : {}),
-      ...(slice ? { slice } : {}), ...(ledger.tasks[id].slicePlan ? { slicePlan: ledger.tasks[id].slicePlan.reference } : {}),
-      ...(workPacket ? { workPacket, toolBudget: { work: 0, read: 0, handoff: 0, admissions: [] } } : {}) };
-    captureUnityRepairScope(project, reservation, source);
-    ledger.dispatches[reservation.id] = reservation;
-    sliceCapacity(project, ledger, ancestors);
-    ledger.events.push({ action: "reserve", at: reservation.createdAt, dispatchId: reservation.id, taskId: id });
-    return reservation;
-  });
-}
-export function claim(project, dispatchId, identity) {
-  return transaction(project, ledger => {
-    const d = ledger.dispatches[dispatchId]; need(d, "Unknown dispatch reservation");
-    for (const coverage of d.budgetEvidence ?? []) need(coverage.currentSessionId === identity.sessionId, "Dispatch must use the supervised session that owns its budget allowance");
-    if (d.protectedAllocation) need(d.protectedAllocation.sessionId === identity.sessionId, "Dispatch must use the session that owns its protected budget allocation");
-    need(identity.sessionId && identity.toolUseId && identity.agent === d.agent, "Dispatch identity/role mismatch");
-    if (d.status === "running") { need(d.sessionId === identity.sessionId && d.toolUseId === identity.toolUseId, "Dispatch already claimed by another invocation"); return d; }
-    need(d.status === "reserved", "Dispatch is not available to claim");
-    const task = taskRecord(project, d.taskId);
-    if (d.kind === "implementation") requireDesignReady(project, task);
-    need(task.contractHash === d.contractHash, "Dispatch contract stale");
-    need(snapshot(project, task).sha256 === d.snapshot, "Dispatch source snapshot stale; cancel/reconcile and reserve a fresh attempt");
-    if (d.workPacket) verifyRepairPacket(project, d);
-    if (d.slice) {
-      const current = bindSlice(project, task, ledger, { ...d, sliceId: d.slice.id }, d.purpose);
-      need(current.definitionHash === d.slice.definitionHash && sameSlice(current.dependencies, d.slice.dependencies), "Slice dependency handoffs changed after reservation");
-    }
-    need(!Object.values(ledger.dispatches).some(item => item.id !== d.id && item.sessionId === identity.sessionId && item.toolUseId === identity.toolUseId), "Tool invocation already belongs to another reservation");
-    Object.assign(d, { status: "running", sessionId: identity.sessionId, toolUseId: identity.toolUseId, startedAt: now() });
-    ledger.events.push({ action: "claim", at: d.startedAt, dispatchId }); return d;
-  });
-}
-export function attachAgent(project, dispatchId, agentId) {
-  return transaction(project, ledger => {
-    const d = ledger.dispatches[dispatchId]; need(d && active(d) && d.sessionId, "No claimed dispatch to bind agent");
-    need(typeof agentId === "string" && agentId, "Missing agent identity");
-    need(!d.agentId || d.agentId === agentId, "Reservation already bound to another agent");
-    d.agentId = agentId; return d;
-  });
-}
-export function getDispatch(project, id, dispatchId) {
-  taskRecord(project, id);
-  const d = load(project).dispatches[dispatchId];
-  need(d?.taskId === id, "Dispatch does not belong to this task");
-  return d;
-}
-export function dispatchPrompt(project, id, dispatchId) {
-  const task = taskRecord(project, id), d = getDispatch(project, id, dispatchId);
-  need(d.contractHash === task.contractHash, "Dispatch contract stale");
-  if (d.workPacket) {
-    verifyRepairPacket(project, d);
-    return { dispatchId, prompt: repairPrompt(task, d) };
-  }
-  need(["reserved", "running"].includes(d.status), "Prompt requires a reserved or running dispatch");
-  const state = check(project, task, d.kind === "review" ? "review" : task.mode === "implement" ? "implementation" : "analysis");
-  need(state.allowed, state.message);
-  if (d.status === "reserved" || d.kind !== "implementation") need(state.snapshot === d.snapshot, "Dispatch source snapshot stale");
-  const route = d.kind === "review" ? task.execution.profile.models.review : task.implementationRoute;
-  const handoffs = (d.handoffPaths ?? []).map(file => ({ path: file, content: handoffTemplate(task, d) }));
-  const prompt = `[NCCGS-DISPATCH:${dispatchId}]\nTask ${id}, ${d.kind}, ${task.risk}: ${task.contract.objective}\n` +
-    `Assignment: ${d.reason}\nTask record: .nccgs/tasks/${id}.json\nIntake: ${task.intake.path}\n` +
-    `Contract: ${task.contractHash}\nStarting source: ${d.snapshot}\nRequested route: ${route.model}/${route.effort ?? "unspecified"}; not observed execution.\n` +
-    `Check the installed role's maxTurns and native session overrides before launch; prompt text cannot increase capacity.\n` +
-    `Source write ownership: ${JSON.stringify(d.writePaths)}\nCanonical sources: ${JSON.stringify(task.contract.sources ?? [])}\n` +
-    `Read the pinned task contract for acceptance, checks, manual gates and design references; preserve all of them.\n` +
-    slicePromptContext(project, task, d) +
-    `Use foreground execution. Do not delegate or change task records. The coordinator owns verification and stage recording.\n` +
-    (d.kind === "review" ? "Review independently; follow .claude/nccgs/protocols/review-handoff.md. Keep negative findings and pending conditions.\n" : "Follow .claude/nccgs/protocols/agent-contract.md for this bounded assignment.\n") +
-    (d.handoffTransport === "native-result"
-      ? "Return the entire assigned Markdown handoff as your sole final text response, without an outer code fence. Do not write a file or run handoff validation. The correlated native hook copies your exact text to the pinned path; all existing completion and review gates still apply.\n"
-      : handoffs.length ? "Write the assigned draft early. Fill it with actual findings; mark COMPLETE only when your assignment has finished.\n" : "No handoff path was reserved; report this to the coordinator if an artifact is required.\n") +
-    handoffs.map(h => `Handoff file: ${h.path}\nInitial draft (not evidence):\n${h.content}\n` +
-      (/^[\w./ -]+$/.test(h.path)
-        ? (d.handoffTransport === "native-result" ? "Return this completed document as text; retain negative findings and pending conditions.\n" : `Before returning, validate structure with one plain command:\nnode .claude/nccgs/tools/task.mjs handoff-validate --id ${id} --dispatch ${dispatchId} --file "${h.path}"\n`)
-        : "Ask the coordinator to validate this handoff with the fixed handoff-validate command; its path needs shell-specific quoting.\n")).join("\n");
-  return { dispatchId, agent: d.agent, prompt, handoffs, scope: "Preparation only; does not launch, write artifacts, approve work or spend another attempt." };
-}
-export function pinnedRepairEvidence(project, relative) {
-  return Object.values(load(project).dispatches).some(d => d.workPacket &&
-    [d.workPacket.reference, ...d.workPacket.context, d.workPacket.scope, d.workPacket.unity?.capabilities].filter(Boolean).some(ref => ref.path.toLowerCase() === relative.toLowerCase()));
-}
-export function admitRepairTool(project, dispatchId, input) {
-  const result = transaction(project, ledger => {
-    const d = ledger.dispatches[dispatchId];
-    const uncertainHandoff = d?.workPacket?.schemaVersion === 2 && d.status === "uncertain" &&
-      ["Write", "Edit", "MultiEdit"].includes(input.tool_name) && d.handoffPaths.includes(path.relative(project, path.resolve(project, input.tool_input?.file_path ?? ".")).split(path.sep).join("/"));
-    need(d?.workPacket && (d.status === "running" || uncertainHandoff) && input.agent_id && input.agent_id === d.agentId && input.session_id === d.sessionId, "Repair tool requires the running, correlated worker");
-    need(typeof input.tool_use_id === "string" && input.tool_use_id.length > 0, "Repair tool-use identity missing");
-    const budget = d.toolBudget, limits = d.workPacket.budget;
-    need(budget && Array.isArray(budget.admissions) && [budget.work, budget.read, budget.handoff].every(n => Number.isSafeInteger(n) && n >= 0), "Repair tool budget missing/corrupt; restore history, never reset it");
-    const counted = { work: 0, read: 0, handoff: 0 }, seen = new Set();
-    for (const entry of budget.admissions) {
-      need(["work", "handoff"].includes(entry.bucket) && typeof entry.read === "boolean" && typeof entry.allowed === "boolean" && entry.toolUseId && !seen.has(entry.toolUseId), "Repair admission history corrupt");
-      seen.add(entry.toolUseId); counted[entry.bucket]++; if (entry.read) counted.read++;
-    }
-    need(Object.keys(counted).every(key => budget[key] === counted[key]), "Repair counters differ from admission history; never reset spent calls");
-    const fingerprint = hash(JSON.stringify([input.tool_name, input.tool_input ?? {}]));
-    const previous = budget.admissions.find(a => a.toolUseId === input.tool_use_id);
-    if (previous) {
-      need(previous.fingerprint === fingerprint, "Repair tool-use ID reused with different input");
-      // Re-delivery must not re-admit a call after its source context changed.
-      if (previous.allowed && previous.bucket !== "handoff") {
-        verifyRepairPacket(project, d);
-        need(taskRecord(project, d.taskId).contractHash === d.contractHash, "Repair contract stale");
-        need(!(d.editorSteps ?? []).some(s => s.status !== "completed"), "Editor operation failed or remains uncertain; retain the attempt and return PARTIAL");
-      }
-      return previous;
-    }
-    let scope, reason = null;
-    try { scope = repairToolScope(project, d, input); }
-    catch (error) { scope = { bucket: "work", read: false }; reason = error.message; }
-    // Persist denied attempts too. Throwing inside this transaction would lose
-    // the accounting and let retries obtain an unlimited exploration allowance.
-    budget[scope.bucket]++;
-    if (scope.read) budget.read++;
-    try {
-      if (scope.bucket === "handoff") need(budget.handoff <= limits.handoffCalls, "Repair handoff allowance exhausted");
-      else {
-        need(budget.work <= limits.workCalls, "Repair work allowance exhausted");
-        if (scope.read) need(budget.read <= limits.readCalls, "Repair read allowance exhausted");
-        need(Date.now() - Date.parse(d.startedAt) <= limits.durationMs, "Repair work deadline reached");
-        need(taskRecord(project, d.taskId).contractHash === d.contractHash, "Repair contract stale");
-        verifyRepairPacket(project, d);
-        need(!(d.editorSteps ?? []).some(s => s.status !== "completed"), "Editor operation failed or remains uncertain; retain the attempt and return PARTIAL");
-      }
-    } catch (error) { reason = error.message; }
-    const remaining = { work: Math.max(0, limits.workCalls - budget.work), read: Math.max(0, limits.readCalls - budget.read), handoff: Math.max(0, limits.handoffCalls - budget.handoff) };
-    const entry = { toolUseId: input.tool_use_id, fingerprint, bucket: scope.bucket, read: scope.read, allowed: !reason, reason, at: now(), remaining,
-      ...(scope.editorStep ? { editorStep: scope.editorStep } : {}) };
-    budget.admissions.push(entry);
-    return entry;
-  });
-  need(result.allowed, `${result.reason}. Write the assigned PARTIAL handoff and return; remaining handoff calls: ${result.remaining.handoff}`);
-  return { additionalContext: `NCCGS repair tool allowance remaining: ${result.remaining.work} work, ${result.remaining.read} reads, ${result.remaining.handoff} handoff writes. Verification belongs to the coordinator. Return the assigned handoff before native turn exhaustion.` };
-}
-
-// Called only by the fixed worker CLI after its tool admission. A step is pinned
-// before launch and never replayed automatically, including after an interruption.
-export function runRepairEditor(project, id, dispatchId, stepId, execute = spawnSync) {
-  const prepared = transaction(project, ledger => {
-    const d = ledger.dispatches[dispatchId];
-    need(d?.taskId === id && d.status === "running" && d.workPacket?.schemaVersion === 2, "Editor step needs a running typed Unity repair");
-    const task = taskRecord(project, id);
-    need(task.contractHash === d.contractHash, "Repair contract stale");
-    requireDesignReady(project, task);
-    const readiness = check(project, task, "implementation"); need(readiness.allowed, readiness.message);
-    verifyRepairPacket(project, d); verifyUnityRepairScope(project, d);
-    const steps = d.workPacket.unity.steps, step = steps.find(s => s.id === stepId);
-    need(step, "Unknown pinned Editor step");
-    d.editorSteps ??= [];
-    need(!d.editorSteps.some(s => s.id === stepId), "Editor step already attempted; inspect its original receipt, never replay");
-    need(steps.slice(0, steps.indexOf(step)).every(s => d.editorSteps.some(e => e.id === s.id && e.status === "completed")), "Editor steps must finish in packet order");
-    need(Date.now() - Date.parse(d.startedAt) + step.timeoutMs + 1000 <= d.workPacket.budget.durationMs, "Repair deadline cannot fit this Editor step");
-    const admission = d.toolBudget.admissions.find(a => a.allowed && a.editorStep === stepId && !d.editorSteps.some(s => s.toolUseId === a.toolUseId));
-    need(admission, "Editor step requires its correlated worker tool admission");
-    const invocation = unityEditorInvocation(project, step, d.workPacket.sceneSafety ?? null);
-    d.editorSteps.push({ id: stepId, status: "running", startedAt: now(), toolUseId: admission.toolUseId });
-    ledger.events.push({ action: "repair-editor-start", at: now(), dispatchId, stepId });
-    return { step, invocation };
-  });
-  let result;
-  try { result = execute(prepared.invocation.executable, prepared.invocation.arguments, { cwd: project, shell: false, windowsHide: true,
-    encoding: "utf8", timeout: prepared.step.timeoutMs + 1000, maxBuffer: 4 * 1024 * 1024 }); }
-  catch (error) { result = { error, status: null, stdout: "", stderr: "" }; }
-  return transaction(project, ledger => {
-    const d = ledger.dispatches[dispatchId], step = d.editorSteps.find(s => s.id === stepId);
-    need(step?.status === "running", "Editor operation state changed; inspect before any continuation");
-    const notStarted = ["ENOENT", "EACCES"].includes(result.error?.code);
-    let status = result.status === 0 && !result.error && !result.signal ? "completed" : notStarted ? "failed" : "uncertain";
-    const blockedScene = blockedUnityScene(prepared.invocation, result);
-    if (blockedScene !== null) status = "failed"; // Known precondition refusal: packet body never ran.
-    let scopeError = null;
-    try { verifyRepairPacket(project, d); verifyUnityRepairScope(project, d); }
-    catch (error) { scopeError = error.message; if (status === "completed") status = "failed"; }
-    const relative = `.nccgs/evidence/repair-operations/${dispatchId}-${stepId}.json`;
-    atomicJson(contained(project, relative), { schemaVersion: 1, origin: "unity-repair-operation", taskId: id, dispatchId, stepId,
-      contractHash: d.contractHash, startedAt: step.startedAt, finishedAt: now(), status, ...prepared.invocation,
-      exitCode: result.status ?? null, signal: result.signal ?? null, error: result.error?.message ?? null, scopeError, blockedScene,
-      stdout: String(result.stdout ?? ""), stderr: String(result.stderr ?? ""),
-      note: "Editor operation receipt only; not verification, acceptance or provider execution evidence." });
-    Object.assign(step, { status, finishedAt: now(), evidence: artifact(project, relative) });
-    if (status === "uncertain") { d.status = "uncertain"; d.uncertainty = "Unity Editor operation may still be active; external reconciliation required before releasing ownership"; }
-    ledger.events.push({ action: "repair-editor-finish", at: step.finishedAt, dispatchId, stepId, status, evidence: step.evidence });
-    return { status: status === "completed" ? "EXECUTED" : "FAIL", operationStatus: status, evidence: step.evidence,
-      message: status === "completed" ? "Inspect the Editor result; finish the handoff. Required verification and independent review remain pending."
-        : blockedScene !== null ? `Unsaved scene blocked the operation: ${blockedScene}. Nothing was saved or discarded. Return PARTIAL and preserve this attempt; the owner must resolve unsaved work before a new authorized packet.`
-        : "Return PARTIAL. Preserve this attempt; do not retry or release an uncertain Editor operation without external reconciliation." };
-  });
-}
-// Called only by the launch guard before a native invocation is admitted. A
-// claimed/uncertain worker can never be released through this recovery path.
-export function rejectUnclaimed(project, dispatchId, rejection) {
-  return transaction(project, ledger => {
-    const d = ledger.dispatches[dispatchId]; need(d, "Unknown dispatch reservation");
-    need(rejection.sessionId && rejection.toolUseId && rejection.agent === d.agent && rejection.reason?.trim(), "Rejected launch identity/reason missing");
-    need(d.status === "reserved" && !d.sessionId && !d.toolUseId && !d.agentId && !d.startedAt, "Only a never-claimed reservation can be rejected automatically");
-    Object.assign(d, { status: "failed", invocationStatus: "not-started", finishedAt: now(),
-      failure: rejection.reason, launchRejection: { ...rejection, origin: "pre-tool-use-guard" } });
-    ledger.events.push({ action: "reject-unclaimed", at: d.finishedAt, dispatchId, rejection: d.launchRejection });
-    return d;
-  });
-}
-export function complete(project, dispatchId, input) {
-  return transaction(project, ledger => {
-    const d = ledger.dispatches[dispatchId]; need(d, "Unknown dispatch");
-    if ((["completed", "failed"].includes(d.status) || d.workStatus === "incomplete-editor") && d.runtime) { need(same(d.runtime, input.runtime), "Dispatch already completed with different evidence"); return d; }
-    need(["running", "uncertain"].includes(d.status), "Only a claimed dispatch can complete");
-    const editorUncertain = (d.editorSteps ?? []).some(s => ["running", "uncertain"].includes(s.status));
-    need(input.runtime?.path?.startsWith(".nccgs/evidence/runtime/observations/"), "Completion needs durable runtime observation");
-    const trace = json(verifyArtifact(project, input.runtime)), raw = json(verifyArtifact(project, trace.observationSource));
-    need(trace.observationSource?.path?.startsWith(".nccgs/evidence/runtime/sources/"), "Completion requires durable raw runtime source");
-    need(trace.origin === "runtime-observation" && trace.observedProvider === "claude-code", "Completion requires Claude Code runtime evidence, not configuration/Codex");
-    for (const key of ["dispatchId", "taskId", "contractHash", "sessionId", "toolUseId", "agentId", "snapshot", "status", "capturedAt", "observedProvider"])
-      need(trace[key] !== undefined && trace[key] === raw[key], `Runtime raw source ${key} mismatch`);
-    need(trace.dispatchId === d.id && trace.taskId === d.taskId && trace.contractHash === d.contractHash && trace.sessionId === d.sessionId && trace.toolUseId === d.toolUseId, "Completion identity/contract mismatch");
-    need(trace.agentId && (!d.agentId || d.agentId === trace.agentId), "Completion agent identity mismatch");
-    need(["completed", "failed"].includes(trace.status), "Incomplete/background response is not completion");
-    need(same(trace.nativeCompletion ?? null, raw.nativeCompletion ?? null), "Native completion diagnosis differs from raw source");
-    const nativeIncomplete = Boolean(raw.nativeCompletion?.reason);
-    need(Date.parse(trace.capturedAt) >= Date.parse(d.startedAt) && Date.parse(trace.capturedAt) <= Date.now(), "Completion time is invalid");
-    const task = taskRecord(project, d.taskId), finalSnapshot = snapshot(project, task).sha256;
-    need(task.contractHash === d.contractHash && trace.snapshot === finalSnapshot, "Completion covers stale contract/snapshot");
-    let returnedHandoffFailure = null;
-    if (d.handoffTransport === "native-result") {
-      need(same(trace.returnedHandoff ?? null, raw.returnedHandoff ?? null), "Returned handoff differs from raw source");
-      const captured = raw.returnedHandoff;
-      if (captured?.status !== "captured") returnedHandoffFailure = captured?.reason ?? "missing-native-result";
-      else {
-        need(d.handoffPaths.length === 1 && captured.evidence?.path === d.handoffPaths[0], "Returned handoff path mismatch");
-        verifyArtifact(project, captured.evidence);
-      }
-    }
-    const mutatedReadOnly = d.kind !== "implementation" && d.snapshot !== finalSnapshot;
-    const metrics = Object.fromEntries(["durationMs", "toolUseCount", "totalTokens", "costUsd"].map(key => {
-      const value = raw[key] ?? null;
-      need(value === null || (Number.isFinite(value) && value >= 0), `Invalid measured ${key}`);
-      need(trace[key] == null || trace[key] === value, `Observed ${key} differs from raw source`);
-      return [key, value];
-    }));
-    Object.assign(d, { status: mutatedReadOnly || nativeIncomplete || trace.status === "failed" ? "failed" : "completed", agentId: trace.agentId,
-      completedSnapshot: finalSnapshot, finishedAt: now(), runtime: input.runtime, telemetry: metrics,
-      ...(mutatedReadOnly ? { failure: "Read-only dispatch modified source" } : {}),
-      ...(nativeIncomplete ? { failure: `Native worker incomplete: ${raw.nativeCompletion.reason}`, nativeCompletion: raw.nativeCompletion } : {}) });
-    const missing = (d.handoffPaths ?? []).filter(p => !fs.existsSync(contained(project, p)) || !fs.statSync(contained(project, p)).isFile() || fs.statSync(contained(project, p)).size === 0);
-    d.invocationStatus = raw.nativeCompletion?.reportedStatus ?? trace.status;
-    d.handoff = { status: !d.handoffPaths?.length ? "unassessed" : missing.length ? "missing" : "present", missing,
-      artifacts: (d.handoffPaths ?? []).filter(p => !missing.includes(p)).map(p => artifact(project, p)),
-      note: "Artifact presence is not product acceptance; native completion alone is not a complete handoff" };
-    const partial = d.handoffProtocol === 1 ? d.handoff.artifacts.filter(ref => {
-      const text = fs.readFileSync(verifyArtifact(project, ref), "utf8");
-      return !/^NCCGS-HANDOFF: COMPLETE\r?$/m.test(text) || /^NCCGS-HANDOFF: PARTIAL\r?$/m.test(text);
-    }).map(ref => ref.path) : [];
-    d.handoff.partial = partial;
-    if (missing.length || partial.length) {
-      d.status = "failed";
-      d.failure = missing.length ? "Required handoff artifacts are missing; reserve a new bounded attempt" : "Handoff is partial or missing its COMPLETE marker; reserve a new bounded attempt";
-    }
-    if (returnedHandoffFailure) { d.status = "failed"; d.failure = `Returned handoff rejected: ${returnedHandoffFailure}`; }
-    if (d.workPacket) {
-      try {
-        verifyRepairPacket(project, d);
-        verifyUnityRepairScope(project, d, true);
-        if (d.workPacket.schemaVersion === 2) {
-          need(d.workPacket.unity.steps.every(s => d.editorSteps?.some(e => e.id === s.id && e.status === "completed")), "Required Editor operations did not complete");
-          for (const s of d.editorSteps ?? []) verifyArtifact(project, s.evidence);
-        }
-      }
-      catch (error) { d.status = "failed"; d.failure = `Repair context changed: ${error.message}`; }
-    }
-    // The native worker can finish while a resident Editor operation remains
-    // uncertain. Keep its observed usage and original handoff without releasing
-    // ownership or converting that observation into completed repair work.
-    if (editorUncertain) {
-      d.status = "uncertain";
-      d.uncertainty = "Native worker finished but Editor operation is still running or uncertain; external reconciliation required";
-    }
-    d.workStatus = editorUncertain ? "incomplete-editor" : d.status === "completed" ? "completed" : "incomplete";
-    ledger.events.push({ action: "complete", at: d.finishedAt, dispatchId, status: d.status }); return d;
-  });
-}
-export function markUncertain(project, dispatchId, reason) {
-  return transaction(project, ledger => {
-    const d = ledger.dispatches[dispatchId]; need(d && active(d), "No active dispatch");
-    d.status = "uncertain"; d.uncertainty = reason;
-    ledger.events.push({ action: "uncertain", at: now(), dispatchId, reason }); return d;
-  });
-}
-export function reconcile(project, dispatchId, decision) {
-  need(!(process.env.CLAUDECODE || process.env.CLAUDE_CODE_ENTRYPOINT), "Reconciliation releasing a slot requires an external operator");
-  need(["failed", "cancelled"].includes(decision.status) && decision.reason?.trim() && decision.reference?.trim(), "Reconcile needs explicit status, reason and observation reference");
-  return transaction(project, ledger => {
-    const d = ledger.dispatches[dispatchId]; need(d && active(d), "Only active/uncertain dispatch can be reconciled");
-    Object.assign(d, { status: decision.status, finishedAt: now(), reconciliation: decision });
-    ledger.events.push({ action: "reconcile", at: d.finishedAt, dispatchId, decision }); return d;
-  });
-}
-export function extendDispatch(project, id, decision) {
-  need(!(process.env.CLAUDECODE || process.env.CLAUDE_CODE_ENTRYPOINT), "Dispatch extension requires an external operator");
-  need(decision.reason?.trim() && decision.reference?.path, "Dispatch extension needs a reason and authorization artifact");
-  verifyArtifact(project, decision.reference);
-  return transaction(project, ledger => {
-    const task = taskRecord(project, id), entry = ledger.tasks[id];
-    need(entry && !task.closed, "Only an open registered task can extend dispatch limits");
-    need(!Object.values(ledger.dispatches).some(active), "Settle all active dispatches before extending limits");
-    const previousLimit = entry.limits.maxDispatches, newLimit = decision.maxDispatches;
-    need(decision.previousLimit === previousLimit, "Dispatch extension expected limit is stale");
-    need(Number.isSafeInteger(newLimit) && newLimit > previousLimit && newLimit <= 1000, "Dispatch extension must increase the finite limit");
-    const extension = { action: "extend-dispatch", taskId: id, at: now(), previousLimit, newLimit,
-      reason: decision.reason.trim(), reference: decision.reference };
-    entry.limits.maxDispatches = newLimit;
-    ledger.events.push(extension);
-    return extension; // Spent attempts, ancestor limits and protected slots remain intact.
-  });
-}
-export function status(project, id) {
-  taskRecord(project, id); const ledger = load(project), reservations = Object.values(ledger.dispatches).filter(d => belongs(ledger, d.taskId, id));
-  return { taskId: id, reservations, active: reservations.filter(active), limits: ledger.tasks[id]?.limits ?? null,
-    deliveryBudget: deliveryBudget(ledger.tasks[id], reservations),
-    usage: { dispatches: reservations.length, reviewDispatches: reservations.filter(d => d.kind === "review").length }, telemetry: telemetryFrom(ledger, id, project) };
-}
-export function telemetry(project, id) { taskRecord(project, id); return telemetryFrom(load(project), id, project); }
-export function checkpoint(project, id, input = {}) {
-  need(input.reason?.trim(), "Checkpoint needs a reason");
-  const task = taskRecord(project, id), file = `.nccgs/evidence/checkpoints/${id}-${crypto.randomUUID()}.json`;
-  atomicJson(contained(project, file), { schemaVersion: 1, taskId: id, reason: input.reason, capturedAt: now(),
-    sourceSnapshot: snapshot(project, task).sha256, task: artifact(project, `.nccgs/tasks/${id}.json`), orchestration: status(project, id) });
-  return artifact(project, file);
-}
-export function resume(project, id) {
-  return transaction(project, ledger => {
-    const task = taskRecord(project, id); chain(project, id, ledger);
-    const unresolved = Object.values(ledger.dispatches).filter(d => belongs(ledger, d.taskId, id) && active(d));
-    ledger.events.push({ action: "resume", taskId: id, at: now(), unresolved: unresolved.map(d => d.id) });
-    return { taskId: id, sourceSnapshot: snapshot(project, task).sha256, needsReconciliation: unresolved.length > 0,
-      reservations: unresolved, telemetry: telemetryFrom(ledger, id, project), message: "Resume preserves attempts, observations, findings and budgets; no automatic slot expiry or approval." };
-  });
-}
-export function findDispatch(project, input) {
-  const ledger = load(project);
-  const marker = !input.agent_id && ["Agent", "Task"].includes(input.tool_name) ? input.tool_input?.prompt?.match(/^\[NCCGS-DISPATCH:([\w-]+)\]/)?.[1] : null;
-  if (marker) return ledger.dispatches[marker] ?? null;
-  const items = Object.values(ledger.dispatches).filter(d => d.sessionId === input.session_id &&
-    ((input.tool_use_id && d.toolUseId === input.tool_use_id) || (input.agent_id && d.agentId === input.agent_id)));
-  return items.length === 1 ? items[0] : null;
-}
-export function correlateAgentStart(project, input) {
-  const items = Object.values(load(project).dispatches).filter(d => active(d) && d.sessionId === input.session_id && d.agent === input.agent_type && !d.agentId);
-  // SubagentStart has no tool-use ID. Ambiguous launches must never be guessed.
-  return items.length === 1 ? attachAgent(project, items[0].id, input.agent_id) : null;
-}
-export function validateStageDispatch(project, task, input, trace, kind) {
-  const ledger = load(project), d = ledger.dispatches[input.dispatchId];
-  need(d?.handoff?.status !== "missing", `${kind}: invocation ended but required handoff artifacts are missing; reserve a new attempt`);
-  need(!d?.handoff?.partial?.length, `${kind}: handoff is partial; reserve a new bounded attempt`);
-  need(d && d.taskId === task.id && d.kind === kind && d.status === "completed", `${kind}: completed managed dispatch required`);
-  need(d.handoff?.status !== "missing", `${kind}: invocation ended but required handoff artifacts are missing; reserve a new attempt`);
-  for (const ref of d.handoff?.artifacts ?? []) verifyArtifact(project, ref);
-  if (d.workPacket) verifyRepairPacket(project, d);
-  for (const step of d.editorSteps ?? []) verifyArtifact(project, step.evidence);
-  need(d.contractHash === task.contractHash && d.completedSnapshot === input.snapshot && same(d.runtime, input.runtime), "Stage dispatch covers different snapshot/contract/evidence");
-  need(d.sessionId === trace.sessionId && d.agentId === trace.agentId && d.toolUseId === trace.toolUseId, "Stage dispatch/runtime identity mismatch");
-  const stored = readSlicePlan(project, task, ledger);
-  if (stored) {
-    const progress = sliceProgress(project, task, ledger, stored);
-    need(progress.slices.every(s => s.state === "DELIVERED"), "All planned slices need complete current native handoffs before integrated verification/review");
-    const integration = ledger.dispatches[progress.slices.find(s => s.id === stored.plan.integration).dispatchId];
-    if (kind === "implementation") need(d.id === integration.id || (d.purpose === "repair" && d.slicePlan && Date.parse(d.createdAt) >= Date.parse(integration.finishedAt)),
-      "Record the final integration dispatch (or subsequent repair), never promote an intermediate slice to whole-task completion");
-    if (kind === "review") need(!Object.values(ledger.dispatches).some(other => belongs(ledger, other.taskId, task.id) && other.kind === "implementation"
-      && other.sessionId === trace.sessionId && other.agentId === trace.agentId), "Review must be independent of every implementation contributor, including earlier slices and failed repairs");
-  }
-  // Recording rejects consumed IDs; read-only inspection must accept an already
-  // recorded stage without treating it as a new attempt.
-  return d;
-}
-export const validateReviewDispatch = (project, task, input, trace) => validateStageDispatch(project, task, input, trace, "review");
-export function runDispatch(command, { project, id, value }) {
-  const request = () => json(contained(project, value("--request")));
-  if (command === "reserve") return reserve(project, id, request());
-  if (command === "dispatch-claim") return claim(project, value("--dispatch"), request());
-  if (command === "dispatch-complete") return complete(project, value("--dispatch"), { runtime: artifact(project, value("--file")) });
-  if (command === "dispatch-reconcile") return reconcile(project, value("--dispatch"), request());
-  if (command === "extend-dispatch") return extendDispatch(project, id, request());
-  if (command === "dispatch-status") return status(project, id);
-  if (command === "dispatch-prompt") return dispatchPrompt(project, id, value("--dispatch"));
-  if (command === "checkpoint") return checkpoint(project, id, { reason: value("--reason") });
-  if (command === "resume") return resume(project, id);
-  if (command === "telemetry") return telemetry(project, id);
-  return null;
-}