specrails-desktop 2.57.0 → 2.58.0

package/server/dist/modules/builder/runtime/milestone-chain.js

@@ -1,11 +1,13 @@
 "use strict";
 // Server-durable milestone launch chain (premium-milestone-progress, D3/D4).
 //
-// "Launch Milestone N" in sequential mode: chunk the milestone's todo specs
-// (≤3 per rail), launch chunk 1 through the ORDINARY rails launch route, and
-// — when that chunk's delivery settles — launch the next chunk STACKED on the
-// delivered branch, so a greenfield walking skeleton accumulates without
-// waiting for a merge. The plan lives in SQLite (survives window close, app
+// "Launch Milestone N": order the milestone's todo specs by their declared
+// dependencies (prerequisites, then execution_order), put ONE spec on each
+// rail (mode `implement`), launch the first through the ORDINARY rails launch
+// route, and — when that spec's delivery settles — launch the next one STACKED
+// on the delivered branch, so a greenfield walking skeleton accumulates without
+// waiting for a merge. Launches are always sequential (the Parallel option was
+// removed); auto-continue is on by default and a failure always pauses. The plan lives in SQLite (survives window close, app
 // restart, machine sleep), advances from the delivery-settle chokepoint (the
 // `rail.pr_state` broadcast tapped in the project's bound broadcast — the
 // engine's `onLoopRunFinished` fires BEFORE the delivery row leaves
@@ -13,32 +15,63 @@
 // pauses with a typed reason on any failure (never skips ahead), and is
 // visible/controllable (resume / cancel) from every surface.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MilestoneChainManager = exports.MAX_TICKETS_PER_CHAIN_CHUNK = void 0;
-exports.isMilestoneChainEnabled = isMilestoneChainEnabled;
+exports.MilestoneChainManager = exports.RAIL_LIMIT_REACHED = exports.MAX_TICKETS_PER_CHAIN_CHUNK = void 0;
 exports.chunkTickets = chunkTickets;
+exports.orderChainTickets = orderChainTickets;
 exports.chainRailName = chainRailName;
+exports.isBuilderRailName = isBuilderRailName;
 const milestone_progress_1 = require("./milestone-progress");
 const milestone_chain_store_1 = require("./milestone-chain-store");
 const ids_1 = require("../../../ids");
-exports.MAX_TICKETS_PER_CHAIN_CHUNK = 3;
-/** `SPECRAILS_MILESTONE_CHAIN=false|0|off` ⇒ every milestone launch is parallel and no row is written. */
-function isMilestoneChainEnabled(env = process.env) {
-    const raw = env.SPECRAILS_MILESTONE_CHAIN;
-    if (raw === undefined || raw === '')
-        return true;
-    const normalized = raw.trim().toLowerCase();
-    return !(normalized === '0' || normalized === 'false' || normalized === 'off');
-}
+/** One spec per rail: every chunk of a milestone chain carries exactly one spec. */
+exports.MAX_TICKETS_PER_CHAIN_CHUNK = 1;
 function chunkTickets(ticketIds, size = exports.MAX_TICKETS_PER_CHAIN_CHUNK) {
     const chunks = [];
     for (let i = 0; i < ticketIds.length; i += size)
         chunks.push(ticketIds.slice(i, i + size));
     return chunks;
 }
-function chainRailName(n, chunkIndex, totalChunks) {
+/**
+ * Launch order for a milestone's specs: a stable topological order over the
+ * specs' `prerequisites` (edges to specs outside the set — already done or in
+ * another milestone — are ignored), ties broken by `execution_order` (unset
+ * last) and then id. A dependency cycle cannot block the milestone: the
+ * remaining specs follow in tie order.
+ */
+function orderChainTickets(tickets) {
+    const byId = new Map(tickets.map((t) => [t.id, t]));
+    const rank = (a, b) => {
+        const ea = byId.get(a)?.executionOrder ?? Number.POSITIVE_INFINITY;
+        const eb = byId.get(b)?.executionOrder ?? Number.POSITIVE_INFINITY;
+        return ea !== eb ? (ea < eb ? -1 : 1) : a - b;
+    };
+    const pending = new Map();
+    for (const t of tickets) {
+        pending.set(t.id, new Set((t.prerequisites ?? []).filter((id) => id !== t.id && byId.has(id))));
+    }
+    const order = [];
+    while (pending.size > 0) {
+        const ready = [...pending.entries()].filter(([, deps]) => deps.size === 0).map(([id]) => id).sort(rank);
+        // Cycle: take the best-ranked remaining spec so the chain still progresses.
+        const next = ready[0] ?? [...pending.keys()].sort(rank)[0];
+        order.push(next);
+        pending.delete(next);
+        for (const deps of pending.values())
+            deps.delete(next);
+    }
+    return order;
+}
+/** Builder rails are named after their spec: `M1 · #12`. */
+function chainRailName(n, ticketIds) {
     const label = (0, milestone_progress_1.milestoneLabelFor)(n);
-    return totalChunks === 1 ? label : `${label} · ${chunkIndex + 1}`;
+    return ticketIds.length ? `${label} · ${ticketIds.map((id) => `#${id}`).join(' ')}` : label;
+}
+/** A rail name the Project Builder owns (`M<n>` or `M<n> · …`). */
+function isBuilderRailName(name) {
+    return typeof name === 'string' && /^M\d+(?: · .+)?$/.test(name);
 }
+/** Pause reason when every rail slot is taken by undecided work. */
+exports.RAIL_LIMIT_REACHED = 'rail_limit_reached';
 const SUCCESS_DECISIONS = new Set(['on_review', 'no_changes', 'pr_draft', 'pr_ready', 'completed', 'merged']);
 class MilestoneChainManager {
     db;
@@ -52,9 +85,6 @@ class MilestoneChainManager {
     now() {
         return this.io.now?.() ?? Date.now();
     }
-    enabled() {
-        return this.io.enabled?.() ?? isMilestoneChainEnabled();
-    }
     /** Non-terminal chains. */
     listActive() {
         return (0, milestone_chain_store_1.listActiveChains)(this.db).map(milestone_chain_store_1.toChainSnapshot);
@@ -88,34 +118,37 @@ class MilestoneChainManager {
     }
     todoTicketIds(n) {
         const label = (0, milestone_progress_1.milestoneLabelFor)(n);
-        return this.io.readTickets()
-            .filter((t) => t.status === 'todo' && Array.isArray(t.labels) && t.labels.includes(label))
-            .map((t) => t.id)
-            .sort((a, b) => a - b);
+        return orderChainTickets(this.io.readTickets()
+            .filter((t) => t.status === 'todo' && Array.isArray(t.labels) && t.labels.includes(label)));
     }
-    /** Create → assign → launch ONE chunk on a fresh rail — or, for a retry,
-     *  on the rail the failed attempt used when nothing undecided sits on it. */
-    async launchChunk(n, chunks, chunkIndex, baseBranch, reuseRailIndex = null, baseDeliveryIds) {
+    /** Assign → launch ONE spec on a rail: the retried chunk's previous rail,
+     *  else a free builder-owned rail (same name, this chain's, then any builder
+     *  rail), else a fresh one. At the rail limit it fails `rail_limit_reached`. */
+    async launchChunk(n, chunks, chunkIndex, baseBranch, reuseRailIndex = null, baseDeliveryIds, chain) {
         const ticketIds = chunks[chunkIndex];
         let railIndex;
-        const name = chainRailName(n, chunkIndex, chunks.length);
-        const byName = reuseRailIndex === null ? this.freeRailNamed(name) : null;
-        if (reuseRailIndex !== null) {
-            railIndex = reuseRailIndex;
-        }
-        else if (byName !== null) {
-            railIndex = byName;
+        const name = chainRailName(n, ticketIds);
+        const reused = reuseRailIndex ?? this.freeRailNamed(name) ?? this.freeBuilderRail(chain);
+        if (reused !== null) {
+            railIndex = reused;
+            if (this.railName(reused) !== name && this.io.renameRail) {
+                // Best effort: a stale label is cosmetic, never a reason to stop.
+                try {
+                    await this.io.renameRail(reused, name);
+                }
+                catch { /* keep the old label */ }
+            }
         }
         else {
             const rail = await this.io.createRail(name);
             if (!rail.ok)
-                return rail;
+                return rail.error === exports.RAIL_LIMIT_REACHED ? { ...rail, status: 409 } : rail;
             railIndex = rail.railIndex;
         }
         const assigned = await this.io.assignTickets(railIndex, ticketIds);
         if (!assigned.ok)
             return assigned;
-        const launched = await this.io.launch(railIndex, { mode: 'batch-implement', ...(baseDeliveryIds?.length ? { baseDeliveryIds } : baseBranch ? { baseBranch } : {}) });
+        const launched = await this.io.launch(railIndex, { mode: 'implement', ...(baseDeliveryIds?.length ? { baseDeliveryIds } : baseBranch ? { baseBranch } : {}) });
         if (!launched.ok)
             return launched;
         const delivery = this.io.activeDeliveryForRail(railIndex);
@@ -131,7 +164,39 @@ class MilestoneChainManager {
             const index = this.io.findRailByName?.(name) ?? null;
             if (index === null)
                 return null;
-            return this.io.activeDeliveryForRail(index) ? null : index;
+            return this.railFree(index) ? index : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    railName(railIndex) {
+        try {
+            return this.io.listRails?.().find((r) => r.railIndex === railIndex)?.name ?? null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /** Nothing undecided, nothing running, and no other active chain mid-flight on it. */
+    railFree(railIndex) {
+        if (this.io.activeDeliveryForRail(railIndex))
+            return false;
+        if (this.io.railBusy?.(railIndex))
+            return false;
+        return !(0, milestone_chain_store_1.listActiveChains)(this.db).some((row) => row.current_rail_index === railIndex && (row.current_delivery_id !== null || (0, milestone_chain_store_1.parseRunIds)(row).length > 0));
+    }
+    /** Before allocating a new rail slot: a rail this chain already used, else
+     *  any builder-named rail, that is free (its PR decided or nothing on it). */
+    freeBuilderRail(chain) {
+        try {
+            const own = chain ? (0, milestone_chain_store_1.parseLaunched)(chain).map((l) => l.railIndex) : [];
+            const builder = (this.io.listRails?.() ?? []).filter((r) => isBuilderRailName(r.name)).map((r) => r.railIndex);
+            for (const index of [...new Set([...own, ...builder])]) {
+                if (this.railFree(index))
+                    return index;
+            }
+            return null;
         }
         catch {
             return null;
@@ -151,10 +216,13 @@ class MilestoneChainManager {
             return null;
         }
     }
-    async start(n, requestedMode, opts = {}) {
-        const enabled = this.enabled();
+    /**
+     * Launch a milestone. Always sequential: one spec per rail, each stacked on
+     * the previous delivered branch. `autoAdvance` defaults to ON; turning it off
+     * parks the chain at a checkpoint after every delivered rail.
+     */
+    async start(n, opts = {}) {
         const autoAdvance = opts.autoAdvance !== false;
-        const mode = enabled ? requestedMode : 'parallel';
         const active = (0, milestone_chain_store_1.listActiveChains)(this.db).find((c) => c.milestone_n === n);
         if (active)
             return { ok: false, status: 409, error: 'chain_active', chainId: active.id };
@@ -166,40 +234,15 @@ class MilestoneChainManager {
         if (ticketIds.length === 0)
             return { ok: false, status: 400, error: 'no_tickets', detail: `no todo specs labeled ${(0, milestone_progress_1.milestoneLabelFor)(n)}` };
         const chunks = chunkTickets(ticketIds);
-        if (mode === 'parallel') {
-            const launched = [];
-            let failure = null;
-            for (let i = 0; i < chunks.length; i++) {
-                const r = await this.launchChunk(n, chunks, i, null);
-                if (!r.ok) {
-                    failure = r;
-                    break;
-                }
-                launched.push(r.entry);
-            }
-            if (launched.length === 0 && failure)
-                return { ok: false, status: failure.status, error: failure.error, detail: failure.detail };
-            let chainId = null;
-            if (enabled) {
-                // Recorded `completed` so parallel milestones show chunk ordering in
-                // the same progress model; never advances anything.
-                const row = (0, milestone_chain_store_1.createChain)(this.db, { id: (0, ids_1.newId)(), milestoneN: n, milestoneId: milestone.id, mode, chunks, integrationBranch: await this.safeIntegrationBranch(), status: 'completed', nowMs: this.now() });
-                (0, milestone_chain_store_1.updateChain)(this.db, row.id, 'completed', { nextChunk: launched.length, launched }, this.now());
-                chainId = row.id;
-                const fresh = (0, milestone_chain_store_1.getChain)(this.db, row.id);
-                if (fresh)
-                    this.emit(fresh);
-            }
-            return { ok: true, status: 202, chainId, launched, pending: chunks.slice(launched.length) };
-        }
         const row = (0, milestone_chain_store_1.createChain)(this.db, {
-            id: (0, ids_1.newId)(), milestoneN: n, milestoneId: milestone.id, mode, chunks,
+            id: (0, ids_1.newId)(), milestoneN: n, milestoneId: milestone.id, mode: 'sequential', chunks,
             integrationBranch: await this.safeIntegrationBranch(), autoAdvance, nowMs: this.now(),
         });
-        const first = await this.launchChunk(n, chunks, 0, null);
+        const first = await this.launchChunk(n, chunks, 0, null, null, undefined, row);
         if (!first.ok) {
-            // Nothing launched ⇒ no chain remains active (the route relays the guard).
-            (0, milestone_chain_store_1.updateChain)(this.db, row.id, 'running', { status: 'cancelled', pauseReason: `launch_rejected:${first.error}` }, this.now());
+            // Nothing launched ⇒ no chain remains active (the route relays the guard,
+            // including `rail_limit_reached` when every rail holds undecided work).
+            (0, milestone_chain_store_1.updateChain)(this.db, row.id, 'running', { status: 'cancelled', pauseReason: first.error === exports.RAIL_LIMIT_REACHED ? exports.RAIL_LIMIT_REACHED : `launch_rejected:${first.error}` }, this.now());
             return { ok: false, status: first.status, error: first.error, detail: first.detail, chainId: row.id };
         }
         this.recordLaunched(row.id, first.entry);
@@ -272,12 +315,17 @@ class MilestoneChainManager {
         }
         (0, milestone_chain_store_1.updateChain)(this.db, row.id, row.status, { status: 'waiting', headBranch: head, pauseReason: null }, this.now());
         const reuse = chunkIndex < row.next_chunk ? this.reusableRailFor(row, chunkIndex) : null;
-        const r = await this.launchChunk(row.milestone_n, chunks, chunkIndex, head, reuse, multiRepositoryHistory ? earlierDeliveries : undefined);
+        const r = await this.launchChunk(row.milestone_n, chunks, chunkIndex, head, reuse, multiRepositoryHistory ? earlierDeliveries : undefined, row);
         const current = (0, milestone_chain_store_1.getChain)(this.db, chainId);
         if (!current || !(0, milestone_chain_store_1.isActiveChainStatus)(current.status))
             return;
         if (!r.ok) {
-            this.pause(current, `launch_rejected:${r.error}`);
+            // Every rail holds undecided work: wait for the user to decide pending
+            // PRs, then Resume launches this same spec.
+            if (r.error === exports.RAIL_LIMIT_REACHED)
+                this.pause(current, exports.RAIL_LIMIT_REACHED);
+            else
+                this.pause(current, `launch_rejected:${r.error}`);
             return;
         }
         this.recordLaunched(chainId, r.entry);

package/server/dist/modules/delivery/runtime/definition-fork.js

@@ -0,0 +1,158 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateDefinitionForkRequest = validateDefinitionForkRequest;
+exports.forkDefinitionRun = forkDefinitionRun;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const db_1 = require("../../../db");
+const agent_runtime_bridge_1 = require("../../agent-runtime/runtime/agent-runtime-bridge");
+const loop_runs_store_1 = require("../../loops/runtime/loop-runs-store");
+const loop_definition_recovery_1 = require("../../loops/runtime/loop-definition-recovery");
+const rail_pr_store_1 = require("./rail-pr-store");
+const isolated_settlement_store_1 = require("./isolated-settlement-store");
+const rail_worktrees_store_1 = require("./rail-worktrees-store");
+const object = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+const canonical = (value) => Array.isArray(value) ? value.map(canonical) : object(value)
+    ? Object.fromEntries(Object.keys(value).sort().map(key => [key, canonical(value[key])])) : value;
+function validateDefinitionForkRequest(value) {
+    if (!object(value) || Object.keys(value).some(key => !['requestId', 'fromNodePath', 'scopeId', 'visit', 'state'].includes(key)) ||
+        typeof value.requestId !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(value.requestId) ||
+        typeof value.fromNodePath !== 'string' || !value.fromNodePath.trim() || value.fromNodePath.length > 2048 ||
+        value.scopeId !== undefined && (typeof value.scopeId !== 'string' || !value.scopeId || value.scopeId.length > 2048) ||
+        value.visit !== undefined && (!Number.isSafeInteger(value.visit) || Number(value.visit) < 1) ||
+        value.state !== undefined && (!object(value.state) || Object.keys(value.state).some(key => !['$vars', '$outputs'].includes(key)) || Object.values(value.state).some(channel => !object(channel))))
+        throw new Error('invalid_fork_request');
+    if (JSON.stringify(value).length > 2 * 1024 * 1024)
+        throw new Error('invalid_fork_request: State exceeds 2 MiB');
+    return value;
+}
+/** Core owns the historical cut; Desktop atomically moves only host ownership.
+ * A durable request precedes Core publication so a lost acknowledgement can be
+ * retried. The source job, frozen inputs, events and accounting remain untouched.
+ */
+async function forkDefinitionRun(ctx, runId, input, io = {}) {
+    const db = ctx.db, projectId = ctx.project.id;
+    const frozen = (0, loop_runs_store_1.readDefinitionRun)(db, runId), sourceJob = (0, db_1.getJob)(db, runId);
+    if (!frozen || frozen.row.project_id !== projectId || !frozen.metadata.contextPath || !sourceJob)
+        throw new Error('runtime_run_not_found');
+    const request = validateDefinitionForkRequest(input), encoded = JSON.stringify(canonical(request));
+    const prior = db.prepare('SELECT * FROM definition_fork_operations WHERE project_id=? AND source_run_id=? AND request_id=?').get(projectId, runId, request.requestId);
+    if (prior && prior.request_json !== encoded)
+        throw new Error('fork_request_conflict');
+    if (prior?.adopted && prior.result_json)
+        return JSON.parse(prior.result_json);
+    if ((0, loop_runs_store_1.readDefinitionSuccessor)(db, runId))
+        throw new Error('runtime_fork_owns_worktree');
+    if (!prior && db.prepare('SELECT 1 FROM definition_fork_operations WHERE source_run_id=? LIMIT 1').get(runId))
+        throw new Error('fork_request_pending: Retry the original request');
+    const childRunId = prior?.child_run_id ?? `fork-${(0, node_crypto_1.createHash)('sha256').update(JSON.stringify([projectId, runId, request.requestId])).digest('hex').slice(0, 32)}`;
+    const observed = (0, loop_runs_store_1.readDefinitionExecutionClaim)(db, runId);
+    const probe = await (io.probe ?? loop_definition_recovery_1.probeDefinitionRun)({ db, cwd: ctx.project.path, env: process.env }, runId);
+    if (probe.status === 'unavailable')
+        throw new Error('runtime_status_unavailable');
+    if (probe.lease?.active || ctx.loopRunManager.isDefinitionCancellationPending(runId))
+        throw new Error('runtime_run_active');
+    if ((0, loop_runs_store_1.readDefinitionRun)(db, runId)?.row.status === 'running')
+        throw new Error('runtime_run_active: Wait for the host pause or terminal settlement');
+    if (observed && !ctx.loopRunManager.isDefinitionRunActive(runId))
+        db.prepare(`DELETE FROM definition_execution_claims WHERE run_id=? AND owner=?
+    AND EXISTS (SELECT 1 FROM loop_runs WHERE id=? AND status='paused' AND restart_reason='restart')`).run(runId, observed.owner, runId);
+    const token = `fork:${(0, node_crypto_1.randomUUID)()}`;
+    const execution = (0, loop_runs_store_1.claimDefinitionExecution)(db, runId, { owner: token, repositoryMounts: (0, loop_runs_store_1.definitionRepositoryMounts)(frozen.request) });
+    if (!execution.ok)
+        throw new Error('runtime_run_active');
+    const claimed = [];
+    try {
+        const owned = db.prepare('SELECT delivery_id FROM definition_delivery_settlements WHERE project_id=? AND run_id=? AND superseded_by IS NULL').all(projectId, runId);
+        const deliveries = owned.map(row => (0, rail_pr_store_1.getPrDelivery)(db, row.delivery_id));
+        const parentIds = deliveries.flatMap(row => row?.parent_delivery_id ? [row.parent_delivery_id] : []);
+        const all = [...deliveries, ...[...new Set(parentIds)].map(id => (0, rail_pr_store_1.getPrDelivery)(db, id))];
+        if (frozen.request.deferTerminalOutcome && !deliveries.length)
+            throw new Error('Original isolated settlement snapshot is unavailable');
+        if (frozen.row.status === 'completed' && deliveries.some(row => !(0, isolated_settlement_store_1.readIsolatedSettlementRecords)(db, projectId, row.id).find(record => record.snapshot.run.runId === runId)?.result))
+            throw new Error('runtime_settlement_pending: Finish original settlement before forking');
+        if (all.some(row => !row || ['discarded', 'superseded', 'merged', 'completed'].includes(row.decision)))
+            throw new Error('Delivery ownership has already changed');
+        const host = (0, agent_runtime_bridge_1.readFrozenRuntimeHost)(frozen.metadata.contextPath, process.env, runId);
+        const forkOptions = { ...request, kind: 'fork', runId, childRunId, contextPath: frozen.metadata.contextPath, cwd: host.cwd, env: host.env };
+        if (!io.fork)
+            await (0, agent_runtime_bridge_1.assertRetainedForkSupport)(forkOptions);
+        db.transaction(() => {
+            for (const row of all) {
+                if (!(0, rail_pr_store_1.claimPrDeliveryOperation)(db, row.id, row.decision, 'recover-and-retry', token))
+                    throw new Error('Delivery is busy');
+                claimed.push(row);
+            }
+            if (!prior)
+                db.prepare('INSERT INTO definition_fork_operations(project_id,source_run_id,request_id,child_run_id,request_json) VALUES (?,?,?,?,?)').run(projectId, runId, request.requestId, childRunId, encoded);
+        })();
+        let fork;
+        try {
+            fork = io.fork ? await io.fork(forkOptions) : await (0, agent_runtime_bridge_1.runAgentRuntimeControl)(forkOptions);
+        }
+        catch (error) {
+            // An authoritative pre-publication rejection is not a lost receipt. Only
+            // drop its intent when the destination does not exist; uncertain failures
+            // and all published/partial children keep the exact retry identity.
+            if (error instanceof Error && /^(fork_ambiguous|fork_checkpoint_missing|invalid_arguments|resume_incompatible|lease_held):/.test(error.message) &&
+                !(0, node_fs_1.existsSync)((0, node_path_1.join)((0, node_path_1.dirname)((0, node_path_1.dirname)(frozen.metadata.contextPath)), childRunId))) {
+                db.prepare('DELETE FROM definition_fork_operations WHERE project_id=? AND source_run_id=? AND request_id=? AND adopted=0 AND result_json IS NULL').run(projectId, runId, request.requestId);
+            }
+            throw error;
+        }
+        if (fork.runId !== childRunId || fork.forkOf !== runId)
+            throw new Error('Core returned another fork identity');
+        const result = { loopRunId: childRunId, forkOf: runId, fromNodePath: fork.fromNodePath, scopeId: fork.scopeId, visit: fork.visit };
+        db.transaction(() => {
+            // Recheck all ownership after asynchronous Core work; a failed adoption
+            // rolls back entirely and retains the published child for the same retry.
+            const tickets = JSON.parse(frozen.row.ticket_ids_json ?? '[]');
+            for (const ticket of tickets) {
+                const owner = db.prepare('SELECT owner_id FROM ticket_outcome_ownership WHERE ticket_id=?').get(ticket);
+                if (owner?.owner_id !== runId)
+                    throw new Error('Ticket ownership changed before fork adoption');
+            }
+            (0, loop_runs_store_1.createLoopRun)(db, { id: childRunId, projectId, loopId: frozen.row.loop_id, loopName: frozen.row.loop_name, railIndex: frozen.row.rail_index,
+                ticketId: frozen.row.ticket_id, ticketIds: tickets, ticketCompletionStatus: frozen.row.ticket_completion_status, causalOwnership: !!frozen.row.causal_ownership,
+                provider: frozen.row.provider, model: frozen.row.model, reasoningEffort: frozen.row.reasoning_effort, iterationLimit: frozen.row.iteration_limit, startedAt: new Date().toISOString() });
+            (0, db_1.createJob)(db, { id: childRunId, command: sourceJob.command, owner: 'loop', provider: sourceJob.provider, causal_ownership: !!frozen.row.causal_ownership, started_at: new Date().toISOString() });
+            (0, loop_runs_store_1.saveDefinitionRun)(db, childRunId, { ...frozen.metadata, contextPath: fork.contextPath, runtimeDirectory: fork.runtimeDirectory,
+                definitionPath: fork.definitionPath, configPath: fork.configPath, context: fork.context,
+                inheritedAddendaClaims: [...(frozen.metadata.inheritedAddendaClaims ?? []), ...(frozen.request.addenda?.ids.length ? [{ runId, ids: frozen.request.addenda.ids }] : [])],
+                request: { ...frozen.request, runId: childRunId } });
+            (0, loop_runs_store_1.linkDefinitionFork)(db, childRunId, { forkOf: runId, forkCut: { fromNodePath: fork.fromNodePath, scopeId: fork.scopeId, visit: fork.visit, revision: fork.revision } });
+            db.prepare("UPDATE loop_runs SET status='paused',restart_reason='fork' WHERE id=?").run(childRunId);
+            if (frozen.request.executionManifest)
+                db.prepare('UPDATE loop_runs SET execution_manifest=? WHERE id=?').run(JSON.stringify(frozen.request.executionManifest), childRunId);
+            db.prepare("UPDATE ticket_outcome_ownership SET owner_id=?,generation=generation+1,claimed_at=datetime('now') WHERE owner_id=?").run(childRunId, runId);
+            db.prepare("UPDATE rail_ticket_ownership SET owner_id=?,generation=generation+1,claimed_at=datetime('now') WHERE owner_id=?").run(childRunId, runId);
+            for (const row of deliveries) {
+                const source = (0, isolated_settlement_store_1.readIsolatedSettlementRecords)(db, projectId, row.id).find(record => record.snapshot.run.runId === runId);
+                if (!source)
+                    throw new Error('Original isolated allocation is missing');
+                const snapshot = source.snapshot, ledger = (0, rail_worktrees_store_1.getRailWorktree)(db, snapshot.run.ledgerId);
+                if (!ledger || ledger.run_id !== runId || ledger.branch !== snapshot.run.handle.branch || ledger.worktree_path !== snapshot.run.handle.worktreePath)
+                    throw new Error('Worktree ownership changed before fork adoption');
+                (0, isolated_settlement_store_1.saveIsolatedSettlementSnapshot)(db, { ...snapshot, run: { ...snapshot.run, runId: childRunId } });
+                db.prepare('UPDATE definition_delivery_settlements SET superseded_by=? WHERE project_id=? AND delivery_id=? AND run_id=? AND superseded_by IS NULL').run(childRunId, projectId, row.id, runId);
+                db.prepare("UPDATE rail_worktrees SET run_id=?,merge_state='building' WHERE id=? AND run_id=?").run(childRunId, ledger.id, runId);
+            }
+            for (const row of all) {
+                const runIds = JSON.parse(row.run_ids).map(id => id === runId ? childRunId : id);
+                if (!runIds.includes(childRunId))
+                    runIds.push(childRunId);
+                const branches = JSON.parse(row.branches).filter(branch => branch.runId !== runId);
+                if (!(0, rail_pr_store_1.transitionClaimedDecision)(db, row.id, row.decision, 'building', token, { runIds, branches, implementationOutcome: 'unknown', deliveryOutcome: 'not_started', statusCode: 'restart_pending', statusDetail: 'Fork created; resume the linked run to continue.', settleEvidence: null }))
+                    throw new Error('Delivery changed before fork adoption');
+            }
+            db.prepare('UPDATE definition_fork_operations SET result_json=?,adopted=1 WHERE project_id=? AND source_run_id=? AND request_id=?').run(JSON.stringify(result), projectId, runId, request.requestId);
+        })();
+        return result;
+    }
+    finally {
+        for (const row of claimed)
+            (0, rail_pr_store_1.releasePrDeliveryOperation)(db, row.id, token);
+        execution.release();
+    }
+}

package/server/dist/modules/delivery/runtime/delivery-evidence.js

@@ -8,6 +8,7 @@ exports.extractVerifyStepText = extractVerifyStepText;
 exports.parseConfidenceScore = parseConfidenceScore;
 exports.harvestDeliveryEvidence = harvestDeliveryEvidence;
 exports.readRuntimeEvidence = readRuntimeEvidence;
+exports.projectDefinitionRuntimeEvidence = projectDefinitionRuntimeEvidence;
 exports.healRuntimeEvidence = healRuntimeEvidence;
 exports.readSettleEvidence = readSettleEvidence;
 /**
@@ -283,12 +284,13 @@ function harvestDeliveryEvidence(io, units) {
         const evidence = {
             ticketId: unit.ticketId,
             runId: unit.runId,
+            ...(unit.reviewerStepId ? { reviewerStepId: unit.reviewerStepId } : {}),
             sentinel: 'absent',
             sentinelDetail: null,
             verifyTail: null,
             confidence: null,
         };
-        let unitErrored = false;
+        let unitErrored = unit.definitionStatus?.status === 'unavailable';
         let verifyStartedAtMs = null;
         try {
             if (unit.runId) {
@@ -321,8 +323,12 @@ function harvestDeliveryEvidence(io, units) {
             unitErrored = true;
         }
         try {
-            if (unit.runtimeDir && unit.runId) {
-                const runtime = readRuntimeEvidence(unit.runtimeDir, unit.runId, fsIo);
+            if (unit.runId && (unit.definitionStatus || unit.runtimeDir)) {
+                const runtime = unit.definitionStatus
+                    ? projectDefinitionRuntimeEvidence(unit.definitionStatus, unit.reviewerStepId)
+                    : readRuntimeEvidence(unit.runtimeDir, unit.runId, fsIo);
+                if (unit.definitionStatus)
+                    evidence.runtime = runtime;
                 if (runtime) {
                     evidence.runtime = runtime;
                     // The runtime reviewer's structured verdict IS the reviewer score for
@@ -427,11 +433,18 @@ function readRuntimeEvidence(runtimeDir, runId, fsIo) {
         checks.push({ name, status: str(raw.status, 40) ?? 'unknown', required: raw.required === true, hostRun, evidence, scope: str(raw.scope), limitations: str(raw.limitations) });
     }
     const findings = strList(acceptance?.findings, 6);
-    let review = null;
     const checkpoint = readJson(fsIo, path_1.default.join(runtimeDir, 'agent-workflow', runId, 'checkpoint.json'));
     const steps = isRecord(checkpoint) && isRecord(checkpoint.state) && isRecord(checkpoint.state.steps) ? checkpoint.state.steps : null;
     const reviewer = steps && isRecord(steps.reviewer) ? steps.reviewer : null;
     const output = reviewer && isRecord(reviewer.output) ? reviewer.output : null;
+    const review = parseRuntimeReview(output);
+    if (commands.length === 0 && checks.length === 0 && findings.length === 0 && !review)
+        return null;
+    return { commands, checks, findings, review };
+}
+/** A reviewer verdict stays AI-reported; it cannot create host verification. */
+function parseRuntimeReview(value) {
+    const output = isRecord(value) ? value : null;
     if (output && ('score' in output || 'approved' in output)) {
         const aspects = {};
         if (isRecord(output.aspects)) {
@@ -442,7 +455,7 @@ function readRuntimeEvidence(runtimeDir, runId, fsIo) {
         const issues = Array.isArray(output.issues)
             ? output.issues.slice(0, 6).map((i) => (typeof i === 'string' ? i : isRecord(i) ? (str(i.message) ?? str(i.title) ?? str(i.description) ?? JSON.stringify(i).slice(0, RUNTIME_TEXT_CAP)) : null)).filter((x) => !!x)
             : [];
-        review = {
+        return {
             approved: typeof output.approved === 'boolean' ? output.approved : null,
             score: typeof output.score === 'number' && Number.isFinite(output.score) ? output.score : null,
             aspects,
@@ -450,9 +463,39 @@ function readRuntimeEvidence(runtimeDir, runId, fsIo) {
             summary: str(output.summary, 1200),
         };
     }
-    if (commands.length === 0 && checks.length === 0 && findings.length === 0 && !review)
+    return null;
+}
+/** Pure projection of exact committed scopes; never read Core's private database. */
+function projectDefinitionRuntimeEvidence(status, reviewerStepId) {
+    if (status.status === 'unavailable' || !status.scopes)
         return null;
-    return { commands, checks, findings, review };
+    const commands = [];
+    const scopedReviews = [];
+    for (const scope of status.scopes) {
+        if (!['succeeded', 'failed'].includes(scope.status) || !scope.attemptId || !isRecord(scope.output))
+            continue;
+        const output = scope.output;
+        if (scope.kind === 'verify' && typeof output.receiptId === 'string' && Array.isArray(output.commands)) {
+            for (const raw of output.commands) {
+                if (commands.length >= RUNTIME_LIST_CAP)
+                    break;
+                if (!isRecord(raw) || typeof raw.command !== 'string' || !Number.isInteger(raw.exitCode))
+                    continue;
+                const exitCode = raw.exitCode;
+                commands.push({ label: raw.command.slice(0, 200), outcome: exitCode === 0 ? 'passed' : 'failed', exitCode,
+                    durationMs: null, required: true, hostRun: true, outputTail: null });
+            }
+        }
+        const review = scope.status !== 'succeeded' ? null : scope.kind === 'implementation' ? parseRuntimeReview(output.review)
+            : reviewerStepId === scope.nodePath && scope.kind === 'role-turn' ? parseRuntimeReview(output.structured ?? output) : null;
+        if (review)
+            scopedReviews.push({ nodePath: scope.nodePath, scopeId: scope.scopeId, attemptId: scope.attemptId, review });
+    }
+    // Multiple branch verdicts have no defined aggregate confidence score.
+    // Keep that absence explicit instead of letting the last branch win.
+    const review = scopedReviews.length === 1 ? scopedReviews[0].review : null;
+    const findings = scopedReviews.length > 1 ? ['Multiple scoped reviewer verdicts; no aggregate confidence score is defined.'] : [];
+    return commands.length || review || findings.length ? { commands, checks: [], findings, review, scopedReviews } : null;
 }
 /**
  * Heal a persisted settle evidence whose units predate the runtime harvest:
@@ -460,7 +503,7 @@ function readRuntimeEvidence(runtimeDir, runId, fsIo) {
  * now. Returns the healed evidence when anything was added, else null (so the
  * caller neither rewrites the row nor re-broadcasts). Pure apart from `fsIo`.
  */
-function healRuntimeEvidence(evidence, pipelineDir, fsIo = {}) {
+function healRuntimeEvidence(evidence, pipelineDir, fsIo = {}, definitionStatuses = new Map()) {
     const io = {
         readFile: fsIo.readFile ?? ((p) => fs_1.default.readFileSync(p, 'utf8')),
         listDir: fsIo.listDir ?? ((p) => fs_1.default.readdirSync(p)),
@@ -469,11 +512,14 @@ function healRuntimeEvidence(evidence, pipelineDir, fsIo = {}) {
     };
     let changed = false;
     const units = evidence.units.map((unit) => {
-        if (unit.runtime !== undefined || !unit.runId)
+        if (!unit.runId || unit.runtime)
+            return unit;
+        const definition = definitionStatuses.get(unit.runId);
+        if (definition?.status === 'unavailable' || !definition && unit.runtime !== undefined)
             return unit;
         let runtime = null;
         try {
-            runtime = readRuntimeEvidence(path_1.default.join(pipelineDir, unit.runId), unit.runId, io);
+            runtime = definition ? projectDefinitionRuntimeEvidence(definition, unit.reviewerStepId) : readRuntimeEvidence(path_1.default.join(pipelineDir, unit.runId), unit.runId, io);
         }
         catch {
             runtime = null;