specrails-desktop 2.59.0 → 2.59.1

package/server/dist/modules/delivery/runtime/rails-router.js

@@ -42,6 +42,7 @@ const accept_ladder_1 = require("../../execution/runtime/accept-ladder");
 const rail_pr_decision_1 = require("./rail-pr-decision");
 const active_pr_continuation_1 = require("./active-pr-continuation");
 const rail_isolated_launch_1 = require("./rail-isolated-launch");
+const rail_relaunch_1 = require("./rail-relaunch");
 const worktree_manager_1 = require("../../../worktree-manager");
 const integration_branch_1 = require("../../../integration-branch");
 const rail_worktree_release_1 = require("./rail-worktree-release");
@@ -94,10 +95,17 @@ function prDeliveryRevisionAllowed(delivery, revisionOfDeliveryId, ticketIds) {
         return false;
     if ((0, rail_pr_store_1.isTerminalPrDecision)(delivery.decision))
         return false;
+    if (!hasDeliveredWork(delivery))
+        return false;
     const covered = new Set(delivery.ticketIds);
     const requested = new Set(ticketIds);
     return requested.size > 0 && requested.size === covered.size && [...requested].every((id) => covered.has(id));
 }
+function hasDeliveredWork(delivery) {
+    return Boolean((delivery.branch && delivery.deliverySha && ((delivery.prUrl && delivery.prState === 'pr-created') || (delivery.implementationOutcome !== 'failed' && delivery.deliveryOutcome !== 'blocked' && delivery.deliveryOutcome !== 'not_started' && delivery.deliveryOutcome !== 'no_changes')))
+        || delivery.branches?.some(unit => unit.succeeded && unit.finalSha && unit.changed !== false && unit.implementationOutcome !== 'failed' && unit.deliveryOutcome !== 'blocked' && unit.deliveryOutcome !== 'not_started' && unit.deliveryOutcome !== 'no_changes')
+        || delivery.repositoryDeliveries?.some(unit => unit.branch && unit.deliverySha && unit.implementationOutcome !== 'failed' && unit.deliveryOutcome !== 'blocked' && unit.deliveryOutcome !== 'not_started' && unit.deliveryOutcome !== 'no_changes'));
+}
 function prDeliveryCheckoutTarget(delivery) {
     if (delivery.branch && delivery.deliverySha)
         return { branch: delivery.branch, sha: delivery.deliverySha };
@@ -493,13 +501,47 @@ function createRailsRouter() {
             res.status(500).json({ error: 'Failed to update rail name' });
         }
     });
-    // POST /rails/:railIndex/launch — launch job(s) for a rail
-    router.post('/:railIndex/launch', async (req, res) => {
+    // Both doors share admission checks; Relaunch resolves its original source
+    // before interpreting launch options, never the mutable slot's new specs.
+    router.post(['/:railIndex/launch', '/:railIndex/relaunch'], async (req, res) => {
         const railIndex = parseInt(req.params.railIndex, 10);
         if (isNaN(railIndex) || railIndex < 0 || railIndex >= rails_store_1.MAX_RAILS) {
             res.status(400).json({ error: 'Invalid rail index' });
             return;
         }
+        const c = ctx(req);
+        let relaunchSource;
+        if (/\/relaunch\/?$/i.test(req.path)) {
+            try {
+                if (!(0, feature_flags_1.isLoopsEnabled)()) {
+                    res.status(409).json({ error: 'relaunch_workflow_unavailable', detail: 'The original loop workflow cannot run while Loops are disabled.',
+                        action: 'Enable Loops before retrying this attempt.' });
+                    return;
+                }
+                relaunchSource = (0, rail_relaunch_1.resolveRailRelaunch)(c, railIndex, req.body?.sourceId);
+                if (relaunchSource.delivery && !(0, rail_isolation_1.isRailPrDeliveryEnabled)()) {
+                    res.status(409).json({ error: 'relaunch_delivery_unavailable', detail: 'The original attempt belongs to isolated PR delivery, which is disabled.',
+                        action: 'Enable PR delivery before retrying this attempt.' });
+                    return;
+                }
+                if (relaunchSource.delivery && hasDeliveredWork(relaunchSource.delivery)) {
+                    res.status(409).json({ error: 'relaunch_requires_recovery',
+                        detail: 'This attempt has delivered work that must be recovered before it can be retried.',
+                        action: 'Use Recover & retry or the delivery actions on this card.' });
+                    return;
+                }
+                req.body = { ...relaunchSource.config,
+                    originConversationId: req.body?.originConversationId ?? relaunchSource.delivery?.originConversationId,
+                    originSurface: req.body?.originSurface ?? relaunchSource.delivery?.originSurface ?? 'dashboard',
+                };
+            }
+            catch (error) {
+                res.status(409).json({ error: error instanceof rail_relaunch_1.RailRelaunchError ? error.code : 'relaunch_config_unavailable',
+                    detail: error instanceof Error ? error.message : String(error),
+                    action: error instanceof rail_relaunch_1.RailRelaunchError ? error.action : 'Configure a fresh launch on a free rail.' });
+                return;
+            }
+        }
         let runtimeProviderOverride;
         try {
             runtimeProviderOverride = (0, agent_runtime_settings_1.validateRuntimeProviderOverride)(req.body?.runtimeProviderOverride);
@@ -597,6 +639,8 @@ function createRailsRouter() {
             loopId = (0, loop_factory_1.getFactoryLoop)(loopId).id; // canonicalize saved legacy aliases
             mode = fmode;
         }
+        if (relaunchSource)
+            relaunchSource.config = { ...relaunchSource.config, mode };
         if (!VALID_MODES.has(mode)) {
             res.status(400).json({ error: 'mode must be "implement", "freestyle" or "loop"' });
             return;
@@ -634,7 +678,6 @@ function createRailsRouter() {
         // spawn-time gate in QueueManager (kill-switch + persistent-stdin
         // capability) decides, so the launch no longer passes an explicit flag. A
         // legacy `interactive` body param is accepted and ignored (wire compat).
-        const c = ctx(req);
         try {
             (0, process_admission_1.assertProcessAdmission)(c.project.id);
         }
@@ -645,7 +688,15 @@ function createRailsRouter() {
             }
             throw err;
         }
-        const rail = (0, rails_store_1.getRail)(c.db, railIndex);
+        const storedRail = (0, rails_store_1.getRail)(c.db, railIndex);
+        const rail = relaunchSource ? { ...storedRail, ticketIds: [...relaunchSource.ticketIds],
+            profileName: typeof profileName === 'string' ? profileName : null,
+            aiEngine: typeof aiEngine === 'string' ? aiEngine : null } : storedRail;
+        if (relaunchSource && rail.ticketIds.some(id => !c.getTicketSpec?.(id))) {
+            res.status(409).json({ error: 'relaunch_specs_unavailable', detail: 'One or more original specs are no longer available.',
+                action: 'Refresh the mission and configure a launch with the current specs.' });
+            return;
+        }
         if (rail.ticketIds.length === 0) {
             res.status(400).json({ error: 'Rail has no tickets assigned' });
             return;
@@ -676,6 +727,10 @@ function createRailsRouter() {
             return;
         }
         let repositoryBases;
+        if (relaunchSource?.delivery?.executionManifest && baseDeliveryIds === undefined) {
+            repositoryBases = { repositoryBaseBranches: Object.fromEntries(relaunchSource.delivery.executionManifest.repositories.map(repo => [repo.repositoryId, repo.baseBranch])), repositoryBaseShas: {} };
+            baseBranch = repositoryBases.repositoryBaseBranches[primaryRepository.id] ?? baseBranch;
+        }
         if (baseDeliveryIds !== undefined) {
             try {
                 repositoryBases = await (0, multi_repo_bases_1.resolveRepositoryDeliveryBases)(c.db, c.project, repositoryIds, baseDeliveryIds, worktree_manager_1.defaultGitRunner);
@@ -983,6 +1038,18 @@ function createRailsRouter() {
                     return;
                 }
                 const scope = loopGraph.config.ticketScope ?? (loopGraph.config.journal === 'implementation' ? 'all' : (0, loop_command_catalog_1.dominantTicketScope)(promptsText));
+                // Freeze only admitted launch choices. Execution paths, run ids,
+                // addendum claims and revision generation ids must never be replayed.
+                const launchConfig = {
+                    mode, loopId, repositoryIds, workspaceSelection,
+                    aiEngine: rolesMode ? loop_role_engines_1.ROLES_ENGINE : loopProvider, model: loopModel,
+                    reasoning_effort: effort, profileName: resolvedProfile,
+                    ...(runtimeProviderOverride ? { runtimeProviderOverride } : {}),
+                    ...(baseBranch ? { baseBranch } : {}),
+                    ...(baseDeliveryIds ? { baseDeliveryIds } : {}),
+                    ...(typeof targetPrNumber === 'number' ? { targetPrNumber } : {}),
+                    ...(followUp ? { followUp } : {}),
+                };
                 // Parallel isolation (default-on; disable with SPECRAILS_RAIL_WORKTREES=0):
                 // a per-ticket rail on a repo-mutating loop runs each ticket in its own git
                 // worktree, then merges the branches back. A non-git repo or an unborn
@@ -991,6 +1058,7 @@ function createRailsRouter() {
                 let isolationUnavailable;
                 let continuablePrDelivery = null;
                 let revisionRequest = null;
+                let retryOfDelivery = null;
                 // Read-only vs mutating is DERIVED from the loop's nodes (see loop-effect),
                 // not a user flag — a content-read-only loop (no ai-step/shell) never writes,
                 // so it is not isolated; anything that can write is.
@@ -1006,7 +1074,7 @@ function createRailsRouter() {
                     // `pr_decision_pending` — the user already saw the failure on the card,
                     // and pressing Launch again IS the decision. A revision naming it is
                     // meaningless (there is no work to revise) and gets a precise 409.
-                    if (pending && (0, rail_pr_store_1.isPreparationFailureRow)(pending)) {
+                    if (pending && !relaunchSource && (0, rail_pr_store_1.isPreparationFailureRow)(pending)) {
                         if (revisionOfDeliveryId === pending.id) {
                             res.status(409).json({
                                 error: 'invalid_revision_target',
@@ -1029,6 +1097,15 @@ function createRailsRouter() {
                     // Explicit change requests name it; open addenda on the same rail
                     // identify it implicitly. Both use the existing supersession contract.
                     const revisionsEnabled = (0, feature_flags_1.areDeliveryRevisionsEnabled)();
+                    const failedAddendumRetry = Boolean(launchAddenda.length && pendingSnapshot && !revisionOfDeliveryId
+                        && ['implementation_failed', 'pr_failed'].includes(pendingSnapshot.decision)
+                        && !pendingSnapshot.prUrl && !hasDeliveredWork(pendingSnapshot)
+                        && new Set(pendingSnapshot.ticketIds).size === new Set(rail.ticketIds).size
+                        && rail.ticketIds.every(id => pendingSnapshot.ticketIds.includes(id)));
+                    const identifiedFailureRetry = Boolean(relaunchSource?.delivery && pendingSnapshot
+                        && relaunchSource.sourceId === pendingSnapshot.id
+                        && ['implementation_failed', 'pr_failed'].includes(pendingSnapshot.decision)
+                        && !hasDeliveredWork(pendingSnapshot));
                     const addendumContinuation = Boolean(launchAddenda.length && pendingSnapshot && pendingSnapshot.decision !== 'building'
                         && !revisionOfDeliveryId
                         && prDeliveryRevisionAllowed(pendingSnapshot, pendingSnapshot.id, rail.ticketIds));
@@ -1042,7 +1119,7 @@ function createRailsRouter() {
                         });
                         return;
                     }
-                    if (pendingSnapshot && !revisionOfPending && !prDeliveryContinuesTickets(pendingSnapshot, rail.ticketIds)) {
+                    if (pendingSnapshot && !revisionOfPending && !failedAddendumRetry && !identifiedFailureRetry && !prDeliveryContinuesTickets(pendingSnapshot, rail.ticketIds)) {
                         res.status(409).json({ error: 'pr_decision_pending', prDeliveryId: pendingSnapshot.id });
                         return;
                     }
@@ -1055,11 +1132,13 @@ function createRailsRouter() {
                                 : revisionNote,
                         };
                     }
+                    if ((failedAddendumRetry || identifiedFailureRetry) && pendingSnapshot)
+                        retryOfDelivery = { deliveryId: pendingSnapshot.id, decision: pendingSnapshot.decision };
                     // Explicit target vs an undecided continuable delivery: the slot's
                     // active generation owns its PR. A DIFFERENT explicit target would
                     // append to the undecided branches → 409; the SAME PR is redundant
                     // (the continuation contract below already drives it) and is dropped.
-                    if (pendingSnapshot && typeof targetPrNumber === 'number' && pendingSnapshot.prNumber !== targetPrNumber
+                    if (pendingSnapshot && !retryOfDelivery && typeof targetPrNumber === 'number' && pendingSnapshot.prNumber !== targetPrNumber
                         && !pendingSnapshot.repositoryDeliveries?.some((delivery) => delivery.prNumber === targetPrNumber)) {
                         res.status(409).json({ error: 'pr_decision_pending', prDeliveryId: pendingSnapshot.id });
                         return;
@@ -1080,6 +1159,11 @@ function createRailsRouter() {
                     res.status(409).json({ error: 'repository_isolation_required', detail: 'Selected repositories require worktree isolation for this loop.' });
                     return;
                 }
+                if (relaunchSource?.delivery && !useIsolation) {
+                    res.status(409).json({ error: 'relaunch_isolation_required', detail: 'The original attempt was isolated; its retry must also use an isolated worktree.',
+                        action: 'Restore worktree isolation and the original workflow before retrying.' });
+                    return;
+                }
                 if (typeof targetPrNumber === 'number' && !useIsolation) {
                     res.status(400).json({ error: 'target_pr_requires_pr_mode', detail: 'targetPrNumber requires an isolated (worktree) launch; this launch would run in the shared checkout' });
                     return;
@@ -1133,7 +1217,10 @@ function createRailsRouter() {
                             }
                         }
                         try {
+                            if (relaunchSource && (0, rail_relaunch_1.restoreRelaunchRail)(c, railIndex, relaunchSource))
+                                broadcastRailUpdated(c, railIndex, 'tickets');
                             const ids = await (0, rail_isolated_launch_1.launchIsolatedRail)({
+                                launchConfig,
                                 runtimeProviderOverride,
                                 ctx: c, railIndex, ticketIds: [...rail.ticketIds], repositoryIds, workspaceSelection, ...repositoryBases, loopId, loopName, loopGraph,
                                 provider: loopProvider, model: loopModel, effort, scope,
@@ -1142,7 +1229,7 @@ function createRailsRouter() {
                                 originSurface: originSurface ?? 'dashboard',
                                 originConversationId: originConversationId ?? null,
                                 ...(baseBranch ? { baseBranch } : {}),
-                                ...(continuablePrDelivery?.executionManifest && !revisionRequest ? { repositoryContinuation: { deliveryId: continuablePrDelivery.id, decision: continuablePrDelivery.decision } } : {}),
+                                ...(continuablePrDelivery?.executionManifest && !revisionRequest && !retryOfDelivery ? { repositoryContinuation: { deliveryId: continuablePrDelivery.id, decision: continuablePrDelivery.decision } } : {}),
                                 ...(continuablePrDelivery && !continuablePrDelivery.executionManifest && prDeliveryContinuesTickets(continuablePrDelivery, rail.ticketIds) ? {
                                     requiredPrContinuation: {
                                         deliveryId: continuablePrDelivery.id,
@@ -1157,18 +1244,23 @@ function createRailsRouter() {
                                 // Explicit target only drives fresh launches; when the slot has
                                 // a continuable delivery for the same PR, the continuation
                                 // contract above is the (stricter) authority.
-                                ...(typeof targetPrNumber === 'number' && !continuablePrDelivery
+                                ...(typeof targetPrNumber === 'number' && (!continuablePrDelivery || retryOfDelivery)
                                     ? { explicitPrTarget: { prNumber: targetPrNumber } }
                                     : {}),
                                 // Revision of an undecided delivery: the guard above proved the
                                 // exemption, so pass the contract through for supersession.
                                 ...(revisionRequest ? { revision: revisionRequest } : {}),
+                                ...(retryOfDelivery ? { retryOfDelivery } : {}),
                                 ...(followUp ? { followUp } : {}),
                             });
                             res.status(202).json({ loopRunIds: ids, railIndex, mode, loopId, prDeliveryId: (0, rail_pr_store_1.getActivePrDeliveryByRail)(c.db, railIndex)?.id ?? null, isolated: true, ...(followUp ? { followUp: { id: followUp.id, version: followUp.version, hash: followUp.hash } } : {}) });
                             return;
                         }
                         catch (err) {
+                            if (err instanceof rail_relaunch_1.RailRelaunchError) {
+                                res.status(409).json({ error: err.code, detail: err.message, action: err.action });
+                                return;
+                            }
                             if (err instanceof rail_pr_store_1.PrDeliveryGenerationConflict) {
                                 res.status(409).json({
                                     error: 'pr_delivery_generation_conflict',
@@ -1186,7 +1278,7 @@ function createRailsRouter() {
                                 });
                                 return;
                             }
-                            if (continuablePrDelivery || err instanceof rail_isolated_launch_1.PrContinuationIsolationError) {
+                            if ((continuablePrDelivery && !retryOfDelivery) || err instanceof rail_isolated_launch_1.PrContinuationIsolationError) {
                                 const detail = err instanceof Error ? err.message : String(err);
                                 res.status(409).json({
                                     error: 'pr_continuation_isolation_required',
@@ -1208,6 +1300,8 @@ function createRailsRouter() {
                 // Spawn from the SAME cwd a rail uses (workspace when relocated, else the
                 // repo) so native `{{cmd:*}}` slash commands resolve — and surface the repo
                 // via SPECRAILS_REPO_DIR + `--add-dir` exactly like QueueManager.
+                if (relaunchSource && (0, rail_relaunch_1.restoreRelaunchRail)(c, railIndex, relaunchSource))
+                    broadcastRailUpdated(c, railIndex, 'tickets');
                 const loopExec = (0, workspace_resolution_1.resolveProjectExecution)({ slug: c.project.slug, path: c.project.path });
                 const loopRunIds = [];
                 const loopTicketCompletionStatus = (0, rail_isolation_1.isRailPrDeliveryEnabled)() ? 'on_review' : 'done';
@@ -1270,6 +1364,7 @@ function createRailsRouter() {
                     };
                     const runPromise = c.loopRunManager
                         .run({
+                        launchConfig,
                         runtimeProviderOverride,
                         runId,
                         loopId,
@@ -1414,6 +1509,10 @@ function createRailsRouter() {
             res.status(202).json({ jobId, railIndex, mode });
         }
         catch (err) {
+            if (err instanceof rail_relaunch_1.RailRelaunchError) {
+                res.status(409).json({ error: err.code, detail: err.message, action: err.action });
+                return;
+            }
             if (err instanceof queue_manager_1.ClaudeNotFoundError) {
                 res.status(503).json({ error: 'Claude CLI not found' });
                 return;

package/server/dist/modules/execution/runtime/revision-seed.js

@@ -46,8 +46,12 @@ function buildRevisionSeed(input) {
     return [
         '## Revision briefing',
         '',
-        `This is revision ${input.revisionNumber} of work that has ALREADY been delivered for the spec(s) below.`,
-        'The code exists on the branch listed here. Do NOT start over, re-plan, or re-implement it.',
+        input.branches.length > 0
+            ? `This is revision ${input.revisionNumber} of recorded branch work for the spec(s) below.`
+            : `This is attempt ${input.revisionNumber} for the spec(s) below; no delivered branch was recorded.`,
+        input.branches.length > 0
+            ? 'Inspect the recorded branch first. Preserve its existing implementation and apply the requested changes.'
+            : 'Implement the full spec together with the requested changes; do not assume prior implementation exists.',
         '',
         '## What the user asked to change',
         '',

package/server/dist/modules/loops/runtime/loop-agent-defaults.json

@@ -2,5 +2,5 @@
     "architect": "## Your task: architecture\n\nYou are the Specrails architect. Turn the requested work into an unambiguous, implementable plan that a developer agent will execute without talking to you.\n\n1. Orient quickly: locate the code the change touches, the tests that cover it and the conventions that apply. Calibrate depth to the blast radius. A localized change gets a short proposal, focused design and only the tasks it needs; a cross-cutting change earns a full impact analysis.\nIn design.md include a Local reference patterns section: cite actual repository paths and symbols for the closest existing implementation and its tests. Explain async rendering/state updates, error propagation and test setup when relevant. Check installed framework versions. If no equivalent exists, state that explicitly; never invent references.\n2. Decide the approach, name the exact files/modules to create or change (inside the repository scope when one is declared), and call out risks, edge cases and compatibility concerns. Plan only the change the requested work needs; unrelated clean-ups are out of scope.\n3. Break the work into ordered, atomic tasks. Each task names concrete files and includes its own tests. Every task must be completable by an agent that can only edit files and run commands: never add tasks such as \"run the test suite\", \"verify\", \"test manually in a browser\", \"commit\" or \"open a PR\". Core runs verification and the host owns delivery.\n4. Execute the official OpenSpec fast-forward skill. Query status and instructions in dependency order; author the real delta specs and other artifacts using those templates and project rules. Preserve existing requirements through OpenSpec delta semantics. Do not fabricate complete replacement specs.\n5. Propose verification. For each repository listed below without a configured verification command, name the existing command that proves the change: the project's test script, type check, build or lint (for example `npm` with args `[\"test\"]`, or `cargo` with `[\"test\"]`). Only propose commands that exist in the repository today or that a task in this plan adds; omit repositories where nothing automated applies. For a repository with a scope, the command must exercise that scope: omit cwd (it then runs in the scope directory) or name a directory inside it; never a command that runs every workspace of a larger checkout. Core runs them after the developer finishes and feeds failures back.\n6. Score your confidence honestly: `high` when the code evidence is conclusive; `medium` when the design rests on one non-obvious assumption (name it in the design); `low` when several plausible designs exist and you cannot choose without missing information. With `low`, put the single question whose answer decides the design in `question`. Core first lets you investigate further, then either asks the requester that exact question or proceeds on your stated assumptions, depending on the project configuration.",
     "developer": "## Your task: implementation\n\nYou are the Specrails developer. Execute the official openspec-apply-change skill for the approved change, implement its pending tasks completely and update their progress through that workflow. Do not substitute a hand-written approximation of apply.\n\n1. Load and execute openspec-apply-change through the supplied binding. Consult its status and instructions apply, read the context files OpenSpec returns, then the relevant existing code and tests.\n2. Work task by task in order. Use test-driven development: write or extend the test first, make it pass with the smallest correct change, then tidy up. Run only focused tests that cover what you touched while iterating. Core owns the complete verification plan and runs it after your turn; do not duplicate that full run. Fix the precise failures Core returns on a correction pass.\n3. Immediately after completing each task, mark it `- [x]` in `tasks.md`; do not postpone all progress updates until the end of the phase. Only mark tasks whose code and tests are complete. Change nothing else in `tasks.md`, and never edit `proposal.md`, `design.md` or the specs: those documents are frozen, and editing them invalidates the run. If a task cannot be completed, leave it `- [ ]` and list it under `incomplete` with the reason.\n4. Keep the implementation consistent with the repository: naming, error handling, import style, formatting and existing utilities. Do not add dependencies unless the design requires them. Change only what the tasks require: the diff should contain the requested change and its tests, nothing else.\nInvestigation budget: consult the local reference patterns in design.md and equivalent application tests before framework internals or node_modules. After three unsuccessful experiments on the same failure, stop repeating commands: state the hypothesis, evidence and next discriminating experiment, then change approach. If three further experiments add no evidence, report the specific blocker under incomplete rather than consuming the remaining turn budget. Never weaken assertions or change acceptance criteria to make a test pass.\nVerification evidence: run tests without piping their output through grep/head or other filters that mask the original exit status. Capture complete stdout/stderr in a temporary log and preserve the test process exit code; inspect that log separately. Report the command and original exit code. Remove temporary debug tests before finishing. Core independently runs the final verification commands.\n5. If the shell is unavailable, still finish every task that only needs code and tests; Core runs the verification commands after your turn and returns the exact failures to you.\n\n## Durable implementation progress\n\nWhen loading the official apply skill, read its savedProgress handoff before repeating investigation. Reconcile it with the current diff and tasks; it is advisory history, never accepted verification evidence. Preserve completed work and previously discovered test commands or environment blockers. Recheck a blocker only when its relevant condition changed.\nAfter each completed task, and whenever the next action or a blocker changes, call the scoped workflow action write_progress with progress: {summary, completedTasks, nextTasks, checks: [{command, outcome}], blockers}. Replace the previous handoff with a concise current account (at most 8 KB); include exact focused test commands, original exit outcomes, relevant paths and the next discriminating action. Keep nextTasks concrete enough for a fresh session to continue unfinished work. Do not include full logs, credentials or claims that old checks authorize acceptance. The host persists this record outside the frozen OpenSpec artifacts. Use read_progress to refresh it. If interrupted, the next session receives it from load_skill; do not write runtime files directly.",
     "reviewer": "## Your task: review\n\nYou are the Specrails reviewer and the last gate before this change is archived. Inspect the implementation, the approved artifacts and the verification evidence read-only. Do not fix anything.\n\nCheck, in this order:\n1. Spec completeness: every requirement in the change specs and every acceptance criterion is implemented. Cross-reference each one against the code.\n2. Task completion: every task in `tasks.md` is `- [x]` and is backed by real code and tests, not just a ticked box.\n3. Test quality: new behavior has tests that assert on behavior, cover error paths, and would fail without the change. Missing tests for production code are a blocking issue.\n4. Correctness and conventions: types and signatures fit the codebase, patterns match the repository, imports and error handling are consistent, no unrelated changes.\n5. Security: no secrets, injection, path traversal, unsafe deserialization, missing authorization or new attack surface. Scale scrutiny to what the change touches.\n6. Performance: no obvious N+1, unbounded loops or blocking work on hot paths introduced by the change.\n\nJudge BEHAVIOUR against the acceptance criteria, never the shape of the code against the wording of the plan: module layout, file lists, class or function names, naming conventions and implementation techniques named in the ticket, the design or a \"contract layer\" are suggestions the developer may legitimately improve on. A working implementation that satisfies a criterion by other means is correct; asking to rename, move or rewrite it to match the plan's wording is NOT an issue. Only a criterion that is not met, a defect, a missing test or a regression is.\n\nReview THE CHANGE. The change set below lists every file this run changed relative to its base, measured by Core from git. Judge those changes and the behavior they affect; code the change did not touch is not an issue unless the change breaks it. Never ask for edits to pre-existing code, other packages or workspaces, or configuration outside the change. An environment problem (credentials, registry access, missing tools) is not a code issue: record it under findings, never as an issue for the fixer.\n\nThe verification evidence below comes from real subprocesses run by Core after the developer finished; treat it as fact, not as a claim by the developer.",
-    "fixer": "## Your task: correction\n\nYou are the Specrails FIXER. The verification commands (or the review) failed after the developer's pass; your only job is to make them pass with minimal, precise edits to this change.\n\n1. Read the failing output below first: the exact command, its exit code and the reported files and lines. Start from those files, not from the plan.\n2. Decide whether this change caused the failure. It did when the failure points at files in the change set below or at behavior they affect. A failure in code the change never touched (another package or workspace, a pre-existing test), in the environment (missing credentials, environment variables, registry access or tools) or in configuration outside the change is NOT yours to fix: edit nothing for it, and report it under `incomplete` with the exact error. Core then stops and asks the host instead of starting another round.\n3. Patch exactly the files and lines the failure names; touch neighbouring code only when the failure cannot be fixed otherwise. Rewrite a file only when a patch cannot express the change.\n4. Never re-implement a feature, rename or restructure, reformat, add dependencies, or widen the change beyond the failure. Never weaken an assertion, delete a test or change acceptance criteria to make a check pass — if a test is wrong, fix the test to the specification and say so.\n5. A test file the host reports as never executed must be wired into the repository's test command (the test script or runner configuration) and then made to pass.\n6. Confirm with the narrowest command that reproduces the failure (the failing test file or test name). Do not re-run whole suites or other workspaces: Core re-runs the complete verification plan after your turn.\n7. Do not read the repository beyond the files the failure names and their direct dependencies. `proposal.md`, `design.md` and the specs are frozen; in `tasks.md` only tick a task you completed.\n8. Finish with the same JSON summary object as the developer, listing under `incomplete` only failures you could not fix and why.\n\n## Durable implementation progress\n\nWhen loading the official apply skill, read its savedProgress handoff before repeating investigation. Reconcile it with the current diff and tasks; it is advisory history, never accepted verification evidence. Preserve completed work and previously discovered test commands or environment blockers. Recheck a blocker only when its relevant condition changed.\nAfter each completed task, and whenever the next action or a blocker changes, call the scoped workflow action write_progress with progress: {summary, completedTasks, nextTasks, checks: [{command, outcome}], blockers}. Replace the previous handoff with a concise current account (at most 8 KB); include exact focused test commands, original exit outcomes, relevant paths and the next discriminating action. Keep nextTasks concrete enough for a fresh session to continue unfinished work. Do not include full logs, credentials or claims that old checks authorize acceptance. The host persists this record outside the frozen OpenSpec artifacts. Use read_progress to refresh it. If interrupted, the next session receives it from load_skill; do not write runtime files directly."
+    "fixer": "## Your task: correction\n\nYou are the Specrails FIXER. The verification commands (or the review) failed after the developer's pass; your only job is to make them pass with minimal, precise edits to this change.\n\n1. Read the host failure facts first: command, cwd, original exit code, failureSummary, expected assertion and application file/line. If the excerpt is truncated, use read_verification_evidence with the command's evidenceId for complete stdout/stderr and source. Read the failing test and the implementation it exercises.\n2. Reproduce the failure with the narrowest test command. Compare the assertion, intended behavior, current implementation and actual diff. An unchanged file or a pre-existing test does not prove the failure is unrelated: changes can break existing tests indirectly. Classify the cause as an implementation defect, a test compatibility assumption, or an external/scope blocker. A claim that the failure existed before this change needs baseline or historical evidence; otherwise state that it is unconfirmed.\n3. Patch exactly the files and lines the failure names; touch neighbouring code only when the failure cannot be fixed otherwise. Rewrite a file only when a patch cannot express the change.\n4. Fix incorrect implementation behavior. A failing mandatory host test inside the admitted repository/workspace may also receive a minimal compatibility repair when you prove that its expected behavior is unchanged. For example, a source assertion broken only by formatting may tolerate whitespace while retaining every required operand and guard. This applies even to a pre-existing test outside the current changed-file list. Explain the original expectation and why the repair still rejects the prohibited behavior. Never weaken an assertion, delete or skip a test, hardcode success, change acceptance criteria, add dependencies or widen the repair beyond the diagnosed failure.\n5. A test file the host reports as never executed must be wired into the repository's test command (the test script or runner configuration) and then made to pass.\n6. Confirm the repair with the focused test command and a negative case for any repaired assertion: removing a required safety guard or returning the wrong value must still fail. Preserve the original test exit status; never pipe test execution through grep/head or another command that masks it. Capture stdout/stderr in a temporary log and inspect that log separately. Core runs the complete verification plan after your turn.\n7. Inspect only the reported files, direct dependencies and the evidence needed to establish the cause. Never edit outside the admitted repository/workspace, credentials, environment or unrelated configuration. For an external or unrepairable scope blocker, make no speculative edits and report the exact error, observed evidence and required action. `proposal.md`, `design.md` and the specs remain frozen; only tick completed tasks.\n8. Return the requested JSON contract. Include the diagnosis, exact focused commands and original exit codes, repair and preserved assertion in summary. List every unresolved failure and its reason under incomplete, even when the implementation tasks are already ticked. A failed test remains failed until real host verification passes.\n\n## Durable implementation progress\n\nWhen loading the official apply skill, read its savedProgress handoff before repeating investigation. Reconcile it with the current diff and tasks; it is advisory history, never accepted verification evidence. Preserve completed work and previously discovered test commands or environment blockers. Recheck a blocker only when its relevant condition changed.\nAfter each completed task, and whenever the next action or a blocker changes, call the scoped workflow action write_progress with progress: {summary, completedTasks, nextTasks, checks: [{command, outcome}], blockers}. Replace the previous handoff with a concise current account (at most 8 KB); include exact focused test commands, original exit outcomes, relevant paths and the next discriminating action. Keep nextTasks concrete enough for a fresh session to continue unfinished work. Do not include full logs, credentials or claims that old checks authorize acceptance. The host persists this record outside the frozen OpenSpec artifacts. Use read_progress to refresh it. If interrupted, the next session receives it from load_skill; do not write runtime files directly."
 }

package/server/dist/modules/loops/runtime/loop-definition-events.js

@@ -129,7 +129,7 @@ function createDefinitionEventProjection(input) {
                     persist('loop_step', { index: nextCount, kind: 'core', title: workflow.nodePath, iteration: workflow.visit, startedAtMs: Date.parse(at), ...correlation });
                 }
                 else if (opening && ['step_succeeded', 'step_failed', 'step_blocked', 'step_interrupted', 'step_retrying', 'step_paused'].includes(String(workflow.type))) {
-                    persist('loop_step_end', { index: opening.index, status: workflow.type === 'step_succeeded' ? 'ok' : workflow.type === 'step_paused' ? 'paused' : workflow.type === 'step_interrupted' ? 'interrupted' : 'failed',
+                    persist('loop_step_end', { index: opening.index, status: workflow.type === 'step_succeeded' ? workflow.outcome === 'fail' ? 'failed' : 'ok' : workflow.type === 'step_paused' ? 'paused' : workflow.type === 'step_interrupted' ? 'interrupted' : 'failed',
                         runtimeStatus: String(workflow.type).slice(5), outcome: workflow.outcome, exitCode: null,
                         durationMs: Math.max(0, Date.parse(at) - Number(opening.startedAtMs)), ...correlation });
                 }

package/server/dist/modules/loops/runtime/loop-implement-recipe.js

@@ -35,15 +35,19 @@ function configurableImplementGraph() {
     const implementation = objectSchema({ summary: string, incomplete: strings });
     turn('developer', 'Developer', 'build', `Implement every approved task for change ${change} using the bound official apply skill. Preserve proposal, design and specs; only tick tasks you completed. Report summary and incomplete task descriptions. Prior execution evidence and human answers: {{history.text}}`, implementation, 'tasks');
     node('tasks', 'Check artifacts and completed tasks', 'artifact-contract', { change, contractId: 'plan', action: 'check', requireCompletedTasks: true }, { pass: 'verify', fail: 'developer', failed: 'failed' });
-    node('verify', 'Verify candidate', 'verify', { commands: 'configured', additionalCommandsFrom: 'architect' }, { pass: 'reviewer', fail: 'fixer', failed: 'failed' });
+    node('verify', 'Verify candidate', 'verify', { commands: 'configured', additionalCommandsFrom: 'architect' }, { pass: 'reviewer', fail: 'correction-context', failed: 'failed' });
     turn('reviewer', 'Reviewer', 'assess', `Review change ${change} read-only against all approved artifacts and frozen ticket acceptance criteria. Inspect real code and the host verification evidence: {{outputs.verify}}. Return approved, summary, issues, score (0-100), and aspects. Prior execution: {{history.text}}`, objectSchema({ approved: { type: 'boolean' }, summary: string, issues: strings, score, aspects: objectSchema(Object.fromEntries(Object.keys(aspects).map(aspect => [aspect, score]))) }), 'review-policy');
-    node('review-policy', 'Review acceptance policy', 'condition', { expr: ['$outputs.reviewer.structured.approved == true', '$outputs.reviewer.structured.issues.length == 0', '$outputs.reviewer.structured.score >= 70', ...Object.entries(aspects).map(([aspect, threshold]) => `$outputs.reviewer.structured.aspects.${aspect} >= ${threshold}`)].join(' && ') }, { true: 'approve', false: 'fixer' });
-    turn('fixer', 'Fixer', 'correct', `Correct only failures in change ${change}, using the bound apply skill and preserving approved artifacts. Report summary and incomplete tasks. Host verification: {{outputs.verify}}.  Prior execution: {{history.text}}`, implementation, 'tasks');
+    node('review-policy', 'Review acceptance policy', 'condition', { expr: ['$outputs.reviewer.structured.approved == true', '$outputs.reviewer.structured.issues.length == 0', '$outputs.reviewer.structured.score >= 70', ...Object.entries(aspects).map(([aspect, threshold]) => `$outputs.reviewer.structured.aspects.${aspect} >= ${threshold}`)].join(' && ') }, { true: 'approve', false: 'correction-context' });
+    node('correction-context', 'Select current review findings', 'condition', { expr: '$outputs.verify.valid == true && exists($outputs.reviewer.candidateHash) && $outputs.reviewer.candidateHash == $outputs.verify.candidateHash' }, { true: 'capture-review', false: 'clear-review' });
+    node('capture-review', 'Capture current review findings', 'assign', { set: { latestReview: '{{outputs.reviewer}}' } }, { next: 'fixer', failed: 'failed' });
+    node('clear-review', 'Clear outdated review findings', 'assign', { set: { latestReview: 'No reviewer findings for the current verified candidate. Diagnose the current host verification failure first.' } }, { next: 'fixer', failed: 'failed' });
+    turn('fixer', 'Fixer', 'correct', `Correct the reported implementation, test or review failure for change ${change} using the bound apply skill and preserving approved artifacts. Read failureSummary, command, cwd, exitCode and evidenceId first; use read_verification_evidence for truncated evidence. Reproduce the exact focused failure, inspect the assertion and tested code, then apply the smallest repair that preserves the required behavior. An unchanged filename does not prove an unrelated failure. A mandatory test inside the admitted workspace may receive a proven formatting/compatibility repair while retaining every required guard. Report diagnosis, focused commands with original exit codes, repair and unresolved failures in summary and incomplete. If the cause cannot be repaired within scope, explain the evidence and required action; an unchanged candidate with failed verification stops this run. Host verification: {{outputs.verify}}. Latest review findings for this candidate: {{run.latestReview}}. Prior execution: {{history.text}}`, implementation, 'correction-progress');
+    node('correction-progress', 'Check correction progress', 'condition', { expr: '$outputs.verify.valid == true || (exists($outputs.fixer.candidateHash) && $outputs.fixer.candidateHash != null && $outputs.fixer.candidateHash != $outputs.verify.candidateHash)' }, { true: 'tasks', false: 'correction-stalled' });
     node('approve', 'Approve archive', 'approval', { reason: `Approve archiving the reviewed and verified candidate for change ${change}.`, bindCandidate: true, enabled: agents.approvalBeforeArchive === true }, { next: 'approval-policy' });
     node('approval-policy', 'Approval decision', 'condition', { expr: '$outputs.approve.response.approved == true' }, { true: 'archive', false: 'failed' });
     node('archive', 'Archive OpenSpec', 'openspec-archive', { change, allowArchived: true, requiresVerified: true, reviewedCandidate: '{{outputs.reviewer.candidateHash}}', approvedCandidate: '{{outputs.approve.candidateHash}}' }, { next: 'verify-archive', failed: 'verify' });
     node('verify-archive', 'Verify archived candidate', 'verify', { commands: 'configured', additionalCommandsFrom: 'architect' }, { pass: 'done', fail: 'failed', failed: 'failed' });
-    nodes.push({ id: 'done', type: 'end', position: { x: 0, y: nodes.length * 140 }, data: { outcome: 'success', requiresVerified: true } }, { id: 'failed', type: 'end', position: { x: 360, y: nodes.length * 140 }, data: { outcome: 'failure' } });
+    nodes.push({ id: 'done', type: 'end', position: { x: 0, y: nodes.length * 140 }, data: { outcome: 'success', requiresVerified: true } }, { id: 'failed', type: 'end', position: { x: 360, y: nodes.length * 140 }, data: { outcome: 'failure' } }, { id: 'correction-stalled', type: 'end', position: { x: 720, y: nodes.length * 140 }, data: { outcome: 'failure', reason: 'Verification remains failed and the correction made no candidate changes. {{outputs.fixer.structured.summary}}' } });
     edges.unshift({ id: 'e-start', source: 'start', target: 'architect' });
     return { nodes, edges, config: { maxIterations: 12, maxTransitions: 200, timeoutMinutes: 0, aiStepTimeoutMinutes: 0, change: 'new', journal: 'ledger-only', ticketScope: 'all', agents, reviewerStepId: 'reviewer' } };
 }

package/server/dist/modules/loops/runtime/loop-run-manager.js

@@ -145,29 +145,37 @@ const CHANGE_ID_RE = /openspec[\\/]+changes[\\/]+(?!archive(?:[\\/]|$))([A-Za-z0
 function resolveRunVars(text, vars) {
     return text.replace(RUN_TOKEN_RE, (_m, key) => vars[key] ?? '');
 }
-const CHANGE_NAME_RE = /^[a-z0-9][a-z0-9._-]{0,99}$/i;
+const CHANGE_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 /** The authoritative OpenSpec target for a launch.
- *  Addenda/delivery deltas get a run-specific name; ordinary launches use the
+ *  Addenda/delivery deltas use durable content/lineage identity; ordinary launches use the
  *  follow-up's declared name, else the spec's `openspecChangeName`. */
 function seedChangeId(req) {
-    if (req.addenda?.ids.length) {
-        // A new generation never picks an old/archived proposal, even when the
-        // ticket metadata still names it. Resuming the same run keeps its target.
-        const hash = (0, crypto_1.createHash)('sha256').update(JSON.stringify([req.runId, req.addenda.ids, req.addenda.briefing])).digest('hex').slice(0, 20);
-        return { id: `spec-addenda-${hash}`, source: 'addenda' };
-    }
-    if (req.constants?.REVISION_REQUEST) {
-        const hash = (0, crypto_1.createHash)('sha256').update(JSON.stringify([req.runId, req.constants.REVISION_REQUEST])).digest('hex').slice(0, 20);
-        return { id: `delivery-change-${hash}`, source: 'revision' };
-    }
+    const valid = (value) => value.length <= 64 && CHANGE_NAME_RE.test(value);
     const fromFollowUp = typeof req.followUp?.openspecChangeName === 'string' ? req.followUp.openspecChangeName.trim() : '';
-    if (fromFollowUp && CHANGE_NAME_RE.test(fromFollowUp))
-        return { id: fromFollowUp, source: 'followUp' };
     const direct = typeof req.spec?.openspecChangeName === 'string' ? req.spec.openspecChangeName.trim() : '';
     const fromMetadata = typeof req.spec?.metadata?.openspecChangeName === 'string' ? req.spec.metadata.openspecChangeName.trim() : '';
-    const fromSpec = direct || fromMetadata;
-    if (fromSpec && CHANGE_NAME_RE.test(fromSpec))
-        return { id: fromSpec, source: 'spec' };
+    const declared = valid(fromFollowUp) ? fromFollowUp : valid(direct || fromMetadata) ? direct || fromMetadata : '';
+    const source = declared === fromFollowUp ? 'followUp' : 'spec';
+    if (req.addenda?.ids.length || req.constants?.REVISION_REQUEST) {
+        const state = declared ? openspecChangeState(req.cwd, declared) : 'missing';
+        // A pending implementation's addenda refine the same change. Only work
+        // already delivered/archived needs a separate delta proposal.
+        if (declared && (state === 'active' || (state === 'missing' && !req.constants?.REVISION_REQUEST && req.spec?.status !== 'on_review')))
+            return { id: declared, source };
+        const hash = (0, crypto_1.createHash)('sha256').update(JSON.stringify([
+            req.constants?.REVISION_OF_DELIVERY_ID ?? null,
+            req.constants?.REVISION_NUMBER ?? null,
+            req.constants?.REVISION_REQUEST ?? null,
+            req.addenda ? [...req.addenda.ids].sort() : [], req.addenda?.briefing ?? null,
+        ])).digest('hex').slice(0, 12);
+        const revisionNumber = req.constants?.REVISION_NUMBER;
+        const kind = req.addenda?.ids.length ? 'addenda' : 'revision';
+        const suffix = req.constants?.REVISION_REQUEST ? `rev${revisionNumber && /^[1-9]\d{0,3}$/.test(revisionNumber) ? revisionNumber : '1'}-${hash}` : `addenda-${hash}`;
+        const stem = declared || (req.ticketId && req.ticketId > 0 ? `ticket-${req.ticketId}` : 'spec');
+        return { id: `${stem.slice(0, 63 - suffix.length).replace(/-+$/, '')}-${suffix}`, source: kind };
+    }
+    if (declared)
+        return { id: declared, source };
     return undefined;
 }
 /** Where an OpenSpec change currently lives under `cwd`: an ACTIVE
@@ -854,6 +862,8 @@ class LoopRunManager {
             });
             if (definitionEngine)
                 (0, loop_runs_store_1.saveDefinitionRun)(this.db, runId, { request: req, source: 'definition' });
+            if (req.launchConfig)
+                this.db.prepare('UPDATE loop_runs SET launch_config_json = ? WHERE id = ?').run(JSON.stringify(req.launchConfig), runId);
             if (req.executionManifest)
                 this.db.prepare('UPDATE loop_runs SET execution_manifest = ? WHERE id = ?').run(JSON.stringify(req.executionManifest), runId);
             (0, db_1.createJob)(this.db, {

package/server/dist/modules/subscription-usage/adapters/claude.js

@@ -85,29 +85,39 @@ function createClaudeReader(options = {}) {
             const oauth = (0, domain_1.record)(data.claudeAiOauth);
             if (typeof oauth.accessToken !== 'string' || !oauth.accessToken)
                 return { availability: 'unsupported-auth', windows: [], plan: null, source: null };
-            const response = await (options.request ?? fetch)('https://api.anthropic.com/api/oauth/usage', {
-                headers: { Authorization: `Bearer ${oauth.accessToken}`, 'anthropic-beta': 'oauth-2025-04-20', 'User-Agent': 'claude-code/2.1.0' },
-                signal: AbortSignal.any([signal, AbortSignal.timeout(10_000)]), redirect: 'error',
-            });
-            if (!response.ok) {
-                await response.body?.cancel().catch(() => { });
-                if (response.status === 401)
-                    throw new errors_1.UsageError('signed-out');
-                if (response.status === 403)
-                    throw new errors_1.UsageError('permission-denied');
-                if (response.status === 429) {
-                    const header = response.headers.get('retry-after');
-                    const seconds = header !== null && header.trim() !== '' ? Number(header) : NaN;
-                    const date = header ? Date.parse(header) : NaN;
-                    const retry = Number.isFinite(seconds) ? seconds * 1000 : Number.isFinite(date) ? date - Date.now() : 60_000;
-                    throw new errors_1.UsageError('rate-limited', true, Math.max(30_000, Math.min(24 * 60 * 60_000, retry)));
+            async function query(route) {
+                const response = await (options.request ?? fetch)(`https://api.anthropic.com/api/oauth/${route}`, {
+                    headers: { Authorization: `Bearer ${oauth.accessToken}`, 'anthropic-beta': 'oauth-2025-04-20', 'User-Agent': 'claude-code/2.1.0' },
+                    signal: AbortSignal.any([signal, AbortSignal.timeout(10_000)]), redirect: 'error',
+                });
+                if (!response.ok) {
+                    await response.body?.cancel().catch(() => { });
+                    if (response.status === 401)
+                        throw new errors_1.UsageError('signed-out');
+                    if (response.status === 403)
+                        throw new errors_1.UsageError('permission-denied');
+                    if (response.status === 429) {
+                        const header = response.headers.get('retry-after');
+                        const seconds = header !== null && header.trim() !== '' ? Number(header) : NaN;
+                        const date = header ? Date.parse(header) : NaN;
+                        const retry = Number.isFinite(seconds) ? seconds * 1000 : Number.isFinite(date) ? date - Date.now() : 60_000;
+                        throw new errors_1.UsageError('rate-limited', true, Math.max(30_000, Math.min(24 * 60 * 60_000, retry)));
+                    }
+                    throw new errors_1.UsageError('provider-error', response.status >= 500);
                 }
-                throw new errors_1.UsageError('provider-error', response.status >= 500);
+                return (0, local_auth_1.limitedJson)(response);
             }
-            const payload = await (0, local_auth_1.limitedJson)(response), windows = (0, domain_1.normalizeClaude)(payload);
-            if (!windows.length)
+            const payload = await query('usage'), windows = (0, domain_1.normalizeClaude)(payload);
+            let plan = (0, domain_1.claudePlan)(oauth.subscriptionType) ?? (0, domain_1.claudePlan)(oauth.rateLimitTier);
+            const candidate = (0, domain_1.normalizeClaudeSpend)(payload, 'enterprise', (options.now ?? Date.now)());
+            if (!plan && candidate) {
+                const profile = (0, domain_1.record)(await query('profile')), organization = (0, domain_1.record)(profile.organization);
+                plan = (0, domain_1.claudePlan)(organization.organization_type) ?? (0, domain_1.claudePlan)(organization.rate_limit_tier);
+            }
+            const spend = plan === 'enterprise' ? candidate : null;
+            if (!windows.length && !spend)
                 throw new errors_1.UsageError('usage-unavailable');
-            return { availability: 'available', windows, plan: null, source: 'oauth' };
+            return { availability: 'available', windows: spend ? [] : windows, spend, plan, source: 'oauth' };
         },
     };
 }

package/server/dist/modules/subscription-usage/application.js

@@ -5,7 +5,8 @@ exports.backoff = backoff;
 function withFreshness(row, now) {
     if (!row.observedAt)
         return { ...row, freshness: 'unknown' };
-    const expired = now - Date.parse(row.observedAt) >= 300_000 || row.windows.some(w => w.resetsAt && Date.parse(w.resetsAt) <= now);
+    const expired = now - Date.parse(row.observedAt) >= 300_000 || row.windows.some(w => w.resetsAt && Date.parse(w.resetsAt) <= now)
+        || !!row.spend?.resetsAt && Date.parse(row.spend.resetsAt) <= now;
     return { ...row, freshness: expired || row.refreshState === 'error' ? 'stale' : 'fresh' };
 }
 function backoff(failures) { return Math.min(300_000, 30_000 * 2 ** Math.min(4, Math.max(0, failures - 1))); }

package/server/dist/modules/subscription-usage/domain.js

@@ -4,6 +4,9 @@ exports.duration = exports.percentage = exports.record = exports.USAGE_PROVIDERS
 exports.timestamp = timestamp;
 exports.windowLabel = windowLabel;
 exports.normalizeClaude = normalizeClaude;
+exports.claudePlan = claudePlan;
+exports.hasClaudeWindows = hasClaudeWindows;
+exports.normalizeClaudeSpend = normalizeClaudeSpend;
 exports.normalizeCodex = normalizeCodex;
 exports.initialUsage = initialUsage;
 exports.USAGE_PROVIDERS = ['claude', 'codex'];
@@ -47,6 +50,37 @@ function normalizeClaude(payload) {
         }
     return windows;
 }
+function claudePlan(value) {
+    if (typeof value !== 'string')
+        return null;
+    const words = value.trim().toLowerCase().split(/[^a-z0-9]+/);
+    return ['enterprise', 'team', 'max', 'pro', 'ultra', 'free'].find(plan => words.includes(plan)) ?? null;
+}
+function hasClaudeWindows(windows) {
+    return windows.some(window => window.usedPercent !== null || window.resetsAt !== null);
+}
+function normalizeClaudeSpend(payload, plan, now) {
+    if (plan !== 'enterprise' || hasClaudeWindows(normalizeClaude(payload)))
+        return null;
+    const extra = (0, exports.record)((0, exports.record)(payload).extra_usage);
+    const amount = (value) => typeof value === 'number' && Number.isFinite(value) && value >= 0 ? value : null;
+    const used = amount(extra.used_credits), limit = amount(extra.monthly_limit);
+    if (used === null && limit === null)
+        return null;
+    const currency = extra.currency == null ? 'USD' : typeof extra.currency === 'string' ? extra.currency.trim().toUpperCase() : '';
+    if (!/^[A-Z]{3}$/.test(currency))
+        return null;
+    // OAuth spend is in currency minor units, including fractional minor units.
+    const exponent = new Intl.NumberFormat('en', { style: 'currency', currency }).resolvedOptions().maximumFractionDigits ?? 2;
+    const divisor = 10 ** exponent;
+    const usedAmount = used === null ? null : used / divisor, limitAmount = limit === null ? null : limit / divisor;
+    const limitStatus = limit !== null ? 'limited' : extra.monthly_limit === null && extra.is_enabled === true ? 'unlimited' : 'unknown';
+    const ratio = used !== null && limit !== null && limit > 0 ? used / limit * 100 : null;
+    const usedPercent = limitStatus === 'limited' ? amount(extra.utilization) ?? (ratio !== null && Number.isFinite(ratio) ? ratio : null) : null;
+    const date = new Date(now);
+    return { kind: 'enterprise-on-demand', usedAmount, limitAmount, limitStatus, currency, usedPercent,
+        resetsAt: timestamp(extra.resets_at, typeof extra.resets_at === 'number') ?? new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth() + 1, 1)).toISOString() };
+}
 function normalizeCodex(payload) {
     const data = (0, exports.record)(payload), groups = (0, exports.record)(data.rateLimitsByLimitId);
     const entries = Object.keys(groups).length ? Object.entries(groups) : [['codex', data.rateLimits]];
@@ -66,5 +100,5 @@ function normalizeCodex(payload) {
 }
 function initialUsage(providerId, generation) {
     return { providerId, installed: null, generation, availability: 'unavailable', refreshState: 'idle', freshness: 'unknown', plan: null,
-        windows: [], source: null, observedAt: null, attemptedAt: null, retryAt: null, issue: null };
+        windows: [], spend: null, source: null, observedAt: null, attemptedAt: null, retryAt: null, issue: null };
 }

package/server/dist/modules/subscription-usage/runtime/usage-service.js

@@ -59,7 +59,7 @@ function createUsageService(deps) {
             const available = result.availability === 'available';
             if (!available)
                 clear(id);
-            rows.set(id, { ...rows.get(id), availability: result.availability, plan: result.plan, source: result.source, windows: available ? result.windows : [],
+            rows.set(id, { ...rows.get(id), availability: result.availability, plan: result.plan, source: result.source, windows: available ? result.windows : [], spend: available ? result.spend ?? null : null,
                 // Identity is internal: explicitly select fields instead of returning adapter metadata.
                 providerId: id, installed: true, refreshState: 'idle', freshness: available ? 'fresh' : 'unknown',
                 observedAt: available ? new Date(now()).toISOString() : null, retryAt: new Date(now() + 30_000).toISOString(),