toolroll 0.9.51 → 0.9.53

package/dist/claim.js

@@ -28,14 +28,9 @@
  * rather than probable.
  */
 import { randomUUID } from "node:crypto";
-import { attendedLivenessState } from "./liveness.js";
 import { authenticate } from "./runner.js";
 import { pauseForAuth } from "./provider-auth.js";
 import { DEFAULT_MAX_OPEN_DECISIONS, missingCapability, scopeApprovedForDispatch, taskReadinessBlocker, } from "./dispatch.js";
-/** attendedLivenessState over the store's ISO columns. */
-function attendedWatchState(lastBeatAt, now, absoluteExpiry) {
-    return attendedLivenessState(lastBeatAt === null ? null : Date.parse(lastBeatAt), now.getTime(), Date.parse(absoluteExpiry));
-}
 import { BUILT_IN, } from "./store.js";
 import { digestOf } from "./scope.js";
 import { parseExecutionPlanDocument } from "./plan.js";
@@ -100,15 +95,15 @@ function acquireLocked(store, taskRef, runner, options) {
         // THE COORDINATOR QUARANTINE in the one primitive every claim road
         // shares (MCP spec v6, round-3 f1): a coordinator-filed task whose
         // scope has not been sealed by the password ceremony claims for
-        // NOBODY — not the pre-approval planner road, not an attended
-        // authorization, not a raw CLI claim. One SQL predicate, so roads
-        // cannot diverge. After the seal it is ordinary in every respect.
+        // NOBODY — not the pre-approval planner road, not a raw CLI claim.
+        // One SQL predicate, so roads cannot diverge. After the seal it is
+        // ordinary in every respect.
         if (placedRef !== null && placedRef.coordinatorCid !== null && !store.scopeSealed(placedRef.externalId)) {
             return { ok: false, reason: "coordinator-filed" };
         }
         // The reservation gate lives HERE, in the one primitive every
         // acquisition path shares (queue-columns review, finding 1): tick's
-        // acquireIfReady, the raw CLI claim, and the tournament resume all
+        // acquireIfReady and the raw CLI claim both
         // pass through this line, so a task reserved for one worker can
         // never be taken by another, whatever the caller's snapshot said.
         // Scheduling, not authority: nothing about WHAT may build changes.
@@ -124,15 +119,6 @@ function acquireLocked(store, taskRef, runner, options) {
         if (mirrorWhy !== null && mirrorWhy !== "not-a-mirror") {
             return { ok: false, reason: "external", detail: mirrorWhy };
         }
-        // The attended gate (Phase 2, v6 W10/Q4), in the one primitive every
-        // acquisition path shares — raw CLI claims included: a task with an
-        // OPEN attended authorization dispatches only to its named runner,
-        // and a task whose ONLY authority is attended dispatches only while
-        // the operator is watching, with the one attempt unspent.
-        // An authorization past its absolute expiry gates NOTHING (round-6
-        // finding 8): it is a corpse the sweep will close, and letting it
-        // keep refusing other runners on an approved task would be a
-        // permanent lock nobody signed.
         // THE MODE BELT on the one primitive every claim road shares (Codex
         // people round 2, finding 2): a mode-sealed approval whose signature
         // no longer stands — revoked, expired by clock, or a dead signer —
@@ -145,29 +131,6 @@ function acquireLocked(store, taskRef, runner, options) {
                 message: "the operating mode that approved this has ended — the approval falls back to a person",
             };
         }
-        const attendedRow = store.openAuthorizationFor(taskRef);
-        const attendedOpen = attendedRow !== null && Date.parse(attendedRow.absoluteExpiry) > now.getTime() ? attendedRow : null;
-        if (attendedOpen !== null) {
-            if (attendedOpen.runner !== runner) {
-                return { ok: false, reason: "attended-held", runner: attendedOpen.runner };
-            }
-            const scopeApproved = db
-                .prepare(`SELECT 1 AS hit FROM task_scope
-             JOIN task_ref ON task_ref.id = ? AND task_scope.task_id = task_ref.external_id
-             WHERE task_scope.approved_digest = task_scope.digest AND task_scope.approved_at IS NOT NULL AND (COALESCE(task_scope.approval_basis, 'password') <> 'mode'
-                OR EXISTS (SELECT 1 FROM operating_mode om
-                            JOIN approver signer ON signer.name = om.signed_by
-                           WHERE om.repo = task_ref.repo AND om.revoked_at IS NULL
-                             AND om.absolute_expiry > ? AND om.digest = task_scope.mode_digest
-                             AND signer.revoked_at IS NULL AND signer.role = 'approver'))`)
-                .get(taskRef, now.toISOString());
-            if (scopeApproved === undefined) {
-                const watching = attendedWatchState(attendedOpen.lastBeatAt, now, attendedOpen.absoluteExpiry);
-                if ((watching !== "live" && watching !== "grace") || attendedOpen.attemptRun !== null) {
-                    return { ok: false, reason: "attended-only" };
-                }
-            }
-        }
         const existing = latest(db, taskRef);
         if (existing !== undefined && isLive(existing, stamp)) {
             return {
@@ -274,24 +237,8 @@ export function acquireIfReady(store, taskRef, runner, options) {
                 return { ok: false, reason: "not-ready", message: "the scope is not approved" };
             }
         }
-        let attendedAuthority = false;
         if (role !== "planner" && !approvedScope) {
-            // The authority union (v6 W1): an unapproved scope still dispatches
-            // when a LIVE attended authorization names THIS runner and its one
-            // attempt is unspent — the authorization IS the authority. Everything
-            // else about readiness still gates below and in acquireLocked.
-            const authorization = store.openAuthorizationFor(taskRef);
-            const watching = authorization === null
-                ? null
-                : attendedWatchState(authorization.lastBeatAt, options.now, authorization.absoluteExpiry);
-            attendedAuthority =
-                authorization !== null &&
-                    authorization.runner === runner &&
-                    (watching === "live" || watching === "grace") &&
-                    authorization.attemptRun === null;
-            if (!attendedAuthority) {
-                return { ok: false, reason: "not-ready", message: "the scope is not approved" };
-            }
+            return { ok: false, reason: "not-ready", message: "the scope is not approved" };
         }
         // Capabilities are re-read inside the same transaction as the CAS, like
         // every other readiness fact: a key that expired between the survey and
@@ -304,10 +251,7 @@ export function acquireIfReady(store, taskRef, runner, options) {
         // registered runners; a runner the store has never met is a test driving
         // the API directly, and the CLI always registers.
         const registered = store.getRunner(runner);
-        if (registered !== null && !attendedAuthority) {
-            // Capacity governs UNATTENDED work (v6 W2 + round-6 finding 7): an
-            // attended session's bound is one-held-per-runner, so a full
-            // unattended ledger must not refuse the operator who is watching.
+        if (registered !== null) {
             const held = store.liveClaimCount(runner, options.now);
             if (held >= registered.runner.capacity) {
                 return {
@@ -380,124 +324,6 @@ export function acquireIfReady(store, taskRef, runner, options) {
         return taken;
     });
 }
-/**
- * The FALLBACK-ADMISSION claim (E3d, review finding 4): the one gate a
- * pending-admission chain cycle dispatches through. It enforces everything
- * `acquireIfReady` enforces — task state, holds, blockers, the approved
- * scope + live-mode belt, capability, capacity, and quota — with EXACTLY
- * ONE deliberate difference: a BACKOFF hold does not gate, because the
- * pending admission IS the system's answer to the predecessor's failure
- * (waiting out the exhausted entry's backoff to run a different credential
- * would be waiting for nothing). Quota is keyed by the PINNED entry's
- * provider, model, and auth mode — the credential that would actually
- * spend — so an exhausted fallback credential refuses here, before any
- * claim exists.
- */
-export function acquireFallback(store, taskRef, runner, options) {
-    return inTransaction(store, () => {
-        const db = store.handle;
-        const stamp = options.now.toISOString();
-        const task = db
-            .prepare(`SELECT task.id, task.state FROM task
-         JOIN task_ref ON task_ref.external_id = task.id AND task_ref.backend = ?
-         WHERE task_ref.id = ?`)
-            .get(BUILT_IN, taskRef);
-        if (task === undefined)
-            return { ok: false, reason: "not-ready", message: "no such task" };
-        // A task the strikes already ended (state failed) or that concluded is
-        // TERMINAL: its pending cycle never spends (the reviewer's third-strike
-        // scenario) — the cycle simply waits out as an inert record.
-        if (String(task["state"]) !== "queued") {
-            return { ok: false, reason: "not-ready", message: `state is ${String(task["state"])}, not queued` };
-        }
-        // Every hold EXCEPT backoff gates: an operator hold, a decision hold,
-        // an incident hold all still mean "do not spend".
-        const hold = db
-            .prepare(`SELECT reason FROM hold
-         WHERE task_ref = ? AND owner_kind <> 'backoff' AND (until IS NULL OR until > ?) LIMIT 1`)
-            .get(taskRef, stamp);
-        if (hold !== undefined)
-            return { ok: false, reason: "not-ready", message: `held: ${String(hold["reason"])}` };
-        const blocker = db
-            .prepare(`SELECT blocker.id FROM task_edge
-         JOIN task AS blocker ON blocker.id = task_edge.blocker
-         WHERE task_edge.blocked = ? AND blocker.state <> 'done'
-         ORDER BY blocker.id LIMIT 1`)
-            .get(String(task["id"]));
-        if (blocker !== undefined)
-            return { ok: false, reason: "not-ready", message: `waiting on ${String(blocker["id"])}` };
-        // The approved scope + live-mode belt, verbatim from acquireIfReady: a
-        // chain approval IS a scope approval, and a mode-sealed one must still
-        // stand.
-        const approvedScope = db
-            .prepare(`SELECT 1 AS hit FROM task_scope
-         JOIN task_ref ON task_ref.id = ? AND task_scope.task_id = task_ref.external_id
-         WHERE task_scope.approved_digest = task_scope.digest AND task_scope.approved_at IS NOT NULL AND (COALESCE(task_scope.approval_basis, 'password') <> 'mode'
-                OR EXISTS (SELECT 1 FROM operating_mode om
-                            JOIN approver signer ON signer.name = om.signed_by
-                           WHERE om.repo = task_ref.repo AND om.revoked_at IS NULL
-                             AND om.absolute_expiry > ? AND om.digest = task_scope.mode_digest
-                             AND signer.revoked_at IS NULL AND signer.role = 'approver'))`)
-            .get(taskRef, stamp);
-        if (approvedScope === undefined) {
-            return { ok: false, reason: "not-ready", message: "the scope is not approved" };
-        }
-        const gap = missingCapability(store, taskRef, options.repo ?? null, options.now);
-        if (gap !== null)
-            return { ok: false, reason: "capability", message: gap };
-        // The pinned entry's provider must not be one this runner reports
-        // unavailable (v47): the approved chain is the ONLY substitution road,
-        // and it still never dispatches onto a provider known to be missing.
-        const entryReadiness = store.runnerReadinessOf(runner, options.provider);
-        if (entryReadiness !== null && entryReadiness.state === "unavailable") {
-            return {
-                ok: false,
-                reason: "provider-unavailable",
-                message: `${entryReadiness.provider} is reported unavailable on ${runner} (${entryReadiness.reason}; observed ${entryReadiness.observedAt}) — the fallback entry cannot run here`,
-            };
-        }
-        const registered = store.getRunner(runner);
-        if (registered !== null) {
-            const held = store.liveClaimCount(runner, options.now);
-            if (held >= registered.runner.capacity) {
-                return {
-                    ok: false,
-                    reason: "capacity",
-                    message: `${runner} holds ${held} of ${registered.runner.capacity} slot(s) — a free CPU against a full ledger is not capacity`,
-                };
-            }
-        }
-        // Quota, keyed by the PINNED credential that would spend.
-        const quota = store.quotaState(runner, options.provider, options.model, options.now, options.authMode);
-        if (quota !== null && quota.state === "exhausted") {
-            return {
-                ok: false,
-                reason: "quota",
-                message: `${runner}'s ${options.provider} quota is exhausted (${quota.reason})${quota.resetAt === null ? "" : ` until ${quota.resetAt}`} — the fallback entry's own credential is spent`,
-            };
-        }
-        // The attention budget, exactly as the ordinary road holds it (E3d
-        // verify, R4): a fallback attempt can park and add a decision like any
-        // other, so above the budget a task with a measured parking habit steps
-        // aside here too — backoff is the ONE exemption, not this.
-        const budget = options.maxOpenDecisions ?? DEFAULT_MAX_OPEN_DECISIONS;
-        if (store.countUnanswered() >= budget) {
-            const rate = store.refForId(taskRef)?.parkRate ?? 0;
-            if (rate > 0) {
-                return {
-                    ok: false,
-                    reason: "attention-budget",
-                    message: `${store.countUnanswered()} decisions already wait and this task parks ${Math.round(rate * 100)}% of its attempts — answer some before it may add more`,
-                };
-            }
-        }
-        const taken = acquireLocked(store, taskRef, runner, options);
-        if (taken.ok && quota !== null) {
-            store.consumeHalfOpen(runner, options.provider, options.model, options.now, options.authMode);
-        }
-        return taken;
-    });
-}
 /**
  * "I am still here." Extends the lease, and tells a superseded runner that it
  * has been superseded — which is the cheapest moment for it to find out, well
@@ -541,6 +367,35 @@ function refusal(db, leaseId) {
     const row = db.prepare("SELECT 1 AS hit FROM claim WHERE lease_id = ?").get(leaseId);
     return { ok: false, reason: row === undefined ? "unknown" : "fenced" };
 }
+/** The release every ending makes: a compare-and-swap that only the live lease nobody superseded wins. */
+function releaseAs(store, leaseId, as, now) {
+    const { changes } = store.handle
+        .prepare(`UPDATE claim SET released_at = ?, released_by = ? WHERE lease_id = ? AND released_at IS NULL AND ${NOT_SUPERSEDED}`)
+        .run(now.toISOString(), as, leaseId);
+    return Number(changes) > 0;
+}
+/**
+ * The open attempt an ending seals, proved first inside finalize's transaction: the run must be this lease's open
+ * attempt of the role the ending is for (anything else is a caller defect, thrown — not a race to absorb).
+ */
+function openAttempt(store, leaseId, runId, what, role) {
+    const run = store.getRun(runId);
+    if (run === null || run.leaseId !== leaseId || run.outcome !== null)
+        throw new Error(`run ${runId} is not ${leaseId}'s open attempt — ${what} seals exactly one`);
+    if (role !== undefined && run.role !== role)
+        throw new Error(`run ${runId} is a ${run.role} run — only ${role} runs can be sealed as ${what}`);
+    return run;
+}
+/** Release the claim as `as`, or — for a lease the world moved past — finish the run (and its open repair child) as a
+ * fenced refusal and say why. Null when the release won. */
+function releaseOrRefuse(store, leaseId, as, runId, now, repairRun = null) {
+    if (releaseAs(store, leaseId, as, now))
+        return null;
+    if (repairRun !== null)
+        store.finishRun(repairRun.id, { outcome: "refused", reason: "fenced", now });
+    store.finishRun(runId, { outcome: "refused", reason: "fenced", now });
+    return refusal(store.handle, leaseId);
+}
 /**
  * Hand the task back.
  *
@@ -553,11 +408,7 @@ function refusal(db, leaseId) {
 export function release(store, leaseId, now) {
     const db = store.handle;
     return inTransaction(store, () => {
-        const { changes } = db
-            .prepare(`UPDATE claim SET released_at = ?, released_by = 'released'
-          WHERE lease_id = ? AND released_at IS NULL AND ${NOT_SUPERSEDED}`)
-            .run(now.toISOString(), leaseId);
-        if (Number(changes) === 0) {
+        if (!releaseAs(store, leaseId, "released", now)) {
             // A repeat of a hand-back this same lease already made is not a fence —
             // nobody took the task away, the runner simply said so twice because its
             // first acknowledgement was lost. M1 asks for duplicate completion to be
@@ -599,6 +450,35 @@ function duplicateOrRefusal(db, leaseId, own) {
         return { ok: false, reason: "fenced" };
     return refusal(db, leaseId);
 }
+/**
+ * THE ONE WAY AN ATTEMPT ENDS: seal `outcome` for `leaseId` in one fenced transaction.
+ *
+ * Every ending passes the same fence, in the same order: the run is this lease's open attempt of the right role (a
+ * caller defect otherwise, thrown); a stop that applies to it wins — the attempt is sealed as interrupted instead
+ * (except the endings that ARE a stop or a service hand-back); then the claim is released by a compare-and-swap only the
+ * live, unsuperseded lease wins. A lease the world moved past writes nothing but its own run's fenced refusal (the
+ * stop and hand-back endings still end their run, touching no task state), and a retry of an ending the same lease
+ * already made answers as a duplicate where that ending allows it. Only then does the ending's own effect run —
+ * decision and hold, incident, strike and backoff, scope, report, revision, task state, the disowned mirror — inside
+ * the same transaction, so nothing of it exists without the release, and a crash rolls all of it back together.
+ */
+export function finalize(store, leaseId, outcome) {
+    return inTransaction(store, () => {
+        switch (outcome.kind) {
+            case "complete": return sealComplete(store, leaseId, outcome);
+            case "park": return sealPark(store, leaseId, outcome);
+            case "malformed": return sealMalformed(store, leaseId, outcome);
+            case "interrupted": return sealInterrupted(store, leaseId, outcome);
+            case "hand-back": return sealHandBack(store, leaseId, outcome);
+            case "failure": return sealFailure(store, leaseId, outcome);
+            case "plan": return sealPlan(store, leaseId, outcome);
+            case "revision": return sealRevision(store, leaseId, outcome);
+            case "plan-failure": return sealPlanFailure(store, leaseId, outcome);
+            case "scout": return sealScout(store, leaseId, outcome);
+            case "scout-failure": return sealScoutFailure(store, leaseId, outcome);
+        }
+    });
+}
 /**
  * Release the lease and write the task's terminal state, as one step.
  *
@@ -613,172 +493,71 @@ function duplicateOrRefusal(db, leaseId, own) {
  * `duplicate` and also writes nothing — the first completion already said,
  * and a retry changing the answer would make "done" negotiable.
  */
-export function completeFenced(store, leaseId, state, now, mutation = {}) {
+function sealComplete(store, leaseId, args) {
+    const { state, now, mutation = {} } = args;
     const db = store.handle;
-    return inTransaction(store, () => {
-        const stoppedRun = db.prepare("SELECT r.id FROM run r JOIN run_stop s ON s.run = r.id WHERE r.lease_id = ? AND r.outcome IS NULL LIMIT 1").get(leaseId);
-        if (stoppedRun !== undefined) {
-            const runId = Number(stoppedRun["id"]);
-            const run = store.getRun(runId);
-            const task = store.refForId(run.taskRef);
-            if (task !== null)
-                interruptIfStopped(store, { leaseId, runId, taskId: task.externalId, now });
-            return { ok: false, reason: "stopped" };
-        }
-        const { changes } = db
-            .prepare(`UPDATE claim SET released_at = ?, released_by = 'completed'
-          WHERE lease_id = ? AND released_at IS NULL AND ${NOT_SUPERSEDED}`)
-            .run(now.toISOString(), leaseId);
-        if (Number(changes) === 0) {
-            // Only a completion this same lease already made reads as a duplicate.
-            // The DURABLE disposition (released_by) reproduces the original arm —
-            // whatever the task or the tracker did since (finding 33). A lease
-            // the reaper or recovery released was never *accepted*; a late
-            // completion after that is exactly the stale commit the fence keeps
-            // out.
-            const released = db
-                .prepare("SELECT * FROM claim WHERE lease_id = ? AND released_at IS NOT NULL")
-                .get(leaseId);
-            if (released !== undefined) {
-                const by = String(released["released_by"] ?? "");
-                if (by === "completed" || by === "disowned") {
-                    return {
-                        ok: true,
-                        arm: by === "disowned" ? "disowned" : "completed",
-                        claim: readClaim(released),
-                        duplicate: true,
-                    };
-                }
-                return { ok: false, reason: "fenced" };
+    const stoppedRun = db.prepare("SELECT r.id FROM run r JOIN run_stop s ON s.run = r.id WHERE r.lease_id = ? AND r.outcome IS NULL LIMIT 1").get(leaseId);
+    if (stoppedRun !== undefined) {
+        const runId = Number(stoppedRun["id"]);
+        const run = store.getRun(runId);
+        const task = store.refForId(run.taskRef);
+        if (task !== null)
+            interruptIfStopped(store, { leaseId, runId, taskId: task.externalId, now });
+        return { ok: false, reason: "stopped" };
+    }
+    if (!releaseAs(store, leaseId, "completed", now)) {
+        // Only a completion this same lease already made reads as a duplicate.
+        // The DURABLE disposition (released_by) reproduces the original arm —
+        // whatever the task or the tracker did since (finding 33). A lease
+        // the reaper or recovery released was never *accepted*; a late
+        // completion after that is exactly the stale commit the fence keeps
+        // out.
+        const released = db
+            .prepare("SELECT * FROM claim WHERE lease_id = ? AND released_at IS NOT NULL")
+            .get(leaseId);
+        if (released !== undefined) {
+            const by = String(released["released_by"] ?? "");
+            if (by === "completed" || by === "disowned") {
+                return {
+                    ok: true,
+                    arm: by === "disowned" ? "disowned" : "completed",
+                    claim: readClaim(released),
+                    duplicate: true,
+                };
             }
-            return refusal(db, leaseId);
+            return { ok: false, reason: "fenced" };
         }
-        const row = db.prepare("SELECT * FROM claim WHERE lease_id = ?").get(leaseId);
-        const claim = readClaim(row);
-        const taskId = db
-            .prepare("SELECT external_id FROM task_ref WHERE id = ? AND backend = ?")
-            .get(claim.taskRef, BUILT_IN);
-        // The completion gate (external dispatch, v4 §24): the latch is read
-        // INSIDE this transaction, on a FRESH win only. A latched mirror's
-        // completion is DISOWNED — the task is cancelled, the disposition is
-        // written durably, and the caller never sees the completed arm, so
-        // publication is impossible by construction.
-        const disowned = taskId !== undefined && !store.mirrorAllowsCompletion(String(taskId["external_id"]));
-        if (disowned) {
-            db.prepare("UPDATE claim SET released_by = 'disowned' WHERE lease_id = ?").run(leaseId);
-        }
-        if (taskId !== undefined) {
-            store.replay(mutation, "completeFenced", () => {
-                if (disowned) {
-                    // Cancellation goes through the one floor — a disowned
-                    // completion is a typed machine reason, not a bare state write.
-                    store.applyCancellation(String(taskId["external_id"]), { kind: "machine", code: "disowned-completion" }, now, null);
-                }
-                else {
-                    db.prepare("UPDATE task SET state = ?, updated_at = ? WHERE id = ?").run(state, now.toISOString(), String(taskId["external_id"]));
-                }
-                return true;
-            });
-        }
-        store.bumpWake();
-        return { ok: true, arm: disowned ? "disowned" : "completed", claim };
-    });
-}
-/**
- * Seal a park, fenced at the write (§7).
- *
- * The builder proved its lease after the agent ran; this transaction proves
- * it again *in the same statement that releases it*, because everything a
- * park creates — the decision, its hold, the outbox row — is only true if
- * this lease still spoke for the task at the moment of sealing. A superseded
- * lease creates none of it: no decision, no hold, no notification, and the
- * run is finalized as the fenced refusal it was. A crash anywhere inside
- * rolls all of it back together; there is no instant at which a decision
- * exists without its hold.
- *
- * `released_by = 'parked'` so a late retry from this lease is answered with
- * the fence, not "duplicate": a park hands the task to a person, and nothing
- * the runner says afterwards is that person's answer.
- */
-/**
- * Continuation admission (Phase 2E, A4 / v3 R7): the AUTHORIZATION is the
- * claimable unit — the finished parent task is never re-queued, its state,
- * strikes, holds, and dependents untouched. Every shared gate still runs
- * (acquireLocked: reservation, external mirror, the attended gates, the
- * lease CAS); the queued-state readiness gate alone is replaced by
- * construction. Liveness, the named runner, and the unspent attempt are
- * re-proved HERE at claim time and again at the final dispatch proof.
- */
-export function acquireContinuation(store, authorization, runner, options) {
-    const live = store.readAuthorization(authorization.id);
-    if (live === null ||
-        live.closedAt !== null ||
-        live.attemptRun !== null ||
-        live.parentRun === null ||
-        live.runner !== runner) {
-        return { ok: false, reason: "attended-only", message: "the authorization is not an open continuation for this runner" };
-    }
-    const watching = attendedWatchState(live.lastBeatAt, options.now, live.absoluteExpiry);
-    if (watching !== "live" && watching !== "grace") {
-        return { ok: false, reason: "attended-only", message: "the operator is not watching" };
+        return refusal(db, leaseId);
     }
-    if (store.activeTournamentTerms(live.taskRef) !== null) {
-        return { ok: false, reason: "contest-open", message: "a tournament raced onto this task — continuation waits" };
+    const row = db.prepare("SELECT * FROM claim WHERE lease_id = ?").get(leaseId);
+    const claim = readClaim(row);
+    const taskId = db
+        .prepare("SELECT external_id FROM task_ref WHERE id = ? AND backend = ?")
+        .get(claim.taskRef, BUILT_IN);
+    // The completion gate (external dispatch, v4 §24): the latch is read
+    // INSIDE this transaction, on a FRESH win only. A latched mirror's
+    // completion is DISOWNED — the task is cancelled, the disposition is
+    // written durably, and the caller never sees the completed arm, so
+    // publication is impossible by construction.
+    const disowned = taskId !== undefined && !store.mirrorAllowsCompletion(String(taskId["external_id"]));
+    if (disowned) {
+        db.prepare("UPDATE claim SET released_by = 'disowned' WHERE lease_id = ?").run(leaseId);
     }
-    const blocked = store.continuationBlockOf(live.parentRun);
-    if (blocked !== null) {
-        return { ok: false, reason: "continuation-blocked", message: blocked };
+    if (taskId !== undefined) {
+        store.replay(mutation, "completeFenced", () => {
+            if (disowned) {
+                // Cancellation goes through the one floor — a disowned
+                // completion is a typed machine reason, not a bare state write.
+                store.applyCancellation(String(taskId["external_id"]), { kind: "machine", code: "disowned-completion" }, now, null);
+            }
+            else {
+                db.prepare("UPDATE task SET state = ?, updated_at = ? WHERE id = ?").run(state, now.toISOString(), String(taskId["external_id"]));
+            }
+            return true;
+        });
     }
-    return acquire(store, live.taskRef, runner, options);
-}
-/**
- * The HELD park (Phase 2E, v2 S1f): the decision is recorded, paged, and
- * causally linked to the session turn that produced it — and NOTHING else
- * ends. The lease stays; the run stays open; the process stays held. The
- * conversation continues when the answer is injected as the next turn.
- * The one-unresolved-per-run partial unique refuses a second open park.
- */
-export function finalizeParkHeld(store, args) {
-    const { runId, taskId, decision, artifactIds, sessionTurn, now } = args;
-    return inTransaction(store, () => {
-        const held = store.heldSessionOf(runId);
-        if (held === null || held.endedAt !== null || held.state !== "open") {
-            return { ok: false, reason: "not-held" };
-        }
-        const run = store.getRun(runId);
-        if (run === null || run.outcome !== null)
-            return { ok: false, reason: "not-held" };
-        let decisionId;
-        try {
-            decisionId = store.saveDecision({
-                run: runId,
-                urgency: decision.urgency,
-                recap: decision.recap,
-                question: decision.question,
-                options: decision.options,
-                recommendation: decision.recommendation,
-                ...(decision.assignee === null ? {} : { assignee: decision.assignee }),
-                ...(decision.deadline === null ? {} : { deadline: decision.deadline }),
-            }, now);
-        }
-        catch {
-            // The partial unique: one unresolved question per run at a time.
-            return { ok: false, reason: "decision-open" };
-        }
-        store.handle.prepare("UPDATE decision SET session_turn = ? WHERE id = ?").run(sessionTurn, decisionId);
-        for (const artifact of artifactIds)
-            store.linkEvidence(decisionId, artifact);
-        store.enqueueNotification({
-            source: { run: runId },
-            dedupeKey: `decision:${decisionId}`,
-            kind: "decision",
-            subject: `${taskId} asked a question mid-session`,
-            body: `${oneLine(decision.question, 200)}\n\`toolroll decide ${decisionId}\``,
-            pushClass: "decision",
-            link: `/d/${decisionId}`,
-        }, now);
-        return { ok: true, decisionId };
-    });
+    store.bumpWake();
+    return { ok: true, arm: disowned ? "disowned" : "completed", claim };
 }
 /**
  * Validate the optional accepted formatting child against the open planner
@@ -824,69 +603,70 @@ function plannerRepairChild(store, root, repairRunId) {
     }
     throw new Error(`run ${repairRunId} is outside planner ${root.id}'s bounded linear correction chain`);
 }
-export function finalizeParkFenced(store, args) {
-    const { leaseId, runId, taskId, decision, artifactIds, now } = args;
-    const db = store.handle;
-    return inTransaction(store, () => {
-        const run = store.getRun(runId);
-        if (run === null || run.leaseId !== leaseId || run.outcome !== null) {
-            // A run that names another lease or is already finished cannot be
-            // sealed by this call — that is a caller defect, not a race to absorb.
-            throw new Error(`run ${runId} is not ${leaseId}'s open attempt — a park seals exactly one`);
-        }
-        const repairRun = plannerRepairChild(store, run, args.repairRunId ?? null);
-        const stopped = interruptIfStopped(store, { leaseId, runId, taskId, now });
-        if (stopped !== null)
-            return { ok: false, reason: "stopped" };
-        const { changes } = db
-            .prepare(`UPDATE claim SET released_at = ?, released_by = 'parked'
-          WHERE lease_id = ? AND released_at IS NULL AND ${NOT_SUPERSEDED}`)
-            .run(now.toISOString(), leaseId);
-        if (Number(changes) === 0) {
-            if (repairRun !== null)
-                store.finishRun(repairRun.id, { outcome: "refused", reason: "fenced", now });
-            store.finishRun(runId, { outcome: "refused", reason: "fenced", now });
-            return refusal(db, leaseId);
-        }
-        const decisionId = store.saveDecision({
-            run: runId,
-            urgency: decision.urgency,
-            recap: decision.recap,
-            question: decision.question,
-            options: decision.options,
-            recommendation: decision.recommendation,
-            ...(decision.assignee === null ? {} : { assignee: decision.assignee }),
-            ...(decision.deadline === null ? {} : { deadline: decision.deadline }),
-        }, now);
-        for (const artifact of artifactIds)
-            store.linkEvidence(decisionId, artifact);
-        // The hold is indefinite by construction. The decision's deadline is
-        // attention metadata; wiring it into `until` would dispatch the task,
-        // unanswered, the moment the deadline passed — expiry never chooses.
-        store.holdOwned({
-            taskRef: run.taskRef,
-            ownerKind: "decision",
-            ownerId: String(decisionId),
-            reason: `decision:${decisionId} — ${oneLine(decision.question, 80)}`,
-            until: null,
-        }, now);
-        store.finishRun(runId, { outcome: "parked", reason: `decision:${decisionId}`, now });
-        if (repairRun !== null) {
-            store.finishRun(repairRun.id, { outcome: "no-change", reason: "structured planner output repaired", now });
-        }
-        store.enqueueNotification({
-            source: { run: runId },
-            dedupeKey: `decision:${decisionId}`,
-            kind: "decision",
-            subject: `${taskId} parked a decision`,
-            body: `${oneLine(decision.question, 200)}\n\`toolroll decide ${decisionId}\``,
-            // The push stamp (arc 3): class + machine-minted link, at enqueue
-            // or never. Fixed phrases ride the push service; this subject does not.
-            pushClass: "decision",
-            link: `/d/${decisionId}`,
-        }, now);
-        return { ok: true, decisionId };
-    });
+/**
+ * Seal a park, fenced at the write (§7).
+ *
+ * The builder proved its lease after the agent ran; this transaction proves
+ * it again *in the same statement that releases it*, because everything a
+ * park creates — the decision, its hold, the outbox row — is only true if
+ * this lease still spoke for the task at the moment of sealing. A superseded
+ * lease creates none of it: no decision, no hold, no notification, and the
+ * run is finalized as the fenced refusal it was. A crash anywhere inside
+ * rolls all of it back together; there is no instant at which a decision
+ * exists without its hold.
+ *
+ * `released_by = 'parked'` so a late retry from this lease is answered with
+ * the fence, not "duplicate": a park hands the task to a person, and nothing
+ * the runner says afterwards is that person's answer.
+ */
+function sealPark(store, leaseId, args) {
+    const { runId, taskId, decision, artifactIds, now } = args;
+    const run = openAttempt(store, leaseId, runId, "a park");
+    const repairRun = plannerRepairChild(store, run, args.repairRunId ?? null);
+    const stopped = interruptIfStopped(store, { leaseId, runId, taskId, now });
+    if (stopped !== null)
+        return { ok: false, reason: "stopped" };
+    const fenced = releaseOrRefuse(store, leaseId, "parked", runId, now, repairRun);
+    if (fenced !== null)
+        return fenced;
+    const decisionId = store.saveDecision({
+        run: runId,
+        urgency: decision.urgency,
+        recap: decision.recap,
+        question: decision.question,
+        options: decision.options,
+        recommendation: decision.recommendation,
+        ...(decision.assignee === null ? {} : { assignee: decision.assignee }),
+        ...(decision.deadline === null ? {} : { deadline: decision.deadline }),
+    }, now);
+    for (const artifact of artifactIds)
+        store.linkEvidence(decisionId, artifact);
+    // The hold is indefinite by construction. The decision's deadline is
+    // attention metadata; wiring it into `until` would dispatch the task,
+    // unanswered, the moment the deadline passed — expiry never chooses.
+    store.holdOwned({
+        taskRef: run.taskRef,
+        ownerKind: "decision",
+        ownerId: String(decisionId),
+        reason: `decision:${decisionId} — ${oneLine(decision.question, 80)}`,
+        until: null,
+    }, now);
+    store.finishRun(runId, { outcome: "parked", reason: `decision:${decisionId}`, now });
+    if (repairRun !== null) {
+        store.finishRun(repairRun.id, { outcome: "no-change", reason: "structured planner output repaired", now });
+    }
+    store.enqueueNotification({
+        source: { run: runId },
+        dedupeKey: `decision:${decisionId}`,
+        kind: "decision",
+        subject: `${taskId} parked a decision`,
+        body: `${oneLine(decision.question, 200)}\n\`toolroll decide ${decisionId}\``,
+        // The push stamp (arc 3): class + machine-minted link, at enqueue
+        // or never. Fixed phrases ride the push service; this subject does not.
+        pushClass: "decision",
+        link: `/d/${decisionId}`,
+    }, now);
+    return { ok: true, decisionId };
 }
 /**
  * Seal a park whose payload never became a decision (§6's bounded repair ran
@@ -896,49 +676,38 @@ export function finalizeParkFenced(store, args) {
  * malformed payload is preserved as evidence — a person may still be able to
  * read what the agent meant.
  */
-export function finalizeMalformedFenced(store, args) {
-    const { leaseId, runId, taskId, problems, now } = args;
-    const db = store.handle;
-    return inTransaction(store, () => {
-        const run = store.getRun(runId);
-        if (run === null || run.leaseId !== leaseId || run.outcome !== null) {
-            throw new Error(`run ${runId} is not ${leaseId}'s open attempt — a park seals exactly one`);
-        }
-        const stopped = interruptIfStopped(store, { leaseId, runId, taskId, now });
-        if (stopped !== null)
-            return { ok: false, reason: "stopped" };
-        const { changes } = db
-            .prepare(`UPDATE claim SET released_at = ?, released_by = 'parked'
-          WHERE lease_id = ? AND released_at IS NULL AND ${NOT_SUPERSEDED}`)
-            .run(now.toISOString(), leaseId);
-        if (Number(changes) === 0) {
-            store.finishRun(runId, { outcome: "refused", reason: "fenced", now });
-            return refusal(db, leaseId);
-        }
-        const incidentId = store.createIncident({ run: runId, kind: "malformed-decision" }, now);
-        store.holdOwned({
-            taskRef: run.taskRef,
-            ownerKind: "incident",
-            ownerId: String(incidentId),
-            reason: `malformed-decision — the agent tried to park ${taskId} and could not say what`,
-            until: null,
-        }, now);
-        store.finishRun(runId, { outcome: "failed", reason: "malformed-decision", now });
-        store.enqueueNotification({
-            source: { run: runId },
-            dedupeKey: `malformed:${runId}`,
-            kind: "malformed-decision",
-            pushClass: "attention",
-            link: `/r/${runId}`,
-            subject: `${taskId}: the agent parked but could not say what`,
-            body: [
-                `Repair ran out. The task is held until somebody looks.`,
-                ...problems.slice(0, 5).map(problem => `- ${oneLine(problem.message, 120)}`),
-                `The raw payload is preserved in run ${runId}'s evidence.`,
-            ].join("\n"),
-        }, now);
-        return { ok: true, incidentId };
-    });
+function sealMalformed(store, leaseId, args) {
+    const { runId, taskId, problems, now } = args;
+    const run = openAttempt(store, leaseId, runId, "a park");
+    const stopped = interruptIfStopped(store, { leaseId, runId, taskId, now });
+    if (stopped !== null)
+        return { ok: false, reason: "stopped" };
+    const fenced = releaseOrRefuse(store, leaseId, "parked", runId, now);
+    if (fenced !== null)
+        return fenced;
+    const incidentId = store.createIncident({ run: runId, kind: "malformed-decision" }, now);
+    store.holdOwned({
+        taskRef: run.taskRef,
+        ownerKind: "incident",
+        ownerId: String(incidentId),
+        reason: `malformed-decision — the agent tried to park ${taskId} and could not say what`,
+        until: null,
+    }, now);
+    store.finishRun(runId, { outcome: "failed", reason: "malformed-decision", now });
+    store.enqueueNotification({
+        source: { run: runId },
+        dedupeKey: `malformed:${runId}`,
+        kind: "malformed-decision",
+        pushClass: "attention",
+        link: `/r/${runId}`,
+        subject: `${taskId}: the agent parked but could not say what`,
+        body: [
+            `Repair ran out. The task is held until somebody looks.`,
+            ...problems.slice(0, 5).map(problem => `- ${oneLine(problem.message, 120)}`),
+            `The raw payload is preserved in run ${runId}'s evidence.`,
+        ].join("\n"),
+    }, now);
+    return { ok: true, incidentId };
 }
 /** 1m, 2m, 4m, 8m, 16m — doubling, capped. Indexed by strikes-1. */
 const BACKOFF_MS = [60_000, 120_000, 240_000, 480_000, 960_000];
@@ -958,50 +727,42 @@ export const MAX_STRIKES = 3;
  * ends the run as interrupted — that IS the honest ending — but touches
  * no task state: the task belongs to whoever holds it now.
  */
-export function finalizeInterruptedFenced(store, args) {
-    const { leaseId, runId, taskId, stopRun, now } = args;
+function sealInterrupted(store, leaseId, args) {
+    const { runId, taskId, stopRun, now } = args;
     const db = store.handle;
-    return inTransaction(store, () => {
-        const run = store.getRun(runId);
-        if (run === null || run.leaseId !== leaseId || run.outcome !== null) {
-            throw new Error(`run ${runId} is not ${leaseId}'s open attempt — an interruption seals exactly one`);
-        }
-        const { changes } = db
-            .prepare(`UPDATE claim SET released_at = ?, released_by = 'interrupted'
-          WHERE lease_id = ? AND released_at IS NULL AND ${NOT_SUPERSEDED}`)
-            .run(now.toISOString(), leaseId);
-        const fenced = Number(changes) === 0;
-        if (args.message !== undefined && args.message.trim() !== "") {
-            store.recordOutcomeFacts(runId, { handoff: args.message });
-        }
-        // Owned descendants first (a repair turn, a correction) — the parent's
-        // ending settles the stop, and every owned row ends in the same write.
-        for (const owned of store.ownedRunsOf(runId)) {
-            if (owned === runId)
-                continue;
-            const child = store.getRun(owned);
-            if (child !== null && child.outcome === null) {
-                store.finishRun(owned, { outcome: "failed", reason: "interrupted", now, stopSettlement: "interrupted" });
-            }
+    const run = openAttempt(store, leaseId, runId, "an interruption");
+    // A lease the world moved past still ends its run as interrupted — that IS the honest ending — touching no task state.
+    const fenced = !releaseAs(store, leaseId, "interrupted", now);
+    if (args.message !== undefined && args.message.trim() !== "") {
+        store.recordOutcomeFacts(runId, { handoff: args.message });
+    }
+    // Owned descendants first (a repair turn, a correction) — the parent's
+    // ending settles the stop, and every owned row ends in the same write.
+    for (const owned of store.ownedRunsOf(runId)) {
+        if (owned === runId)
+            continue;
+        const child = store.getRun(owned);
+        if (child !== null && child.outcome === null) {
+            store.finishRun(owned, { outcome: "failed", reason: "interrupted", now, stopSettlement: "interrupted" });
         }
-        store.finishRun(runId, {
-            outcome: "failed",
-            reason: "interrupted",
-            ...(args.committed === undefined ? {} : { committed: args.committed }),
-            now,
-            stopSettlement: "interrupted",
-        });
-        store.settleRunStop(stopRun, "interrupted", now);
-        if (fenced)
-            return { ok: true, stopRun, requeued: false, fenced: true };
-        // Back to the queue, where the stop's hold keeps it — a paused task
-        // reads as queued-and-held, exactly like an operator pause.
-        const requeued = db
-            .prepare("UPDATE task SET state = 'queued', updated_at = ? WHERE id = ? AND state = 'running'")
-            .run(now.toISOString(), taskId);
-        store.bumpWake();
-        return { ok: true, stopRun, requeued: Number(requeued.changes) > 0, fenced: false };
+    }
+    store.finishRun(runId, {
+        outcome: "failed",
+        reason: "interrupted",
+        ...(args.committed === undefined ? {} : { committed: args.committed }),
+        now,
+        stopSettlement: "interrupted",
     });
+    store.settleRunStop(stopRun, "interrupted", now);
+    if (fenced)
+        return { ok: true, stopRun, requeued: false, fenced: true };
+    // Back to the queue, where the stop's hold keeps it — a paused task
+    // reads as queued-and-held, exactly like an operator pause.
+    const requeued = db
+        .prepare("UPDATE task SET state = 'queued', updated_at = ? WHERE id = ? AND state = 'running'")
+        .run(now.toISOString(), taskId);
+    store.bumpWake();
+    return { ok: true, stopRun, requeued: Number(requeued.changes) > 0, fenced: false };
 }
 /**
  * Hand an attempt back because the SERVICE stopped (its builder is
@@ -1014,37 +775,29 @@ export function finalizeInterruptedFenced(store, args) {
  * resumes it. A lease the world moved past still ends the run, touching no
  * task state.
  */
-export function finalizeHandBackFenced(store, args) {
-    const { leaseId, runId, taskId, now } = args;
+function sealHandBack(store, leaseId, args) {
+    const { runId, taskId, now } = args;
     const db = store.handle;
-    return inTransaction(store, () => {
-        const run = store.getRun(runId);
-        if (run === null || run.leaseId !== leaseId || run.outcome !== null) {
-            throw new Error(`run ${runId} is not ${leaseId}'s open attempt — a hand-back seals exactly one`);
-        }
-        const { changes } = db
-            .prepare(`UPDATE claim SET released_at = ?, released_by = 'interrupted'
-          WHERE lease_id = ? AND released_at IS NULL AND ${NOT_SUPERSEDED}`)
-            .run(now.toISOString(), leaseId);
-        const fenced = Number(changes) === 0;
-        if (args.message.trim() !== "")
-            store.recordOutcomeFacts(runId, { handoff: args.message });
-        for (const owned of store.ownedRunsOf(runId)) {
-            if (owned === runId)
-                continue;
-            const child = store.getRun(owned);
-            if (child !== null && child.outcome === null)
-                store.finishRun(owned, { outcome: "failed", reason: "interrupted", now });
-        }
-        store.finishRun(runId, { outcome: "failed", reason: "interrupted", now });
-        if (fenced)
-            return { ok: true, requeued: false, fenced: true };
-        const requeued = db
-            .prepare("UPDATE task SET state = 'queued', updated_at = ? WHERE id = ? AND state = 'running'")
-            .run(now.toISOString(), taskId);
-        store.bumpWake();
-        return { ok: true, requeued: Number(requeued.changes) > 0, fenced: false };
-    });
+    const run = openAttempt(store, leaseId, runId, "a hand-back");
+    // A lease the world moved past still ends its run as interrupted — that IS the honest ending — touching no task state.
+    const fenced = !releaseAs(store, leaseId, "interrupted", now);
+    if (args.message.trim() !== "")
+        store.recordOutcomeFacts(runId, { handoff: args.message });
+    for (const owned of store.ownedRunsOf(runId)) {
+        if (owned === runId)
+            continue;
+        const child = store.getRun(owned);
+        if (child !== null && child.outcome === null)
+            store.finishRun(owned, { outcome: "failed", reason: "interrupted", now });
+    }
+    store.finishRun(runId, { outcome: "failed", reason: "interrupted", now });
+    if (fenced)
+        return { ok: true, requeued: false, fenced: true };
+    const requeued = db
+        .prepare("UPDATE task SET state = 'queued', updated_at = ? WHERE id = ? AND state = 'running'")
+        .run(now.toISOString(), taskId);
+    store.bumpWake();
+    return { ok: true, requeued: Number(requeued.changes) > 0, fenced: false };
 }
 /**
  * THE STOP FENCE at settlement (v52): when a stop applies to the run —
@@ -1060,11 +813,12 @@ export function interruptIfStopped(store, args) {
         return null;
     const run = store.getRun(args.runId);
     const where = run?.worktree ?? null;
-    return finalizeInterruptedFenced(store, {
-        ...args,
+    const { leaseId, ...rest } = args;
+    return inTransaction(store, () => sealInterrupted(store, leaseId, {
+        ...rest,
         stopRun: stop.run,
         message: args.message ?? `stopped by ${stop.requestedBy} (run #${stop.run}) — ${where === null ? "the attempt's evidence is on record" : `the work is preserved in ${where}`}`,
-    });
+    }));
 }
 /**
  * Seal a failed attempt: one fenced transaction for the release, the run,
@@ -1081,104 +835,91 @@ export function interruptIfStopped(store, args) {
  * worktree holds unpreserved work, ordinary re-pooling would refuse it as
  * dirty forever, so it is an immediate incident naming the checkout.
  */
-export function finalizeFailureFenced(store, args) {
-    const { leaseId, runId, taskId, failureClass, message, now } = args;
+function sealFailure(store, leaseId, args) {
+    const { runId, taskId, failureClass, message, now } = args;
     const db = store.handle;
-    return inTransaction(store, () => {
-        const run = store.getRun(runId);
-        if (run === null || run.leaseId !== leaseId || run.outcome !== null) {
-            throw new Error(`run ${runId} is not ${leaseId}'s open attempt — a failure seals exactly one`);
-        }
-        if (run.role !== "builder") {
-            throw new Error(`run ${runId} is a ${run.role} run — only top-level builder attempts take strikes`);
-        }
-        const stopped = interruptIfStopped(store, { leaseId, runId, taskId, now });
-        if (stopped !== null)
-            return { ok: false, reason: "stopped" };
-        const { changes } = db
-            .prepare(`UPDATE claim SET released_at = ?, released_by = 'released'
-          WHERE lease_id = ? AND released_at IS NULL AND ${NOT_SUPERSEDED}`)
-            .run(now.toISOString(), leaseId);
-        if (Number(changes) === 0) {
-            store.finishRun(runId, { outcome: "refused", reason: "fenced", now });
-            return refusal(db, leaseId);
-        }
-        // A sign-in that no longer works is not the attempt's fault: no strike,
-        // no retry, the task back in the queue, and its provider paused.
-        if (failureClass !== "commit-failure" && run.terminalClass === "auth-expired") {
-            return { ok: true, ...sealAuthExpired(store, run, taskId, now) };
-        }
-        store.finishRun(runId, { outcome: "failed", reason: failureClass, now });
-        if (failureClass === "commit-failure") {
-            // The work exists and is uncommitted; nothing times its way out of
-            // that. A person (or an explicit repair) proves the checkout.
-            const incidentId = store.createIncident({ run: runId, kind: "commit-failure" }, now);
-            store.holdOwned({
-                taskRef: run.taskRef,
-                ownerKind: "incident",
-                ownerId: String(incidentId),
-                reason: `commit-failure — uncommitted work preserved in ${args.worktree}`,
-                until: null,
-            }, now);
-            store.enqueueNotification({
-                source: { run: runId },
-                dedupeKey: `commit-failure:${runId}`,
-                kind: "commit-failure",
-                pushClass: "attention",
-                link: `/r/${runId}`,
-                subject: `${taskId}: the commit itself failed`,
-                body: `${oneLine(message, 200)}\nThe work is preserved, uncommitted, in ${args.worktree}. Prove it and \`toolroll task requeue ${taskId}\`.`,
-            }, now);
-            return { ok: true, disposition: "commit-incident", incidentId };
-        }
-        const strikes = store.addStrike(run.taskRef);
-        if (strikes >= MAX_STRIKES) {
-            const incidentId = store.createIncident({ run: runId, kind: "attempts-exhausted" }, now);
-            store.holdOwned({
-                taskRef: run.taskRef,
-                ownerKind: "incident",
-                ownerId: String(incidentId),
-                reason: `attempts-exhausted — ${strikes} consecutive failures, last: ${failureClass}`,
-                until: null,
-            }, now);
-            db.prepare("UPDATE task SET state = 'failed', updated_at = ? WHERE id = ?").run(now.toISOString(), taskId);
-            store.enqueueNotification({
-                source: { run: runId },
-                dedupeKey: `stalled:${run.taskRef}`,
-                kind: "attempts-exhausted",
-                pushClass: "attention",
-                link: `/r/${runId}`,
-                subject: `${taskId} stalled after ${strikes} straight failures`,
-                body: `Last failure (${failureClass}): ${oneLine(message, 200)}\nIt will not be retried. Read the runs, then \`toolroll task requeue ${taskId}\`.`,
-            }, now);
-            return { ok: true, disposition: "stalled", strikes, incidentId };
-        }
-        // Under the limit: requeue behind a doubling pause the failure owns.
-        // Replacing the previous backoff hold is correct — this attempt's strike
-        // already reflects the whole streak.
-        const wait = BACKOFF_MS[Math.min(strikes, BACKOFF_MS.length) - 1];
-        const until = new Date(now.getTime() + wait);
+    const run = openAttempt(store, leaseId, runId, "a failure", "builder");
+    const stopped = interruptIfStopped(store, { leaseId, runId, taskId, now });
+    if (stopped !== null)
+        return { ok: false, reason: "stopped" };
+    const fenced = releaseOrRefuse(store, leaseId, "released", runId, now);
+    if (fenced !== null)
+        return fenced;
+    // A sign-in that no longer works is not the attempt's fault: no strike,
+    // no retry, the task back in the queue, and its provider paused.
+    if (failureClass !== "commit-failure" && run.terminalClass === "auth-expired") {
+        return { ok: true, ...sealAuthExpired(store, run, taskId, now) };
+    }
+    store.finishRun(runId, { outcome: "failed", reason: failureClass, now });
+    if (failureClass === "commit-failure") {
+        // The work exists and is uncommitted; nothing times its way out of
+        // that. A person (or an explicit repair) proves the checkout.
+        const incidentId = store.createIncident({ run: runId, kind: "commit-failure" }, now);
         store.holdOwned({
             taskRef: run.taskRef,
-            ownerKind: "backoff",
-            ownerId: String(run.taskRef),
-            // Run 2085: this failure is named in plain words wherever the hold shows.
-            reason: failureClass === "no-handoff"
-                ? `The agent stopped before handing off; its work was kept and it is being resumed (retry ${strikes}/${MAX_STRIKES} in ${Math.round(wait / 60_000)}m)`
-                : `retry ${strikes}/${MAX_STRIKES} after ${failureClass} — backing off ${Math.round(wait / 60_000)}m`,
-            until,
+            ownerKind: "incident",
+            ownerId: String(incidentId),
+            reason: `commit-failure — uncommitted work preserved in ${args.worktree}`,
+            until: null,
         }, now);
         store.enqueueNotification({
             source: { run: runId },
-            dedupeKey: `run:${runId}:failed`,
-            kind: "build-failed",
-            subject: failureClass === "no-handoff"
-                ? `${taskId}: the agent stopped before handing off; its work was kept, retry ${strikes}/${MAX_STRIKES}`
-                : `${taskId}: attempt failed (${failureClass}), retry ${strikes}/${MAX_STRIKES}`,
-            body: `${oneLine(message, 200)}\nNext attempt no earlier than ${until.toISOString()}.`,
+            dedupeKey: `commit-failure:${runId}`,
+            kind: "commit-failure",
+            pushClass: "attention",
+            link: `/r/${runId}`,
+            subject: `${taskId}: the commit itself failed`,
+            body: `${oneLine(message, 200)}\nThe work is preserved, uncommitted, in ${args.worktree}. Prove it and \`toolroll task requeue ${taskId}\`.`,
         }, now);
-        return { ok: true, disposition: "backoff", strikes, until: until.toISOString() };
-    });
+        return { ok: true, disposition: "commit-incident", incidentId };
+    }
+    const strikes = store.addStrike(run.taskRef);
+    if (strikes >= MAX_STRIKES) {
+        const incidentId = store.createIncident({ run: runId, kind: "attempts-exhausted" }, now);
+        store.holdOwned({
+            taskRef: run.taskRef,
+            ownerKind: "incident",
+            ownerId: String(incidentId),
+            reason: `attempts-exhausted — ${strikes} consecutive failures, last: ${failureClass}`,
+            until: null,
+        }, now);
+        db.prepare("UPDATE task SET state = 'failed', updated_at = ? WHERE id = ?").run(now.toISOString(), taskId);
+        store.enqueueNotification({
+            source: { run: runId },
+            dedupeKey: `stalled:${run.taskRef}`,
+            kind: "attempts-exhausted",
+            pushClass: "attention",
+            link: `/r/${runId}`,
+            subject: `${taskId} stalled after ${strikes} straight failures`,
+            body: `Last failure (${failureClass}): ${oneLine(message, 200)}\nIt will not be retried. Read the runs, then \`toolroll task requeue ${taskId}\`.`,
+        }, now);
+        return { ok: true, disposition: "stalled", strikes, incidentId };
+    }
+    // Under the limit: requeue behind a doubling pause the failure owns.
+    // Replacing the previous backoff hold is correct — this attempt's strike
+    // already reflects the whole streak.
+    const wait = BACKOFF_MS[Math.min(strikes, BACKOFF_MS.length) - 1];
+    const until = new Date(now.getTime() + wait);
+    store.holdOwned({
+        taskRef: run.taskRef,
+        ownerKind: "backoff",
+        ownerId: String(run.taskRef),
+        // Run 2085: this failure is named in plain words wherever the hold shows.
+        reason: failureClass === "no-handoff"
+            ? `The agent stopped before handing off; its work was kept and it is being resumed (retry ${strikes}/${MAX_STRIKES} in ${Math.round(wait / 60_000)}m)`
+            : `retry ${strikes}/${MAX_STRIKES} after ${failureClass} — backing off ${Math.round(wait / 60_000)}m`,
+        until,
+    }, now);
+    store.enqueueNotification({
+        source: { run: runId },
+        dedupeKey: `run:${runId}:failed`,
+        kind: "build-failed",
+        subject: failureClass === "no-handoff"
+            ? `${taskId}: the agent stopped before handing off; its work was kept, retry ${strikes}/${MAX_STRIKES}`
+            : `${taskId}: attempt failed (${failureClass}), retry ${strikes}/${MAX_STRIKES}`,
+        body: `${oneLine(message, 200)}\nNext attempt no earlier than ${until.toISOString()}.`,
+    }, now);
+    return { ok: true, disposition: "backoff", strikes, until: until.toISOString() };
 }
 /**
  * The auth-expired ending, inside the caller's fenced transaction (claim
@@ -1212,8 +953,8 @@ const PLAN_BACKOFF_MS = [60_000, 2 * 60_000, 4 * 60_000];
  * will restate), which is why this is the park discipline, not the DONE
  * one (Codex planning review, question 2).
  */
-export function finalizePlanFenced(store, args) {
-    const { leaseId, runId, taskId, plan, now } = args;
+function sealPlan(store, leaseId, args) {
+    const { runId, taskId, plan, now } = args;
     const db = store.handle;
     // The ingestion record (contract handoff, task 1) is composed here from
     // the filed terms and the drafted plan; its file and row land inside the
@@ -1233,174 +974,151 @@ export function finalizePlanFenced(store, args) {
             amendment,
             changes: contractChanges,
         };
-    return inTransaction(store, () => {
-        const run = store.getRun(runId);
-        if (run === null || run.leaseId !== leaseId || run.outcome !== null) {
-            throw new Error(`run ${runId} is not ${leaseId}'s open attempt — a plan seals exactly one`);
+    const run = openAttempt(store, leaseId, runId, "a plan", "planner");
+    const repairRun = plannerRepairChild(store, run, args.repairRunId ?? null);
+    if (store.lookupRef(taskId)?.id !== run.taskRef)
+        throw new Error("a planner can finalize only its own task");
+    const stopped = interruptIfStopped(store, { leaseId, runId, taskId, now });
+    if (stopped !== null)
+        return { ok: false, reason: "stopped" };
+    const invalidSource = (detail, kind = "malformed") => {
+        const failed = sealPlanFailure(store, leaseId, { runId, taskId, failure: kind, message: detail, now });
+        if (repairRun !== null)
+            store.finishRun(repairRun.id, { outcome: "refused", reason: failed.ok ? "source-invalid" : "fenced", now });
+        return failed.ok ? { ok: false, reason: "source-invalid", detail } : failed;
+    };
+    const sources = store.artifactsFor(runId).filter(one => one.kind === "plan-contract" && one.key.endsWith("/planner-source.json"));
+    // Legacy rows have no input stamp or artifact. Every current dispatch
+    // stamps even an empty scope; dropping a caller argument cannot bypass custody.
+    if (args.source !== undefined || sources.length > 0 || run.scopeDigest !== null) {
+        if (args.source === undefined || args.evidenceRoot === undefined || sources.length !== 1 || sources[0].id !== args.sourceArtifact) {
+            return invalidSource("the planner's admitted source inventory is missing, ambiguous, or was not presented");
+        }
+        const artifact = sources[0];
+        let verified;
+        try {
+            verified = readVerifiedArtifact(args.evidenceRoot, artifact);
+        }
+        catch {
+            return invalidSource("the planner source file cannot be read");
         }
-        if (run.role !== "planner") {
-            throw new Error(`run ${runId} is a ${run.role} run — only planner runs draft plans`);
+        if (!verified.ok || artifact.truncated)
+            return invalidSource("the planner source bytes no longer verify");
+        const recorded = decodePlannerSource(verified.content);
+        if (recorded === null || recorded.taskId !== taskId || !verified.content.equals(encodePlannerSource(args.source)) || run.scopeDigest !== (recorded.contract.scope?.digest ?? "")) {
+            return invalidSource("the supplied planning source is not the source recorded for this run");
         }
-        const repairRun = plannerRepairChild(store, run, args.repairRunId ?? null);
-        if (store.lookupRef(taskId)?.id !== run.taskRef)
-            throw new Error("a planner can finalize only its own task");
-        const stopped = interruptIfStopped(store, { leaseId, runId, taskId, now });
-        if (stopped !== null)
-            return { ok: false, reason: "stopped" };
-        const invalidSource = (detail, kind = "malformed") => {
-            const failed = finalizePlanFailureFenced(store, { leaseId, runId, taskId, kind, message: detail, now });
+        if (contractChanges.length > 0 && (typeof amendment !== "string" || !amendment.trim() || amendment.length > PLANNER_SOURCE_LIMITS.amendment)) {
+            return invalidSource("a planner changed the filed contract without a bounded, explicit amendment");
+        }
+    }
+    // THE SOURCE RECHECK (contract handoff, task 1): the filed request is
+    // re-derived from durable state inside this very transaction and must
+    // still be the one the planner read. A scope rewritten, approved, or
+    // re-termed while the planner ran is the NEWER source; an old draft
+    // never overwrites it. The attempt ends refused in words — no strike,
+    // the planner did nothing wrong — and the task stays requested. The
+    // claim releases under the same fence the ingestion would have used.
+    if (args.source !== undefined) {
+        const current = plannerContractOf(store, taskId);
+        const currentDigest = current.ok ? plannerSourceDigest(current.contract) : null;
+        const currentAnswers = store.answeredDecisionsFor(taskId, PLANNER_SOURCE_LIMITS.answers + 1).map(one => ({ question: one.question, choice: one.choice ?? "", note: one.note }));
+        if (currentDigest !== args.source.sourceDigest || canonicalContractJson(currentAnswers) !== canonicalContractJson(args.source.answers)) {
+            const detail = current.ok
+                ? describeSourceDrift(args.source, current.contract)
+                : `the filed request can no longer be read: ${current.message}`;
+            const fenced = releaseOrRefuse(store, leaseId, "released", runId, now, repairRun);
+            if (fenced !== null)
+                return fenced;
             if (repairRun !== null)
-                store.finishRun(repairRun.id, { outcome: "refused", reason: failed.ok ? "source-invalid" : "fenced", now });
-            return failed.ok ? { ok: false, reason: "source-invalid", detail } : failed;
-        };
-        const sources = store.artifactsFor(runId).filter(one => one.kind === "plan-contract" && one.key.endsWith("/planner-source.json"));
-        // Legacy rows have no input stamp or artifact. Every current dispatch
-        // stamps even an empty scope; dropping a caller argument cannot bypass custody.
-        if (args.source !== undefined || sources.length > 0 || run.scopeDigest !== null) {
-            if (args.source === undefined || args.evidenceRoot === undefined || sources.length !== 1 || sources[0].id !== args.sourceArtifact) {
-                return invalidSource("the planner's admitted source inventory is missing, ambiguous, or was not presented");
-            }
-            const artifact = sources[0];
-            let verified;
-            try {
-                verified = readVerifiedArtifact(args.evidenceRoot, artifact);
-            }
-            catch {
-                return invalidSource("the planner source file cannot be read");
-            }
-            if (!verified.ok || artifact.truncated)
-                return invalidSource("the planner source bytes no longer verify");
-            const recorded = decodePlannerSource(verified.content);
-            if (recorded === null || recorded.taskId !== taskId || !verified.content.equals(encodePlannerSource(args.source)) || run.scopeDigest !== (recorded.contract.scope?.digest ?? "")) {
-                return invalidSource("the supplied planning source is not the source recorded for this run");
-            }
-            if (contractChanges.length > 0 && (typeof amendment !== "string" || !amendment.trim() || amendment.length > PLANNER_SOURCE_LIMITS.amendment)) {
-                return invalidSource("a planner changed the filed contract without a bounded, explicit amendment");
-            }
+                store.finishRun(repairRun.id, { outcome: "refused", reason: "stale-source", now });
+            store.finishRun(runId, { outcome: "refused", reason: "stale-source", now });
+            store.enqueueNotification({
+                source: { run: runId },
+                dedupeKey: `plan-stale-source:${run.taskRef}:${runId}`,
+                kind: "plan-stale-source",
+                link: `/t/${encodeURIComponent(taskId)}`,
+                subject: `${taskId}: the filed request changed while the planner ran`,
+                body: `${oneLine(detail, 300)}\nNothing from that draft was ingested; the current terms stand and the next pass plans against them.`,
+            }, now);
+            return { ok: false, reason: "stale-source", detail };
         }
-        // THE SOURCE RECHECK (contract handoff, task 1): the filed request is
-        // re-derived from durable state inside this very transaction and must
-        // still be the one the planner read. A scope rewritten, approved, or
-        // re-termed while the planner ran is the NEWER source; an old draft
-        // never overwrites it. The attempt ends refused in words — no strike,
-        // the planner did nothing wrong — and the task stays requested. The
-        // claim releases under the same fence the ingestion would have used.
-        if (args.source !== undefined) {
-            const current = plannerContractOf(store, taskId);
-            const currentDigest = current.ok ? plannerSourceDigest(current.contract) : null;
-            const currentAnswers = store.answeredDecisionsFor(taskId, PLANNER_SOURCE_LIMITS.answers + 1).map(one => ({ question: one.question, choice: one.choice ?? "", note: one.note }));
-            if (currentDigest !== args.source.sourceDigest || canonicalContractJson(currentAnswers) !== canonicalContractJson(args.source.answers)) {
-                const detail = current.ok
-                    ? describeSourceDrift(args.source, current.contract)
-                    : `the filed request can no longer be read: ${current.message}`;
-                const released = db
-                    .prepare(`UPDATE claim SET released_at = ?, released_by = 'released'
-              WHERE lease_id = ? AND released_at IS NULL AND ${NOT_SUPERSEDED}`)
-                    .run(now.toISOString(), leaseId);
-                if (Number(released.changes) === 0) {
-                    if (repairRun !== null)
-                        store.finishRun(repairRun.id, { outcome: "refused", reason: "fenced", now });
-                    store.finishRun(runId, { outcome: "refused", reason: "fenced", now });
-                    return refusal(db, leaseId);
-                }
-                if (repairRun !== null)
-                    store.finishRun(repairRun.id, { outcome: "refused", reason: "stale-source", now });
-                store.finishRun(runId, { outcome: "refused", reason: "stale-source", now });
-                store.enqueueNotification({
-                    source: { run: runId },
-                    dedupeKey: `plan-stale-source:${run.taskRef}:${runId}`,
-                    kind: "plan-stale-source",
-                    link: `/t/${encodeURIComponent(taskId)}`,
-                    subject: `${taskId}: the filed request changed while the planner ran`,
-                    body: `${oneLine(detail, 300)}\nNothing from that draft was ingested; the current terms stand and the next pass plans against them.`,
-                }, now);
-                return { ok: false, reason: "stale-source", detail };
+    }
+    if (record !== null && args.evidenceRoot !== undefined) {
+        const recordBytes = encodePlanContractRecord(record);
+        if (recordBytes.length > EVIDENCE_CAPS["plan-contract"])
+            return invalidSource("the required plan amendment record exceeds its explicit evidence cap");
+        try {
+            const recordId = storeEvidence(store, args.evidenceRoot, runId, "plan-contract", "plan-contract.json", recordBytes, record.changes.length === 0
+                ? "plan ingestion: filed contract reproduced exactly (verified tree)"
+                : `plan ingestion: ${record.changes.length} contract change(s), amendment ${record.amendment === null ? "absent" : "stated"} (verified tree)`, now, { captureStatus: "ok" });
+            const captured = store.getArtifact(recordId);
+            if (captured === null || captured.truncated || !readVerifiedArtifact(args.evidenceRoot, captured).ok) {
+                return invalidSource("the required plan contract record did not seal completely", "failure");
             }
         }
-        if (record !== null && args.evidenceRoot !== undefined) {
-            const recordBytes = encodePlanContractRecord(record);
-            if (recordBytes.length > EVIDENCE_CAPS["plan-contract"])
-                return invalidSource("the required plan amendment record exceeds its explicit evidence cap");
+        catch {
+            return invalidSource("the required plan contract record could not be saved", "failure");
+        }
+    }
+    const fenced = releaseOrRefuse(store, leaseId, "completed", runId, now, repairRun);
+    if (fenced !== null)
+        return fenced;
+    store.saveScope({
+        taskId,
+        goal: plan.goal,
+        outOfScope: plan.outOfScope,
+        touches: plan.touches,
+        acceptance: plan.acceptance,
+        proposedAt: now.toISOString(),
+        digest: digestOf({ goal: plan.goal, outOfScope: plan.outOfScope, touches: plan.touches, acceptance: plan.acceptance }),
+        budgetMicrousd: filed?.terms.budgetMicrousd ?? null,
+        approvedAt: null,
+        approvedBy: null,
+        approvedDigest: null,
+    }, {}, filed === null ? {} : {
+        proposedVia: filed.proposedVia,
+        qualityMode: filed.terms.qualityMode,
+        ...(filed.terms.profile == null ? {} : { profile: filed.terms.profile }),
+        ...(filed.terms.profile != null && routeFromJson(filed.terms.routeJson) !== null &&
+            canonicalContractJson([...new Set(filed.acceptance.flatMap(one => one.evidence))].sort()) === canonicalContractJson([...new Set(plan.acceptance.flatMap(one => one.evidence))].sort())
+            ? { route: routeFromJson(filed.terms.routeJson) } : {}),
+    });
+    let verifiedPlan = false;
+    if (args.artifact !== null) {
+        const artifactId = store.saveArtifact({ run: runId, kind: "plan", ...args.artifact }, now);
+        if (args.evidenceRoot !== undefined && !args.artifact.truncated) {
             try {
-                const recordId = storeEvidence(store, args.evidenceRoot, runId, "plan-contract", "plan-contract.json", recordBytes, record.changes.length === 0
-                    ? "plan ingestion: filed contract reproduced exactly (verified tree)"
-                    : `plan ingestion: ${record.changes.length} contract change(s), amendment ${record.amendment === null ? "absent" : "stated"} (verified tree)`, now, { captureStatus: "ok" });
-                const captured = store.getArtifact(recordId);
-                if (captured === null || captured.truncated || !readVerifiedArtifact(args.evidenceRoot, captured).ok) {
-                    return invalidSource("the required plan contract record did not seal completely", "failure");
-                }
+                const captured = store.getArtifact(artifactId);
+                const verified = captured === null ? null : readVerifiedArtifact(args.evidenceRoot, captured);
+                verifiedPlan = verified?.ok === true && verified.content.equals(Buffer.from(plan.plan, "utf8")) && parseExecutionPlanDocument(plan.plan).ok;
             }
             catch {
-                return invalidSource("the required plan contract record could not be saved", "failure");
-            }
-        }
-        const { changes } = db
-            .prepare(`UPDATE claim SET released_at = ?, released_by = 'completed'
-          WHERE lease_id = ? AND released_at IS NULL AND ${NOT_SUPERSEDED}`)
-            .run(now.toISOString(), leaseId);
-        if (Number(changes) === 0) {
-            if (repairRun !== null)
-                store.finishRun(repairRun.id, { outcome: "refused", reason: "fenced", now });
-            store.finishRun(runId, { outcome: "refused", reason: "fenced", now });
-            return refusal(db, leaseId);
-        }
-        store.saveScope({
-            taskId,
-            goal: plan.goal,
-            outOfScope: plan.outOfScope,
-            touches: plan.touches,
-            acceptance: plan.acceptance,
-            proposedAt: now.toISOString(),
-            digest: digestOf({ goal: plan.goal, outOfScope: plan.outOfScope, touches: plan.touches, acceptance: plan.acceptance }),
-            budgetMicrousd: filed?.terms.budgetMicrousd ?? null,
-            approvedAt: null,
-            approvedBy: null,
-            approvedDigest: null,
-        }, {}, filed === null ? {} : {
-            proposedVia: filed.proposedVia,
-            riskLevel: filed.terms.riskLevel,
-            qualityMode: filed.terms.qualityMode,
-            ...(filed.terms.profile == null ? {} : { profile: filed.terms.profile }),
-            ...(filed.terms.profile != null && routeFromJson(filed.terms.routeJson) !== null &&
-                canonicalContractJson([...new Set(filed.acceptance.flatMap(one => one.evidence))].sort()) === canonicalContractJson([...new Set(plan.acceptance.flatMap(one => one.evidence))].sort())
-                ? { route: routeFromJson(filed.terms.routeJson) } : {}),
-        });
-        let verifiedPlan = false;
-        if (args.artifact !== null) {
-            const artifactId = store.saveArtifact({ run: runId, kind: "plan", ...args.artifact }, now);
-            if (args.evidenceRoot !== undefined && !args.artifact.truncated) {
-                try {
-                    const captured = store.getArtifact(artifactId);
-                    const verified = captured === null ? null : readVerifiedArtifact(args.evidenceRoot, captured);
-                    verifiedPlan = verified?.ok === true && verified.content.equals(Buffer.from(plan.plan, "utf8")) && parseExecutionPlanDocument(plan.plan).ok;
-                }
-                catch {
-                    verifiedPlan = false;
-                }
+                verifiedPlan = false;
             }
         }
-        store.setPlanState(run.taskRef, "drafted");
-        const autoApproved = sealUnchangedPlanUnderMode(store, taskId, args.source?.sourceDigest ?? "", runId, args.source !== undefined && filed !== null && contractChanges.length === 0 && amendment === null && verifiedPlan, now);
-        store.resetPlanStrikes(run.taskRef);
-        store.finishRun(runId, { outcome: "built", reason: "plan-drafted", now });
-        if (repairRun !== null) {
-            store.finishRun(repairRun.id, { outcome: "no-change", reason: "structured planner output repaired", now });
-        }
-        store.enqueueNotification({
-            source: { run: runId },
-            dedupeKey: `plan:${run.taskRef}:${runId}`,
-            kind: "plan-ready",
-            subject: autoApproved ? `${taskId}: unchanged plan auto-approved` : `${taskId}: plan ready for review${contractChanges.length === 0 ? "" : ` — ${contractChanges.length} contract change${contractChanges.length === 1 ? "" : "s"} to check`}`,
-            body: `The planner proposes: ${oneLine(plan.goal, 200)}\n` +
-                (contractChanges.length === 0
-                    ? filed === null
-                        ? ""
-                        : "The filed goal, exclusions, touches, and acceptance criteria are reproduced exactly.\n"
-                    : `It AMENDS the filed contract (${oneLine(describeContractChanges(contractChanges).join("; "), 300)})${amendment === null ? "" : ` — because: ${oneLine(amendment, 200)}`}\n`) +
-                (autoApproved ? "Approved under the signed operating mode. The next build may proceed with the original terms and required quality checks." : "Review, edit, and approve the scope — nothing builds until you do."),
-        }, now);
-        return { ok: true, changes: contractChanges.length, amendment };
-    });
+    }
+    store.setPlanState(run.taskRef, "drafted");
+    const autoApproved = sealUnchangedPlanUnderMode(store, taskId, args.source?.sourceDigest ?? "", runId, args.source !== undefined && filed !== null && contractChanges.length === 0 && amendment === null && verifiedPlan, now);
+    store.resetPlanStrikes(run.taskRef);
+    store.finishRun(runId, { outcome: "built", reason: "plan-drafted", now });
+    if (repairRun !== null) {
+        store.finishRun(repairRun.id, { outcome: "no-change", reason: "structured planner output repaired", now });
+    }
+    store.enqueueNotification({
+        source: { run: runId },
+        dedupeKey: `plan:${run.taskRef}:${runId}`,
+        kind: "plan-ready",
+        subject: autoApproved ? `${taskId}: unchanged plan auto-approved` : `${taskId}: plan ready for review${contractChanges.length === 0 ? "" : ` — ${contractChanges.length} contract change${contractChanges.length === 1 ? "" : "s"} to check`}`,
+        body: `The planner proposes: ${oneLine(plan.goal, 200)}\n` +
+            (contractChanges.length === 0
+                ? filed === null
+                    ? ""
+                    : "The filed goal, exclusions, touches, and acceptance criteria are reproduced exactly.\n"
+                : `It AMENDS the filed contract (${oneLine(describeContractChanges(contractChanges).join("; "), 300)})${amendment === null ? "" : ` — because: ${oneLine(amendment, 200)}`}\n`) +
+            (autoApproved ? "Approved under the signed operating mode. The next build may proceed with the original terms and required quality checks." : "Review, edit, and approve the scope — nothing builds until you do."),
+    }, now);
+    return { ok: true, changes: contractChanges.length, amendment };
 }
 /** Which part of the filed request moved, in words — for the refusal,
  * the page, and the notification. */
@@ -1434,7 +1152,7 @@ function describeSourceDrift(source, current) {
  * without committing — the park discipline, applied to the road rather than
  * to a question. The ledger row, the hold when one is owed, the run's
  * outcome, and the page exist together or, if the lease was superseded,
- * not at all. Structurally `finalizePlanFenced`'s twin: the same
+ * not at all. Structurally the plan ending's twin: the same
  * open-attempt assertion, the same fenced release, the same all-or-nothing
  * transaction.
  *
@@ -1460,56 +1178,42 @@ function describeSourceDrift(source, current) {
  * finished as `refused`, reusing the existing outcome vocabulary rather
  * than growing it: no work was committed, and nothing failed.
  */
-export function finalizeRevisionFenced(store, args) {
-    const { leaseId, runId, taskId, taskRef, revision, now } = args;
-    const db = store.handle;
-    return inTransaction(store, () => {
-        const run = store.getRun(runId);
-        if (run === null || run.leaseId !== leaseId || run.outcome !== null) {
-            throw new Error(`run ${runId} is not ${leaseId}'s open attempt — a plan revision seals exactly one`);
-        }
-        if (run.role !== "builder") {
-            throw new Error(`run ${runId} is a ${run.role} run — only builder runs file plan revisions`);
-        }
-        const stopped = interruptIfStopped(store, { leaseId, runId, taskId, now });
-        if (stopped !== null)
-            return { ok: false, reason: "stopped" };
-        const { changes } = db
-            .prepare(`UPDATE claim SET released_at = ?, released_by = 'released'
-          WHERE lease_id = ? AND released_at IS NULL AND ${NOT_SUPERSEDED}`)
-            .run(now.toISOString(), leaseId);
-        if (Number(changes) === 0) {
-            store.finishRun(runId, { outcome: "refused", reason: "fenced", now });
-            return refusal(db, leaseId);
-        }
-        const applied = revision.authorityKind === "plan-only";
-        const revisionId = store.insertPlanRevision({ taskRef, ...revision, kind: "builder-proposal", status: applied ? "applied" : "blocked" }, now);
-        const moved = revision.changedFields
-            .map(field => (field === "signed-scope" ? "the signed scope" : "publication authority"))
-            .join(" and ");
-        if (!applied) {
-            store.holdOwned({
-                taskRef,
-                ownerKind: "revision",
-                ownerId: String(revisionId),
-                reason: `plan-revision-blocked — ${moved} changed while this build ran, so revision ${revision.revision} waits for a person`,
-                until: null,
-            }, now);
-        }
-        store.finishRun(runId, { outcome: "refused", reason: applied ? "plan-revised" : "plan-revision-blocked", now });
-        store.enqueueNotification({
-            source: { run: runId },
-            dedupeKey: `plan-revision:${taskRef}:${revisionId}`,
-            kind: applied ? "plan-revised" : "plan-revision-blocked",
-            ...(applied ? {} : { pushClass: "attention" }),
-            link: `/t/${encodeURIComponent(taskId)}`,
-            subject: `${taskId}: plan revision ${revision.revision} ${applied ? "applied — resuming" : "awaiting your approval"}`,
-            body: applied
-                ? `The build found the plan wrong and rewrote it: ${oneLine(revision.reason, 200)}\nEvidence: ${oneLine(revision.evidenceLink ?? "none given", 200)}\nNothing was committed. The next attempt builds against the new plan.`
-                : `The build proposed a new plan, but ${moved} changed while it ran — so nothing was applied: ${oneLine(revision.reason, 200)}\nEvidence: ${oneLine(revision.evidenceLink ?? "none given", 200)}\nNothing runs on this task until you accept or reject the revision.`,
+function sealRevision(store, leaseId, args) {
+    const { runId, taskId, taskRef, revision, now } = args;
+    const run = openAttempt(store, leaseId, runId, "a plan revision", "builder");
+    const stopped = interruptIfStopped(store, { leaseId, runId, taskId, now });
+    if (stopped !== null)
+        return { ok: false, reason: "stopped" };
+    const fenced = releaseOrRefuse(store, leaseId, "released", runId, now);
+    if (fenced !== null)
+        return fenced;
+    const applied = revision.authorityKind === "plan-only";
+    const revisionId = store.insertPlanRevision({ taskRef, ...revision, kind: "builder-proposal", status: applied ? "applied" : "blocked" }, now);
+    const moved = revision.changedFields
+        .map(field => (field === "signed-scope" ? "the signed scope" : "publication authority"))
+        .join(" and ");
+    if (!applied) {
+        store.holdOwned({
+            taskRef,
+            ownerKind: "revision",
+            ownerId: String(revisionId),
+            reason: `plan-revision-blocked — ${moved} changed while this build ran, so revision ${revision.revision} waits for a person`,
+            until: null,
         }, now);
-        return { ok: true, revisionId, authorityKind: revision.authorityKind };
-    });
+    }
+    store.finishRun(runId, { outcome: "refused", reason: applied ? "plan-revised" : "plan-revision-blocked", now });
+    store.enqueueNotification({
+        source: { run: runId },
+        dedupeKey: `plan-revision:${taskRef}:${revisionId}`,
+        kind: applied ? "plan-revised" : "plan-revision-blocked",
+        ...(applied ? {} : { pushClass: "attention" }),
+        link: `/t/${encodeURIComponent(taskId)}`,
+        subject: `${taskId}: plan revision ${revision.revision} ${applied ? "applied — resuming" : "awaiting your approval"}`,
+        body: applied
+            ? `The build found the plan wrong and rewrote it: ${oneLine(revision.reason, 200)}\nEvidence: ${oneLine(revision.evidenceLink ?? "none given", 200)}\nNothing was committed. The next attempt builds against the new plan.`
+            : `The build proposed a new plan, but ${moved} changed while it ran — so nothing was applied: ${oneLine(revision.reason, 200)}\nEvidence: ${oneLine(revision.evidenceLink ?? "none given", 200)}\nNothing runs on this task until you accept or reject the revision.`,
+    }, now);
+    return { ok: true, revisionId, authorityKind: revision.authorityKind };
 }
 /**
  * The planner's own fenced failure finalizer (Codex planning review,
@@ -1524,93 +1228,80 @@ export function finalizeRevisionFenced(store, args) {
  * nothing without the repair machinery (deliberately not wired for
  * planners in v1).
  */
-export function finalizePlanFailureFenced(store, args) {
-    const { leaseId, runId, taskId, kind, message, now } = args;
+function sealPlanFailure(store, leaseId, args) {
+    const { runId, taskId, failure: kind, message, now } = args;
     const db = store.handle;
-    return inTransaction(store, () => {
-        const run = store.getRun(runId);
-        if (run === null || run.leaseId !== leaseId || run.outcome !== null) {
-            throw new Error(`run ${runId} is not ${leaseId}'s open attempt — a failure seals exactly one`);
-        }
-        if (run.role !== "planner") {
-            throw new Error(`run ${runId} is a ${run.role} run — this finalizer seals planner attempts only`);
-        }
-        const stopped = interruptIfStopped(store, { leaseId, runId, taskId, now });
-        if (stopped !== null)
-            return { ok: false, reason: "stopped" };
-        const { changes } = db
-            .prepare(`UPDATE claim SET released_at = ?, released_by = 'released'
-          WHERE lease_id = ? AND released_at IS NULL AND ${NOT_SUPERSEDED}`)
-            .run(now.toISOString(), leaseId);
-        if (Number(changes) === 0) {
-            store.finishRun(runId, { outcome: "refused", reason: "fenced", now });
-            return refusal(db, leaseId);
-        }
-        if (kind === "failure" && run.terminalClass === "auth-expired")
-            return { ok: true, ...sealAuthExpired(store, run, taskId, now) };
-        const malformedKind = args.malformed === "decision" ? "malformed-decision" : "malformed-plan";
-        store.finishRun(runId, { outcome: "failed", reason: kind === "malformed" ? malformedKind : oneLine(message, 120), now });
-        if (kind === "malformed") {
-            const incidentId = store.createIncident({ run: runId, kind: malformedKind }, now);
-            store.holdOwned({
-                taskRef: run.taskRef,
-                ownerKind: "incident",
-                ownerId: String(incidentId),
-                reason: `${malformedKind} — the planner's ${args.malformed === "decision" ? "question" : "plan"} failed validation`,
-                until: null,
-            }, now);
-            store.enqueueNotification({
-                source: { run: runId },
-                dedupeKey: `${malformedKind}:${runId}`,
-                kind: malformedKind,
-                pushClass: "attention",
-                link: `/r/${runId}`,
-                subject: `${taskId}: the planner's ${args.malformed === "decision" ? "question" : "plan"} failed validation`,
-                body: `${oneLine(message, 300)}\nResolve the incident to let planning retry.`,
-            }, now);
-            return { ok: true, disposition: "malformed-incident", incidentId };
-        }
-        const strikes = store.addPlanStrike(run.taskRef);
-        if (strikes >= MAX_PLAN_STRIKES) {
-            const incidentId = store.createIncident({ run: runId, kind: "plan-attempts-exhausted" }, now);
-            store.holdOwned({
-                taskRef: run.taskRef,
-                ownerKind: "incident",
-                ownerId: String(incidentId),
-                reason: `plan-attempts-exhausted — ${strikes} straight planning failures`,
-                until: null,
-            }, now);
-            store.enqueueNotification({
-                source: { run: runId },
-                dedupeKey: `plan-stalled:${run.taskRef}`,
-                kind: "plan-attempts-exhausted",
-                pushClass: "attention",
-                link: `/r/${runId}`,
-                subject: `${taskId}: planning stalled after ${strikes} straight failures`,
-                body: `Last failure: ${oneLine(message, 200)}\nResolve the incident to let planning retry, or write the scope yourself.`,
-            }, now);
-            return { ok: true, disposition: "exhausted", incidentId, strikes };
-        }
-        const wait = PLAN_BACKOFF_MS[Math.min(strikes, PLAN_BACKOFF_MS.length) - 1];
-        const until = new Date(now.getTime() + wait);
+    const run = openAttempt(store, leaseId, runId, "a failure", "planner");
+    const stopped = interruptIfStopped(store, { leaseId, runId, taskId, now });
+    if (stopped !== null)
+        return { ok: false, reason: "stopped" };
+    const fenced = releaseOrRefuse(store, leaseId, "released", runId, now);
+    if (fenced !== null)
+        return fenced;
+    if (kind === "failure" && run.terminalClass === "auth-expired")
+        return { ok: true, ...sealAuthExpired(store, run, taskId, now) };
+    const malformedKind = args.malformed === "decision" ? "malformed-decision" : "malformed-plan";
+    store.finishRun(runId, { outcome: "failed", reason: kind === "malformed" ? malformedKind : oneLine(message, 120), now });
+    if (kind === "malformed") {
+        const incidentId = store.createIncident({ run: runId, kind: malformedKind }, now);
         store.holdOwned({
             taskRef: run.taskRef,
-            // Its own owner id: a planning pause must never displace the
-            // builder's backoff for the same task, or vice versa.
-            ownerKind: "backoff",
-            ownerId: `plan:${run.taskRef}`,
-            reason: `plan retry ${strikes}/${MAX_PLAN_STRIKES} — backing off ${Math.round(wait / 60_000)}m`,
-            until,
+            ownerKind: "incident",
+            ownerId: String(incidentId),
+            reason: `${malformedKind} — the planner's ${args.malformed === "decision" ? "question" : "plan"} failed validation`,
+            until: null,
         }, now);
         store.enqueueNotification({
             source: { run: runId },
-            dedupeKey: `plan-run:${runId}:failed`,
-            kind: "plan-failed",
-            subject: `${taskId}: planning attempt failed, retry ${strikes}/${MAX_PLAN_STRIKES}`,
-            body: `${oneLine(message, 200)}\nNext attempt no earlier than ${until.toISOString()}.`,
+            dedupeKey: `${malformedKind}:${runId}`,
+            kind: malformedKind,
+            pushClass: "attention",
+            link: `/r/${runId}`,
+            subject: `${taskId}: the planner's ${args.malformed === "decision" ? "question" : "plan"} failed validation`,
+            body: `${oneLine(message, 300)}\nResolve the incident to let planning retry.`,
         }, now);
-        return { ok: true, disposition: "backoff", strikes };
-    });
+        return { ok: true, disposition: "malformed-incident", incidentId };
+    }
+    const strikes = store.addPlanStrike(run.taskRef);
+    if (strikes >= MAX_PLAN_STRIKES) {
+        const incidentId = store.createIncident({ run: runId, kind: "plan-attempts-exhausted" }, now);
+        store.holdOwned({
+            taskRef: run.taskRef,
+            ownerKind: "incident",
+            ownerId: String(incidentId),
+            reason: `plan-attempts-exhausted — ${strikes} straight planning failures`,
+            until: null,
+        }, now);
+        store.enqueueNotification({
+            source: { run: runId },
+            dedupeKey: `plan-stalled:${run.taskRef}`,
+            kind: "plan-attempts-exhausted",
+            pushClass: "attention",
+            link: `/r/${runId}`,
+            subject: `${taskId}: planning stalled after ${strikes} straight failures`,
+            body: `Last failure: ${oneLine(message, 200)}\nResolve the incident to let planning retry, or write the scope yourself.`,
+        }, now);
+        return { ok: true, disposition: "exhausted", incidentId, strikes };
+    }
+    const wait = PLAN_BACKOFF_MS[Math.min(strikes, PLAN_BACKOFF_MS.length) - 1];
+    const until = new Date(now.getTime() + wait);
+    store.holdOwned({
+        taskRef: run.taskRef,
+        // Its own owner id: a planning pause must never displace the
+        // builder's backoff for the same task, or vice versa.
+        ownerKind: "backoff",
+        ownerId: `plan:${run.taskRef}`,
+        reason: `plan retry ${strikes}/${MAX_PLAN_STRIKES} — backing off ${Math.round(wait / 60_000)}m`,
+        until,
+    }, now);
+    store.enqueueNotification({
+        source: { run: runId },
+        dedupeKey: `plan-run:${runId}:failed`,
+        kind: "plan-failed",
+        subject: `${taskId}: planning attempt failed, retry ${strikes}/${MAX_PLAN_STRIKES}`,
+        body: `${oneLine(message, 200)}\nNext attempt no earlier than ${until.toISOString()}.`,
+    }, now);
+    return { ok: true, disposition: "backoff", strikes };
 }
 /**
  * Seal a successful scouting run (mate arc §10): the report artifact, the
@@ -1619,46 +1310,33 @@ export function finalizePlanFailureFenced(store, args) {
  * here touches a branch, a publication, or a scope: the deliverable is
  * the artifact, and the task is done the moment it verifies.
  */
-export function finalizeScoutFenced(store, args) {
-    const { leaseId, runId, taskId, report, now } = args;
+function sealScout(store, leaseId, args) {
+    const { runId, taskId, report, now } = args;
     const db = store.handle;
-    return inTransaction(store, () => {
-        const run = store.getRun(runId);
-        if (run === null || run.leaseId !== leaseId || run.outcome !== null) {
-            throw new Error(`run ${runId} is not ${leaseId}'s open attempt — a report seals exactly one`);
-        }
-        if (run.role !== "scout") {
-            throw new Error(`run ${runId} is a ${run.role} run — only scout runs deliver reports`);
-        }
-        const stopped = interruptIfStopped(store, { leaseId, runId, taskId, now });
-        if (stopped !== null)
-            return { ok: false, reason: "stopped" };
-        const { changes } = db
-            .prepare(`UPDATE claim SET released_at = ?, released_by = 'completed'
-          WHERE lease_id = ? AND released_at IS NULL AND ${NOT_SUPERSEDED}`)
-            .run(now.toISOString(), leaseId);
-        if (Number(changes) === 0) {
-            store.finishRun(runId, { outcome: "refused", reason: "fenced", now });
-            return refusal(db, leaseId);
-        }
-        store.saveArtifact({ run: runId, kind: "report", ...args.artifact }, now);
-        store.resetStrikes(run.taskRef);
-        store.finishRun(runId, { outcome: "built", reason: "report-delivered", now });
-        const done = store.setTaskState(taskId, "done", now);
-        if (!done.ok) {
-            // A mirror the tracker closed meanwhile: the report stands as evidence
-            // on the run; the task keeps the tracker's word for its state.
-            store.finishRun(runId, { outcome: "built", reason: `report-delivered (task ${done.reason})`, now });
-        }
-        store.enqueueNotification({
-            source: { run: runId },
-            dedupeKey: `report:${run.taskRef}:${runId}`,
-            kind: "report-ready",
-            subject: `${taskId}: report ready — ${oneLine(report.title, 120)}`,
-            body: `${oneLine(report.summary, 300)}\nRead it on the task page${report.followUps.length > 0 ? `; ${report.followUps.length} follow-up(s) file with a tap` : ""}.`,
-        }, now);
-        return { ok: true };
-    });
+    const run = openAttempt(store, leaseId, runId, "a report", "scout");
+    const stopped = interruptIfStopped(store, { leaseId, runId, taskId, now });
+    if (stopped !== null)
+        return { ok: false, reason: "stopped" };
+    const fenced = releaseOrRefuse(store, leaseId, "completed", runId, now);
+    if (fenced !== null)
+        return fenced;
+    store.saveArtifact({ run: runId, kind: "report", ...args.artifact }, now);
+    store.resetStrikes(run.taskRef);
+    store.finishRun(runId, { outcome: "built", reason: "report-delivered", now });
+    const done = store.setTaskState(taskId, "done", now);
+    if (!done.ok) {
+        // A mirror the tracker closed meanwhile: the report stands as evidence
+        // on the run; the task keeps the tracker's word for its state.
+        store.finishRun(runId, { outcome: "built", reason: `report-delivered (task ${done.reason})`, now });
+    }
+    store.enqueueNotification({
+        source: { run: runId },
+        dedupeKey: `report:${run.taskRef}:${runId}`,
+        kind: "report-ready",
+        subject: `${taskId}: report ready — ${oneLine(report.title, 120)}`,
+        body: `${oneLine(report.summary, 300)}\nRead it on the task page${report.followUps.length > 0 ? `; ${report.followUps.length} follow-up(s) file with a tap` : ""}.`,
+    }, now);
+    return { ok: true };
 }
 /**
  * The scout's fenced failure finalizer: the BUILDER's discipline, not the
@@ -1667,92 +1345,79 @@ export function finalizeScoutFenced(store, args) {
  * report is a straight incident with no strike. Never a branch, never a
  * repair session, never a commit.
  */
-export function finalizeScoutFailureFenced(store, args) {
-    const { leaseId, runId, taskId, kind, message, now } = args;
+function sealScoutFailure(store, leaseId, args) {
+    const { runId, taskId, failure: kind, message, now } = args;
     const db = store.handle;
-    return inTransaction(store, () => {
-        const run = store.getRun(runId);
-        if (run === null || run.leaseId !== leaseId || run.outcome !== null) {
-            throw new Error(`run ${runId} is not ${leaseId}'s open attempt — a failure seals exactly one`);
-        }
-        if (run.role !== "scout") {
-            throw new Error(`run ${runId} is a ${run.role} run — this finalizer seals scout attempts only`);
-        }
-        const stopped = interruptIfStopped(store, { leaseId, runId, taskId, now });
-        if (stopped !== null)
-            return { ok: false, reason: "stopped" };
-        const { changes } = db
-            .prepare(`UPDATE claim SET released_at = ?, released_by = 'released'
-          WHERE lease_id = ? AND released_at IS NULL AND ${NOT_SUPERSEDED}`)
-            .run(now.toISOString(), leaseId);
-        if (Number(changes) === 0) {
-            store.finishRun(runId, { outcome: "refused", reason: "fenced", now });
-            return refusal(db, leaseId);
-        }
-        if (kind === "failure" && run.terminalClass === "auth-expired")
-            return { ok: true, ...sealAuthExpired(store, run, taskId, now) };
-        const malformedKind = args.malformed === "decision" ? "malformed-decision" : "malformed-report";
-        store.finishRun(runId, { outcome: "failed", reason: kind === "malformed" ? malformedKind : oneLine(message, 120), now });
-        if (kind === "malformed") {
-            const incidentId = store.createIncident({ run: runId, kind: malformedKind }, now);
-            store.holdOwned({
-                taskRef: run.taskRef,
-                ownerKind: "incident",
-                ownerId: String(incidentId),
-                reason: `${malformedKind} — the scout's ${args.malformed === "decision" ? "question" : "report"} failed validation`,
-                until: null,
-            }, now);
-            store.enqueueNotification({
-                source: { run: runId },
-                dedupeKey: `${malformedKind}:${runId}`,
-                kind: malformedKind,
-                pushClass: "attention",
-                link: `/r/${runId}`,
-                subject: `${taskId}: the scout's ${args.malformed === "decision" ? "question" : "report"} failed validation`,
-                body: `${oneLine(message, 300)}\nResolve the incident to let scouting retry.`,
-            }, now);
-            return { ok: true, disposition: "malformed-incident", incidentId };
-        }
-        const strikes = store.addStrike(run.taskRef);
-        if (strikes >= MAX_STRIKES) {
-            const incidentId = store.createIncident({ run: runId, kind: "attempts-exhausted" }, now);
-            store.holdOwned({
-                taskRef: run.taskRef,
-                ownerKind: "incident",
-                ownerId: String(incidentId),
-                reason: `attempts-exhausted — ${strikes} consecutive scouting failures`,
-                until: null,
-            }, now);
-            db.prepare("UPDATE task SET state = 'failed', updated_at = ? WHERE id = ?").run(now.toISOString(), taskId);
-            store.enqueueNotification({
-                source: { run: runId },
-                dedupeKey: `stalled:${run.taskRef}`,
-                kind: "attempts-exhausted",
-                pushClass: "attention",
-                link: `/r/${runId}`,
-                subject: `${taskId} stalled after ${strikes} straight scouting failures`,
-                body: `Last failure: ${oneLine(message, 200)}\nIt will not be retried. Read the runs, then \`toolroll task requeue ${taskId}\`.`,
-            }, now);
-            return { ok: true, disposition: "stalled", incidentId, strikes };
-        }
-        const wait = BACKOFF_MS[Math.min(strikes, BACKOFF_MS.length) - 1];
-        const until = new Date(now.getTime() + wait);
+    const run = openAttempt(store, leaseId, runId, "a failure", "scout");
+    const stopped = interruptIfStopped(store, { leaseId, runId, taskId, now });
+    if (stopped !== null)
+        return { ok: false, reason: "stopped" };
+    const fenced = releaseOrRefuse(store, leaseId, "released", runId, now);
+    if (fenced !== null)
+        return fenced;
+    if (kind === "failure" && run.terminalClass === "auth-expired")
+        return { ok: true, ...sealAuthExpired(store, run, taskId, now) };
+    const malformedKind = args.malformed === "decision" ? "malformed-decision" : "malformed-report";
+    store.finishRun(runId, { outcome: "failed", reason: kind === "malformed" ? malformedKind : oneLine(message, 120), now });
+    if (kind === "malformed") {
+        const incidentId = store.createIncident({ run: runId, kind: malformedKind }, now);
         store.holdOwned({
             taskRef: run.taskRef,
-            ownerKind: "backoff",
-            ownerId: String(run.taskRef),
-            reason: `scout retry ${strikes}/${MAX_STRIKES} — backing off ${Math.round(wait / 60_000)}m`,
-            until,
+            ownerKind: "incident",
+            ownerId: String(incidentId),
+            reason: `${malformedKind} — the scout's ${args.malformed === "decision" ? "question" : "report"} failed validation`,
+            until: null,
         }, now);
         store.enqueueNotification({
             source: { run: runId },
-            dedupeKey: `run:${runId}:failed`,
-            kind: "scout-failed",
-            subject: `${taskId}: scouting attempt failed, retry ${strikes}/${MAX_STRIKES}`,
-            body: `${oneLine(message, 200)}\nNext attempt no earlier than ${until.toISOString()}.`,
+            dedupeKey: `${malformedKind}:${runId}`,
+            kind: malformedKind,
+            pushClass: "attention",
+            link: `/r/${runId}`,
+            subject: `${taskId}: the scout's ${args.malformed === "decision" ? "question" : "report"} failed validation`,
+            body: `${oneLine(message, 300)}\nResolve the incident to let scouting retry.`,
         }, now);
-        return { ok: true, disposition: "backoff", strikes };
-    });
+        return { ok: true, disposition: "malformed-incident", incidentId };
+    }
+    const strikes = store.addStrike(run.taskRef);
+    if (strikes >= MAX_STRIKES) {
+        const incidentId = store.createIncident({ run: runId, kind: "attempts-exhausted" }, now);
+        store.holdOwned({
+            taskRef: run.taskRef,
+            ownerKind: "incident",
+            ownerId: String(incidentId),
+            reason: `attempts-exhausted — ${strikes} consecutive scouting failures`,
+            until: null,
+        }, now);
+        db.prepare("UPDATE task SET state = 'failed', updated_at = ? WHERE id = ?").run(now.toISOString(), taskId);
+        store.enqueueNotification({
+            source: { run: runId },
+            dedupeKey: `stalled:${run.taskRef}`,
+            kind: "attempts-exhausted",
+            pushClass: "attention",
+            link: `/r/${runId}`,
+            subject: `${taskId} stalled after ${strikes} straight scouting failures`,
+            body: `Last failure: ${oneLine(message, 200)}\nIt will not be retried. Read the runs, then \`toolroll task requeue ${taskId}\`.`,
+        }, now);
+        return { ok: true, disposition: "stalled", incidentId, strikes };
+    }
+    const wait = BACKOFF_MS[Math.min(strikes, BACKOFF_MS.length) - 1];
+    const until = new Date(now.getTime() + wait);
+    store.holdOwned({
+        taskRef: run.taskRef,
+        ownerKind: "backoff",
+        ownerId: String(run.taskRef),
+        reason: `scout retry ${strikes}/${MAX_STRIKES} — backing off ${Math.round(wait / 60_000)}m`,
+        until,
+    }, now);
+    store.enqueueNotification({
+        source: { run: runId },
+        dedupeKey: `run:${runId}:failed`,
+        kind: "scout-failed",
+        subject: `${taskId}: scouting attempt failed, retry ${strikes}/${MAX_STRIKES}`,
+        body: `${oneLine(message, 200)}\nNext attempt no earlier than ${until.toISOString()}.`,
+    }, now);
+    return { ok: true, disposition: "backoff", strikes };
 }
 export function currentClaim(store, taskRef, now) {
     const row = latest(store.handle, taskRef);