smol-symphony 0.1.0 → 0.2.0

package/dist/orchestrator.js

@@ -1,11 +1,35 @@
-// Orchestrator (SPEC §7, §8, §14, §16). Owns the single-authority runtime state and
-// drives the poll-and-dispatch tick, retries, reconciliation, and worker exit handling.
-import { validateDispatch, WorkflowError } from './workflow.js';
-import { ADAPTERS, assertHostCredentialReadable, isKnownAdapter } from './agent/adapters.js';
-import { pickTerminalTarget } from './mcp.js';
+// Orchestrator. Owns the single-authority runtime state and drives the
+// poll-and-dispatch tick, retries, reconciliation, and worker exit handling.
+import { deriveArmRouting, derivePrRouting, validateDispatch, WorkflowError, } from './workflow.js';
+import { validateDispatchIo } from './workflow-loader.js';
+import { writeIssueFile, pickHoldingState } from './issues.js';
+import { resolveDispatchConfig } from './agent/runner.js';
+import { codexCredentialAvailable, codexMissingCredentialMessage, hostClaudeCredentialPath, hostCodexCredentialPath, hostOpencodeCredentialPath, isKnownAdapter, opencodeCredentialAvailable, opencodeMissingCredentialMessage, } from './agent/adapter-names.js';
+import { accessSync, constants as fsConstants, readFileSync } from 'node:fs';
+import { activeStateNames, terminalStateNames } from './issues.js';
+import { buildIssueDetailDto, classifyPrIntent, computeEligibilityReason, decideCircuitBreaker, decideExitRetry, decideReconcileForIssue, decideRetryAfterIneligible, decideSleepCycleArm, requiredAdapterIds, resolveActorString, sleepCycleArmNotes, } from './orchestrator-decisions.js';
+import { resolveGithubRepo } from './workspace.js';
 import { withIssue, log } from './logging.js';
+import { openRunLog } from './runlog.js';
+import { defaultMemProbe, computeMemoryAdmission } from './memory.js';
+import { runProcess } from './util/process.js';
 const CONTINUATION_DELAY_MS = 1_000;
 const FAILURE_BASE_MS = 10_000;
+// Actor stamped into the notes header when the orchestrator (not an agent)
+// auto-arms the reflection issue, so the move is attributable on the dashboard
+// and in the issue body.
+const SLEEP_CYCLE_ACTOR = 'symphony/sleep-cycle';
+/**
+ * Resolve the base branch the autopilot should rebase against. Mirrors the
+ * canonical workspace-setup contract — the `SYMPHONY_BASE_BRANCH` env wins,
+ * else the parsed `workspace.base_branch` (which defaults to `main`).
+ */
+function baseBranchName(configBaseBranch) {
+    const env = process.env.SYMPHONY_BASE_BRANCH;
+    if (env && env.length > 0)
+        return env;
+    return configBaseBranch;
+}
 export class Orchestrator {
     cfg;
     workflowDef;
@@ -13,33 +37,81 @@ export class Orchestrator {
     tracker;
     workspaces;
     runner;
+    memProbe;
+    reconciler;
     running = new Map();
     claimed = new Set();
     retryAttempts = new Map();
+    // Per-issue circuit-breaker streak (issue 128): the last abnormal-exit reason
+    // (normalized) and how many consecutive attempts failed with it. Updated on
+    // every worker exit; cleared on a clean exit, on trip, and on claim release.
+    // In-memory only — a process restart resets the streak, but the *trip itself*
+    // is restart-safe because it physically moves the issue out of the active set.
+    circuitBreakers = new Map();
+    // Sleep-cycle auto-arm (issue 125). Count of terminal-state transitions
+    // observed since the reflection issue was last armed; the idle and
+    // done-threshold triggers both read it, and it resets to 0 on each arm. The
+    // in-flight guard stops two overlapping ticks from both firing the async
+    // Dormant → Reflect move. In-memory only — a process restart resets the
+    // streak (consistent with `circuitBreakers`).
+    doneSinceReflect = 0;
+    armingReflection = false;
     completed = new Set();
-    codexTotals = {
+    // Per-state ledger of the most-recent action-list execution. Surfaced via
+    // `snapshot.reconciler.resources` so the dashboard can render "Done.actions:
+    // push_branch ok, create_pr_if_missing in_progress" without a separate
+    // first-class surface for action state (issue 36 AC5).
+    lastActionResults = new Map();
+    // Per-issue JSONL run log. Opened lazily on first dispatch for an issue, kept open across
+    // retries so the file is one chronological stream per issue, and closed only when the
+    // issue finally unwinds (terminal cleanup, claim release without redispatch, or stop()).
+    runLogs = new Map();
+    // Set of issue ids whose terminal cleanup (workspaces.remove) is still in
+    // flight. Used by closeRunLog to defer the close until the terminal-state
+    // actions capture has stopped writing; otherwise the retry-timer's "claim
+    // released" close fires ~1s after worker exit (before the actions finish)
+    // and we'd lose the action output lines in the JSONL log.
+    cleanupInFlight = new Set();
+    sessionTotals = {
         input_tokens: 0,
         output_tokens: 0,
         total_tokens: 0,
         seconds_running: 0,
     };
-    codexRateLimits = null;
+    rateLimits = null;
     tickTimer = null;
     stopped = false;
     refreshRequested = false;
     // Latest dispatch validation error, if any (operator-visible).
     lastValidationError = null;
     // Optional callback used to propagate reloaded config to components that hold their own
-    // tracker/runner/workspace state (so prompt body, hooks, smolvm config, etc., take effect
-    // on the next dispatch — see §6.2).
+    // tracker/runner/workspace state (so prompt body, per-state actions, gondolin config, etc.,
+    // take effect on the next dispatch).
     onConfigReloaded;
-    constructor(cfg, workflowDef, workflowSrc, tracker, workspaces, runner) {
+    // Last clamp-active state observed by availableGlobalSlots. Used to log
+    // transitions (clamp_active true→false or false→true) at info level without
+    // spamming the log every tick while the cap stays clamped.
+    memoryClampActive = false;
+    constructor(cfg, workflowDef, workflowSrc, tracker, workspaces, runner, 
+    // Memory probe used by the admission cap (issue 27). Defaults to reading
+    // /proc/meminfo synchronously; tests inject a stub that returns a controlled
+    // mem_available_mib so the clamp behavior is deterministic.
+    memProbe = defaultMemProbe, 
+    // Reconciler (issue 32, 33) — owns managed external resources: the
+    // symphony-VM lifecycle reaper, the workspace janitor, and PR autopilot.
+    // Optional so tests that don't exercise reconciliation don't have to
+    // construct one; when absent, `Snapshot.reconciler` is null and stray VM
+    // reaping is skipped. Production wiring in bin/symphony.ts always passes
+    // one in.
+    reconciler = null) {
         this.cfg = cfg;
         this.workflowDef = workflowDef;
         this.workflowSrc = workflowSrc;
         this.tracker = tracker;
         this.workspaces = workspaces;
         this.runner = runner;
+        this.memProbe = memProbe;
+        this.reconciler = reconciler;
         workflowSrc.onChange((next) => {
             if ('error' in next) {
                 this.lastValidationError = next.error.message;
@@ -50,6 +122,10 @@ export class Orchestrator {
             this.workflowDef = next.definition;
             this.lastValidationError = null;
             this.onConfigReloaded?.(next.config, next.definition);
+            // Issue 32: a config-watcher change is one of the reconciler's declared
+            // triggers. Re-binding the resource set picks up new managed-resource
+            // config (e.g. `gondolin.*` VM settings).
+            this.reconciler?.updateConfig(next.config);
             log.info('runtime config reloaded', {
                 poll_interval_ms: next.config.polling.interval_ms,
                 max_concurrent_agents: next.config.agent.max_concurrent_agents,
@@ -61,33 +137,98 @@ export class Orchestrator {
         this.onConfigReloaded = cb;
     }
     async start() {
-        const validation = validateDispatch(this.cfg);
+        const validation = validateDispatch(this.cfg) ?? validateDispatchIo(this.cfg);
         if (validation) {
             log.error('startup validation failed', { error: validation });
             throw new WorkflowError('workflow_parse_error', validation);
         }
-        // Fail fast when symphony will auto-stage credentials but the host file the
-        // adapter needs is missing. Operators who set acp.command explicitly own their
-        // own credential plumbing, so skip the check in that branch.
-        if (this.cfg.acp.command === null && isKnownAdapter(this.cfg.acp.adapter)) {
-            const profile = ADAPTERS[this.cfg.acp.adapter];
-            try {
-                await assertHostCredentialReadable(profile);
-            }
-            catch (err) {
-                log.error('startup credential check failed', { error: err.message });
-                throw new WorkflowError('missing_host_credential', err.message);
-            }
-        }
-        await this.startupTerminalCleanup();
+        await this.assertAdapterCredentials();
+        await this.runStartupReconcile();
         this.scheduleTick(0);
     }
+    /**
+     * Fail fast when symphony will dispatch to an adapter whose host credential
+     * (substituted into the outbound request at Gondolin egress) is missing.
+     * Per-state overrides can change the adapter, so the set is the union of
+     * `cfg.acp.adapter` and every distinct `states.<name>.adapter`. claude needs
+     * `~/.claude/.credentials.json`; codex needs either a `~/.codex/auth.json`
+     * token or an `OPENAI_API_KEY` env var; opencode needs either a
+     * `github-copilot` token in `~/.local/share/opencode/auth.json` or a
+     * COPILOT_GITHUB_TOKEN/GH_TOKEN/GITHUB_TOKEN env var. A missing credential
+     * surfaces here as a clear startup error rather than an opaque per-request
+     * egress failure mid-dispatch.
+     */
+    async assertAdapterCredentials() {
+        const ids = requiredAdapterIds(this.cfg, isKnownAdapter);
+        if (ids.has('claude'))
+            this.assertClaudeCredential();
+        if (ids.has('codex'))
+            this.assertCodexCredential();
+        if (ids.has('opencode'))
+            this.assertOpencodeCredential();
+    }
+    assertClaudeCredential() {
+        const credPath = hostClaudeCredentialPath();
+        try {
+            accessSync(credPath, fsConstants.R_OK);
+        }
+        catch (err) {
+            const msg = `adapter "claude" requires a host credential at ${credPath}, but it is missing or unreadable: ${err.message}`;
+            log.error('startup credential check failed', { adapter: 'claude', error: msg });
+            throw new WorkflowError('missing_host_credential', msg);
+        }
+    }
+    assertCodexCredential() {
+        let authText = null;
+        try {
+            authText = readFileSync(hostCodexCredentialPath(), 'utf8');
+        }
+        catch {
+            authText = null;
+        }
+        if (codexCredentialAvailable(authText, process.env))
+            return;
+        const msg = codexMissingCredentialMessage();
+        log.error('startup credential check failed', { adapter: 'codex', error: msg });
+        throw new WorkflowError('missing_host_credential', msg);
+    }
+    assertOpencodeCredential() {
+        let authText = null;
+        try {
+            authText = readFileSync(hostOpencodeCredentialPath(), 'utf8');
+        }
+        catch {
+            authText = null;
+        }
+        if (opencodeCredentialAvailable(authText, process.env))
+            return;
+        const msg = opencodeMissingCredentialMessage();
+        log.error('startup credential check failed', { adapter: 'opencode', error: msg });
+        throw new WorkflowError('missing_host_credential', msg);
+    }
+    /**
+     * Initial workspace + VM reap and the first reconcile pass (issues 32-34).
+     * The `running` map is empty here, so the janitors converge to "remove
+     * anything orphaned by the previous process" and the bake (if any) starts
+     * before the first dispatch.
+     */
+    async runStartupReconcile() {
+        if (!this.reconciler)
+            return;
+        await this.reconciler.reapWorkspaces();
+        await this.reconciler.reapVms();
+        this.reconciler.start();
+        void this.reconciler.reconcile().catch((err) => log.warn('initial reconcile pass failed', { error: err.message }));
+    }
     async stop() {
         this.stopped = true;
         if (this.tickTimer) {
             clearTimeout(this.tickTimer);
             this.tickTimer = null;
         }
+        if (this.reconciler) {
+            await this.reconciler.stop().catch(() => undefined);
+        }
         for (const e of this.retryAttempts.values())
             clearTimeout(e.timer_handle);
         this.retryAttempts.clear();
@@ -96,8 +237,39 @@ export class Orchestrator {
             e.cancel();
         this.running.clear();
         this.claimed.clear();
+        this.circuitBreakers.clear();
+        // Drain every open run log so the JSONL files are flushed before exit.
+        const closures = [];
+        for (const [issueId, rl] of this.runLogs) {
+            rl.system('runlog_closed', { reason: 'orchestrator_stopped' });
+            closures.push(rl.close());
+            this.runLogs.delete(issueId);
+        }
+        await Promise.all(closures);
+        // VM teardown lives in the reconciler `vm` resource (issue 52). stop() does NOT
+        // wait for in-flight workers to unwind before returning — the bin script then
+        // exits the process, which abruptly ends the per-VM Gondolin runners but can
+        // leave their session sockets behind. Without this backstop, every SIGTERM
+        // during an active run can leak one VM per running entry, and over enough
+        // operator restarts the host OOMs (issue 26). `running` is cleared above,
+        // so the reaper's intended set is ∅ and every `symphony-*` VM (live session +
+        // any orphaned socket) gets torn down.
+        if (this.reconciler) {
+            await this.reconciler.reapVms();
+        }
+    }
+    /**
+     * Operator trigger for an immediate reconcile pass. Used by `symphony reconcile
+     * --force` (which invalidates the cache first via `force: true`) and by any
+     * future dashboard button that wants to re-evaluate the resource DAG without
+     * waiting for the backstop tick.
+     */
+    async triggerReconcile(opts = {}) {
+        if (!this.reconciler)
+            return;
+        await this.reconciler.reconcile(opts);
     }
-    /** Operator trigger for an immediate poll cycle (§13.7 /refresh). */
+    /** Operator trigger for an immediate poll cycle (§9.5 /refresh). */
     triggerRefresh() {
         if (this.refreshRequested)
             return { queued: true, coalesced: true };
@@ -118,77 +290,113 @@ export class Orchestrator {
         if (this.stopped)
             return;
         this.refreshRequested = false;
+        await this.reconcileSafely();
+        if (!this.applyDispatchValidation())
+            return;
+        const fetched = await this.fetchCandidatesForTick();
+        if (!fetched)
+            return;
+        if (this.gatedOnReconciler(fetched.issues.length))
+            return;
+        this.dispatchSorted(this.sortForDispatch(fetched.issues), fetched.root);
+        this.maybeArmSleepCycle(fetched.issues.length === 0);
+        this.scheduleTick(this.cfg.polling.interval_ms);
+    }
+    async reconcileSafely() {
         try {
             await this.reconcile();
         }
         catch (err) {
             log.warn('reconcile error', { error: err.message });
         }
-        const validation = validateDispatch(this.cfg);
+    }
+    /**
+     * Run dispatch validation. Returns true to continue dispatch, false when the
+     * config is invalid (the tick is rescheduled and the caller must return).
+     */
+    applyDispatchValidation() {
+        const validation = validateDispatch(this.cfg) ?? validateDispatchIo(this.cfg);
         if (validation) {
             this.lastValidationError = validation;
             log.warn('dispatch validation failed; skipping dispatch', { error: validation });
             this.scheduleTick(this.cfg.polling.interval_ms);
-            return;
+            return false;
         }
         this.lastValidationError = null;
-        let candidates;
-        let snapshotTrackerRoot;
-        let snapshotTerminalTarget;
+        return true;
+    }
+    /**
+     * Atomic fetch: the tracker returns the issues AND the root it used during
+     * the scan. That's the snapshot we pin onto each RunningEntry, so a workflow
+     * reload that races the dispatch loop can't cause `transition` to operate
+     * against a different tracker root than where the issue lives. Returns
+     * null on tracker error (tick is rescheduled, caller must return).
+     */
+    async fetchCandidatesForTick() {
         try {
-            // Atomic fetch: the tracker returns the issues AND the root/terminal_states
-            // it used during the scan. That's the snapshot we pin onto each RunningEntry,
-            // so a workflow reload that races the dispatch loop can't cause `mark_done`
-            // to operate against a different tracker config than where the issue lives.
-            const result = await this.tracker.fetchCandidateIssues();
-            candidates = result.issues;
-            snapshotTrackerRoot = result.root;
-            snapshotTerminalTarget = pickTerminalTarget(result.terminalStates);
+            const r = await this.tracker.fetchCandidateIssues();
+            return { issues: r.issues, root: r.root };
         }
         catch (err) {
             log.warn('candidate fetch failed', { error: err.message });
             this.scheduleTick(this.cfg.polling.interval_ms);
-            return;
+            return null;
         }
-        const sorted = this.sortForDispatch(candidates);
+    }
+    /**
+     * Reconciler gate (issue 32): refuse to dispatch any issue whose
+     * prerequisites haven't converged. When the gate is closed we kick a
+     * reconcile pass so the loop self-corrects on the next poll instead of
+     * waiting on the slower backstop tick. Returns true when dispatch must
+     * be skipped (caller must return).
+     */
+    gatedOnReconciler(candidateCount) {
+        if (!this.reconciler || this.reconciler.dispatchReady())
+            return false;
+        log.debug('dispatch gated on reconciler', { candidate_count: candidateCount });
+        void this.reconciler.reconcile().catch((err) => log.debug('gated-reconcile failed', { error: err.message }));
+        this.scheduleTick(this.cfg.polling.interval_ms);
+        return true;
+    }
+    dispatchSorted(sorted, snapshotTrackerRoot) {
         for (const issue of sorted) {
             if (this.availableGlobalSlots() <= 0)
                 break;
             if (!this.isEligible(issue))
                 continue;
-            void this.dispatchIssue(issue, null, {
-                trackerRoot: snapshotTrackerRoot,
-                terminalTarget: snapshotTerminalTarget,
-            });
+            void this.dispatchIssue(issue, null, { trackerRoot: snapshotTrackerRoot });
         }
-        this.scheduleTick(this.cfg.polling.interval_ms);
     }
-    /** §8.5: stall detection + tracker state refresh for running issues. */
+    /** Stall detection + tracker state refresh for running issues. */
     async reconcile() {
-        // Part A: stall detection.
-        if (this.cfg.acp.stall_timeout_ms > 0) {
-            const now = Date.now();
-            for (const [issueId, entry] of this.running) {
-                // Skip stall detection for issues awaiting human steering: the agent is
-                // intentionally paused while the human composes a reply, and the wait can
-                // legitimately exceed stall_timeout_ms. The cancel signal still applies
-                // (the runner's awaitSteeringReply respects it) for non-stall reasons like
-                // terminal-state transitions or operator-initiated cancels.
-                if (entry.steering_requested)
-                    continue;
-                const ref = entry.last_codex_timestamp ?? entry.started_at;
-                const elapsed = now - Date.parse(ref);
-                if (Number.isFinite(elapsed) && elapsed > this.cfg.acp.stall_timeout_ms) {
-                    log.warn('stall detected', {
-                        issue_id: issueId,
-                        issue_identifier: entry.identifier,
-                        elapsed_ms: elapsed,
-                    });
-                    this.terminateRunning(issueId, false, `stalled after ${elapsed}ms`);
-                }
+        this.detectStalls();
+        await this.refreshTrackerStates();
+    }
+    detectStalls() {
+        if (this.cfg.acp.stall_timeout_ms <= 0)
+            return;
+        const now = Date.now();
+        for (const [issueId, entry] of this.running) {
+            // Skip stall detection for issues awaiting human steering: the agent is
+            // intentionally paused while the human composes a reply, and the wait can
+            // legitimately exceed stall_timeout_ms. The cancel signal still applies
+            // (the runner's awaitSteeringReply respects it) for non-stall reasons like
+            // terminal-state transitions or operator-initiated cancels.
+            if (entry.steering_requested)
+                continue;
+            const ref = entry.last_event_at ?? entry.started_at;
+            const elapsed = now - Date.parse(ref);
+            if (Number.isFinite(elapsed) && elapsed > this.cfg.acp.stall_timeout_ms) {
+                log.warn('stall detected', {
+                    issue_id: issueId,
+                    issue_identifier: entry.identifier,
+                    elapsed_ms: elapsed,
+                });
+                this.terminateRunning(issueId, false, `stalled after ${elapsed}ms`);
             }
         }
-        // Part B: tracker state refresh.
+    }
+    async refreshTrackerStates() {
         const ids = [...this.running.keys()];
         if (ids.length === 0)
             return;
@@ -201,27 +409,18 @@ export class Orchestrator {
             return;
         }
         const byId = new Map(refreshed.map((i) => [i.id, i]));
-        const terminal = new Set(this.cfg.tracker.terminal_states.map((s) => s.toLowerCase()));
-        const active = new Set(this.cfg.tracker.active_states.map((s) => s.toLowerCase()));
-        for (const id of ids) {
-            const fresh = byId.get(id);
-            if (!fresh) {
-                // Missing from tracker — non-active, no cleanup (§8.5 part B "neither" branch).
-                this.terminateRunning(id, false, 'tracker_state_missing');
-                continue;
-            }
-            const s = fresh.state.toLowerCase();
-            if (terminal.has(s)) {
-                this.terminateRunning(id, true, 'tracker_state_terminal');
-            }
-            else if (active.has(s)) {
-                const entry = this.running.get(id);
-                if (entry)
-                    entry.issue = fresh;
-            }
-            else {
-                this.terminateRunning(id, false, 'tracker_state_non_active');
-            }
+        for (const id of ids)
+            this.applyReconcileAction(id, byId.get(id));
+    }
+    applyReconcileAction(id, fresh) {
+        const decision = decideReconcileForIssue(fresh, this.cfg.states);
+        if (decision.kind === 'terminate') {
+            this.terminateRunning(id, decision.cleanup, decision.reason);
+        }
+        else if (decision.kind === 'refresh' && fresh) {
+            const entry = this.running.get(id);
+            if (entry)
+                entry.issue = fresh;
         }
     }
     terminateRunning(issueId, cleanupWorkspace, reason) {
@@ -231,6 +430,10 @@ export class Orchestrator {
         if (cleanupWorkspace)
             entry.cleanup_workspace_on_exit = true;
         entry.cancel();
+        this.runLogs.get(issueId)?.system('reconciliation_terminating', {
+            reason,
+            cleanup_workspace: cleanupWorkspace,
+        });
         log.info('reconciliation terminating run', {
             issue_id: issueId,
             issue_identifier: entry.identifier,
@@ -238,7 +441,7 @@ export class Orchestrator {
             cleanup_workspace: cleanupWorkspace,
         });
     }
-    /** §8.2 candidate eligibility. */
+    /** Candidate eligibility. */
     isEligible(issue) {
         return this.eligibilityReason(issue, /*ignoreOwnClaim*/ false) === null;
     }
@@ -246,40 +449,110 @@ export class Orchestrator {
     // form is used by the retry path so the issue's own claim/retry entry does not block
     // its own redispatch.
     eligibilityReason(issue, ignoreOwnClaim) {
-        if (!issue.id || !issue.identifier || !issue.title || !issue.state) {
-            return 'missing required issue fields';
-        }
-        const state = issue.state.toLowerCase();
-        const active = new Set(this.cfg.tracker.active_states.map((s) => s.toLowerCase()));
-        const terminal = new Set(this.cfg.tracker.terminal_states.map((s) => s.toLowerCase()));
-        if (!active.has(state) || terminal.has(state))
-            return 'state not active';
-        if (this.running.has(issue.id))
-            return 'already running';
-        if (!ignoreOwnClaim && this.claimed.has(issue.id))
-            return 'already claimed';
-        if (!this.hasPerStateSlot(issue.state))
-            return 'no per-state slot';
-        if (state === 'todo' && this.hasNonTerminalBlocker(issue))
-            return 'has non-terminal blocker';
-        return null;
+        return computeEligibilityReason(issue, ignoreOwnClaim, this.eligibilitySnapshot());
     }
-    hasNonTerminalBlocker(issue) {
-        const terminal = new Set(this.cfg.tracker.terminal_states.map((s) => s.toLowerCase()));
-        for (const b of issue.blocked_by) {
-            if (!b.state)
-                return true;
-            if (!terminal.has(b.state.toLowerCase()))
-                return true;
-        }
-        return false;
+    eligibilitySnapshot() {
+        return {
+            active: new Set(activeStateNames(this.cfg.states).map((s) => s.toLowerCase())),
+            terminal: new Set(terminalStateNames(this.cfg.states).map((s) => s.toLowerCase())),
+            running: new Set(this.running.keys()),
+            claimed: this.claimed,
+            perStateSlot: (state) => this.hasPerStateSlot(state),
+        };
     }
     availableGlobalSlots() {
-        return Math.max(0, this.cfg.agent.max_concurrent_agents - this.running.size);
+        // Pending continuations hold their slot. The continuation is the
+        // post-transition resume of an issue that just normal-exited (e.g.
+        // Todo→Review handoff); without this, a tick firing inside the 1s
+        // continuation window can dispatch a brand-new Todo and steal the slot
+        // the just-transitioned issue is about to reclaim, leaving it requeued
+        // with "no available orchestrator slots" until something else finishes.
+        // Failure-backoff retries do NOT hold slots: the orchestrator is free
+        // to run other work during the exponential-backoff window.
+        let pendingContinuations = 0;
+        for (const r of this.retryAttempts.values()) {
+            if (r.kind === 'continuation')
+                pendingContinuations++;
+        }
+        const admission = this.computeAdmission();
+        // Log a single line when the memory clamp transitions in or out of "active." This
+        // gives the operator the "why isn't this dispatching" signal in the log without
+        // spamming every tick while memory stays low.
+        if (admission.clamp_active !== this.memoryClampActive) {
+            this.memoryClampActive = admission.clamp_active;
+            if (admission.clamp_active) {
+                log.info('memory admission clamping concurrency', {
+                    static_cap: admission.static_cap,
+                    effective_cap: admission.effective_cap,
+                    mem_available_mib: admission.mem_available_mib,
+                    reserve_mib: admission.reserve_mib,
+                    per_vm_mib: admission.per_vm_mib,
+                });
+            }
+            else {
+                log.info('memory admission cleared; full static cap available', {
+                    static_cap: admission.static_cap,
+                    mem_available_mib: admission.mem_available_mib,
+                });
+            }
+        }
+        return Math.max(0, admission.effective_cap - this.running.size - pendingContinuations);
+    }
+    /**
+     * Compute the current memory-admission snapshot. Reads `/proc/meminfo` via the injected
+     * probe (default reads the real file; tests inject a stub). Pure with respect to the
+     * orchestrator state — just folds running count + config + probe reading into the
+     * dynamic cap. Snapshot endpoint and slot accounting both call through here so they
+     * never desync.
+     */
+    computeAdmission() {
+        const staticCap = this.cfg.agent.max_concurrent_agents;
+        const reserveMib = this.cfg.agent.host_memory_reserve_mib;
+        const perVmMib = this.cfg.gondolin.mem_mib;
+        const enabled = this.cfg.agent.memory_admission_enabled;
+        const probe = enabled
+            ? this.memProbe()
+            : { mem_available_mib: null, supported: false };
+        const { effective_cap, admission_room, clamp_active } = computeMemoryAdmission({
+            enabled,
+            static_cap: staticCap,
+            running: this.running.size,
+            probe,
+            reserve_mib: reserveMib,
+            per_vm_mib: perVmMib,
+        });
+        return {
+            enabled,
+            probe_supported: probe.supported,
+            mem_available_mib: probe.mem_available_mib,
+            reserve_mib: reserveMib,
+            per_vm_mib: perVmMib,
+            static_cap: staticCap,
+            effective_cap,
+            admission_room,
+            clamp_active,
+        };
+    }
+    /**
+     * Resolve a state's per-state concurrency cap (`states.<name>.max_concurrent`)
+     * with a case-insensitive name lookup, mirroring how issue states arrive from
+     * the tracker in arbitrary case. Returns undefined when the state is unknown
+     * or declares no cap.
+     */
+    perStateConcurrencyCap(stateName) {
+        const lower = stateName.toLowerCase();
+        for (const [name, sc] of Object.entries(this.cfg.states)) {
+            if (name.toLowerCase() === lower)
+                return sc.max_concurrent;
+        }
+        return undefined;
     }
-    /** §8.3: per-state slot accounting using current running entries. */
+    /** Per-state slot accounting using current running entries. */
     hasPerStateSlot(stateName) {
-        const cap = this.cfg.agent.max_concurrent_agents_by_state[stateName.toLowerCase()];
+        // Per-state concurrency lives on the state (issue 137): read
+        // `states.<name>.max_concurrent` (case-insensitively). Undefined → no
+        // per-state cap, so only the global ceiling applies.
+        const cap = this.perStateConcurrencyCap(stateName);
         if (!cap)
             return this.availableGlobalSlots() > 0;
         let inState = 0;
@@ -287,9 +560,17 @@ export class Orchestrator {
             if (e.issue.state.toLowerCase() === stateName.toLowerCase())
                 inState++;
         }
+        // Mirror the global rule for per-state caps: a pending continuation whose
+        // target state matches counts against the state's cap, so the resuming
+        // worker is guaranteed a slot when its timer fires.
+        for (const r of this.retryAttempts.values()) {
+            if (r.kind === 'continuation' && r.target_state.toLowerCase() === stateName.toLowerCase()) {
+                inState++;
+            }
+        }
         return inState < cap && this.availableGlobalSlots() > 0;
     }
-    /** §8.2 sort: priority ASC (null last), then created_at ASC, then identifier. */
+    /** Sort: priority ASC (null last), then created_at ASC, then identifier. */
     sortForDispatch(issues) {
         return [...issues].sort((a, b) => {
             const pa = a.priority ?? Number.POSITIVE_INFINITY;
@@ -303,7 +584,7 @@ export class Orchestrator {
             return a.identifier.localeCompare(b.identifier);
         });
     }
-    /** §16.4 dispatch_issue */
+    /** Dispatch one issue. */
     async dispatchIssue(issue, attempt, snapshot) {
         if (this.running.has(issue.id))
             return;
@@ -312,15 +593,26 @@ export class Orchestrator {
         const cancel = { cancelled: false };
         const startedAt = new Date().toISOString();
         const workspacePath = this.workspaces.workspacePathFor(issue.identifier);
-        // Snapshot tracker.root and the terminal target BEFORE workspace setup,
-        // before_run, or smolvm bring-up. A WORKFLOW.md reload during that window
-        // (or even between fetchCandidateIssues returning and this iteration of
-        // the dispatch loop) can mutate the live tracker config; pinning here closes
-        // that window. When the caller supplies a snapshot (the tick/retry path
-        // does — it captured at the fetch atomically), prefer those values; the
-        // optional fallback reads the live config for completeness.
+        // Snapshot tracker.root BEFORE workspace setup or Gondolin VM
+        // bring-up. A WORKFLOW.md reload during that window (or even between
+        // fetchCandidateIssues returning and this iteration of the dispatch loop)
+        // can mutate the live tracker config; pinning here closes that window.
+        // When the caller supplies a snapshot (the tick/retry path does — it
+        // captured at the fetch atomically), prefer that value; the optional
+        // fallback reads the live config for completeness.
         const trackerRootAtDispatch = snapshot?.trackerRoot ?? (this.tracker.currentRoot ? this.tracker.currentRoot() : null);
-        const terminalTargetAtDispatch = snapshot?.terminalTarget ?? pickTerminalTarget(this.cfg.tracker.terminal_states);
+        // Pin the effective repo + base branch at dispatch time (same window as
+        // tracker.root above) so a mid-run WORKFLOW.md reload can't drift the Done
+        // action context away from the values the workspace was set up with.
+        const githubRepoAtDispatch = resolveGithubRepo(this.cfg.workspace.github_repo);
+        const baseBranchAtDispatch = baseBranchName(this.cfg.workspace.base_branch);
+        // Resolve "<adapter>/<model or 'default'>" at dispatch time and pin it on
+        // the entry. The MCP transition tool stamps this into the notes-block
+        // header the next agent reads in `issue.description`. The helper folds any
+        // per-state override on top of the workflow defaults; an unknown state
+        // falls back to workflow defaults so an older test harness without a
+        // states map still produces a non-null actor string.
+        const resolvedActor = resolveActorString(this.cfg.states, this.cfg.acp.adapter, this.cfg.acp.model, issue.state);
         const entry = {
             issue_id: issue.id,
             identifier: issue.identifier,
@@ -328,13 +620,13 @@ export class Orchestrator {
             session_id: null,
             thread_id: null,
             turn_id: null,
-            codex_app_server_pid: null,
-            last_codex_event: null,
-            last_codex_timestamp: null,
-            last_codex_message: null,
-            codex_input_tokens: 0,
-            codex_output_tokens: 0,
-            codex_total_tokens: 0,
+            adapter_pid: null,
+            last_event: null,
+            last_event_at: null,
+            last_message: null,
+            input_tokens: 0,
+            output_tokens: 0,
+            total_tokens: 0,
             last_reported_input_tokens: 0,
             last_reported_output_tokens: 0,
             last_reported_total_tokens: 0,
@@ -350,25 +642,114 @@ export class Orchestrator {
             cleanup_workspace_on_exit: false,
             mcp_token: null,
             tracker_root_at_dispatch: trackerRootAtDispatch,
-            terminal_target_at_dispatch: terminalTargetAtDispatch,
-            marked_done: false,
+            github_repo_at_dispatch: githubRepoAtDispatch,
+            base_branch_at_dispatch: baseBranchAtDispatch,
+            resolved_actor: resolvedActor,
+            transitioned: false,
             steering_requested: false,
             steering_question: null,
             steering_context: null,
+            last_transition: null,
         };
         this.running.set(issue.id, entry);
         const logger = withIssue({ issue_id: issue.id, issue_identifier: issue.identifier });
+        const runLog = this.ensureRunLog(issue.id, issue.identifier);
+        if (runLog) {
+            runLog.setAttempt(attempt ?? 0);
+            runLog.system('attempt_started', {
+                attempt: attempt ?? 0,
+                issue_state: issue.state,
+                issue_title: issue.title,
+                workspace_path: workspacePath,
+                tracker_root: trackerRootAtDispatch,
+                // Pin the per-state turn budget so the run-summary reducer can report
+                // turns-used-vs-budget without re-resolving config (issue 123).
+                max_turns: this.resolveStateMaxTurns(issue.state),
+            });
+        }
         logger.info('agent attempt started', { attempt });
-        void this.runWorker(issue, attempt, entry, cancel);
+        void this.runWorker(issue, attempt, entry, cancel, runLog);
     }
-    async runWorker(issue, attempt, entry, cancelSignal) {
+    /**
+     * Open (or return the existing) per-issue run log. Returns `undefined` only when log file
+     * opening throws — symphony should keep running even if logs can't be persisted, so the
+     * runner sees `undefined` and behaves exactly as before.
+     *
+     * `issueId` (tracker primary key) is stamped on every line and is the map key so the
+     * lifecycle survives identifier collisions or renames; `identifier` derives the filename.
+     */
+    ensureRunLog(issueId, identifier) {
+        const existing = this.runLogs.get(issueId);
+        if (existing)
+            return existing;
+        try {
+            const rl = openRunLog(this.cfg.logs.root, issueId, identifier);
+            this.runLogs.set(issueId, rl);
+            return rl;
+        }
+        catch (err) {
+            log.warn('runlog open failed; continuing without run log', {
+                issue_id: issueId,
+                issue_identifier: identifier,
+                error: err.message,
+            });
+            return undefined;
+        }
+    }
+    /**
+     * Resolve the per-state turn budget for the run log's `attempt_started`
+     * event. Returns null on any resolution failure (unknown state) — the
+     * summary reducer treats a null budget as "unknown", never an error.
+     */
+    resolveStateMaxTurns(state) {
+        try {
+            return resolveDispatchConfig(this.cfg, state).max_turns;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Record the end-of-attempt lifecycle events: the `transition` the agent (or
+     * an action reroute) performed during this attempt, if any, followed by
+     * `attempt_ended`. Both feed the run-summary reducer (issue 123); recording
+     * the transition here — once per attempt, off the hot path — is what makes
+     * the state path, rejection notes, and terminal outcome reconstructable.
+     */
+    recordAttemptEnd(runLog, entry, ok, reason, turnsCompleted) {
+        if (entry.last_transition)
+            runLog?.system('transition', { ...entry.last_transition });
+        runLog?.system('attempt_ended', { ok, reason, turns_completed: turnsCompleted });
+    }
+    closeRunLog(issueId, fields, opts = {}) {
+        // If a terminal cleanup (`workspaces.remove`) is mid-flight for this issue, the
+        // terminal-state actions capture may still be writing to the run log. Closing the
+        // log here would truncate those lines on disk. Defer until the cleanup's .finally
+        // fires the close with `viaCleanup: true`.
+        if (!opts.viaCleanup && this.cleanupInFlight.has(issueId))
+            return;
+        const rl = this.runLogs.get(issueId);
+        if (!rl)
+            return;
+        if (fields)
+            rl.system('runlog_closed', fields);
+        // Emit the compact per-issue run summary (issue 123) at the terminal unwind,
+        // when the lifecycle accumulator holds the full trajectory. Pure over
+        // in-memory state, so it precedes (and does not depend on) the stream flush.
+        rl.writeSummary();
+        this.runLogs.delete(issueId);
+        void rl.close();
+    }
+    async runWorker(issue, attempt, entry, cancelSignal, runLog) {
         const logger = withIssue({ issue_id: issue.id, issue_identifier: issue.identifier });
         let ok = false;
         let reason = 'unknown';
+        let turnsCompleted = 0;
         try {
-            const result = await this.runner.runAttempt(issue, attempt, cancelSignal, entry);
+            const result = await this.runner.runAttempt(issue, attempt, cancelSignal, entry, runLog);
             ok = result.ok;
             reason = result.reason;
+            turnsCompleted = result.turnsCompleted;
             if (result.threadId)
                 entry.thread_id = result.threadId;
             entry.turn_count = result.turnsCompleted;
@@ -378,54 +759,272 @@ export class Orchestrator {
             reason = err.message;
             logger.error('worker threw', { error: reason });
         }
+        this.recordAttemptEnd(runLog, entry, ok, reason, turnsCompleted);
         this.onWorkerExit(issue.id, ok, reason, entry);
     }
-    /** §16.6 on_worker_exit */
+    /** on_worker_exit */
     onWorkerExit(issueId, normal, reason, entry) {
         this.running.delete(issueId);
+        // Issue 52: the reconciler `vm` resource is the sole owner of VM teardown.
+        // Every worker exit — clean or not — kicks the reaper so the intended set
+        // (now excluding this issue) converges in a single pass.
+        if (this.reconciler && !this.stopped) {
+            void this.reconciler.reapVms().catch((err) => log.debug('post-exit vm reap failed', { error: err.message }));
+        }
         const elapsedMs = Date.now() - Date.parse(entry.started_at);
-        if (Number.isFinite(elapsedMs)) {
-            this.codexTotals.seconds_running += elapsedMs / 1000;
-        }
-        const identifier = entry.identifier;
-        const logger = withIssue({ issue_id: issueId, issue_identifier: identifier });
-        if (entry.cleanup_workspace_on_exit) {
-            // Workspace removal is deferred until the worker has fully unwound (including
-            // after_run hook execution) so we never delete the dir while the agent is still
-            // inside it.
-            this.workspaces
-                .remove(entry.identifier, this.cfg.hooks)
-                .catch((err) => logger.warn('workspace removal failed', { error: err.message }));
-        }
-        // §14.2: if the service was stopped while this worker was unwinding, do not schedule
+        if (Number.isFinite(elapsedMs))
+            this.sessionTotals.seconds_running += elapsedMs / 1000;
+        const logger = withIssue({ issue_id: issueId, issue_identifier: entry.identifier });
+        if (entry.cleanup_workspace_on_exit)
+            this.scheduleWorkspaceCleanup(issueId, entry, logger);
+        // If the service was stopped while this worker was unwinding, do not schedule
         // a new retry — that would leave a live timer behind even though stop() was called.
         if (this.stopped) {
             this.claimed.delete(issueId);
+            this.circuitBreakers.delete(issueId);
             return;
         }
-        if (normal) {
+        if (normal)
             this.completed.add(issueId);
+        this.recordSleepCycleProgress(entry);
+        // Circuit breaker (issue 128): a deterministically-failing dispatch (same
+        // reason every attempt) would otherwise retry forever under backoff. Trip
+        // after the configured streak and route the issue to a holding state
+        // instead of scheduling another retry.
+        if (this.updateCircuitBreaker(issueId, normal, reason, entry))
+            return;
+        const plan = decideExitRetry({
+            normal,
+            reason,
+            priorAttempt: entry.retry_attempt,
+            targetState: entry.issue.state,
+            continuationDelayMs: CONTINUATION_DELAY_MS,
+            failureBaseMs: FAILURE_BASE_MS,
+            maxBackoffMs: this.cfg.agent.max_retry_backoff_ms,
+        });
+        if (normal) {
             logger.info('worker exited (normal)', { reason });
-            this.scheduleRetry(issueId, {
-                identifier,
-                attempt: 1,
-                delayMs: CONTINUATION_DELAY_MS,
-                error: null,
-            });
         }
         else {
-            const nextAttempt = entry.retry_attempt !== null && entry.retry_attempt !== undefined ? entry.retry_attempt + 1 : 1;
-            const delayMs = Math.min(FAILURE_BASE_MS * Math.pow(2, nextAttempt - 1), this.cfg.agent.max_retry_backoff_ms);
-            logger.warn('worker exited (abnormal)', { reason, next_attempt: nextAttempt, delay_ms: delayMs });
-            this.scheduleRetry(issueId, {
-                identifier,
-                attempt: nextAttempt,
-                delayMs,
-                error: reason,
+            logger.warn('worker exited (abnormal)', {
+                reason,
+                next_attempt: plan.attempt,
+                delay_ms: plan.delayMs,
+            });
+        }
+        this.scheduleRetry(issueId, { identifier: entry.identifier, ...plan });
+    }
+    /**
+     * Fold this exit into the per-issue circuit-breaker streak (issue 128) and
+     * return true when the breaker tripped — the caller must then NOT schedule a
+     * retry. A clean exit clears the streak; an abnormal exit either records the
+     * (normalized) failure or, on reaching `agent.circuit_breaker_threshold`
+     * consecutive identical failures, trips and fires the holding-state route.
+     * The pure `decideCircuitBreaker` owns the counting; this shell just persists
+     * the streak and dispatches the side effect.
+     */
+    updateCircuitBreaker(issueId, normal, reason, entry) {
+        const decision = decideCircuitBreaker({
+            normal,
+            reason,
+            prior: this.circuitBreakers.get(issueId) ?? null,
+            threshold: this.cfg.agent.circuit_breaker_threshold,
+        });
+        if (decision.kind === 'continue') {
+            this.circuitBreakers.set(issueId, {
+                normalizedReason: decision.normalizedReason,
+                count: decision.count,
+            });
+            return false;
+        }
+        this.circuitBreakers.delete(issueId);
+        if (decision.kind === 'trip') {
+            void this.tripCircuitBreaker(issueId, entry, reason, decision.count);
+            return true;
+        }
+        return false;
+    }
+    /**
+     * Stop retrying a circuit-broken issue and move it into a holding state so a
+     * human sees "stuck on identical failure" on the dashboard rather than a
+     * silent multi-hour loop. The move is restart-safe (the file leaves the
+     * active set on disk, so the loop cannot resume on the next process start).
+     * If routing fails — no `holding` state declared, or the tracker can't write
+     * — we keep the issue's dispatch claim so the tick's `already claimed` gate
+     * still halts the loop for this session, and log loudly.
+     */
+    async tripCircuitBreaker(issueId, entry, reason, count) {
+        const logger = withIssue({ issue_id: issueId, issue_identifier: entry.identifier });
+        this.runLogs.get(issueId)?.system('circuit_breaker_tripped', {
+            reason,
+            consecutive_failures: count,
+        });
+        logger.error('circuit breaker tripped; halting retries', { reason, consecutive_failures: count });
+        let holdingState;
+        try {
+            holdingState = pickHoldingState(this.cfg.states);
+        }
+        catch {
+            logger.error('no holding state declared; retaining claim to halt the retry loop', { reason });
+            return;
+        }
+        const moved = await this.routeToHolding(issueId, entry, holdingState, reason, count);
+        if (moved) {
+            this.claimed.delete(issueId);
+            this.closeRunLog(issueId, { reason: 'circuit_breaker_tripped' });
+        }
+    }
+    /**
+     * Move `entry`'s tracker file into `holdingState`, appending a diagnostic
+     * note (rendered into the issue body before the rename) so the operator sees
+     * why it stopped. Returns false when the tracker can't perform the move so
+     * the caller can fall back to retaining the claim. Modelled on the runner's
+     * action-reroute path; the orchestrator owns this move because it is
+     * state-machine behavior, not repo-local glue.
+     */
+    async routeToHolding(issueId, entry, holdingState, reason, count) {
+        if (!this.tracker.moveIssueToState)
+            return false;
+        const notes = [
+            `**Circuit breaker tripped** — routed to \`${holdingState}\` for human inspection.`,
+            '',
+            `Symphony stopped retrying after **${count} consecutive attempts failed with the same error**, to avoid an unbounded dispatch loop (issue 128).`,
+            '',
+            `**Last failure reason:** ${reason}`,
+            '',
+            `Resolve the underlying cause, then move the issue back into an active state to resume dispatch.`,
+        ].join('\n');
+        try {
+            await this.tracker.moveIssueToState(issueId, holdingState, {
+                fromRoot: entry.tracker_root_at_dispatch ?? undefined,
+                fromState: entry.issue.state,
+                notes,
+                actor: entry.resolved_actor,
             });
+            return true;
+        }
+        catch (err) {
+            withIssue({ issue_id: issueId, issue_identifier: entry.identifier }).error('circuit breaker route to holding failed; retaining claim', { error: err.message });
+            return false;
         }
     }
-    /** §8.4 retry queue. */
+    /**
+     * Sleep-cycle auto-arm (issue 125): fold a finished attempt into the
+     * terminal-transition counter the triggers read. Only the work the reflector
+     * mines counts — a transition into a `role: terminal` state (Done/Cancelled)
+     * — and the reflection issue's own moves (it can only go to its holding
+     * dormant state) are excluded so a reflection run never counts toward arming
+     * the next one. No-op when the block is disabled.
+     */
+    recordSleepCycleProgress(entry) {
+        const arm = deriveArmRouting(this.cfg.states);
+        if (!arm.issue)
+            return;
+        if (entry.issue_id === arm.issue || entry.identifier === arm.issue)
+            return;
+        if (entry.last_transition?.terminal)
+            this.doneSinceReflect += 1;
+    }
+    /**
+     * Sleep-cycle auto-arm (issue 125): decide — purely — whether to arm the
+     * reflection cycle this tick, and fire the async Dormant → Reflect move when
+     * a trigger fires. `noActiveCandidates` is true when this poll surfaced no
+     * active-state issues; combined with empty running/claimed/retry sets that is
+     * the orchestrator-idle signal. The in-flight guard prevents two overlapping
+     * ticks from both launching the move.
+     */
+    maybeArmSleepCycle(noActiveCandidates) {
+        const arm = deriveArmRouting(this.cfg.states);
+        if (!arm.armState || this.armingReflection)
+            return;
+        const idle = noActiveCandidates &&
+            this.running.size === 0 &&
+            this.claimed.size === 0 &&
+            this.retryAttempts.size === 0;
+        const trigger = decideSleepCycleArm({
+            enabled: true,
+            issueId: arm.issue,
+            armOnIdle: arm.onIdle,
+            armAfterDone: arm.afterTerminal,
+            doneSinceReflect: this.doneSinceReflect,
+            idle,
+        });
+        if (!trigger)
+            return;
+        this.armingReflection = true;
+        void this.armReflection(arm, trigger).finally(() => {
+            this.armingReflection = false;
+        });
+    }
+    /**
+     * Move the reflection issue from its dormant (holding) state into the active
+     * reflect state. Guarded so it is a no-op unless the issue currently lives in
+     * `dormant_state` (so we never yank it out of Reflect mid-run or relocate it
+     * from some other state), and the counter only resets on a successful move so
+     * a failed arm doesn't silently discard the accumulated terminal count.
+     */
+    async armReflection(arm, trigger) {
+        if (!this.tracker.moveIssueToState || !arm.issue || !arm.from || !arm.armState)
+            return;
+        const current = await this.fetchReflectionIssue(arm.issue);
+        if (!current)
+            return;
+        if (current.state.toLowerCase() !== arm.from.toLowerCase())
+            return;
+        if (this.running.has(current.id) || this.claimed.has(current.id))
+            return;
+        const count = this.doneSinceReflect;
+        try {
+            await this.tracker.moveIssueToState(current.id, arm.armState, {
+                fromState: arm.from,
+                notes: sleepCycleArmNotes(trigger, count, arm.afterTerminal),
+                actor: SLEEP_CYCLE_ACTOR,
+            });
+            this.doneSinceReflect = 0;
+            log.info('sleep cycle armed reflection', {
+                issue_id: current.id,
+                trigger,
+                done_since_reflect: count,
+                reflect_state: arm.armState,
+            });
+        }
+        catch (err) {
+            log.warn('sleep cycle arm failed', {
+                issue_id: current.id,
+                error: err.message,
+            });
+        }
+    }
+    /** Look up the reflection issue's current tracker state; undefined on miss/error. */
+    async fetchReflectionIssue(issueId) {
+        try {
+            const found = await this.tracker.fetchIssueStatesByIds([issueId]);
+            return found.find((i) => i.id === issueId || i.identifier === issueId);
+        }
+        catch (err) {
+            log.debug('sleep cycle reflection-issue lookup failed', {
+                issue_id: issueId,
+                error: err.message,
+            });
+            return undefined;
+        }
+    }
+    /**
+     * Workspace removal deferred until the worker has fully unwound (including the
+     * terminal-state `actions:` block) so we never delete the dir while the agent
+     * is still inside it.
+     */
+    scheduleWorkspaceCleanup(issueId, entry, logger) {
+        this.cleanupInFlight.add(issueId);
+        this.workspaces
+            .remove(entry.identifier)
+            .catch((err) => logger.warn('workspace removal failed', { error: err.message }))
+            .finally(() => {
+            this.cleanupInFlight.delete(issueId);
+            this.closeRunLog(issueId, { reason: 'cleanup_on_exit' }, { viaCleanup: true });
+        });
+    }
+    /** Retry queue. */
     scheduleRetry(issueId, sched) {
         if (this.stopped)
             return;
@@ -441,10 +1040,12 @@ export class Orchestrator {
             due_at_ms: dueAt,
             timer_handle: handle,
             error: sched.error,
+            kind: sched.kind,
+            target_state: sched.target_state,
         });
         this.claimed.add(issueId);
     }
-    /** §16.6 on_retry_timer */
+    /** on_retry_timer */
     async onRetryTimer(issueId) {
         if (this.stopped)
             return;
@@ -452,14 +1053,30 @@ export class Orchestrator {
         if (!entry)
             return;
         this.retryAttempts.delete(issueId);
-        let candidates;
-        let snapshotTrackerRoot;
-        let snapshotTerminalTarget;
+        const fetched = await this.fetchRetryCandidates(issueId, entry);
+        if (!fetched)
+            return;
+        const issue = fetched.issues.find((i) => i.id === issueId);
+        if (!issue) {
+            this.releaseRetryClaim(issueId, entry.identifier, 'not_in_candidates');
+            return;
+        }
+        const reason = this.eligibilityReason(issue, true);
+        if (reason !== null) {
+            this.handleRetryIneligible(issue, entry, reason);
+            return;
+        }
+        void this.dispatchIssue(issue, entry.attempt, { trackerRoot: fetched.root });
+    }
+    /**
+     * Tracker poll for the retry timer. Returns the snapshot or null when the
+     * fetch failed (a failure-shaped retry is rescheduled internally so the
+     * caller can just bail).
+     */
+    async fetchRetryCandidates(issueId, entry) {
         try {
-            const result = await this.tracker.fetchCandidateIssues();
-            candidates = result.issues;
-            snapshotTrackerRoot = result.root;
-            snapshotTerminalTarget = pickTerminalTarget(result.terminalStates);
+            const r = await this.tracker.fetchCandidateIssues();
+            return { issues: r.issues, root: r.root };
         }
         catch (err) {
             log.debug('retry poll failed', {
@@ -472,96 +1089,355 @@ export class Orchestrator {
                 attempt: entry.attempt + 1,
                 delayMs: Math.min(FAILURE_BASE_MS * Math.pow(2, entry.attempt), this.cfg.agent.max_retry_backoff_ms),
                 error: 'retry poll failed',
+                kind: 'failure',
+                target_state: entry.target_state,
             });
-            return;
+            return null;
         }
-        const issue = candidates.find((i) => i.id === issueId);
-        if (!issue) {
-            this.claimed.delete(issueId);
-            log.info('retry releasing claim (not in candidates)', {
-                issue_id: issueId,
-                issue_identifier: entry.identifier,
-            });
+    }
+    /**
+     * Re-applied candidate eligibility came back non-null. The pure
+     * `decideRetryAfterIneligible` picks between rescheduling (only `no
+     * per-state slot`, which is genuine contention) and releasing the claim
+     * (everything else: blocker, missing fields, non-active state).
+     */
+    handleRetryIneligible(issue, entry, reason) {
+        const action = decideRetryAfterIneligible({
+            reason,
+            priorAttempt: entry.attempt,
+            targetState: issue.state,
+            failureBaseMs: FAILURE_BASE_MS,
+            maxBackoffMs: this.cfg.agent.max_retry_backoff_ms,
+        });
+        if (action.kind === 'release') {
+            this.releaseRetryClaim(issue.id, entry.identifier, `ineligible:${reason}`, reason);
             return;
         }
-        // Re-apply full candidate eligibility, ignoring this issue's own claim. This catches
-        // late-breaking issues like a new non-terminal blocker on a Todo or a state change to
-        // an inactive value that slipped past the candidate filter on edge tracker shapes.
-        const reason = this.eligibilityReason(issue, true);
-        if (reason !== null) {
-            if (reason === 'no per-state slot') {
-                this.scheduleRetry(issueId, {
-                    identifier: issue.identifier,
-                    attempt: entry.attempt + 1,
-                    delayMs: Math.min(FAILURE_BASE_MS * Math.pow(2, entry.attempt), this.cfg.agent.max_retry_backoff_ms),
-                    error: 'no available orchestrator slots',
-                });
+        this.scheduleRetry(issue.id, { identifier: issue.identifier, ...action.plan });
+    }
+    releaseRetryClaim(issueId, identifier, closeTag, ineligibleReason) {
+        this.claimed.delete(issueId);
+        this.circuitBreakers.delete(issueId);
+        log.info(ineligibleReason
+            ? 'retry releasing claim (ineligible)'
+            : 'retry releasing claim (not in candidates)', { issue_id: issueId, issue_identifier: identifier, ...(ineligibleReason ? { reason: ineligibleReason } : {}) });
+        this.closeRunLog(issueId, { reason: `claim_released_${closeTag}` });
+    }
+    /**
+     * Implements {@link IntendedVmProvider}. Returns the set of `symphony-*` VM
+     * names the orchestrator currently intends to keep alive — one per running
+     * dispatch. Used by the reconciler's vm resource to compute the orphan set
+     * to reap. `running.set` happens BEFORE the runner calls `createVm`, so a VM
+     * that exists in Gondolin's session registry as part of an in-flight create
+     * is always already represented
+     * here. The reaper sees it as intended and leaves it alone, closing the
+     * "creating-but-not-yet-active" race the issue body calls out.
+     */
+    intendedVmNames() {
+        const out = new Set();
+        for (const entry of this.running.values()) {
+            out.add(this.runner.vmNameFor(entry.issue));
+        }
+        return out;
+    }
+    /**
+     * Implements {@link WorkspaceIntendedProvider}. Returns the map of
+     * identifier → state the reconciler should preserve workspaces for. Two
+     * sources are unioned:
+     *
+     *   • Tracker view: every issue file in a non-terminal state. Anything
+     *     terminal (Done, Cancelled) is fair game for removal — this replaces
+     *     the old `startupTerminalCleanup` sweep with a continuous pass.
+     *   • In-flight allocations: running entries plus claimed/pending retries.
+     *     The window between dispatch claiming an issue and the tracker
+     *     reflecting it is brief but real; without this, a fresh dispatch's
+     *     workspace could be reaped seconds after creation.
+     *
+     * The state value is carried so the reconciler's `create` callback can apply
+     * the merge-state guard (it skips eager recreation of a workspace whose issue
+     * sits in the autopilot's merge state).
+     *
+     * Tracker errors propagate. Catching them here would cause an empty set
+     * to be returned, which the reconciler would treat as authoritative and
+     * reap every workspace — the regression this contract closes. The
+     * resource's `reconcile()` catches the throw and leaves on-disk state
+     * untouched until the next pass.
+     *
+     * Mirrors `intendedVmNames()` in shape so the reconciler's race-condition
+     * reasoning is the same across both janitors.
+     */
+    async activeIdentifiers() {
+        const out = new Map();
+        const nonTerminal = [];
+        for (const [name, cfg] of Object.entries(this.cfg.states)) {
+            if (cfg.role !== 'terminal')
+                nonTerminal.push(name);
+        }
+        const issues = await this.tracker.fetchIssuesByStates(nonTerminal);
+        for (const i of issues)
+            out.set(i.identifier, i.state);
+        // Issue 38/139: when the PR engine is enabled, the merge-state issues'
+        // workspaces are owned by the pr resource (it rebases inside them and cleans
+        // them up post-merge). Include those identifiers in the desired set so the
+        // workspace janitor doesn't reap a workspace the pr resource is actively
+        // driving. The merge state is derived by scanning states for `pr.auto_merge`
+        // (no named-string sibling block). The orchestrator's `createWorkspace`
+        // callback declines to eagerly recreate a missing merge-state workspace — so
+        // adding it here is safe: the workspace either already exists from the
+        // dispatch that ran the issue into the merge state, or it doesn't and the
+        // autopilot just skips the rebase step for that PR.
+        if (this.cfg.pr.enabled) {
+            const mergeState = derivePrRouting(this.cfg.states).mergeState;
+            if (mergeState) {
+                const mergeIssues = await this.tracker.fetchIssuesByStates([mergeState]);
+                for (const i of mergeIssues)
+                    out.set(i.identifier, i.state);
+            }
+        }
+        return out;
+    }
+    /**
+     * Identifiers the orchestrator has claimed for dispatch but the tracker may
+     * not yet reflect as active, with the state the eager workspace create should
+     * see (used for the merge-state guard). Running entries carry the state the
+     * dispatch was claimed from (`issue.state`); pending retries carry their
+     * `target_state` (where the next attempt will run).
+     */
+    inFlightIdentifiers() {
+        const out = new Map();
+        for (const e of this.running.values())
+            out.set(e.identifier, e.issue.state);
+        for (const r of this.retryAttempts.values())
+            out.set(r.identifier, r.target_state);
+        return out;
+    }
+    /**
+     * Implements {@link ProposeFollowupSink} for the action executor's
+     * `propose_followup` action (issue 36). Same tracker shape as the MCP
+     * `propose_issue` tool — file lands in the first declared `holding` state,
+     * with `proposed_by` set to the parent issue's identifier. Uses the live
+     * tracker root (passed-in parent identifier is the canonical attribution).
+     */
+    async proposeFollowup(input) {
+        const root = this.tracker.currentRoot ? this.tracker.currentRoot() : this.cfg.tracker.root;
+        if (!root) {
+            throw new Error('tracker root not available; cannot file propose_followup');
+        }
+        const landingState = pickHoldingState(this.cfg.states);
+        const result = await writeIssueFile({
+            trackerRoot: root,
+            state: landingState,
+            title: input.title,
+            description: input.description ?? '',
+            priority: input.priority ?? null,
+            labels: input.labels ?? [],
+            now: () => Date.now(),
+            extra_front_matter: {
+                proposed_by: input.parent_identifier,
+                proposed_at: new Date().toISOString(),
+            },
+        });
+        log.info('action propose_followup', {
+            proposed_by: input.parent_identifier,
+            identifier: result.identifier,
+            state: result.state,
+        });
+        return { identifier: result.identifier };
+    }
+    /**
+     * Receive a per-attempt action ledger from the runner's cleanup pass. The
+     * snapshot is keyed by state so the dashboard can render "Done.actions:
+     * push_branch ok, create_pr_if_missing rate-limited, retrying" without the
+     * orchestrator having to know about specific action kinds.
+     *
+     * `id` should follow the `actions:<StateName>` convention so it sorts
+     * predictably next to reconciler-resource rows in
+     * `snapshot.reconciler.resources`.
+     */
+    recordActionResult(id, snapshot) {
+        this.lastActionResults.set(id, snapshot);
+    }
+    /**
+     * Workspace removal callback the reconciler invokes for stale dirs (issue
+     * 34). Defers to `WorkspaceManager.remove` (a best-effort `rm -rf`).
+     * Failures are logged at warn (the reconciler's action ledger also records
+     * them).
+     */
+    async removeWorkspace(identifier) {
+        await this.workspaces.remove(identifier);
+    }
+    /**
+     * Workspace create callback the reconciler invokes for non-terminal issues
+     * whose dirs are not yet on disk (issue 34). Delegates to
+     * `WorkspaceManager.ensureFor` so the same canonical clone+branch+remote
+     * setup the dispatch path runs also fires here.
+     *
+     * The intended-set provider supplies the state alongside the identifier so
+     * the merge-state guard below can fire; the `null` fallback is defensive —
+     * production callers always pass a state.
+     *
+     * Race with the runner's dispatch-time `ensureFor` is handled inside
+     * `WorkspaceManager` via a per-identifier in-flight promise lock: both
+     * callers coalesce into one setup pass, so the canonical setup runs exactly
+     * once whether the reconciler or the runner wins the race.
+     */
+    async createWorkspace(identifier, state) {
+        // Issue 38: refuse to eagerly recreate a missing workspace for an issue
+        // in the autopilot's merge state. Those workspaces only exist as
+        // leftovers from a prior dispatch; recreating one from scratch would
+        // miss the agent's local commits (the agent's branch is on the remote,
+        // but a fresh clone would still need a separate fetch to pick it up).
+        // Operators who genuinely want a recreated workspace can cancel the
+        // issue (Cancelled triggers the close path + normal cleanup) and refile.
+        if (this.cfg.pr.enabled && state !== null) {
+            const mergeState = derivePrRouting(this.cfg.states).mergeState;
+            if (mergeState && state.toLowerCase() === mergeState.toLowerCase()) {
                 return;
             }
-            // For non-slot reasons (blocker, missing fields, non-active state), the right action
-            // is to release the claim rather than spin on it.
-            this.claimed.delete(issueId);
-            log.info('retry releasing claim (ineligible)', {
-                issue_id: issueId,
-                issue_identifier: entry.identifier,
-                reason,
+        }
+        await this.workspaces.ensureFor(identifier);
+    }
+    /**
+     * Implements {@link PrIntendedProvider} (issue 38). Returns the set of
+     * terminal-state issues the PR autopilot should manage:
+     *
+     *   • Issues in the configured `merge_state` (default `Done`) become
+     *     `kind: 'merge'` intents. The autopilot rebases them on
+     *     `origin/<base>` and arms GitHub auto-merge.
+     *   • Issues in the configured `close_state` (default `Cancelled`) become
+     *     `kind: 'close'` intents. The autopilot closes the PR without merge
+     *     and best-effort-deletes the remote branch. The workspace is NOT
+     *     supplied — Cancelled cleanup goes through the orchestrator's
+     *     standard terminal path.
+     *
+     * Both queries hit the tracker; failures bubble (the pr resource catches
+     * and surfaces in last_error so a transient tracker hiccup doesn't blank
+     * the autopilot's intended set).
+     *
+     * When `pr.enabled` is false this method is never invoked (the reconciler
+     * skips its pr pass entirely), but the early return keeps the public surface
+     * idempotent. The merge/close targets are derived by scanning states for the
+     * per-state `pr:` field (issue 139), not read from named strings.
+     */
+    async prIntended() {
+        if (!this.cfg.pr.enabled)
+            return [];
+        const { mergeState, closeState } = derivePrRouting(this.cfg.states);
+        if (!mergeState && !closeState)
+            return [];
+        const baseBranch = baseBranchName(this.cfg.workspace.base_branch);
+        const fetchStates = [mergeState, closeState].filter((s) => s !== null);
+        const issues = await this.tracker.fetchIssuesByStates(fetchStates);
+        const out = [];
+        for (const issue of issues) {
+            const intent = classifyPrIntent({
+                issue,
+                mergeState: mergeState ?? '',
+                closeState,
+                baseBranch,
+                mergeWorkspacePath: this.workspaces.workspacePathFor(issue.identifier),
             });
-            return;
+            if (intent)
+                out.push(intent);
         }
-        void this.dispatchIssue(issue, entry.attempt, {
-            trackerRoot: snapshotTrackerRoot,
-            terminalTarget: snapshotTerminalTarget,
-        });
+        return out;
     }
-    /** §8.6 startup terminal workspace cleanup. */
-    async startupTerminalCleanup() {
+    /**
+     * Tracker-side transition the PR autopilot uses to route a conflict-rebasing
+     * issue back into the implementing state (or, after exceeding the attempt
+     * limit, into the holding state). Same shape as the MCP transition tool —
+     * the tracker handles atomic notes-append + cross-directory rename.
+     *
+     * No workspace flag is touched here: the target state's `role` decides
+     * cleanup at the transition's own level (active/holding never trigger
+     * cleanup), and the workspace was preserved across the move into the merge
+     * state in the first place because the PR engine suppresses the terminal
+     * cleanup for that target. See {@link McpRegistry.performTransition} for the
+     * role-driven rule.
+     */
+    async routeIssueForAutopilot(input) {
+        if (!this.tracker.moveIssueToState) {
+            throw new Error('tracker does not support state transitions');
+        }
+        // The tracker file's `id` may diverge from the identifier when the file
+        // sets an explicit front-matter `id`. Resolve via a candidate scan so the
+        // tracker can find the right file even with that aliasing.
+        let issueId = null;
         try {
-            const terminals = await this.tracker.fetchIssuesByStates(this.cfg.tracker.terminal_states);
-            for (const issue of terminals) {
-                try {
-                    await this.workspaces.remove(issue.identifier, this.cfg.hooks);
-                }
-                catch (err) {
-                    log.warn('terminal cleanup failed for issue', {
-                        issue_identifier: issue.identifier,
-                        error: err.message,
-                    });
-                }
-            }
+            const candidates = await this.tracker.fetchIssuesByStates([input.fromState]);
+            const match = candidates.find((c) => c.identifier === input.identifier);
+            if (match)
+                issueId = match.id;
         }
-        catch (err) {
-            log.warn('startup terminal cleanup fetch failed', { error: err.message });
+        catch {
+            // Fall through to identifier fallback below.
         }
+        if (issueId === null)
+            issueId = input.identifier;
+        await this.tracker.moveIssueToState(issueId, input.toState, {
+            fromState: input.fromState,
+            notes: input.notes,
+            actor: input.actor,
+        });
+    }
+    /**
+     * Implements {@link BaseRefProvider}. Returns the configured base branch
+     * name AND its current SHA in the source repo (workflow_dir by default).
+     * Returns null when the SHA can't be resolved (no `.git`, base branch
+     * missing, etc.) — drift detection skips the pass.
+     *
+     * Why both fields: the reconciler's drift check compares the workspace's
+     * own copy of `<branch>` (frozen at clone time) against this SHA. Returning
+     * the branch name keeps the source-of-truth in one place; the inspector
+     * uses it to run `git rev-parse <branch>` inside the workspace.
+     *
+     * The base branch (`workspace.base_branch`, or the `SYMPHONY_BASE_BRANCH` env
+     * override, default `main`) is resolved the same way the dispatch-time clone
+     * does, so the drift check compares against the same ref the workspace was
+     * originally cloned from.
+     */
+    async currentBaseRef() {
+        const branch = process.env.SYMPHONY_BASE_BRANCH && process.env.SYMPHONY_BASE_BRANCH.length > 0
+            ? process.env.SYMPHONY_BASE_BRANCH
+            : this.cfg.workspace.base_branch;
+        const sourceRepo = process.env.SYMPHONY_SOURCE_REPO && process.env.SYMPHONY_SOURCE_REPO.length > 0
+            ? process.env.SYMPHONY_SOURCE_REPO
+            : this.cfg.workflow_dir;
+        const r = await runProcess('git', ['rev-parse', branch], { cwd: sourceRepo });
+        if (r.exit_code !== 0)
+            return null;
+        const sha = r.stdout.trim();
+        return sha.length > 0 ? { branch, sha } : null;
     }
-    // Public hooks the runner uses to feed events back.
+    // Public callbacks the runner uses to feed events back.
     reportTokenUsage(issueId, usage) {
         const e = this.running.get(issueId);
         if (!e)
             return;
-        // §13.5: prefer absolute totals; track deltas to avoid double-counting.
+        // §9.4: prefer absolute totals; track deltas to avoid double-counting.
         const dIn = Math.max(0, usage.input_tokens - e.last_reported_input_tokens);
         const dOut = Math.max(0, usage.output_tokens - e.last_reported_output_tokens);
         const dTot = Math.max(0, usage.total_tokens - e.last_reported_total_tokens);
-        e.codex_input_tokens = usage.input_tokens;
-        e.codex_output_tokens = usage.output_tokens;
-        e.codex_total_tokens = usage.total_tokens;
+        e.input_tokens = usage.input_tokens;
+        e.output_tokens = usage.output_tokens;
+        e.total_tokens = usage.total_tokens;
         e.last_reported_input_tokens = usage.input_tokens;
         e.last_reported_output_tokens = usage.output_tokens;
         e.last_reported_total_tokens = usage.total_tokens;
-        this.codexTotals.input_tokens += dIn;
-        this.codexTotals.output_tokens += dOut;
-        this.codexTotals.total_tokens += dTot;
+        this.sessionTotals.input_tokens += dIn;
+        this.sessionTotals.output_tokens += dOut;
+        this.sessionTotals.total_tokens += dTot;
     }
     reportRateLimits(_issueId, snapshot) {
-        this.codexRateLimits = snapshot;
+        this.rateLimits = snapshot;
     }
     reportRuntimeEvent(issueId, ev) {
         const e = this.running.get(issueId);
         if (!e)
             return;
-        e.last_codex_event = ev.event;
-        e.last_codex_timestamp = ev.at;
-        e.last_codex_message = ev.message;
+        e.last_event = ev.event;
+        e.last_event_at = ev.at;
+        e.last_message = ev.message;
         e.recent_events.push(ev);
         if (e.recent_events.length > 50)
             e.recent_events.shift();
@@ -572,7 +1448,7 @@ export class Orchestrator {
             return;
         e.session_id = info.sessionId;
         e.thread_id = info.threadId;
-        e.codex_app_server_pid = info.pid;
+        e.adapter_pid = info.pid;
     }
     reportTurnStarted(issueId, turnNumber) {
         const e = this.running.get(issueId);
@@ -580,7 +1456,7 @@ export class Orchestrator {
             return;
         e.turn_count = turnNumber;
     }
-    /** §13.3 snapshot. */
+    /** §9.3 snapshot. */
     snapshot() {
         const generatedAt = new Date().toISOString();
         const liveExtraSeconds = [...this.running.values()]
@@ -597,19 +1473,19 @@ export class Orchestrator {
                 state: e.issue.state,
                 session_id: e.session_id,
                 turn_count: e.turn_count,
-                last_event: e.last_codex_event,
-                last_message: e.last_codex_message,
+                last_event: e.last_event,
+                last_message: e.last_message,
                 started_at: e.started_at,
-                last_event_at: e.last_codex_timestamp,
+                last_event_at: e.last_event_at,
                 tokens: {
-                    input_tokens: e.codex_input_tokens,
-                    output_tokens: e.codex_output_tokens,
-                    total_tokens: e.codex_total_tokens,
+                    input_tokens: e.input_tokens,
+                    output_tokens: e.output_tokens,
+                    total_tokens: e.total_tokens,
                 },
                 steering_requested: e.steering_requested,
                 steering_question: e.steering_question,
                 steering_context: e.steering_context,
-                marked_done: e.marked_done,
+                transitioned: e.transitioned,
             })),
             retrying: [...this.retryAttempts.values()].map((r) => ({
                 issue_id: r.issue_id,
@@ -617,67 +1493,77 @@ export class Orchestrator {
                 attempt: r.attempt,
                 due_at: new Date(r.due_at_ms).toISOString(),
                 error: r.error,
+                kind: r.kind,
             })),
-            codex_totals: {
-                ...this.codexTotals,
-                seconds_running: this.codexTotals.seconds_running + liveExtraSeconds,
+            session_totals: {
+                ...this.sessionTotals,
+                seconds_running: this.sessionTotals.seconds_running + liveExtraSeconds,
             },
-            rate_limits: this.codexRateLimits,
+            rate_limits: this.rateLimits,
+            memory_admission: this.computeAdmission(),
+            reconciler: this.buildReconcilerSnapshot(),
         };
     }
+    /**
+     * Combine the reconciler's resource snapshot with the most recent action
+     * results so the dashboard sees both surfaces under one `reconciler.resources`
+     * list. When neither side has anything to report (no reconciler wired AND no
+     * actions ever ran), the field is null to preserve the existing test
+     * harness's "no reconciler" shape.
+     */
+    buildReconcilerSnapshot() {
+        const base = this.reconciler ? this.reconciler.snapshot() : null;
+        if (!base && this.lastActionResults.size === 0)
+            return null;
+        const resources = base ? [...base.resources] : [];
+        for (const snap of this.lastActionResults.values())
+            resources.push(snap);
+        return { resources };
+    }
     /** Issue-detail view used by the HTTP /api/v1/<identifier> endpoint. */
     detailByIdentifier(identifier) {
-        let entry = null;
-        for (const e of this.running.values()) {
-            if (e.identifier === identifier) {
-                entry = e;
-                break;
+        const entry = this.findRunningByIdentifier(identifier);
+        const retry = this.findRetryByIdentifier(identifier);
+        return buildIssueDetailDto(identifier, entry
+            ? {
+                issue_id: entry.issue_id,
+                identifier: entry.identifier,
+                workspace_path: entry.workspace_path,
+                session_id: entry.session_id,
+                turn_count: entry.turn_count,
+                state: entry.issue.state,
+                started_at: entry.started_at,
+                last_event: entry.last_event,
+                last_message: entry.last_message,
+                last_event_at: entry.last_event_at,
+                input_tokens: entry.input_tokens,
+                output_tokens: entry.output_tokens,
+                total_tokens: entry.total_tokens,
+                recent_events: entry.recent_events,
+                last_error: entry.last_error,
             }
-        }
-        let retry = null;
-        for (const r of this.retryAttempts.values()) {
-            if (r.identifier === identifier) {
-                retry = r;
-                break;
+            : null, retry
+            ? {
+                issue_id: retry.issue_id,
+                identifier: retry.identifier,
+                attempt: retry.attempt,
+                due_at_ms: retry.due_at_ms,
+                error: retry.error,
+                kind: retry.kind,
             }
-        }
-        if (!entry && !retry)
-            return null;
-        return {
-            issue_identifier: identifier,
-            issue_id: entry?.issue_id ?? retry?.issue_id ?? null,
-            status: entry ? 'running' : 'retrying',
-            workspace: entry ? { path: entry.workspace_path } : null,
-            attempts: {
-                current_retry_attempt: retry?.attempt ?? null,
-            },
-            running: entry
-                ? {
-                    session_id: entry.session_id,
-                    turn_count: entry.turn_count,
-                    state: entry.issue.state,
-                    started_at: entry.started_at,
-                    last_event: entry.last_codex_event,
-                    last_message: entry.last_codex_message,
-                    last_event_at: entry.last_codex_timestamp,
-                    tokens: {
-                        input_tokens: entry.codex_input_tokens,
-                        output_tokens: entry.codex_output_tokens,
-                        total_tokens: entry.codex_total_tokens,
-                    },
-                }
-                : null,
-            retry: retry
-                ? {
-                    attempt: retry.attempt,
-                    due_at: new Date(retry.due_at_ms).toISOString(),
-                    error: retry.error,
-                }
-                : null,
-            recent_events: entry?.recent_events ?? [],
-            last_error: entry?.last_error ?? retry?.error ?? null,
-            tracked: {},
-        };
+            : null);
+    }
+    findRunningByIdentifier(identifier) {
+        for (const e of this.running.values())
+            if (e.identifier === identifier)
+                return e;
+        return null;
+    }
+    findRetryByIdentifier(identifier) {
+        for (const r of this.retryAttempts.values())
+            if (r.identifier === identifier)
+                return r;
+        return null;
     }
 }
 //# sourceMappingURL=orchestrator.js.map