nomarmy 0.1.0-alpha.14 → 0.1.0-alpha.16

package/bin/nomarmy.mjs

@@ -199,6 +199,10 @@ Usage: nomarmy <command> [options]
                             which agent the General is, in --global
                             (default) or --local
   config paths    where agents.yml and the three army layers live
+  config max-jobs [n]
+                  how many api and subscription jobs run at once, across
+                  every session (default 4); with n, sets it in limits.yml.
+                  Warns when the Podman VM is too small for that many.
   jobs [--watch|--events [--until-done]|--prune|--wait <jobId>|--stop <jobId> [--reason <text>]] [--interval N] [--older-than DAYS]
                   what's running across every session (agent, model, phase,
                   last tool call, files changed, heartbeat) and what just
@@ -1919,6 +1923,11 @@ async function cmdSandbox() {
       const low = machine.memoryMb && machine.memoryMb < MIN_PODMAN_VM_MB;
       console.log(`\nVM ${machine.name} (${machine.state}): ${machine.cpus} CPUs, ${low ? c.red(`${machine.memoryMb / 1024} GiB memory`) : `${machine.memoryMb / 1024} GiB memory`}, ${machine.diskGb} GB disk`);
       if (low) console.log(c.yellow(`  Too small: worker commands get cut off below ${MIN_PODMAN_VM_MB / 1024} GiB. Fix: nomarmy sandbox --memory 8`));
+      const { maxJobs, jobsThatFit, vmGibFor } = await import("../lib/limits.mjs");
+      const limit = maxJobs().value, fit = jobsThatFit(machine.memoryMb);
+      if (fit !== null) console.log(limit > fit
+        ? c.yellow(`  Fits about ${fit} sandboxes at once, but up to ${limit} api and subscription jobs may run. Fix: nomarmy sandbox --memory ${vmGibFor(limit)}, or nomarmy config max-jobs ${fit}`)
+        : c.dim(`  Fits about ${fit} sandboxes at once; up to ${limit} api and subscription jobs may run (nomarmy config max-jobs).`));
     }
     if (images) console.log(`Images: ${images.count}, ${images.size}${images.reclaimable ? `, ${images.reclaimable} reclaimable (nomarmy sandbox --prune)` : ""}`);
     console.log(c.dim(runningJobs ? `${runningJobs} nomArmy job(s) running.` : "No nomArmy jobs running."));
@@ -2451,14 +2460,38 @@ async function cmdConfigPaths() {
   if (json) return out({ globalDir: globalConfigDir(), agents: { path: agentsPath, exists: fs.existsSync(agentsPath) }, army });
   console.log(c.bold("nomArmy config") + c.dim(`  (global dir: ${globalConfigDir()})`));
   console.log(`  ${fs.existsSync(agentsPath) ? c.green("●") : c.dim("○")} ${"agents".padEnd(8)} ${c.dim(agentsPath)}`);
+  const { limitsPath } = await import("../lib/limits.mjs");
+  console.log(`  ${fs.existsSync(limitsPath()) ? c.green("●") : c.dim("○")} ${"limits".padEnd(8)} ${c.dim(limitsPath())}`);
   console.log(c.bold("\nArmy layers"));
   for (const a of army) console.log(`  ${a.exists ? c.green("●") : c.dim("○")} ${a.layer.padEnd(8)} ${c.dim(a.path)}`);
 }
 
+// `nomarmy config max-jobs [n]`: api and subscription jobs at once, machine-wide.
+async function cmdConfigMaxJobs() {
+  const { maxJobs, setMaxJobs, jobsThatFit, vmGibFor } = await import("../lib/limits.mjs");
+  const given = argv[2];
+  if (given !== undefined) {
+    if (!/^\d+$/.test(given)) throw new Error(`max-jobs must be a whole number, got "${given}"`);
+    setMaxJobs(Number(given));
+  }
+  const limit = maxJobs();
+  const machine = process.platform === "linux" ? null : pickMachine(spawnSync("podman", ["machine", "inspect"], { encoding: "utf8" }).stdout);
+  const fit = jobsThatFit(machine?.memoryMb);
+  if (json) return out({ maxJobs: limit.value, source: limit.source, path: limit.path, problem: limit.problem, podmanVmMemoryMb: machine?.memoryMb ?? null, jobsThatFit: fit });
+  const from = { file: `set in ${limit.path}`, env: "from NOMARMY_MAX_POOL_WORKERS in this shell (limits.yml doesn't set it)", default: "the default" }[limit.source];
+  if (limit.problem) console.log(c.yellow(`⚠ ${limit.problem}`));
+  console.log(`${given !== undefined ? c.green("✓ ") : ""}Up to ${c.bold(String(limit.value))} api and subscription jobs at once, across every session (${from}).`);
+  console.log(c.dim("Each agent's max_concurrent in agents.yml also applies, and local-model jobs have their own limit."));
+  if (given !== undefined) console.log(c.dim("Applies to the next job in every session on this version, no restart."));
+  if (fit !== null && limit.value > fit) console.log(c.yellow(`⚠ The Podman VM (${machine.memoryMb / 1024} GiB) fits about ${fit} sandboxes at once; more get refused for memory or cut off. Fix: nomarmy sandbox --memory ${vmGibFor(limit.value)}`));
+  if (given === undefined) console.log(c.dim("Change it with `nomarmy config max-jobs <n>` (1 to 32)."));
+}
+
 async function cmdConfig() {
   const sub = argv[1] ?? "paths";
   if (sub === "paths") return cmdConfigPaths();
-  throw new Error(`Unknown config subcommand "${sub}". Use: nomarmy config paths`);
+  if (sub === "max-jobs") return cmdConfigMaxJobs();
+  throw new Error(`Unknown config subcommand "${sub}". Use: nomarmy config <paths|max-jobs [n]>`);
 }
 
 // --- `nomarmy jobs [--watch]`: what's running, from any session -----------

package/lib/admission.mjs

@@ -4,7 +4,7 @@ import { executionMode } from "./execution.mjs";
 import { jobLabel, jobElapsedSeconds } from "./job-format.mjs";
 import { continuationProblem } from "./continue-from.mjs";
 import { loadConfig } from "./config.mjs";
-import { clampInt } from "./budget-state.mjs";
+import { maxJobs } from "./limits.mjs";
 import { checkBrief, assessAdmission, describeBudgets } from "./budget.mjs";
 import { parseStatusPorcelainZ, isRuntimeJunk } from "./git-record.mjs";
 import { readJson } from "./openclaw-run.mjs";
@@ -38,8 +38,9 @@ export function jobLane(job) {
 // benefit of spreading load across providers with their own separate rate
 // limits. Not rate-limit-aware (see config/providers.yml.example); read
 // fresh each call, matching currentMaxWorkers()'s own env-read pattern.
+/** Api and subscription jobs at once, machine-wide: limits.yml's max_jobs (see lib/limits.mjs). */
 export function currentMaxPoolWorkers() {
-  return clampInt(process.env.NOMARMY_MAX_POOL_WORKERS, 1, 32, 4);
+  return maxJobs().value;
 }
 
 // Pure partition of a batch's ORIGINAL indices by lane -- pulled out of
@@ -192,7 +193,7 @@ export function createJobRuntime(deps) {
       running: [...activeJobs.values()].filter(j => !j.settled).map(j => ({ jobId: j.jobId, workerId: j.workerId, mode: j.mode, lane: j.lane, startedAt: j.startedAt, phase: readJson(path.join(jobsRoot, j.jobId, "status.json"))?.phase ?? "starting" })),
       usageLimits: Object.fromEntries(Object.entries(readUsageSnapshots(stateRoot)).map(([provider, snapshot]) => [provider, usageStatus(snapshot)])),
       maxWorkers: currentMaxWorkers(),
-      remote: { running: runningCount("remote"), maxWorkers: currentMaxPoolWorkers(), note: "api and subscription agents; each agent's own max_concurrent also applies" }
+      remote: (() => { const limit = maxJobs(); return { running: runningCount("remote"), maxWorkers: limit.value, setBy: limit.source === "file" ? limit.path : limit.source === "env" ? "NOMARMY_MAX_POOL_WORKERS" : "default", note: "api and subscription agents; each agent's own max_concurrent also applies. Change with `nomarmy config max-jobs <n>`." }; })()
     };
   }
   async function admit(jobs) {
@@ -352,7 +353,7 @@ export function createJobRuntime(deps) {
     if (jobs.some((j) => jobLane(j) === "remote")) {
       const remoteCeiling = currentMaxPoolWorkers(), runningRemote = runningCount("remote");
       if (runningRemote >= remoteCeiling) {
-        problems.push(`not admitted (capacity): ${runningRemote} remote job(s) (api or subscription agents) already running, at NOMARMY_MAX_POOL_WORKERS=${remoteCeiling}`);
+        problems.push(`not admitted (capacity): ${runningRemote} remote job(s) (api or subscription agents) already running, the limit of ${remoteCeiling} at once (raise it with \`nomarmy config max-jobs <n>\`)`);
       }
     }
     return { problems, admission };

package/lib/continue-from.mjs

@@ -88,6 +88,16 @@ export async function applyRetainedWork({ worktree, baseSha, commit, git }) {
 /** The brief's note, so the worker builds on the work instead of redoing it. */
 export function continuationNote({ continueFrom, record, files }) {
   const listed = files.slice(0, 20).join(", ") + (files.length > 20 ? `, and ${files.length - 20} more` : "");
-  const why = (record.issues ?? []).slice(0, 3).map((i) => `- ${String(i).slice(0, 300)}`).join("\n");
+  // What stopped the work, for the worker: its own NOT DONE, a failed
+  // verification, a timeout. Not the notes addressed to the General (review
+  // flags, "accept only after an independent review"): a worker handed those
+  // took the pending review as its own unfinished task and reported partial.
+  const reasons = [];
+  const notDone = record.reportValidation?.notDone;
+  if (notDone && !/^none\.?$/i.test(String(notDone).trim())) reasons.push(`its worker's NOT DONE: ${notDone}`);
+  if (record.independentVerification?.status === "fail") reasons.push(`its verification failed: ${record.independentVerification.detail ?? record.independentVerification.reason ?? "see the job record"}`);
+  if (record.outcome === "WORKER_TIMEOUT") reasons.push("it ran out of time");
+  if (!reasons.length && record.outcome) reasons.push(`it ended as ${record.outcome}`);
+  const why = reasons.map((r) => `- ${String(r).slice(0, 300)}`).join("\n");
   return `This worktree already holds the unfinished work of job ${continueFrom} (${files.length} file(s): ${listed}). Build on it; don't redo it. Your finished diff is verified as a whole, that work included.${why ? `\nThat job stopped because:\n${why}` : ""}`;
 }

package/lib/coordinator-instructions.mjs

@@ -16,7 +16,7 @@ Before dispatching:
 - To run tests without changing anything, use mode: verify; it costs no model usage.
 - Mark an implement job stakes: high when a mistake would be costly (security, access control, personal or tenant data, data loss, money, irreversible changes), however small it is. It then needs a verification profile, keeps the revert check, and needs an independent review before you accept it: a scout on another vendor with reviews: <job id>.
 - Brief outcomes, not edits: a task, explicit acceptance criteria, and the tests that prove it. Put facts you've already resolved in evidence.
-- Prefer local_worker_start for anything longer than a few minutes. Right after, if you can run a background command, run \`nomarmy jobs --wait <job_id>\` in the background so you're told the moment it finishes and can tell the operator (for several jobs, \`nomarmy jobs --events --until-done\`, which exits when they've all finished); otherwise poll local_worker_status with wait_seconds. Never run the plain \`nomarmy jobs --events\` stream as a background command: it only reports when it exits, so you'd never hear; it's for a monitor that reads each line. For a whole feature, use /feature (run_start keeps a run's jobs, spend and hours bounded).
+- Prefer local_worker_start for anything longer than a few minutes. Right after, if you can run a background command, run \`nomarmy jobs --wait <job_id>\` in the background so you're told the moment it finishes and can tell the operator (for several jobs, \`nomarmy jobs --events --until-done\`, which exits when they've all finished); otherwise poll local_worker_status with wait_seconds. To read a finished job, use local_worker_status with report: true (the report, a scout's cited findings, the outcome, issues and commit); full: true is the whole record and rarely needed. Review scouts (reviews set, or a review-phase role) default to 20 minutes, other jobs to 10; pass timeout_seconds for more. Never run the plain \`nomarmy jobs --events\` stream as a background command: it only reports when it exits, so you'd never hear; it's for a monitor that reads each line. For a whole feature, use /feature (run_start keeps a run's jobs, spend and hours bounded).
 
 Trust boundary:
 - A worker's four-line report is a claim; nomArmy's verified git record and independent verification are the evidence. A job isn't complete if its report is missing or malformed, its STATUS is partial or blocked, STATUS done lacks VERIFICATION pass, or its changes aren't committed by nomArmy.

package/lib/diff-checks.mjs

@@ -111,6 +111,12 @@ const TEST_SELECTION_FLAG_PATTERNS = Object.freeze([
 export function detectScopedTestSelectionRisk({ commands = [], testChanges = null } = {}) {
   const touchedTestFiles = [...(testChanges?.new_tests_added ?? []), ...(testChanges?.existing_tests_modified ?? [])];
   if (touchedTestFiles.length === 0) return null;
+  // A command that runs the changed test files by name, with no filter of its
+  // own, runs exactly the tests this diff touched: another command's -k can't
+  // exclude them. Senti's python profile does this and the warning fired on
+  // every job, which teaches people to ignore it.
+  const runsChangedTestsByName = commands.some((c) => /\$\{?NOMARMY_CHANGED_TEST_FILES\b/.test(String(c ?? "")) && !TEST_SELECTION_FLAG_PATTERNS.some((p) => p.re.test(String(c))));
+  if (runsChangedTestsByName) return null;
   const flagged = [];
   for (const command of commands) {
     const match = TEST_SELECTION_FLAG_PATTERNS.find((p) => p.re.test(String(command ?? "")));

package/lib/doctor.mjs

@@ -10,6 +10,7 @@ import path from "node:path";
 import os from "node:os";
 import { spawn, spawnSync } from "node:child_process";
 import { executionMode } from "./execution.mjs";
+import { maxJobs, jobsThatFit, vmGibFor } from "./limits.mjs";
 
 const MIN_NODE_MAJOR = 18;
 const DEFAULT_LLAMA_HOST = "127.0.0.1";
@@ -197,6 +198,20 @@ export function checkPodmanMachineMemory(facts) {
   };
 }
 
+/** Whether the Podman VM fits the api and subscription jobs the operator allowed at once. */
+export function checkPodmanVmFitsJobs(facts) {
+  const fit = jobsThatFit(facts.podmanMachineMemoryMb);
+  const limit = facts.maxJobs;
+  if (limit?.problem) return { ok: false, message: limit.problem, fix: "nomarmy config max-jobs <n>" };
+  if (fit === null || !limit) return { ok: true, message: "Jobs at once vs Podman VM: not applicable." };
+  if (limit.value <= fit) return { ok: true, message: `Up to ${limit.value} api and subscription jobs at once; the Podman VM fits about ${fit}.` };
+  return {
+    ok: false,
+    message: `Up to ${limit.value} api and subscription jobs may run at once, but the Podman VM (${(facts.podmanMachineMemoryMb / 1024).toFixed(0)} GiB) fits about ${fit} sandboxes; the rest get refused for memory or cut off.`,
+    fix: `nomarmy sandbox --memory ${vmGibFor(limit.value)}  (or lower the limit: nomarmy config max-jobs ${fit})`,
+  };
+}
+
 export function checkPodmanDaemon(facts) {
   if (!facts.podmanFound) {
     return {
@@ -496,6 +511,7 @@ export async function collectFacts(env = process.env) {
     podmanDaemonReachable: podmanDaemon.reachable,
     podmanDaemonError: podmanDaemon.error,
     podmanMachineMemoryMb: podmanPath && podmanDaemon.reachable ? probePodmanMachineMemory(podmanPath, platform) : null,
+    maxJobs: maxJobs({ env }),
     podmanIdMappings: podmanPath && podmanDaemon.reachable ? probePodmanIdMappings(podmanPath, platform) : null,
     execution,
     endpoint,
@@ -515,6 +531,7 @@ export function evaluateChecks(facts) {
     { id: "podman", ...checkPodmanPresent(facts) },
     { id: "podman-daemon", ...checkPodmanDaemon(facts) },
     { id: "podman-vm-memory", ...checkPodmanMachineMemory(facts) },
+    { id: "podman-vm-jobs", ...checkPodmanVmFitsJobs(facts) },
     { id: "podman-idmap", ...checkPodmanIdMappings(facts) },
     { id: "endpoint", ...checkEndpoint(facts) },
   ];

package/lib/execute.mjs

@@ -541,7 +541,11 @@ export function createExecutor(deps) {
         const request = readStopRequest(jobDir);
         issues.push(`stopped on request${request?.reason ? `: ${request.reason}` : ""}; the worktree is kept, so continue_from can pick the work up (on another model too)`);
       } else if (workerError) issues.push(`worker error: ${String(workerError).split("\n")[0]}`);
-      if ((result ?? attempted)?.salvaged) issues.push(`runner cleanup failed after the run (${(result ?? attempted).salvagedFrom}); the worker's report was recovered from the run's transcript`);
+      // OpenClaw's own cleanup failing after a finished run is benign once the report
+      // is recovered, and it happens on most Codex jobs: kept on the record for
+      // stats, out of the issues the General reviews.
+      const runnerNotes = [];
+      if ((result ?? attempted)?.salvaged) runnerNotes.push(`runner cleanup failed after the run (${(result ?? attempted).salvagedFrom}); the worker's report was recovered from the run's transcript`);
       if (jevClaims?.error) issues.push(`Jev report check skipped (${jevClaims.error}); this job's result doesn't depend on it`);
       if (judged?.error) issues.push(`Judge ${judged.skipped ? "skipped" : "didn't answer"} (${judged.error}); this job's result doesn't depend on it`);
       if (workerFailed || workerTimedOut) { const restarted = vmRestartIssue(vmStartedBefore, deps.podmanVmStartedAt?.() ?? null); if (restarted) issues.unshift(restarted); }
@@ -578,7 +582,7 @@ export function createExecutor(deps) {
         outcome: finalOutcome.outcome, recovered: finalOutcome.recovered, recoveryAttempted: finalOutcome.recoveryAttempted,
         reportRecoveryAttempted, reportRecovered,
         reviewRequired: finalOutcome.reviewRequired || record.testChanges.reviewRequired,
-        coordinatorStatus, issues: [...issues, ...(independentVerification.issues ?? [])], reportValidation, independentVerification,
+        coordinatorStatus, issues: [...issues, ...(independentVerification.issues ?? [])], runnerNotes, reportValidation, independentVerification,
         // Original, unsubstituted regressionCheck (real "restore_failed" status
         // visible here even though resolveOutcome above only ever saw a
         // not_run-substituted view) -- full transparency for the caller.
@@ -640,7 +644,10 @@ export function createExecutor(deps) {
       const workerStartedMs = Date.now();
       progress("worker");
       try {
-        result = await runOpenClaw({ task, acceptance, verification: null, mode, cwd: worktree, baseRef: base.ref, baseSha: base.sha, timeoutSeconds, runtimeDir, profile, reasoning, pool, subscriptionWorker, onBehalfOf, model, reportSize, jobDir, workerId: workerId || jobId, evidenceTool: evidencePlaced ? evidenceTool : null });
+        // The run gets the work share; the reserve stays for report recovery
+        // below. Scouts had none, so a timed-out scout left about 0 seconds
+        // and its findings were never recovered.
+        result = await runOpenClaw({ task, acceptance, verification: null, mode, cwd: worktree, baseRef: base.ref, baseSha: base.sha, timeoutSeconds: deriveTimeBudget({ timeoutSeconds }).workTimeoutSeconds, runtimeDir, profile, reasoning, pool, subscriptionWorker, onBehalfOf, model, reportSize, jobDir, workerId: workerId || jobId, evidenceTool: evidencePlaced ? evidenceTool : null });
       } catch (error) {
         workerFailed = true;
         // error.timedOut is set only by our own spawn timer (run(), above) --
@@ -670,10 +677,12 @@ export function createExecutor(deps) {
 
       // See shouldAttemptScoutRecovery's own doc comment: this only fires when
       // the report is genuinely unusable, gated by whatever time is actually
-      // left against the caller's original timeout (scout has no reserved
-      // report-phase budget the way implement does).
+      // left against the caller's original timeout (the reserve held back
+      // from the run above).
       let reportRecoveryAttempted = false, reportRecovered = false;
-      const remainingSeconds = timeoutSeconds - Math.round(workerElapsedMs / 1000);
+      // At least the reserve, as implement's recovery gets: nomArmy's own kill
+      // lands 30s after OpenClaw's timer, which would otherwise eat it.
+      const remainingSeconds = Math.max(deriveTimeBudget({ timeoutSeconds }).reportReserveSeconds, timeoutSeconds - Math.round(workerElapsedMs / 1000));
       if (shouldAttemptScoutRecovery({ workerFailed, workerTimedOut, report, remainingSeconds })) {
         reportRecoveryAttempted = true;
         // What the first run left, in case the follow-up can't see its session.
@@ -725,7 +734,11 @@ export function createExecutor(deps) {
       const worker = workerMetadata(result ?? attempted);
       const issues = [...outcome.reasons];
       if (workerError) issues.push(`scout error: ${String(workerError).split("\n")[0]}`);
-      if ((result ?? attempted)?.salvaged) issues.push(`runner cleanup failed after the run (${(result ?? attempted).salvagedFrom}); the scout's report was recovered from the run's transcript`);
+      // OpenClaw's own cleanup failing after a finished run is benign once the report
+      // is recovered, and it happens on most Codex jobs: kept on the record for
+      // stats, out of the issues the General reviews.
+      const runnerNotes = [];
+      if ((result ?? attempted)?.salvaged) runnerNotes.push(`runner cleanup failed after the run (${(result ?? attempted).salvagedFrom}); the scout's report was recovered from the run's transcript`);
       const failures = worker.toolSummary?.failures ?? 0; if (failures > 0) issues.push(`scout recorded ${failures} tool failure(s)`);
       if (dirty) issues.push(`snapshot changed: ${record.repoStatusFiles.join(", ")}`);
       if (jevCitations?.flags.length) issues.push(`CITATIONS MAY NOT SUPPORT FINDINGS (Jev): ${jevCitations.flags.map((f) => `"${String(verified.findings[f.index].text).slice(0, 80)}${String(verified.findings[f.index].text).length > 80 ? "..." : ""}" (${f.verdict}, ${f.probability.toFixed(2)})`).join("; ")}. Read those cited lines before relying on them; they're marked [JEV] in the report.`);
@@ -768,7 +781,7 @@ export function createExecutor(deps) {
       const manifest = { version: VERSION, jobId, workerId: workerId || jobId, mode, projectDir, worktree: worktreeRetained ? worktree : null, branch: null, baseSha: base.sha, startedAt, finishedAt,
         objective: task, mustCover: acceptance ?? [], ...(reviews ? { reviews } : {}),
         ...(jevCitations ? { validators: { jev: { check: "scout-citations", checked: jevCitations.checked, flags: jevCitations.flags, errors: jevCitations.errors, inputTokens: jevCitations.usage } } } : {}),
-        outcome: outcome.outcome, coordinatorStatus: outcome.coordinatorStatus, reviewRequired: outcome.reviewRequired, issues,
+        outcome: outcome.outcome, coordinatorStatus: outcome.coordinatorStatus, reviewRequired: outcome.reviewRequired, issues, runnerNotes,
         scout: { question: report.question, confidence: report.confidence, notFound: report.notFound,
           findings: verified.findings, supported: verified.supported, unsupported: verified.unsupported, weak: verified.weak,
           excerptLinesUsed: verified.excerptLinesUsed, excerptTruncated: verified.excerptTruncated,
@@ -860,7 +873,11 @@ export function createExecutor(deps) {
       const worker = workerMetadata(result ?? attempted);
       const issues = [...outcome.reasons];
       if (workerError) issues.push(`decompose error: ${String(workerError).split("\n")[0]}`);
-      if ((result ?? attempted)?.salvaged) issues.push(`runner cleanup failed after the run (${(result ?? attempted).salvagedFrom}); the decomposer's report was recovered from the run's transcript`);
+      // OpenClaw's own cleanup failing after a finished run is benign once the report
+      // is recovered, and it happens on most Codex jobs: kept on the record for
+      // stats, out of the issues the General reviews.
+      const runnerNotes = [];
+      if ((result ?? attempted)?.salvaged) runnerNotes.push(`runner cleanup failed after the run (${(result ?? attempted).salvagedFrom}); the decomposer's report was recovered from the run's transcript`);
       const failures = worker.toolSummary?.failures ?? 0; if (failures > 0) issues.push(`decomposer recorded ${failures} tool failure(s)`);
       if (dirty) issues.push(`snapshot changed: ${record.repoStatusFiles.join(", ")}`);
       if (overlaps.length) issues.push(`${overlaps.length} subtask pair(s) claim overlapping files; not safe to dispatch as independent jobs as proposed`);
@@ -890,7 +907,7 @@ export function createExecutor(deps) {
       };
       const manifest = { version: VERSION, jobId, workerId: workerId || jobId, mode, projectDir, worktree: worktreeRetained ? worktree : null, branch: null, baseSha: base.sha, startedAt, finishedAt,
         objective: task, constraints: acceptance ?? [],
-        outcome: outcome.outcome, coordinatorStatus: outcome.coordinatorStatus, reviewRequired: outcome.reviewRequired, issues,
+        outcome: outcome.outcome, coordinatorStatus: outcome.coordinatorStatus, reviewRequired: outcome.reviewRequired, issues, runnerNotes,
         decompose: { objective: report.objective, confidence: report.confidence, notSplittable: report.notSplittable,
           subtasks: report.subtasks.map((s, i) => ({ task: s.task, acceptance: s.acceptance, citations: verified.findings[i]?.citations ?? [], supported: verified.findings[i]?.supported ?? false, weak: verified.findings[i]?.weak ?? false })),
           overlaps, supported: verified.supported, unsupported: verified.unsupported, weak: verified.weak,

package/lib/job-format.mjs

@@ -88,6 +88,28 @@ export function compactJobRecord(meta) {
   return meta.mode === "scout" ? compactScoutRecord(meta) : meta.mode === "decompose" ? compactDecomposeRecord(meta) : compactImplementRecord(meta);
 }
 
+/**
+ * The report and what nomArmy decided about it, without the rest of the
+ * record: full=true put the whole execution record in the General's context
+ * when it only wanted the worker's answer. Scout findings keep their verified
+ * citations, since they are the report.
+ */
+export function reportView(meta) {
+  const iv = meta.independentVerification;
+  const base = { jobId: meta.jobId, mode: meta.mode, outcome: meta.outcome, coordinatorStatus: meta.coordinatorStatus, reviewRequired: meta.reviewRequired ?? false, issues: meta.issues ?? [] };
+  if (meta.mode === "scout") {
+    const s = meta.scout ?? {};
+    return { ...base, question: s.question ?? meta.objective ?? null, confidence: s.confidence ?? null, notFound: s.notFound ?? null, findings: s.findings ?? [], unsupported: s.unsupported ?? [] };
+  }
+  return { ...base,
+    report: meta.reportValidation?.fields ?? null,
+    verification: iv ? { status: iv.status, detail: iv.status === "fail" ? String(iv.detail ?? iv.reason ?? "").slice(0, 600) || null : null } : null,
+    revertCheck: meta.regressionCheck?.status ?? null,
+    commit: meta.commit ? { created: Boolean(meta.commit.created), sha: meta.commit.sha ?? null, branch: meta.branch ?? null, reason: meta.commit.created ? null : meta.commit.reason ?? null } : null,
+    changedFiles: meta.git?.changedFiles ?? [], additions: meta.git?.additions ?? null, deletions: meta.git?.deletions ?? null,
+    ...(meta.mode === "decompose" ? { proposal: meta.decompose ?? meta.proposal ?? null } : {}) };
+}
+
 // Evidence before claim, in the display order too: the record is what
 // nomArmy verified against Git, the worker's report is prose it wrote about
 // itself. Leading with the report buried the record below whatever the

package/lib/limits.mjs

@@ -0,0 +1,77 @@
+// Machine-wide limits, in ~/.config/nomarmy/limits.yml. One place for every
+// coordinator: an environment variable lives in each Claude Code, Codex and
+// Cursor registration separately, so the sessions could disagree.
+//
+// Its own file, not a section of config.yml: config.yml is validated strictly,
+// and a session still running an older copy refused the whole file (and with
+// it every role) when a new key appeared there. Older copies never read this
+// file, so writing it can't break them.
+
+import fs from "node:fs";
+import path from "node:path";
+import YAML from "yaml";
+import { z } from "zod";
+import { globalConfigDir } from "./army.mjs";
+import { RESERVES } from "./sizing.mjs";
+
+export const LIMITS_FILENAME = "limits.yml";
+export const DEFAULT_MAX_JOBS = 4;
+export const MAX_MAX_JOBS = 32;
+
+export const limitsSchema = z.object({
+  // Api and subscription jobs at once, across every session. Local-model jobs have their own limit.
+  max_jobs: z.number().int().min(1).max(MAX_MAX_JOBS).optional(),
+}).passthrough();
+
+export function limitsPath(env = process.env) {
+  return path.join(globalConfigDir(env), LIMITS_FILENAME);
+}
+
+/**
+ * How many api and subscription jobs may run at once, and where that came
+ * from: limits.yml, then NOMARMY_MAX_POOL_WORKERS (older setups set it in each
+ * registration), then the default. Read on every call, so a change applies to
+ * the next job in every session. A missing or unreadable file falls through
+ * rather than holding jobs up.
+ */
+export function maxJobs({ env = process.env, filePath = limitsPath(env) } = {}) {
+  let problem = null;
+  if (fs.existsSync(filePath)) {
+    try {
+      const parsed = limitsSchema.safeParse(YAML.parse(fs.readFileSync(filePath, "utf8")) ?? {});
+      if (parsed.success && parsed.data.max_jobs) return { value: parsed.data.max_jobs, source: "file", path: filePath, problem };
+      if (!parsed.success) problem = `${filePath}: max_jobs must be a whole number from 1 to ${MAX_MAX_JOBS}; ignored. Fix: nomarmy config max-jobs <n>`;
+    } catch (error) { problem = `${filePath} is not valid YAML (${error.message.split("\n")[0]}); ignored.`; }
+  }
+  const declared = Number.parseInt(env.NOMARMY_MAX_POOL_WORKERS ?? "", 10);
+  if (Number.isFinite(declared)) return { value: Math.min(MAX_MAX_JOBS, Math.max(1, declared)), source: "env", path: null, problem };
+  return { value: DEFAULT_MAX_JOBS, source: "default", path: null, problem };
+}
+
+/** Write max_jobs, keeping the rest of limits.yml (comments included) as it was. */
+export function setMaxJobs(n, { filePath = limitsPath() } = {}) {
+  if (!Number.isInteger(n) || n < 1 || n > MAX_MAX_JOBS) throw new Error(`max-jobs must be a whole number from 1 to ${MAX_MAX_JOBS}, got "${n}"`);
+  const text = fs.existsSync(filePath) ? fs.readFileSync(filePath, "utf8") : "# Machine-wide limits for nomArmy: `nomarmy config max-jobs <n>` sets max_jobs.\n";
+  const doc = YAML.parseDocument(text);
+  if (doc.errors.length) throw new Error(`${filePath} is not valid YAML: ${doc.errors[0].message}`);
+  if (doc.contents === null) doc.contents = doc.createNode({});
+  doc.set("max_jobs", n);
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, String(doc));
+  return n;
+}
+
+// The Podman VM's own system and page cache, before any sandbox.
+const VM_BASE_BYTES = 2 * 1024 ** 3;
+
+/** How many sandboxes fit in a Podman VM of this size, by the per-job reserve admission uses. */
+export function jobsThatFit(vmMemoryMb) {
+  if (!Number.isFinite(vmMemoryMb)) return null;
+  return Math.max(0, Math.floor((vmMemoryMb * 1024 ** 2 - VM_BASE_BYTES) / RESERVES.sandboxPerNomBytes));
+}
+
+/** The VM size (GiB, rounded up to an even number) that fits `jobs` sandboxes. */
+export function vmGibFor(jobs) {
+  const gib = Math.ceil((VM_BASE_BYTES + jobs * RESERVES.sandboxPerNomBytes) / 1024 ** 3);
+  return gib + (gib % 2);
+}

package/lib/openclaw-run.mjs

@@ -157,12 +157,44 @@ export function parseUnsupportedThinkingError(errorMessage) {
 // worker that ran out of room, but has valid session state worth resuming)
 // it exists for. Checked against the real captured envelope from that
 // incident, not a synthesized shape.
-export function parseOpenClawInternalTimeout(stdout) {
+export function parseOpenClawInternalTimeout(stdout, stderr = "") {
+  // OpenClaw's own timer can end a run in the middle of a tool call. The
+  // envelope then reports that call's failure ("Read failed", status
+  // "error"), not a timeout; its run log still says so. Seen live on a Grok
+  // security review cut off mid-read at 600s: recorded as a crash, so its
+  // findings were never recovered.
+  if (/embedded run timeout: /.test(String(stderr))) return true;
   let parsed;
   try { parsed = JSON.parse(stdout); } catch { return false; }
   return parsed?.ok === false && (parsed?.status === "timeout" || parsed?.error?.kind === "timeout");
 }
 
+/** What a failed run's envelope still says it used, so a failed job's spend is recorded too. */
+export function failedRunUsage(stdout) {
+  let parsed;
+  try { parsed = JSON.parse(stdout); } catch { return {}; }
+  if (!parsed || typeof parsed !== "object") return {};
+  const out = {};
+  if (parsed.usage && typeof parsed.usage === "object") out.usage = parsed.usage;
+  if (Number.isFinite(parsed.costUsd)) out.costUsd = parsed.costUsd;
+  if (parsed.toolSummary && typeof parsed.toolSummary === "object") out.toolSummary = parsed.toolSummary;
+  if (typeof parsed.sessionId === "string") out.sessionId = parsed.sessionId;
+  return out;
+}
+
+/**
+ * The time a run has, told to the worker. Without it a Grok scout read files
+ * for its whole 10 minutes and was cut off before writing a word of its report.
+ */
+export function timeBudgetNote(timeoutSeconds, mode) {
+  const total = Number(timeoutSeconds);
+  if (!Number.isFinite(total) || total <= 0) return "";
+  const minutes = Math.max(1, Math.round(total / 60));
+  const wrapAt = Math.max(1, Math.floor((total * 0.8) / 60));
+  const what = mode === "scout" || mode === "decompose" ? "stop exploring and write your report from what you have" : "stop starting new work, finish verification and write your report";
+  return `\n\nTIME\nThis run has about ${minutes} minute(s), then it is cut off. By minute ${wrapAt}, ${what}. A report on part of the question, with what's left under NOT DONE, is far more useful than none.`;
+}
+
 /**
  * A run whose work finished but whose exit failed: OpenClaw logged the run
  * ending normally (stopReason=stop) and then errored, e.g. "Codex one-shot
@@ -471,7 +503,7 @@ export function createOpenClawRunner(deps) {
       ? scoutPrompt({ question: task, mustCover: acceptance, baseRef, baseSha, workerId, limits: jobBudgets.scout, report: jobBudgets.report.scout, evidenceTool })
       : mode === "decompose"
       ? decomposePrompt({ objective: task, constraints: acceptance, baseRef, baseSha, workerId, limits: jobBudgets.decompose, report: jobBudgets.report.decompose, evidenceTool })
-      : workerPrompt({ task, acceptance, verification, mode, baseRef, baseSha, workerId, evidence, report: jobBudgets.report.implement }));
+      : workerPrompt({ task, acceptance, verification, mode, baseRef, baseSha, workerId, evidence, report: jobBudgets.report.implement })) + (overridePrompt ? "" : timeBudgetNote(timeoutSeconds, mode));
     fs.writeFileSync(path.join(jobDir, `brief${logSuffix}.txt`), prompt + "\n");
     // --state-dir keeps OpenClaw's session state (its transcript database among
     // it) inside the job directory instead of a temp dir it deletes on exit.
@@ -586,7 +618,7 @@ export function createOpenClawRunner(deps) {
         // a graceful internal timeout, not an opaque crash -- relabel it so
         // executeImplement/executeScout's workerTimedOut check (and therefore
         // report recovery) sees it correctly.
-        if (!error.timedOut && parseOpenClawInternalTimeout(error.stdout)) {
+        if (!error.timedOut && error.stopReason !== "stopped" && parseOpenClawInternalTimeout(error.stdout, error.stderr)) {
           error.timedOut = true;
           error.stopReason = error.stopReason ?? "openclaw_internal_timeout";
         }
@@ -611,7 +643,7 @@ export function createOpenClawRunner(deps) {
         }
         // What was attempted, for the job record: a failed job used to be
         // labeled with the local default model, whatever it really ran on.
-        error.partialResult = { model: bareModel, provider: selected.entry?.provider ?? workerProvider, budgetsUsed: jobBudgets };
+        error.partialResult = { ...failedRunUsage(error.stdout), model: bareModel, provider: selected.entry?.provider ?? workerProvider, budgetsUsed: jobBudgets };
         throw error;
       } finally {
         // A cloned copy of the ambient OpenClaw config (which may carry a real

package/lib/stats.mjs

@@ -118,12 +118,13 @@ export function computeStats(records, { repo = null, sinceMs = null, untilMs = n
 
   const workerMinutes = implement.map((r) => r.metrics?.worker_elapsed).filter(Number.isFinite).map((ms) => ms / 60000);
   const jobMinutes = implement.map((r) => r.metrics?.total_elapsed).filter(Number.isFinite).map((ms) => ms / 60000);
-  const tokens = { total: 0, input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
+  const tokens = { total: 0, input: 0, output: 0, cacheRead: 0, cacheWrite: 0, untracked: 0 };
   const spend = {};
   for (const r of jobs) {
     const m = r.metrics ?? {};
     tokens.total += m.worker_tokens_total ?? 0; tokens.input += m.worker_tokens_in ?? 0; tokens.output += m.worker_tokens_out ?? 0;
     tokens.cacheRead += m.worker_tokens_cache_read ?? 0; tokens.cacheWrite += m.worker_tokens_cache_write ?? 0;
+    if (r.mode !== "verify" && !(m.worker_tokens_total > 0)) tokens.untracked++;
     if (Number.isFinite(m.worker_cost_usd) && m.worker_cost_usd > 0) spend[jobModel(r) ?? "unknown"] = (spend[jobModel(r) ?? "unknown"] ?? 0) + m.worker_cost_usd;
   }
 
@@ -131,12 +132,14 @@ export function computeStats(records, { repo = null, sinceMs = null, untilMs = n
   const claimedDone = implement.filter((r) => r.reportValidation?.status === "done" && r.reportValidation?.tests === "pass");
   const verificationFailed = claimedDone.filter((r) => r.independentVerification?.status === "fail");
   const revertStillPassed = claimedDone.filter((r) => r.independentVerification?.status === "pass" && r.regressionCheck?.status === "fail");
+  // Claimed success with an empty diff: there was nothing to verify.
+  const changedNothing = claimedDone.filter((r) => r.independentVerification?.status === "not_run");
   const passedBoth = claimedDone.filter((r) => r.independentVerification?.status === "pass" && r.regressionCheck?.status !== "fail");
   const flaggedAfterPassing = passedBoth.filter((r) => (r.issues ?? []).some((i) => /^(MUTANTS SURVIVED|REPORT MAY NOT MATCH|JUDGE \(|VERIFICATION INPUT CHANGED)/.test(i)));
 
   const signals = {};
   for (const [name, re] of SIGNALS) {
-    const n = jobs.filter((r) => (r.issues ?? []).some((i) => re.test(i))).length;
+    const n = jobs.filter((r) => [...(r.issues ?? []), ...(r.runnerNotes ?? [])].some((i) => re.test(i))).length;
     if (n) signals[name] = n;
   }
 
@@ -176,6 +179,7 @@ export function computeStats(records, { repo = null, sinceMs = null, untilMs = n
       verificationFailed: verificationFailed.length,
       revertStillPassed: revertStillPassed.length,
       passedBoth: passedBoth.length,
+      changedNothing: changedNothing.length,
       flaggedAfterPassing: flaggedAfterPassing.length,
     },
     notCompleted: sortDesc(count(jobs.filter((r) => !/^(WORKER_DONE|RECOVERED_SUCCESS|VERIFIED|SCOUT_DONE|DECOMPOSE_DONE|SCOUT_NOT_FOUND)$/.test(r.outcome ?? "")), (r) => r.outcome)),
@@ -212,7 +216,7 @@ export function formatStats(s) {
     `  Committed     ${s.code.committedJobs} job(s) · +${s.code.linesAdded} / -${s.code.linesRemoved} lines · ${s.code.files} files · ${s.code.newTestFiles} new test files`,
     `  Worker time   median ${mins(s.workerMinutes.median)} per implement job, p90 ${mins(s.workerMinutes.p90)}, total ${Math.round(s.workerMinutes.total)} min`,
     `  Job time      median ${mins(s.jobMinutes.median)}, p90 ${mins(s.jobMinutes.p90)}, total ${Math.round(s.jobMinutes.total)} min (with verification and checks)`,
-    `  Tokens        ${big(s.tokens.total)} total (${big(s.tokens.input)} in, ${big(s.tokens.output)} out, ${big(s.tokens.cacheRead)} cache read)`,
+    `  Tokens        ${big(s.tokens.total)} total (${big(s.tokens.input)} in, ${big(s.tokens.output)} out, ${big(s.tokens.cacheRead)} cache read)${s.tokens.untracked ? `; ${s.tokens.untracked} job(s) recorded no token counts` : ""}`,
     `  API spend     $${s.spendUsd.total.toFixed(2)}${Object.keys(s.spendUsd.byModel).length ? ` (${Object.entries(s.spendUsd.byModel).map(([k, v]) => `${k} $${v.toFixed(2)}`).join(", ")})` : ""}; subscriptions aren't billed per call`,
     "",
     `CLAIM VS EVIDENCE (implement jobs that reported "done, tests pass": ${c.claimedDone})`,
@@ -220,6 +224,7 @@ export function formatStats(s) {
     `  Passed, but reverting still passed    ${c.revertStillPassed}${pct(c.revertStillPassed, c.claimedDone)}`,
     `  Passed both                           ${c.passedBoth}${pct(c.passedBoth, c.claimedDone)}`,
     `    of those, flagged by another check  ${c.flaggedAfterPassing} (mutants, Jev, judge, rewritten checks)`,
+    ...(c.changedNothing ? [`  Changed nothing, nothing to verify    ${c.changedNothing}${pct(c.changedNothing, c.claimedDone)}`] : []),
     `  High-stakes jobs                      ${s.highStakes?.jobs ?? 0}, ${s.highStakes?.reviewed ?? 0} with an independent review`,
     "  Defects the General found at integration aren't in the records; count them in your own review.",
     "",

package/lib/suggestions.mjs

@@ -11,7 +11,12 @@ const OK = /^(WORKER_DONE|RECOVERED_SUCCESS|SCOUT_DONE|SCOUT_NOT_FOUND|DECOMPOSE
 
 const provider = (r) => r.metrics?.worker_provider ?? r.worker?.provider ?? null;
 const model = (r) => r.metrics?.worker_model ?? r.worker?.model ?? null;
-const agent = (r) => r.labels?.agent ?? null;
+// The local model is the built-in "local" agent, whatever model is loaded.
+const agent = (r) => r.labels?.agent ?? (provider(r) === "llama-cpp" ? "local" : null);
+// New tokens only: cache reads are most of an api job's total and cost a fraction.
+const freshTokens = (r) => (r.metrics?.worker_tokens_in ?? 0) + (r.metrics?.worker_tokens_out ?? 0);
+/** The runner exited before a report: an OpenClaw, sandbox or provider failure, not the model's work. */
+export const runnerFailed = (r) => r.outcome === "WORKER_FAILED" && [...(r.issues ?? []), ...(r.reasons ?? [])].some((x) => /^(worker|scout|decomposer) process failed/.test(x));
 const pct = (n, of) => Math.round((100 * n) / of);
 
 /** Whether a high-stakes job has had an independent review: a scout, or a judge, on another vendor. */
@@ -36,11 +41,13 @@ export function computeSuggestions(records, { minJobs = MIN_JOBS, agentFor = ()
   const groups = new Map();
   for (const r of work) {
     const key = `${jobRole(r) ?? ""}|${model(r) ?? ""}|${r.mode}`;
-    const g = groups.get(key) ?? { role: jobRole(r), model: model(r), mode: r.mode, agent: agent(r), provider: provider(r), jobs: 0, ok: 0, timeout: 0, unsupported: 0, tokens: 0 };
-    g.jobs++; if (OK.test(r.outcome ?? "")) g.ok++;
+    const g = groups.get(key) ?? { role: jobRole(r), model: model(r), mode: r.mode, agent: agent(r), provider: provider(r), jobs: 0, rated: 0, ok: 0, runner: 0, timeout: 0, unsupported: 0, tokens: 0, tokenJobs: 0 };
+    g.jobs++;
+    if (runnerFailed(r)) g.runner++; else g.rated++;
+    if (OK.test(r.outcome ?? "")) g.ok++;
     if (r.outcome === "WORKER_TIMEOUT") g.timeout++;
     if (r.outcome === "SCOUT_UNSUPPORTED") g.unsupported++;
-    g.tokens += r.metrics?.worker_tokens_total ?? 0;
+    if (freshTokens(r) > 0) { g.tokens += freshTokens(r); g.tokenJobs++; }
     g.agent = g.agent ?? agent(r) ?? agentFor(provider(r));
     groups.set(key, g);
   }
@@ -50,39 +57,47 @@ export function computeSuggestions(records, { minJobs = MIN_JOBS, agentFor = ()
     if (!g.model) continue;
     const kind = g.mode === "scout" ? "scouts" : "implement jobs";
     const who = g.role ? `${g.role} on ${g.model}` : `${kind} with no role on ${g.model}`;
+    // The runner failing isn't the model doing poor work: say so apart, and leave those out of its rate.
+    if (g.runner >= 3 && g.runner / g.jobs >= 0.4) {
+      out.push({ level: "warn", key: `runner-failed:${g.role}:${g.model}:${g.mode}`, title: `${who}: the runner failed on ${g.runner} of ${g.jobs} ${kind} before any report`,
+        evidence: "OpenClaw, the sandbox or the provider exited early, so these say nothing about the model's work. Check `nomarmy health` and one job's log (`nomarmy jobs <id>`); a model its vendor refuses fails this way too.", command: null });
+    }
     // Scouts that come back empty.
-    if (g.mode === "scout" && g.jobs >= 3 && g.unsupported / g.jobs >= 0.4) {
-      out.push({ level: "warn", key: `scout-unsupported:${g.role}:${g.model}`, title: `${who}: ${g.unsupported} of ${g.jobs} scouts came back unsupported`,
+    if (g.mode === "scout" && g.rated >= 3 && g.unsupported / g.rated >= 0.4) {
+      out.push({ level: "warn", key: `scout-unsupported:${g.role}:${g.model}`, title: `${who}: ${g.unsupported} of ${g.rated} scouts came back unsupported`,
         evidence: "Their findings couldn't be tied to cited lines. A different agent, or report: full, usually fixes it.", command: assign(g) });
       continue;
     }
-    if (g.jobs < minJobs) continue;
+    if (g.rated < minJobs) continue;
+    const runnerNote = g.runner ? ` (plus ${g.runner} the runner failed on, not counted)` : "";
     // A pairing that rarely finishes.
-    if (g.ok / g.jobs < 0.5) {
-      const better = [...groups.values()].filter((o) => o !== g && o.mode === g.mode && o.jobs >= minJobs && o.model && o.ok / o.jobs >= g.ok / g.jobs + 0.2)
-        .sort((a, b) => b.ok / b.jobs - a.ok / a.jobs)[0];
-      out.push({ level: "warn", key: `low-success:${g.role}:${g.model}:${g.mode}`, title: `${who} finished ${g.ok} of ${g.jobs} ${g.role ? kind : ""}`.trim() + ` (${pct(g.ok, g.jobs)}%)`,
-        evidence: (better ? `${better.model} finished ${pct(better.ok, better.jobs)}% of its ${better.jobs} ${kind} here${better.role ? ` (as ${better.role})` : ""}.` : "No other model has enough jobs here to compare.") + (g.role ? "" : " These ran with no army role: send this kind of work to a role on a stronger agent instead."),
+    if (g.ok / g.rated < 0.5) {
+      const better = [...groups.values()].filter((o) => o !== g && o.mode === g.mode && o.rated >= minJobs && o.model && o.ok / o.rated >= g.ok / g.rated + 0.2)
+        .sort((a, b) => b.ok / b.rated - a.ok / a.rated)[0];
+      out.push({ level: "warn", key: `low-success:${g.role}:${g.model}:${g.mode}`, title: `${who} finished ${g.ok} of ${g.rated} ${g.role ? kind : ""}`.trim() + ` (${pct(g.ok, g.rated)}%)${runnerNote}`,
+        evidence: (better ? `${better.model} finished ${pct(better.ok, better.rated)}% of its ${better.rated} ${kind} here${better.role ? ` (as ${better.role})` : ""}.` : "No other model has enough jobs here to compare.") + (g.role ? "" : " These ran with no army role: send this kind of work to a role on a stronger agent instead."),
         command: g.role ? assign(g, better?.model ?? "<another model>") : null });
     }
     // Timeouts.
-    if (g.timeout >= 3 && g.timeout / g.jobs >= 0.25) {
-      out.push({ level: "info", key: `timeouts:${g.role}:${g.model}`, title: `${who} timed out on ${g.timeout} of ${g.jobs} jobs`,
+    if (g.timeout >= 3 && g.timeout / g.rated >= 0.25) {
+      out.push({ level: "info", key: `timeouts:${g.role}:${g.model}`, title: `${who} timed out on ${g.timeout} of ${g.rated} jobs`,
         evidence: "Smaller briefs (one outcome each), a longer timeout_seconds, or a faster model would help.", command: null });
     }
   }
 
-  // A lighter model doing as well on implement work, for much less.
-  const impl = [...groups.values()].filter((g) => g.mode === "implement" && g.model && g.jobs >= minJobs && g.tokens > 0);
+  // A lighter model doing as well on the same role's implement work, for much less. Only
+  // within one role: different roles do different work, so across roles the numbers don't compare.
+  const impl = [...groups.values()].filter((g) => g.mode === "implement" && g.role && g.model && g.rated >= minJobs && g.tokenJobs >= minJobs);
   for (const heavy of impl) {
     for (const light of impl) {
-      if (light === heavy || light.model === heavy.model) continue;
-      const lightRate = light.ok / light.jobs, heavyRate = heavy.ok / heavy.jobs;
-      if (lightRate >= heavyRate - 0.05 && light.tokens / light.jobs <= 0.5 * (heavy.tokens / heavy.jobs)) {
+      if (light === heavy || light.role !== heavy.role || light.model === heavy.model) continue;
+      const lightRate = light.ok / light.rated, heavyRate = heavy.ok / heavy.rated;
+      const lightPerJob = light.tokens / light.tokenJobs, heavyPerJob = heavy.tokens / heavy.tokenJobs;
+      if (lightRate >= heavyRate - 0.05 && lightPerJob <= 0.5 * heavyPerJob) {
         out.push({ level: "info", key: `lighter:${heavy.role}:${heavy.model}:${light.model}`,
-          title: `${light.model} finished ${pct(light.ok, light.jobs)}% of its jobs${light.role ? ` (as ${light.role})` : ""} on ${Math.round((light.tokens / light.jobs) / 1000)}k tokens a job; ${heavy.model}${heavy.role ? ` (as ${heavy.role})` : ""} finished ${pct(heavy.ok, heavy.jobs)}% on ${Math.round((heavy.tokens / heavy.jobs) / 1000)}k`,
-          evidence: "They did different work, so try it rather than switch outright: put the role on auto so the General picks per job, or send its routine pieces to the lighter model.",
-          command: heavy.role ? `nomarmy army assign ${heavy.role} ${heavy.agent ?? "<agent>"} auto` : null });
+          title: `${heavy.role}: ${light.model} finished ${pct(light.ok, light.rated)}% of its jobs on ${Math.round(lightPerJob / 1000)}k new tokens a job; ${heavy.model} finished ${pct(heavy.ok, heavy.rated)}% on ${Math.round(heavyPerJob / 1000)}k`,
+          evidence: `Same role, so similar work. Moving ${heavy.role} to ${light.model} would cost less; keep ${heavy.model} for the harder pieces with model on the job.${light.agent === "local" ? ` The local agent runs whichever model is loaded; these ran on ${light.model}.` : ""}`,
+          command: light.agent ? `nomarmy army assign ${heavy.role} ${light.agent}${light.agent === "local" ? "" : ` ${light.model}`}` : null });
       }
     }
   }

package/lib/transcript.mjs

@@ -14,6 +14,7 @@
 // Estimates are labeled as such and use the same 4-chars-per-token rule as
 // the budgets; the point is the sign and the order of magnitude.
 import fs from "node:fs";
+import zlib from "node:zlib";
 import path from "node:path";
 import { CALIBRATED } from "./budget.mjs";
 
@@ -33,6 +34,27 @@ export function findTranscriptDb(stateDir) {
   return null;
 }
 
+/**
+ * One transcript row's event. OpenClaw 2026.9.6 stores larger events
+ * zstd-compressed in event_zstd with event_json null; reading event_json alone
+ * missed 85 of a Grok scout's 140 events (the file reads and command output
+ * report recovery and the idle breaker rely on). Null when the row can't be
+ * read: a torn row, or a Node without zstd (before 22.15).
+ */
+export function eventFromRow(row) {
+  try {
+    if (row.event_json != null) return JSON.parse(row.event_json);
+    if (row.event_zstd != null && typeof zlib.zstdDecompressSync === "function") return JSON.parse(zlib.zstdDecompressSync(Buffer.from(row.event_zstd)).toString("utf8"));
+  } catch { /* torn or unreadable */ }
+  return null;
+}
+
+// event_zstd arrived with OpenClaw 2026.9.6; older databases don't have it.
+function eventColumns(db) {
+  try { return db.prepare("select name from pragma_table_info('transcript_events')").all().some((c) => c.name === "event_zstd") ? "event_json, event_zstd" : "event_json"; }
+  catch { return "event_json"; }
+}
+
 /**
  * Reduce raw transcript events to what the coordinator cares about. Pure:
  * takes the parsed `event_json` objects in order.
@@ -119,9 +141,9 @@ export async function readOpenClawTranscript(stateDir) {
   try {
     const db = new DatabaseSync(dbPath, { readOnly: true });
     try {
-      const rows = db.prepare("select event_json from transcript_events order by seq, rowid").all();
+      const rows = db.prepare(`select ${eventColumns(db)} from transcript_events order by seq, rowid`).all();
       const events = [];
-      for (const r of rows) { try { events.push(JSON.parse(r.event_json)); } catch { /* skip a torn row */ } }
+      for (const r of rows) { const e = eventFromRow(r); if (e) events.push(e); }
       return { available: true, reason: null, dbPath, events: events.length, ...summarizeTranscriptEvents(events) };
     } finally { db.close(); }
   } catch (error) {
@@ -164,10 +186,10 @@ export async function readOpenClawTranscriptTail(stateDir, { limit = 40, sinceEv
     try {
       const total = Number(db.prepare("select count(*) as n from transcript_events").get()?.n ?? 0);
       const rows = sinceEvent !== null
-        ? db.prepare("select event_json from transcript_events order by rowid limit -1 offset ?").all(sinceEvent)
-        : limit > 0 ? db.prepare("select event_json from transcript_events order by rowid desc limit ?").all(limit).reverse() : [];
+        ? db.prepare(`select ${eventColumns(db)} from transcript_events order by rowid limit -1 offset ?`).all(sinceEvent)
+        : limit > 0 ? db.prepare(`select ${eventColumns(db)} from transcript_events order by rowid desc limit ?`).all(limit).reverse() : [];
       const events = [];
-      for (const r of rows) { try { events.push(JSON.parse(r.event_json)); } catch { /* skip a torn row */ } }
+      for (const r of rows) { const e = eventFromRow(r); if (e) events.push(e); }
       return { available: true, reason: null, dbPath, events: total, ...summarizeTranscriptEvents(events) };
     } finally { db.close(); }
   } catch (error) {

package/mcp/server.mjs

@@ -43,7 +43,7 @@ import { probeModel } from "../lib/model-probe.mjs";
 import { jevSettings, judgeSettings } from "../lib/validators.mjs";
 import { agentRunsToolsOnHost } from "../lib/dispatch-schema.mjs";
 import { createBuildMetrics, resolveOutcome, finalText, workerMetadata, usageMetrics, policyAdmissionProblems, applyRefactorContract, applyVerificationPolicy, resolveVerifyRegression } from "../lib/outcome.mjs";
-import { jobLabel, compactJobRecord, formatResult, formatUnion, testChangeBanner, regressionCheckBanner, decomposeOverlapBanner } from "../lib/job-format.mjs";
+import { jobLabel, compactJobRecord, formatResult, reportView, formatUnion, testChangeBanner, regressionCheckBanner, decomposeOverlapBanner } from "../lib/job-format.mjs";
 
 export { run, mapLimit };
 export { readsMeasurable, measureReads };
@@ -219,6 +219,17 @@ export function makeHeartbeatTick(jobDir) { return heartbeatTick(jobDir, livePro
 // Senti run none were tagged, so a 4-hour run went 8.46 hours unchecked.
 let activeRunId = null;
 
+export const DEFAULT_TIMEOUT_SECONDS = 600;
+export const REVIEW_SCOUT_TIMEOUT_SECONDS = 1200;
+/** A review scout (reviews set, or a review-phase role) gets longer: reviews trace across the codebase. */
+export function defaultTimeoutSeconds(job, getArmyFn) {
+  if (job.mode !== "scout") return DEFAULT_TIMEOUT_SECONDS;
+  if (job.reviews) return REVIEW_SCOUT_TIMEOUT_SECONDS;
+  if (!job.army_role) return DEFAULT_TIMEOUT_SECONDS;
+  try { return getArmyFn()?.roles?.[job.army_role]?.phase === "review" ? REVIEW_SCOUT_TIMEOUT_SECONDS : DEFAULT_TIMEOUT_SECONDS; }
+  catch { return DEFAULT_TIMEOUT_SECONDS; }
+}
+
 export function expandJobs(jobs, { getArmy = currentArmy, getAgents = () => agentsConfig().agents, getActiveRun = () => activeRunId, env = process.env } = {}) {
   const problems = [];
   let army = null, agents = null;
@@ -226,6 +237,7 @@ export function expandJobs(jobs, { getArmy = currentArmy, getAgents = () => agen
   const expanded = jobs.map((job, i) => {
     try {
       let j = runId && !job.run_id ? { ...job, run_id: runId } : job;
+      if (j.timeout_seconds == null) j = { ...j, timeout_seconds: defaultTimeoutSeconds(j, () => (army ??= getArmy().army)) };
       if (j.mode === "verify") {
         const { agent, model, army_role, on_behalf_of, agentName, pool, subscription_worker, roleModel, ...rest } = j;
         return { ...rest, ...(army_role ? { armyRole: army_role } : {}) };
@@ -297,7 +309,7 @@ export const jobSchema = z.object({
   ),
   mode: z.enum(["scout", "implement", "decompose", "verify"]).default("implement").describe("verify: run a required verification profile with no worker and no model tokens; base_ref selects the branch or commit (default current HEAD), task is a short record label, agent/model are unused and army_role is only a label. implement: edit in an isolated worktree, coordinator commits on a valid report. scout: read-only research; every finding must cite [path:start-end] and nomArmy attaches the cited lines after verifying them against the base commit. decompose: read-only; proposes 2+ independent, evidence-grounded subtasks for a broad objective instead of doing everything in one worker turn. Never auto-dispatched -- the proposal is reviewed like a scout's findings, and the coordinator makes its own separate dispatch call with whatever subtasks it chooses to use."),
   base_ref: z.string().optional(),
-  timeout_seconds: z.number().int().min(30).max(1800).default(600),
+  timeout_seconds: z.number().int().min(30).max(1800).optional().describe("Default 600; 1200 for a review scout (one with `reviews`, or an army role in the review phase), since a real security review read for the full 10 minutes and was cut off."),
   reasoning: z.enum(["low", "medium", "high"]).default("medium").describe("Thinking level passed to the worker model. On the local model it takes effect when that model supports thinking (NOMARMY_MODEL_THINKING); on an api or subscription agent it applies per that agent's own `thinking` setting (false = off, a fixed level = always that level). Default is medium, not high, on real measured evidence: on an identical ticket, gpt-oss-20b at high took 318s with 21 tool calls and 4 failures, and at medium took 62s with 9 calls and 0 failures -- high did not produce a better answer, it thrashed. A separate open-ended task made Qwen3.6-27B time out completely at high (630s, zero output) and succeed at medium. Do not raise this to high by default reasoning that more thinking should help -- it has only ever hurt or timed out in testing so far. Reach for high only after a task has already failed once at medium and the failure looks like an under-thinking problem specifically (wrong root cause, not a formatting or scope issue)."),
   agent: z.string().regex(/^[A-Za-z0-9._-]{1,64}$/).optional().describe("Run on this agent from the operator's agents.yml, by name (e.g. \"codex\", \"grok\", \"local\"): the local model, a metered api key, or one person's subscription. Omit agent and army_role to use the local model. Refuses an unknown name, never falls back. Mutually exclusive with army_role. A subscription agent also requires on_behalf_of."),
   model: z.string().regex(/^\S{1,200}$/).optional().describe("The model to run on the job's agent (an api or subscription agent), e.g. \"gpt-6-sol\". Overrides the role's model and the agent's default. Required when the role's model is \"auto\" or the agent has no default. The `army` tool lists each agent's models. Refused on the local agent, whose model `nomarmy model` sets."),
@@ -401,9 +413,10 @@ server.tool("local_worker_start", "Start one worker or scout in the background a
 // always crossed; 110s returns in-line with margin. Raise it only for a
 // client that neither backgrounds nor times out that early.
 export const MAX_STATUS_WAIT_SECONDS = Number.parseInt(process.env.NOMARMY_MAX_STATUS_WAIT_SECONDS ?? "", 10) || 110;
-server.tool("local_worker_status", `Status of one job started by this server: phase (starting, worktree, worker, verification, commit, record, finished), elapsed time against its timeout, and the result once finished. wait_seconds long-polls up to that long for completion (max ${MAX_STATUS_WAIT_SECONDS}, to stay inside MCP client request timeouts; poll again for longer jobs). full=true returns the complete formatted result instead of a summary.`, {
-  job_id: z.string().min(1), wait_seconds: z.number().int().min(0).max(MAX_STATUS_WAIT_SECONDS).default(0), full: z.boolean().default(false)
-}, async ({ job_id, wait_seconds, full }) => {
+server.tool("local_worker_status", `Status of one job started by this server: phase (starting, worktree, worker, verification, commit, record, finished), elapsed time against its timeout, and the result once finished. wait_seconds long-polls up to that long for completion (max ${MAX_STATUS_WAIT_SECONDS}, to stay inside MCP client request timeouts; poll again for longer jobs). report=true returns just the worker's report (a scout's findings with their verified citations), the outcome, issues, verification and commit. full=true returns the complete execution record.`, {
+  job_id: z.string().min(1), wait_seconds: z.number().int().min(0).max(MAX_STATUS_WAIT_SECONDS).default(0), full: z.boolean().default(false),
+  report: z.boolean().default(false).describe("Just the report and nomArmy's verdict on it, without the rest of the record. Prefer this to full."),
+}, async ({ job_id, wait_seconds, full, report }) => {
   const jobId = path.basename(job_id), entry = activeJobs.get(jobId), jobDir = path.join(ensureJobsRoot(), jobId);
   if (entry && !entry.settled && wait_seconds > 0) await Promise.race([entry.promise.catch(() => {}), sleep(wait_seconds * 1000)]);
   const files = { status: readJson(path.join(jobDir, "status.json")), meta: readJson(path.join(jobDir, "metadata.json")), failure: readJson(path.join(jobDir, "failure.json")) };
@@ -416,9 +429,10 @@ server.tool("local_worker_status", `Status of one job started by this server: ph
   ]);
   if (summary.state === "running") return toolText(JSON.stringify({ ...summary, jobDir, hint: `poll again with wait_seconds up to ${MAX_STATUS_WAIT_SECONDS}; lastTool/filesChangedLive are best-effort and may be absent early in a run` }, null, 2));
   if (entry?.error) return toolText(JSON.stringify({ ...summary, jobDir }, null, 2), true);
+  if (report && files.meta) return toolText(JSON.stringify(reportView(files.meta), null, 2), summary.coordinatorStatus !== "complete");
   if (full && entry?.result) return toolText(formatResult(entry.result), !entry.result.ok);
   if (full && files.meta) return toolText(JSON.stringify(files.meta, null, 2), summary.coordinatorStatus !== "complete");
-  return toolText(JSON.stringify({ ...summary, jobDir, hint: entry?.result || files.meta ? "call again with full=true for the complete report" : null }, null, 2), summary.state === "orphaned" || summary.state === "failed");
+  return toolText(JSON.stringify({ ...summary, jobDir, hint: entry?.result || files.meta ? "call again with report=true for the worker's report, or full=true for the complete record" : null }, null, 2), summary.state === "orphaned" || summary.state === "failed");
 });
 // Set when this session's copy of nomArmy changed on disk after it started
 // (nomarmy connect or update ran): shown first in army and capacity, and
@@ -582,7 +596,7 @@ server.tool("local_worker_config", "What this checkout's .nomarmy.yml defines --
   return toolText(JSON.stringify(summary, null, 2), summary.valid === false);
 });
 server.tool("local_workers", "Run independent jobs (implement or scout) with bounded parallelism and wait for all of them. Every implement job receives its own branch, worktree, sandbox session, logs, validation, and coordinator-owned commit. This tool never merges any branch into the developer's branch. With auto_union: true, implement jobs that reach a valid outcome and touch non-overlapping files are additionally merged (git merge --no-ff) into ONE new integration branch -- a review artifact alongside the untouched per-job branches, still not the developer's branch, still reviewed and integrated explicitly. Jobs that overlap or did not finish validly are excluded from the union and reported individually exactly as without auto_union. For long batches prefer local_worker_start per job and poll.", {
-  jobs: z.array(jobSchema).min(1).max(8), max_parallel: z.number().int().min(1).max(8).optional().describe("A cap on how many of this batch run at once. Omit it: local jobs then use the local ceiling and api/subscription jobs theirs (NOMARMY_MAX_POOL_WORKERS), with each agent's own max_concurrent on top. It used to default to the local ceiling, which ran an all-remote batch one job at a time."),
+  jobs: z.array(jobSchema).min(1).max(8), max_parallel: z.number().int().min(1).max(8).optional().describe("A cap on how many of this batch run at once. Omit it: local jobs then use the local ceiling and api/subscription jobs theirs (`nomarmy config max-jobs`, default 4), with each agent's own max_concurrent on top. It used to default to the local ceiling, which ran an all-remote batch one job at a time."),
   auto_union: z.boolean().default(false).describe(
     "After all jobs finish, mechanically merge (git merge --no-ff) implement jobs that reached a valid outcome and touched non-overlapping files into ONE new integration branch for review -- never into the developer's branch. Overlapping or invalid-outcome jobs are excluded and still reported individually, unchanged. All jobs must share one base_ref (or omit it); it is resolved once, before any job starts, and forced onto every job so the union is provably rooted at a single base."
   ),

package/package.json

@@ -3,7 +3,7 @@
   "description": "Every byte verified: a harness for AI coding workers whose claims are never trusted. Your coding assistant stays in charge while workers implement and test in sandboxes, and nomArmy checks every change before it is committed.",
   "author": "Rayson Technologies",
   "license": "Apache-2.0",
-  "version": "0.1.0-alpha.14",
+  "version": "0.1.0-alpha.16",
   "private": false,
   "type": "module",
   "engines": {