vinta-ai-workflows 0.7.0-alpha2 → 0.7.0-alpha20

package/CHANGELOG.md

@@ -7,11 +7,360 @@ the project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [0.7.0] — YYYY-MM-DD
 
+<!-- pre-release: 0.7.0-alpha20 on 2026-09-24 -->
+<!-- pre-release: 0.7.0-alpha19 on 2026-09-19 -->
+<!-- pre-release: 0.7.0-alpha18 on 2026-09-17 -->
+<!-- pre-release: 0.7.0-alpha17 on 2026-09-17 -->
+<!-- pre-release: 0.7.0-alpha16 on 2026-09-16 -->
+<!-- pre-release: 0.7.0-alpha15 on 2026-09-16 -->
+<!-- pre-release: 0.7.0-alpha14 on 2026-09-16 -->
+<!-- pre-release: 0.7.0-alpha13 on 2026-09-16 -->
+<!-- pre-release: 0.7.0-alpha12 on 2026-09-15 -->
+<!-- pre-release: 0.7.0-alpha11 on 2026-09-15 -->
+<!-- pre-release: 0.7.0-alpha10 on 2026-09-15 -->
+<!-- pre-release: 0.7.0-alpha9 on 2026-09-14 -->
+<!-- pre-release: 0.7.0-alpha8 on 2026-09-14 -->
+<!-- pre-release: 0.7.0-alpha7 on 2026-09-14 -->
+<!-- pre-release: 0.7.0-alpha6 on 2026-09-13 -->
+<!-- pre-release: 0.7.0-alpha5 on 2026-09-13 -->
+<!-- pre-release: 0.7.0-alpha4 on 2026-09-13 -->
+<!-- pre-release: 0.7.0-alpha3 on 2026-09-12 -->
 <!-- pre-release: 0.7.0-alpha2 on 2026-09-12 -->
 <!-- pre-release: 0.7.0-alpha1 on 2026-09-11 -->
 
 ### Added
 
+- **A timed-out gate says whether it hung or was slow.** A `gate_result` with
+  `status: timed_out` used to carry only the status, so a run with nine
+  timeouts could not say whether any of them was a stuck suite or a host too
+  busy to finish one. It now carries `timeout`: `quiet_ms` (how long the gate
+  had gone without writing anything when it was killed), `output_bytes`, and
+  the host's `load_1m` beside `cpus`. `quiet_ms` near the timeout is a gate
+  waiting on something; a small one with `load_1m` well above `cpus` is
+  contention. Numbers only, as before: nothing the gate printed reaches the
+  row. The monitor's brief points at the new field. Older rows have no
+  `timeout`.
+
+- **Gate durations are now kept, not just displayed.** Every `gate_result` has
+  carried the runner's own `duration_ms` since gates were journalled, and
+  nothing read it back: the figure went to a live panel and was afterwards
+  reachable only by hand-parsing event payloads, so the one measurement that
+  answers "is the suite why this run took an hour" could not be asked of a
+  finished run. `analyzeRun` now rolls it up per gate — runs, cache hits,
+  summed runtime, the slowest single run, verdicts by kind — and each phase's
+  time split carries `gateRunMs` beside `gatePoolQueueMs`, so a run says how
+  much of its working time was the gate queue and how much was the gate. The
+  post-mortem carries the same as a `gate_costs` finding, which is what makes
+  it durable: `plan-feature` reads these artifacts when sizing the next plan,
+  and a gate pool's capacity and `max_parallel_lanes` are one decision made
+  with half the numbers. Cache hits are counted and their time kept in its own
+  `cache_saved_ms` column — a hit's duration is what the gate cost when it last
+  ran, and adding it to the runtime would report time the run specifically did
+  not spend. A verdict written before the runner measured itself is counted and
+  its milliseconds are not: both reports emit a `gate_durations_unrecorded` gap
+  naming the gates, because a gate reported as free is the number a planner
+  would act on hardest.
+
+- **Phases can run chores: declared agent turns that change the diff rather than
+  judge it.** A gate is a shell command that says pass or fail; a chore is an
+  agent asked to do something to the work — rewrite the comments this phase
+  wrote, add the changelog entry, extract the strings that need translating. It
+  runs on the implementer's own session, so the agent that wrote the diff is the
+  one asked to act on it. Declare them in `chores.<id>` (a `prompt` or a
+  `prompt_ref` into the plan, plus an optional `skill` the prompt names) and
+  pick them with `defaults.chores` for the run or `nodes[].chores` for one
+  phase — a node's list replaces the default rather than adding to it, so `[]`
+  opts a phase out. In `standard-phase` they run in a new `polish` state,
+  between a passing review and the gate: a chore edits the tree, so running it
+  later would merge a diff the gates never ran against, and running it earlier
+  would have the fixer rewrite what it just did. A chore that fails, or that the
+  harness had no capacity for, is journalled and the phase continues to its
+  gates — `on_failure: "fail"` is for one the phase is not correct without.
+
+- **The post-mortem now reports what the schedule cost.** Two findings, both
+  derived from events the journal already carried. `critical_path` is the
+  dependency chain that decided the wall clock — each phase's span, the total,
+  and its share of elapsed — because every phase *off* that chain could be made
+  instant without moving the run, and nothing said which phases those were.
+  `idle_capacity` reports the width the graph actually reached against the lanes
+  it asked for: a plan declaring three lanes that never runs more than two
+  phases at once pays for a third worktree, a third forked database and a third
+  desk, and gets none of them back. Run against a real fourteen-hour build, the
+  two say its critical path was **99% of elapsed time** — six phases, effectively
+  serial — with peak concurrency 2 against 3 lanes and **55% of lane time idle**.
+  `plan-feature` already reads these artifacts before drawing the next set of
+  dependency lines; until now neither depth nor width was in them. A
+  `blocking_cause_unrecorded` gap ships alongside, because the chain is what the
+  *graph* forced and a phase can also wait on a busy lane or an unanswered
+  question — which the journal cannot currently tell apart.
+
+- **`--retry-after <15m>`: an unanswered failure question eventually answers
+  itself.** An observed fourteen-hour run spent 4h07m — 29% of its wall clock —
+  parked on "This phase failed. Try it again?" with nobody at the keyboard; the
+  answer, when it came, was `retry`, and it worked. Unset by default, so a run
+  behaves exactly as it did. Accepts minutes bare or a unit (`15`, `15m`, `90s`,
+  `2h`) on both `run` and `serve`. It is deliberately unbounded and fires again
+  on each new question: a version capped by `--retries` would stall at the cap
+  and idle for the rest of the night, which is the failure it exists for. Every
+  firing is a full phase attempt, so the interval is the throttle. It reaches
+  the failure question and nothing else — a plan's own `await_human` gate asked
+  for a person, and both park through the same code, so answering those would be
+  the orchestrator overruling the plan. An unattended answer is journalled with
+  `unattended: true`, because "a human said try again" and "nobody was here" are
+  the same answer with very different meanings.
+
+- **The daemon now has a log of its own, and a Logs view to read it in.**
+  Transcripts said what the agents did; nothing said what the *daemon* did, so
+  "the run stopped and I don't know why" had no evidence behind it at all.
+  `.vinta-ai-maestro/logs/daemon.ndjson` now records what the process bound,
+  every HTTP request and socket upgrade it refused and why, every start request
+  that produced no run, every scheduler dispatch and node transition, and every
+  deadlock — on one clock, so a node failure can be read beside the refusal
+  thirty seconds before it. `GET /api/logs` serves it as a tail or a follow,
+  with filters for level, run, node and a substring of any event or field; the
+  UI's new **Logs** section follows the tail until you scroll up. The file
+  rotates at 8 MiB and keeps five rotations, so it is bounded whatever the
+  daemon's uptime, and `purge` leaves it alone for the same reason it leaves
+  `flow.db` alone — it holds no repository contents, and it is the record of the
+  failure somebody is about to ask about.
+
+- **A crash is no longer silent.** An exception escaping a node's own handling
+  used to become an unhandled rejection on a promise the scheduler does not
+  hold, and an unhandled rejection ends the process: hours of agent turns and a
+  real amount of money, gone with no journal row, no transcript entry and
+  nothing on disk saying why — because the thing that would have said it was the
+  thing that died. Three changes. A node that throws is now **contained** by the
+  rule §6 already states for failures: it fails, its transitive dependents
+  block, and everything independent of it keeps going. A crash that is still
+  fatal is **recorded first** — `daemon.uncaught_exception` /
+  `daemon.unhandled_rejection`, with the error's kind, its stack frames and the
+  ids of every run in flight. And the in-flight runs are **journalled as ended**
+  before the process goes, so `run --resume <run-id>` picks them up instead of
+  finding a row that says `running` for ever. `serve` and `run` both take
+  `--log-level`, `--log-stderr` and `--log-detail`.
+
+- **The log is identifiers only, enforced rather than asked for — plus the one
+  field that is deliberately prose.** A log is called from anywhere, and "please
+  do not log repository contents" is a hope rather than a control. So a field
+  may only hold a string, a number, a boolean or null — an object is dropped,
+  never stringified, which is the way a diff or a file read becomes a log line —
+  identifier values are capped at 200 characters, field names that are secrets
+  by their name are redacted, and the daemon's token is registered at boot so
+  any value containing it is written `<redacted>`.
+
+  The exception is an error's **`message`**, which every failure record carries
+  beside its kind, capped at 2000 characters and redacted like anything else. It
+  is the default because `.vinta-ai-maestro/runs/` already holds every agent
+  transcript and gate log *verbatim*, in the same gitignored store and under the
+  same `purge` — an error message is a rounding error against a directory that
+  is already a copy of the repository, and excluding it cost the one string that
+  most often explains a failure. `--log-detail kind` narrows to the kind and the
+  stack frames for a checkout under a stricter obligation than this store's own.
+- **A run that is dragging can now tune itself, within bounds somebody wrote
+  down.** A run can be mis-*configured* rather than broken — every phase doing
+  what it was asked, every gate reporting honestly, and the whole thing paying
+  for a test database it rebuilds on every gate run in every lane. Nobody needs
+  waking for that, and the post-mortem found it out an afternoon too late to
+  help. Now a watchdog wakes the run's monitor when a phase passes an hour or a
+  gate's uncached cost passes thirty minutes, the monitor reads the gate logs
+  and the durations, and it answers with a **proposal** that the daemon
+  validates and applies through the existing amend path. `--no-intervene` turns
+  it off.
+
+  It proposes; it never writes. Its authority is four verbs — a gate's command,
+  a gate's timeout, a phase's fix budget, a phase's model — and the line they
+  draw is that it may change **how** the run executes and never **what** it
+  builds. There is no way to express a change to a dependency, a phase brief, a
+  touch list, the base branch, or the set of phases: not refused at runtime,
+  unrepresentable.
+
+  The one field that can do real damage is a gate's command, because
+  `--reuse-db` and `-k not_slow` are the same edit to the same string, and a
+  gate narrowed wrongly goes green and looks like success in every log there
+  is. So a command may only be changed when the gate itself declares
+  `tuning.allowed_flags` — a list a person wrote in the committed plan, under
+  review, before the run started — and the proposed command must be the current
+  one's argv tokens, in order, plus additions from that list. A gate that
+  declares no `tuning` block is not tunable, which is the default.
+
+  A run gets three of these in its life, at most one per gate and per phase.
+  What it changed is journalled as identifiers; why it changed it is the
+  monitor's prose and goes in `runs/<run-id>/interventions.jsonl` beside the
+  run, including every attempt that was refused — an agent trying to do
+  something it may not do, with nobody in the room, is the record most worth
+  keeping. See `packages/vinta-ai-maestro/docs/monitor-intervention.md`.
+
+- **`plan-feature` is told what the newer post-mortem findings mean.** The
+  skill documents each finding and what to *do* about it, and three had been
+  added to the artifact without reaching it: `gate_costs`, `critical_path` and
+  `idle_capacity`. A finding a planning agent cannot interpret is a finding
+  that changes no plan, which is the whole return on emitting it — and the
+  three are among the most actionable there are. `gate_costs` sizes the gate
+  pool capacities a plan declares, and separates a slow suite from a fix loop
+  re-paying for the same one. `critical_path` is the chain to re-draw the graph
+  against: shortening a phase that is not on it changes nothing, so a plan that
+  parallelises harder without touching that chain buys nothing at all.
+  `idle_capacity` says the graph never got as wide as the lanes it asked for,
+  which is a fact about the plan rather than about the machine. Each now has a
+  row beside the findings that already had one.
+
+- **The post-mortem says what a run changed about itself, and whether it
+  helped.** `postmortem.v1` gains an `interventions[]` finding: one entry per
+  amendment the run made to itself, with the effect on the thing it changed. A
+  gate is scored against its own uncached durations either side of the
+  amendment — mean before, mean after, `cheaper` / `dearer` / `unchanged`
+  outside a ten-per-cent band. Cached hits are excluded, because a hit reports
+  the duration of the run that filled the cache and would drag the mean toward
+  whichever side of the boundary that run fell on.
+
+  It is a comparison and not a claim of cause, and the schema says so: a gate
+  that got cheaper did so while phases were finishing and caches warming. It is
+  worth carrying anyway, because without it an autonomous editor is one nobody
+  can tell is making runs worse — and because `plan-feature` now reads it, so a
+  project whose `unit` gate wants `--reuse-db` pays to find that out once
+  instead of every run.
+
+  A phase-level change (a fix budget, a model) is reported `unmeasured` rather
+  than estimated: a phase runs once, so there is no before to compare an after
+  against, and the only candidate baseline is a different phase doing different
+  work. An operator's amendment is not scored at all — a person deciding
+  something is not the run choosing it.
+
+- **`schemas/intervention.v1.schema.json`** — the document the monitor answers
+  with, generated from `src/intervention/intervention.ts` the way the workflow
+  and post-mortem schemas are generated from theirs. It is the odd one in
+  `schemas/`: it validates something a *model* writes rather than a skill or a
+  person, and it is the boundary deciding what an unattended run may change
+  about itself.
+
+- **A run no longer dies with the terminal that started it.** `vinta-ai-maestro
+  serve` accepts `POST /api/runs`, so a run can be submitted to a daemon that
+  was already listening and belongs to that daemon rather than to the shell that
+  asked for it; the request answers with the run id as soon as the run is
+  registered, not when it finishes. Previously `run` was the only way to start a
+  run and it hosted its own daemon, so closing the window killed the scheduler
+  and every agent under it — and left the journal claiming `running` for ever,
+  with nothing able to tell that row apart from a run still in flight.
+
+- **`vinta-ai-maestro run --resume <run-id>` picks an interrupted run back up.**
+  Phases already `done` stay done and are not dispatched again, their lane
+  worktrees are adopted rather than re-provisioned — so whatever an agent had
+  written and not committed is still there — and a phase that was mid-turn when
+  the process died runs again from the top of its pipeline, because the turn it
+  was in belonged to a process that is gone. The plan comes from the run's
+  frozen snapshot, never from the document it was written from, so editing that
+  file in the meantime cannot switch plans under a run already under way. A new
+  `run_resumed` event records each hand-over; it is deliberately not a second
+  `run_started`, which would have moved the run's `started_at` to whenever it
+  was last picked up and made every duration short by the length of the outage.
+
+- **`vinta-ai-maestro gate <gate-id>` runs a declared gate from inside an agent
+  turn.** A phase used to run its full gate suite five or six times a round —
+  implementer, reviewer, fixer, reviewer again, then the authoritative `gate`
+  node — and only the last of those consulted the gate cache or the resource
+  pool. Agents now ask the daemon for a gate by id: the result is cached on the
+  same `(gate id, lane tree hash)` key the `gate` node reads, the gate's
+  resources are held by the daemon rather than by whichever agent remembered to
+  wrap the command, and the id resolves to the plan's own command so a scoped
+  approximation cannot be reported as the gate. Each run is journalled as a
+  `gate_result` event and a `gate_run` transcript entry under the GATE band,
+  whoever asked for it.
+
+- **A project declares what makes a lane runnable.** `project.env_files` copies
+  ignored configuration into each worktree, `project.setup_cmd` runs an
+  idempotent setup hook on provisioning and recycle, and the fixed
+  `project.commands` vocabulary tells implementers, reviewers and fixers the
+  project's real lint, typecheck, test and migration entry points.
+
+- **Compose-backed lanes are isolated past `COMPOSE_PROJECT_NAME`.** The daemon
+  now generates an out-of-tree Compose override per lane, strips fixed host
+  ports, re-pins fixed and external volumes, and carries the complete lane
+  environment into agent and takeover processes as well as gates. Explicitly
+  published services receive probed per-lane ports recorded in the teardown
+  summary.
+
+- **Shared services get one namespace per lane.** `project.services` models a
+  fixed index or lane-derived name inside one Redis, RabbitMQ, object-storage,
+  or similar server, with project-owned create/reset commands and capacity
+  validation before provisioning creates templates or worktrees.
+
+- **Agents can take the semaphore a workflow declares.**
+  `vinta-ai-maestro with <resource> -- <cmd>` waits on the run's existing
+  `ResourcePools`, runs the heavy inner-loop command, and releases on exit.
+  Renewable leases expire when their client disappears, are visible in the
+  live journal, and are surfaced in implementer, reviewer and fixer prompts.
+
+- **A failed phase retries itself, and then asks.** `--on-failure` defaults to
+  `retry`: one cold re-attempt (`--retries <n>`, 0–5), and then the node parks
+  on a question — retry, retry with another member of the crew, or stop. The
+  failures this system produces are overwhelmingly environmental and are gone by
+  the second attempt; the ones that survive it are the ones worth a person.
+  `ask` skips the automatic attempt. `stop` is the old behaviour and remains the
+  right choice for CI, because everything else eventually **waits**.
+
+  A failure that survives its retries says so: the reason carries
+  `(after N attempts)`, which no event otherwise records.
+
+- **A failed phase can be retried by hand.** A **Retry phase** button, and
+  `POST /api/runs/:runId/nodes/:nodeId/retry`. It returns the node to the ready
+  set and unblocks the subtree its failure blocked — a phase that died of
+  something environmental holds up work that was never broken. It needs the run
+  to still be in flight, which with the new default it usually is; a run that
+  has genuinely ended is re-run, not retried, and says so rather than doing
+  nothing.
+
+- **The monitor can go and look.** It was given a digest and nothing else, and
+  read exactly as thin as that sounds — it could say a phase had failed and
+  never say what the phase had written. It is briefed as a technical project
+  manager now, with the map: the plan document, each phase's brief, each lane's
+  worktree path, each branch and its base, and where the journal and transcripts
+  live. It has a shell and its working directory is the repository, so it can
+  read the diff before drawing a conclusion. The digest stays as the index —
+  bounded, cheap, enough to know which phase is worth a closer look.
+
+- **The monitor conversation is kept.** It lived in component state, so a reload
+  threw away every question and every answer — a worse record than the run it
+  describes. It is written to the transcript store under a reserved node id and
+  read back on load, so it outlives the tab, the daemon and the run.
+
+- **Panels expand.** Anything holding content that is only nominally
+  summarisable — an agent's transcript, a gate log, the monitor conversation,
+  the steering box — takes the full container width and about a screen of
+  height on demand. The height travels as a CSS variable, because the element
+  that has to grow is a scroller several components below the panel.
+
+- **A run has a spokesperson you can ask.** `serve` grows a **Monitor** panel on
+  the run view: one agent that reads the journal and answers in prose — what is
+  blocked, why a phase failed, what it would take to move on. It runs on the
+  dearest tier on the crew, because it is read by a person deciding what to do
+  about a failing run, and it is asked a handful of times rather than hundreds.
+
+  Three things it deliberately is not.
+
+  **It is not in the permission path.** The obvious thought, once an agent has
+  been refused something, is to put a smarter agent in front of the refusals —
+  but a phase makes hundreds of tool calls (one node in one real run made 179)
+  and a model turn before each is latency and cost spent on questions like "may
+  I run ruff", which should never have been questions. Permissions are settled
+  structurally, once per spawn, for free.
+
+  **It does not read the transcripts.** Piping every agent's output into a
+  second agent would make the monitor the most expensive thing in the run and
+  tie its cost to the work rather than to the questions. It reads a bounded
+  digest — statuses, failure reasons, pending questions, the last few refusals
+  with their sentences, one trimmed last word per phase — so a one-hour run and
+  a one-day run cost about the same to ask about.
+
+  **It has no authority.** It can explain a §9.1 pause; it cannot answer one.
+  An agent that could quietly approve its colleagues' work would turn a
+  checkpoint into a formality, and the checkpoint is the point.
+
+  It answers about **finished runs too**, which is when "why did this fail" is
+  usually asked, and it needs no lane: it writes nothing.
+
+- **`serve` reads `--permission`.** The flag has been accepted and ignored since
+  it existed. It decides how the monitor is spawned, so it is read now.
+
 - **A plan staffs a team, instead of picking a model per phase.** Choosing a tier
   phase by phase answers "what runs this one" ten times and never adds it up, so the
   two questions that decide what a feature costs go unasked: how many agents does
@@ -79,10 +428,33 @@ the project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
     claimed per review turn rather than per phase — it has one session ledger and
     two concurrent reviews would collide over it — so one reviewer on a three-lane
     plan is a queue at the review step and not a serialised run.
+    - **"Cheapest qualified" has one exception, and it is about sessions.** A
+      member who already holds a session this phase would genuinely resume takes
+      it ahead of a cheaper member who would have to start cold — even when they
+      are more senior than the phase needs, and even when the member the plan
+      named is free. What it buys is the context a cold session spends its first
+      turn rebuilding; what it costs is the dearer model for that phase, which is
+      the smaller of the two bills. **The tier floor is untouched**: warmth
+      reorders the members who already qualify and never widens them, so a warm
+      junior still cannot take a Tier 3 phase.
+    - **Only when a session is genuinely already up.** "Warm" means the scheduler
+      asked its own session-reuse rules and got a yes — same pinned lane, same
+      harness, under the turn ceiling, not poisoned by a failed phase. A member
+      who has merely run before is not warm, because a promotion bought on a
+      resume that is then refused pays the senior's rate *and* cold-starts
+      anyway. With nobody warm, staffing is exactly what it was: a session is
+      being opened either way, and the plan's own level wins.
+    - An operator who picks the member by hand on a retry gets that member. A
+      saving nobody asked for does not overrule an explicit answer.
   - The run view reports who actually worked against who the plan said would.
     `substituted` is the figure to read beside a cost that overran: every
     substitution ran at or above the budgeted tier, so a run can be entirely green
-    and still have been staffed dearer than planned.
+    and still have been staffed dearer than planned. The phases promoted to reuse
+    a warm session are counted **within** that figure and reported apart from it —
+    a peer covering for a busy member costs what the plan budgeted, while a warm
+    promotion is the scheduler deliberately trading model rate against cold
+    starts, and folded together a run that promoted everything to the top tier
+    would read as an ordinary busy wave.
 
 - **`implement-plan` runs independent phases in parallel.** The plan now carries a
   dependency graph and the conductor schedules against it: a phase starts as soon as
@@ -177,8 +549,206 @@ the project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   **generated** from a zod source rather than hand-written — see
   [`schemas/README.md`](schemas/README.md).
 
+- **The monitor keeps thinking when you look away, and thinks out loud.**
+  Asking used to be one long HTTP request that produced the whole answer inside
+  it, which made the turn's lifetime the browser's connection: switching view,
+  reloading or letting a laptop sleep killed the monitor mid-thought and left a
+  question with no answer and no record that one had been attempted. The daemon
+  owns the turn now — `POST` answers `202`, and the monitor journals each
+  thought and each sentence as it produces them, so the conversation is
+  readable while it is being written and by any tab that opens it. The panel
+  renders through the same rows a phase's transcript uses, which is what the
+  API always claimed and the UI never did.
+
+- **A phase's transcript says which agent wrote each line, and holds the gates.**
+  Every spawn on a node appends to one file whatever its role, so a phase that
+  took two fix rounds held five agents' output in one undifferentiated stream —
+  the role was in scope at the append and simply not written down. Each line now
+  carries the role and the session slot that produced it, the view bands the
+  list where one agent stops and the next starts, and gate runs are entries in
+  it rather than only in a log beside it. The operator's own steering stays the
+  operator's (§7), even though the adapter echoes it back on the agent's event
+  stream. Transcripts written before this render exactly as they did, with no
+  bands. The band stays pinned to the top of the scroller while its own run of
+  rows goes past, so the agent you are reading is named without scrolling back
+  to where it started — in the phase transcript and in the monitor conversation
+  alike.
+
 ### Changed
 
+- **Updated the OpenAI and Anthropic models to their latest version.**
+
+- **Updated the generated skills to have `disable-model-invocation: true` set.**
+
+- **An expanded panel reads in a centred column.** Full page used to mean
+  full width too, so on a large monitor a transcript or gate log ran in lines
+  too long to follow. The overlay still covers the window; its header and
+  content now sit in a centred column capped at `max-w-6xl`.
+
+- **The node view reads like a chat.** The transcript now sits above the
+  steering box instead of below it, so the conversation comes first and the
+  box you answer it in is under its newest turn. A terminal opened by *Take
+  over* still appears under the steering box.
+
+- **`--retry-after` backs off when attempts fail faster than it.** An
+  unanswered failure question used to answer itself on a flat interval
+  forever, so a phase whose attempts died within seconds was retried every
+  fifteen minutes for hours, against the same failure, at the price of a cold
+  lane each time. Each attempt that fails in less time than the interval now
+  doubles the next wait, up to 8× (15m becomes 2h); one attempt that runs at
+  least the interval long puts it back. It still never stops on its own: a
+  run whose cause goes away overnight is moving again before morning. The
+  `node.unattended_retry` log line reports the actual wait and the streak.
+
+- **Notifications have an inbox, and are heard from every view.** The UI's
+  notifications used to be a row of banners in the top bar, shown only when
+  browser notifications were refused. They piled up there and could be read
+  only one at a time, by dismissing whichever was in front. Every notification
+  now lands in an inbox behind a bell with an unread count: newest first,
+  filterable by unread and by still-waiting pauses, marked read one at a time
+  or all at once, dismissed singly or cleared. A pause that gets answered stays
+  listed and says *Answered*. The inbox is kept in `localStorage` and shared by
+  every tab, so a reload no longer loses it. It stores what a notification
+  body already carries — a run id, a node id, a reason and the journal's
+  timestamp — and no question text, output or diff. Browser notifications also
+  reach the operator more often now. They used to fire only for the run open
+  on screen; the UI now follows every running run in the background, and a run
+  view takes over that run's stream instead of opening a second one. They also
+  depended on a permission prompt raised by the first pause, which Firefox and
+  Safari ignore when no click raised it, so on those browsers they could never
+  turn on. An *Enable notifications* button now sits in the top bar until the
+  browser has been asked (and in the inbox too), and confirms with one test
+  notification. It also says why the channel is off
+  when it is: blocked in the browser's site settings, or served over plain
+  HTTP on a remote `--host`, which browsers do not allow notifications from.
+  The reminder interval moved into the inbox.
+
+- **The run view's Nodes table names a lane by what distinguishes it.**
+  Every lane in a run is named `${runId}-...`, so the column spelled them in
+  full as `2026-09-11-graphql-aggregations-mubou9ar-crew-3-tier4` on every
+  row, phase after phase — the same forty characters of prefix repeated down
+  the table, wide enough to push the whole table into a horizontal scroll for
+  the sake of a string that was identical everywhere it appeared. The cell now
+  shows the tail that actually differs (`crew-3-tier4`, `lane-2`, `integ`) and
+  keeps the full name in its `title`, because that is what the worktree
+  directory and the branch are called. The phase description beside the node
+  id is bounded and wraps for the same reason — table cells are
+  `whitespace-nowrap`, so one long phase name was setting the width of the
+  whole table.
+
+- **A dispatched phase agent does the work itself, instead of spawning an
+  implementer under it.** claude-code sessions run by the orchestrator were
+  handing their phase to a sub-agent and reporting its summary back, and the
+  pull was not laziness — `implement-phase` ships into the same repositories,
+  its description matches "you are implementing P3 of plan X", and its content
+  is "spawn exactly one implementer subagent". So a session was loading a
+  conductor skill on its own and correctly following it, one level below the
+  conductor that had already spawned it. The cost is the whole point of session
+  reuse: a sub-agent's reading of the codebase ends with the sub-agent, so the
+  warm session that every cross-phase turn greets with "everything you learned
+  still holds" was left holding a paragraph, and each phase paid a cold agent's
+  first turn again. Both halves are now closed. Every `vinta-ai-maestro` role
+  prompt (implementer, reviewer, fixer, chore — cold and continued) carries a
+  no-delegation section that names those skills and says what delegating costs,
+  and the plan-execution unit grows a `dispatched-agent` partial: a guard at the
+  top of all four conductors refusing entry to an agent that was itself handed
+  one phase, plus the same rule inside every composed implementer prompt.
+
+- **The node view's gate panel is a list of verdicts you can open, not a stack
+  of scrolling boxes.** Every gate used to render its whole log at once, each
+  in its own fixed-height box with its own scrollbar — so three gates in a
+  third of a grid row was a column of letterbox slots, and a wheel gesture
+  over one of them was swallowed by that box instead of scrolling the page.
+  Gates are now an accordion: one row per gate, only one open at a time, and
+  the open log has no scroller of its own (it is tail-truncated at 64 KiB
+  already, and long lines wrap the way the diff panel's do). The panel opens
+  on the gate a human question points at, or on the first that is not passing.
+
+- **Each gate row says what happened and what it cost.** The verdict —
+  `running`, `passed`, `failed`, `timed out` — is on the wire now, so a phase
+  whose lint gate passed and whose unit gate failed reads as that instead of
+  as two identical rows; previously the UI could only name the single gate
+  §9.1's question happened to point at, because `NodeDetail` carried an id and
+  a log and nothing else. A running gate shows a clock counting from the
+  daemon's own start time, so a tab opened halfway through a slow suite shows
+  the true elapsed figure rather than starting from zero; a finished one shows
+  the runner's measurement of its latest attempt, with `cached` where the
+  cache served the verdict and a `×N` count where the gate has run more than
+  once.
+
+- **Crew members are named after their tier, not after a seniority.** A roster
+  reads `tier1`, `tier2-1`, `tier2-2`, `tier4` and `reviewer` where it used to
+  read `junior`, `mid-1`, `mid-2` and `senior`. Nothing about the data model
+  moved — `tier` was already the 1-4 number the orchestrator staffs on, and it
+  is still the only thing compared when one member covers for another. What
+  changed is that the label beside it now says the same thing, instead of
+  offering a second vocabulary that could drift from it and that reads as a
+  ranking of people rather than of difficulty. Workflows using the old ids keep
+  running: the ids are free-form and nothing resolves them by name.
+
+- **`plan-feature` emits its workflow with the plan's date prefix.** The
+  executable sibling is now
+  `ai-plans/YYYY-MM-DD-<feature-kebab>.workflow.json` — previously it carried
+  no date, which sorted it away from the `YYYY-MM-DD-FEATURE_NAME_PLAN.md` and
+  `_SPEC.md` it belongs to, so the one file you want with the plan open was the
+  one you had to go looking for. A feature's three files now land adjacent. The
+  case difference between them is not an oversight: the markdown convention is
+  `UPPERCASE_WITH_UNDERSCORES` and a workflow's filename stem *is* its `id`,
+  which the schema requires to be lowercase kebab-case, so the date prefix is
+  the only part the three can share. Existing dateless workflows are unaffected
+  — this is the emitter's convention, not a schema rule.
+- **A gate's command can be retuned while the phase that runs it is still
+  running.** §9's amend refused any change reaching a node in flight, which is
+  exactly the node anyone is looking at when a run is dragging: a `unit` gate
+  missing `--reuse-db` could not be fixed until the run it was costing hours
+  had finished. The refusal now reads a narrower set. A node's harness, model,
+  pipeline, body and base are each read at a moment that has already passed, so
+  changing them is refused as before; a gate's *command* is resolved per gate
+  run by every reader of it, so a running phase simply runs the new command at
+  its next gate. Nothing downstream is blocked either, because a command moves
+  no branch's base. Changing **which** gates a node declares is still refused
+  mid-flight — a phase that gained a gate would finish without ever running it —
+  so that now counts as part of the phase body.
+
+- **A gate result is cached against the command that produced it.** The key was
+  `(gate id, tree hash)`, on the assumption that a gate id names a command.
+  Amending a live run makes that false, and an unchanged tree would have been
+  served the old command's verdict. The command is now part of the key, hashed
+  rather than stored — a command line is repository content. A cache database
+  written before this is dropped when it is opened: its rows cannot say which
+  command produced them, and one re-run per stale entry is the price a lost row
+  already costs.
+
+- **A session cannot inherit a machine's decision to stop compacting.** All
+  three harnesses compact automatically when their context fills — there was
+  never a flag to turn on — but each honours an environment variable that turns
+  it off, and an agent spawned on a machine carrying one would run a long phase
+  straight into a wall it was supposed to be able to survive. Those variables
+  are now stripped from every child the daemon spawns, and claude-code's own
+  setting is reasserted in the per-lane file beside its permission rules. The
+  window itself is left alone: an operator who narrowed theirs compacts earlier,
+  which is not the failure this guards against. A harness that compacts declares
+  it, and a compaction the harness reports is a transcript row like any other.
+
+  One consequence worth knowing: `max_session_turns` used to be a proxy for "this
+  session is nearing a context window it will die on". That death no longer
+  happens, so the ceiling now guards a different thing — a session whose memory
+  was replaced by a summary of itself, and which answers just as confidently.
+
+- **Agent prompts name gates by id rather than printing their commands.** The
+  implementer's step 4 was descriptive — "Outer gate… These run against your
+  lane:" followed by the gate commands — and implementers were observed reading
+  it as a note about what would run later, finishing the scoped inner loop and
+  never running a gate at all. It is imperative now, and every role that runs a
+  gate (implementer, reviewer, fixer, and the continuation of each) is pointed
+  at `vinta-ai-maestro gate <id>`. The fixer prompts no longer say to re-run the
+  gates "until they are green", which contradicted the commit protocol directly
+  below them and left fixers running out the turn with the work uncommitted;
+  they now say to commit and report FAILURE when a gate cannot be turned green.
+  Implementers and fixers report which gates they ran and what each returned —
+  a record for the reviewer to check against, explicitly not a licence for the
+  reviewer to skip running them itself.
+
 - **Phase branches base on their dependencies, not on the previous phase.** A phase
   with no dependencies cuts from the default branch; one with a single dependency
   cuts from that phase's branch; one with several cuts from a
@@ -215,8 +785,878 @@ the project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   `plan/{plan-id}/lane-{phase-id}` branches, merged `--no-ff` into the single plan
   branch at each wave boundary, so the unit commits survive.
 
+- **`project.prepare_cmd`, for the shared servers a run depends on.** A project
+  whose databases are `delivery: external` and whose services point at one Redis
+  has no long-lived containers of its own — the shape these fields recommend —
+  and that makes some *other* stack a hard dependency of every run. Nothing in
+  the package could bring it up. `setup_cmd` looks like the place and is not: it
+  runs per lane, long after the template database was created on a server that
+  had to be up for `createdb` to work at all.
+
+  It runs in the repository root **before anything else a run does** — before
+  the preflight, before the templates, before the first worktree — and again
+  before every lane recycle, so a server that dies mid-run is restored at the
+  next hand-off rather than failing every phase after it. Failure aborts with
+  the exit code and a bounded stderr tail, and says what the failure means
+  rather than only that a command exited. It must be idempotent, and `--wait`
+  is only as good as the `healthcheck` a service declares: without one, compose
+  returns as soon as the container starts and `createdb` races the server.
+
+- **A merge conflict goes to the most senior member who wrote one of its
+  sides.** The conflict fixer was staffed from `defaults` and ignored the roster
+  entirely, so on a tiered crew a collision between two Tier 4 phases was handed
+  to a default-tier agent that had read neither of them — the hardest merge in
+  the run going to the least contextualised agent available, and resolved by
+  guessing which side looked more finished.
+
+  `Integrator` already knows which nodes own the contested paths, and `node_crew`
+  already records who took each one; this is the join. Highest tier among them
+  wins, on that member's own `model` and `harness`, and a tier tie breaks on
+  member id the way roster substitution breaks its own. An unstaffed workflow
+  still resolves through `defaults`, unchanged, and so does a conflict whose
+  nodes cannot be resolved to a member.
+
+  What is carried is the member's **capability, not their session**. A phase's
+  session ran in that phase's lane; the fixer runs in the integration worktree,
+  where the files in dispute are half-merged and unlike anything that session
+  saw — resuming there would give the agent confident, false memories of exactly
+  the files it is merging. The prompt tells the fixer which side is its own, and
+  in the same breath that it is a fresh session and must read rather than
+  recall.
+
 ### Fixed
 
+- **A failed Claude Code turn no longer reads as `claude-code result:
+  success`.** When the CLI ends a turn with `is_error: true` beside
+  `subtype: "success"` (how a plan limit arrives, for one), the recorded
+  error printed the subtype and said "success" — 189 times in one observed
+  run. It now reads `claude-code result: is_error`. Other subtypes
+  (`error_max_turns`, …) are unchanged.
+
+- **The monitor's conversation was mostly unformatted JSON.** Not its answers —
+  its *watchdog's*. An intervention turn must reply with one document matching
+  `intervention.v1.schema.json`, which is what makes the monitor's authority
+  over a live run a closed set of verbs rather than an editor over
+  `workflow.json`; and that turn is journalled into the conversation a person
+  reads, because a run that retuned itself should say so where somebody is
+  already looking. Both of those are right. Rendering the document verbatim was
+  not, and the summary paragraph the operator wanted arrived a thousand
+  characters into one unwrapped line of braces. A proposal now renders as what
+  it says: the summary, then one line per proposed change with its evidence
+  under it, and a tone dot only when something was actually proposed — a turn
+  that looked and changed nothing is the expected outcome and should not shout.
+  The verb table is keyed on the daemon's own union, so a fifth verb fails the
+  UI build rather than shipping as a bare identifier. The journal still holds
+  the bytes the model wrote — only the row changed, so conversations already on
+  disk read as well as new ones. Any other whole-JSON answer is at least
+  indented.
+
+- **The monitor's conversation opened at its oldest entry and never scrolled.**
+  It followed the newest row *only while a turn was running*, on the reasoning
+  that the list is short and the operator is watching the answer they just
+  asked for. Neither half held: the conversation is the journal's, so it holds
+  every question ever asked about the run plus every proposal the run's own
+  watchdog made with nobody asking anything — a hundred entries is ordinary.
+  Opening the panel therefore put the reader at the oldest of them. It now
+  follows the way a phase's transcript does: stuck to the newest row, letting
+  go the moment the reader scrolls up to read, with a "Jump to latest" as the
+  way back. That rule is one module now rather than a well-tested copy in the
+  transcript and none in the monitor, which is how the panel came to be missing
+  three of its parts — including the one that survives a panel being expanded
+  to full page, where the portal hands the view a brand new list scrolled to
+  the top.
+
+- **Hitting the plan's session or weekly limit failed the node instead of
+  waiting for the window to end.** `claude-code`'s refusal table recognised
+  "usage limit reached" and nothing else, and the classifier's default is
+  `fatal` — correctly, since an unrecognised failure must not become an
+  unbounded wait. But the CLI announces a plan window in its own words:
+  "You've hit your session limit", "Session limit reached · resets 3am",
+  "5-hour limit reached", "You've reached your weekly limit". None of those
+  contain "usage limit", so every one of them fell past the table to `fatal`,
+  which fails the node and blocks its whole dependent subtree — for a window
+  that ends by itself in a few hours. The machinery to do the right thing was
+  already there and simply never reached: a `quota` refusal parks the harness,
+  not the node, so every later node joins one wait instead of discovering the
+  limit for itself; the wake time is journalled and survives a daemon restart;
+  and the AIMD ceiling is left alone, because a plan window says nothing about
+  how many agents may run at once. Those wordings are now `quota`. The new row
+  sits *below* `concurrency` and `rate_limit` so that "concurrent session limit
+  reached" keeps the kind that halves the ceiling, and "approaching session
+  limit" — a warning from a harness that is still working — matches nothing.
+
+- **A window that closed *under* a running turn was an ordinary turn failure.**
+  §6.1 is written about a spawn, because that is where a vendor usually says
+  "not right now" — and everything that follows from it, parking the harness so
+  every later node joins one wait, journalling the wake time so a daemon
+  restart does not forget it, leaving the AIMD ceiling alone for a window that
+  says nothing about concurrency, hung off `admit`. So the other arrival of the
+  same fact had none of it: a plan window that closes while an agent is twenty
+  minutes into a phase ends the turn, and the node then burnt its retries
+  against a closed window and failed, blocking its whole dependent subtree —
+  the exact outcome §6.1 exists to prevent, reached by the one path that did not
+  go through admission control. A session now reports a `TurnRefusal`, and the
+  caller answers it with the `CapacityRetry` a refused spawn raises: the lane
+  goes back, the harness parks until the stated reset, and the node re-drives
+  when the window opens.
+
+  Each adapter reads it where its own failure prose is, which is not where its
+  events are: `claude-code`'s terminal `result` frame carries the sentence in
+  the `result` string that `mapResult` deliberately drops (it is agent output,
+  §11), `codex` states a failure as prose on three different frames, and
+  `opencode`'s `session.error` carries it under `data`, which `#errorName`
+  refuses to put in an event. All three read that prose, match it against the
+  table they already had, and drop it — what reaches the caller is a kind, a
+  fixed reason token and a reset time, and what reaches the transcript is one
+  token-only line so the record says why the turn stopped. The stderr-and-exit
+  shape of the same event is read too, from the diagnostics buffer that is the
+  only place that sentence exists.
+
+  The re-drive is a full one, and that is deliberate: the session the turn was
+  using is gone, and resuming from a memory of files a recycle has removed is
+  worse than redoing the work. Nothing is destroyed by it — `recycle` sets
+  aside whatever the turn left uncommitted as a WIP ref first. What it costs is
+  the turn. What it used to cost was the node.
+
+- **A stated reset time was only read when it was an hour on the same day.**
+  `parseRetryAfter` prefers a reset the vendor reported over a guessed backoff,
+  and its wall-clock pattern wanted `am`/`pm` immediately after "reset", so
+  "resets at 15:00", "resets tomorrow at 2am" and the weekly window's "resets
+  on Monday at 12am" all reported nothing — falling back to the five-minute
+  re-probe interval, which across a week-long window is two thousand spawns to
+  discover what the first sentence said. It now reads 24-hour times, `today`,
+  `tomorrow` and a named weekday (the next occurrence of it, which is today
+  only while the hour is still ahead). A reset named by date, "resets Nov 3 at
+  9am", still reports nothing on purpose: a month with no year is a guess, and
+  the re-probe is a better answer than a wait that is wrong by a year. So are
+  "reset 3", "resets at 25:00" and "resets at 13pm" — an hour with neither
+  minutes nor a meridiem is as likely to be a version or a retry count, and
+  everything this function returns becomes a wait.
+
+- **`run --resume` could not provision a pool at all on a project that
+  disables hooks.** `#configureHooks` enables `extensions.worktreeConfig`
+  before it can set `core.hooksPath --worktree`, and that first key is
+  repository-wide: the write lands in the shared `.git/config`, which git takes
+  `.git/config.lock` to edit. Called once per lane out of the provisioning
+  `Promise.all`, the lanes collided on that lock — `could not lock config file
+  …: File exists`. A fresh provision never showed it, because `worktree add`
+  goes through the pool's serialized git turn and staggered the lanes apart by
+  the time they reached the shared write; `adopt` skips `worktree add`, so every
+  lane arrived in the same tick and **every** resume of a `hooks: false` project
+  failed, reproducibly, before a single phase was scheduled. The extension now
+  goes through the same serialized turn. The `--worktree` write stays parallel:
+  it lands in `.git/worktrees/<name>/config.worktree`, one file per lane.
+
+- **A provision failure that was not one of three enumerated kinds said nothing
+  about itself.** `refusal` detailed `DiskProbeError`, `LaneSetupError` and
+  `LaneEnvFileError`; everything else — including the lock collision above and
+  `LaneAdoptError`, the one error a resume is most likely to hit — collapsed to
+  "could not provision the lane pool under …", and the daemon log recorded that
+  same sentence as `run.provision_failed`'s `reason` with no `error` field and
+  no stack. So the run that could not start left behind no record of why, in
+  either place an operator looks. The exclusion was a §11 reading
+  `LaneSetupError` had already revised for this exact reason: §11 keeps
+  repository *contents* out of the record — diffs, file bodies, gate output —
+  and an error's own complaint about a lock file or a ref is not that. An
+  unenumerated error's message is now carried, capped at 500 characters and run
+  through the log's redaction set; `LaneAdoptError` speaks for itself like the
+  other lane errors; and the failure is logged with its kind and stack frames.
+
+- **`doctor` reported the resumed run's own lanes as leftovers blocking it, and
+  offered to destroy them.** The held-branch check fails a run whose phase
+  branches are checked out in another worktree, which is right for a fresh run
+  and exactly wrong for a resume: the integrator puts a lane on
+  `plan/<id>/phase-<n>` for the duration of a phase, so a run killed mid-phase
+  — the kill a resume is *for* — leaves its own lanes holding precisely those
+  branches. Every `run --resume` therefore refused preflight with one failure
+  per phase in flight, each remedied by `git worktree remove --force <lane>`,
+  which deletes the uncommitted work the resume existed to adopt. The check now
+  takes the run being resumed and excludes lanes belonging to it, identified by
+  reading the lane root and asking each worktree which branch it holds — never
+  by comparing git's printed paths with this process's, the platform trap
+  `reap` and `LanePool` both document. `doctor` takes `--resume <run-id>` to ask
+  the same question before a resume, and a lane of *another* run still fails.
+
+- **`vinta-ai-maestro gate` gave up on the slowest gate after five minutes and
+  called it a daemon it could not reach.** The command awaited one `fetch`, on
+  the stated reasoning that a gate is slow for reasons the client cannot shorten
+  and so the client should simply wait — while its own comment claimed it
+  imposed no deadline of its own. It imposed 300 seconds, because that is where
+  Node's `fetch` abandons a response whose headers have not arrived, and a gate
+  that queues for a capacity-1 semaphore and then runs a test suite is routinely
+  slower. In a measured fourteen-hour run this fired **33 times, every one of
+  them on the `unit` gate and none on any other** — a perfect correlation with
+  duration, not a flaky daemon. The gates were running fine and cached green
+  results minutes later; only the answer was lost. Told a transport lie about
+  work in progress, agents wrote polling loops around a command documented as
+  needing none: in one phase, **24 of 108 shell turns were pure waiting, six of
+  them burning a full ten-minute ceiling — 60 minutes, 31% of that phase.** The
+  wait is a `202` hop loop now, which is what `with` already does, having found
+  the same bug the same way and fixed it first.
+
+- **A gate command cut short by the harness started the suite over.** An agent
+  harness caps how long one command may run, and a gate may exceed any such cap
+  — a plan declaring `timeout_s: 2400` is asking for forty minutes against a
+  ten-minute budget. So being killed partway is the *ordinary* ending, and what
+  an agent does next is run the command again. That used to start a second full
+  suite beside the first, queued behind the very semaphore its own predecessor
+  was still holding. The daemon now keys a running gate on `(phase, gate id)`
+  and the re-invocation attaches to it, which makes re-running the command the
+  correct move rather than a wasteful one — worth having, because it is the move
+  an agent makes anyway. There is no token to carry, deliberately: a client that
+  was killed has nothing in hand, and needing something would defeat the point.
+
+- **A pipeline that could not progress was journalled as the word "Error".** The
+  interpreter composes an id-safe reason for exactly this case — which state it
+  could not leave, and which trigger failed to match — and the scheduler threw
+  it as a bare `Error`. `failureReason` reports an unrecognised error by its
+  name, so the sentence was discarded at the one moment it was worth keeping.
+  It is a `PipelineStuckError` now, carrying the state, and the reason survives
+  into the journal. The same shape as the non-zero git exit, fixed the same way.
+
+- **A pull request said nothing but the plan anchor.** The daemon opened PRs
+  with `title: node.name` and `body: node.prompt_ref` — one line, a link to a
+  heading. It had no idea the `prs-context` mechanism existed: there was not a
+  single reference to it in the package, so the rich path the skills use
+  (`open-pr-from-context`, the project's own PR template, inline review
+  comments) was never reached from a run. `open_pr` now reads the phase's
+  `.vinta-ai-workflows/prs-context/<plan>/phase-<node>.md` when the agent wrote
+  one, and the implementer is asked to write it — the 5–15 line summary it
+  already produces, put where a human will read it instead of only the
+  transcript. With no context file the body is composed from the run's own
+  record: the brief, what the phase is based on and why that is not the default
+  branch, its declared surface, its gates, how many attempts it took, and any
+  merge conflicts an agent resolved on the way in — which nobody reviews.
+
+- **A phase with two dependencies could never open a pull request.** Its base is
+  an `integ-<id>` branch and `git_push` pushes only the node's own branch, so
+  `gh` was asked to open against a ref the forge had never seen. It refused, the
+  refusal was discarded, and the phase completed with no PR and nothing saying
+  so — in one observed run, the single node with two dependencies was the single
+  node with no PR. The integration base is pushed before the PR is opened, and
+  every outcome is journalled as `node_pr`, so a PR that did not open is now as
+  visible as one that did.
+
+- **A conflict resolution was never gated.** `IntegratorOptions.verify` has
+  existed as long as the conflict loop, documented as "a resolution that does
+  not build is not a resolution", and nothing ever supplied it. Six merges in
+  one run were resolved by an agent and went straight in — ungated — to become
+  the base the next phase built on, while the phases either side were gated to
+  the hilt. The union of the conflicting nodes' declared gates now runs in the
+  integration worktree, with that worktree's environment, and a red gate spends
+  a fix round instead of shipping.
+
+- **A conflict fixer that committed its own resolution failed the phase.** An
+  agent told to resolve a merge conflict reaches for the sequence a person
+  would — abort, merge again, resolve, commit — and the orchestrator then
+  committed unconditionally on top of it. Against an already-committed
+  resolution `git add --all` is a no-op that exits 0 and `git commit --no-edit`
+  exits 1 with "nothing to commit", which is a throw. A successful resolution
+  was reported as a failed phase, deterministically, on **every wave after a
+  parallel one**: a multi-dependency node is the only thing that merges here,
+  and two sibling phases both creating one file is the common case rather than
+  the rare one. The phase died before its branch was cut, so it left no
+  transcript, no gate log and no branch — only a resolved merge commit sitting
+  in the integration worktree. The commit is now conditional on there being
+  something to commit, and a fixer that discarded the merge instead of resolving
+  it is refused rather than recorded as integrated.
+
+- **The conflict fixer's turn is in the transcript now.** Its event stream was
+  drained and every event dropped — an unread stream never ends — so the one
+  agent turn in a run nobody could watch live was also the one nobody could read
+  afterwards: a resolved merge, a row saying it took two rounds, and no record of
+  what was decided. It lands in the incoming phase's own transcript, beside the
+  implementer and reviewer turns that produced the branches being merged, under
+  a `conflict-fixer` role that keeps it distinguishable from the review fixer —
+  a different job, in a different worktree, on a different thing. The UI has had
+  a band for that role since transcripts learned to name their authors; it had
+  simply never been given one to draw.
+
+- **`PlanDefectError` is now `UnresolvedConflictError`.** The old name made a
+  judgement the orchestrator is not entitled to make. Two same-wave phases
+  touching one file is not a broken plan — the plan's file-overlap analysis is a
+  guess made before a line was written, and the fixer exists because of it. What
+  reaching that error means is narrower: *this* conflict outlasted its rounds and
+  needs a person. The message says so, and now leads with finishing the merge by
+  hand in the integration worktree — which, since a prepared base is reused,
+  survives into the retry — rather than with re-cutting the plan.
+
+- **A conflict was resolved again on every retry, and recorded nowhere.**
+  Conflicts are an ordinary outcome — the plan's file-overlap analysis is a
+  guess and two sibling phases legitimately edit one file — but `prepareBase`
+  reset and re-merged its `integ-<id>` branch unconditionally, so each retry
+  spawned a fresh fixer agent to redo work already done, and discarded any
+  resolution a person had finished by hand in that worktree. One observed run
+  paid for the same resolution three times. A base that already integrates every
+  dependency's current tip is now kept; one built before a dependency moved is
+  still rebuilt, because reuse is about reachability of the tips rather than
+  about the branch existing. Every settled conflict is also journalled as a
+  `node_conflict` event naming both participants, the paths and the rounds it
+  took — previously a wave conflict reached only the post-mortem and a *base*
+  conflict was discarded entirely, so a phase could sit in `running` for minutes
+  while an agent merged in a worktree nobody could see.
+
+- **A failed attempt now says why, wherever it goes next.** The reason was
+  computed at the failure site and handed to the path that gives up — which the
+  default `onFailure: retry` does not take: it retries automatically, then parks
+  on "This phase failed. Try it again?". Both paths dropped the reason, and
+  `#offerRetry` carried a comment asserting the opposite. A phase that failed
+  three times before any agent ran was undiagnosable after the fact, and the
+  only offered action was to repeat it. Every attempt now writes a `node_error`
+  event carrying its reason and attempt number, and a `node.attempt_failed`
+  record to the daemon log.
+
+- **A git command that exited non-zero was persisted as the word "Error".**
+  `failureReason` reports an unrecognised error by its name plus a *string*
+  `code`, and an `execFile` rejection carries `name: 'Error'` with a *numeric*
+  one — so the most common real failure in this package said nothing at all.
+  Git failures now carry their subcommand and exit status (`git commit exited
+  1`), which is a command name and an exit code rather than anything §11 keeps
+  out of the journal.
+
+- **The conflict fixer ran without its worktree's environment.** It was the one
+  agent spawn not given `AgentTask.env`, whose own docstring records this exact
+  bug class. With the daemon's bare environment its `docker compose` resolved to
+  a project named after the directory rather than the isolated one, ignored the
+  `compose.publish: []` override that rides in `COMPOSE_FILE`, and published the
+  project's fixed ports on the host — colliding with the developer's own stack
+  and outliving the run.
+
+- **"Retry with <member>" offered the member that had just failed.** The menu
+  excluded the member the *plan* named, but a substitution means the member that
+  actually ran is someone else — so a phase declared for one tier and covered by
+  a higher one offered that higher one as its escalation, and a third of the
+  menu did nothing distinguishable from plain retry.
+- **An amended workflow now reaches the integrator too, and a wave merge is
+  pinned to the membership it was decided with.** Fixing the executor without
+  fixing the integrator is what made this reachable: `#lastOfWave` decides a
+  wave is complete by counting the executor's node set and `mergeWave` decided
+  what to merge by reading the integrator's, so while both were stale they
+  agreed with each other and nothing showed. One fresh and one stale is a wave
+  whose merge silently omits the branch of a phase that ran.
+
+  The case that gets there is a phase nobody depends on. An amendment is
+  refused while a node it *blocks* is in flight, and such a phase blocks
+  nothing, so it lands freely beside the wave-mates it will be merged with.
+
+  A wave's membership is now computed once, synchronously, by the code that
+  decides the wave is complete, and handed to the merge — a wave merge runs
+  behind the integration worktree's queue and an amendment can land in between,
+  so a merge that re-derived its own membership would merge a phase that never
+  ran. §9's rebase goes through that same queue now, since "the nodes this
+  amendment blocks are idle" says nothing about whether another wave's merge is
+  writing in that directory.
+
+- **An amended workflow now reaches the code that runs the gate.** `adopt`
+  replaced the scheduler's copy of the run's definition and nothing else, while
+  the effect executor and the agent-gate broker each held the snapshot they were
+  constructed with — and the command a gate actually runs is read from the
+  executor's. So an operator who edited a gate command mid-run moved the
+  snapshot, the journal and the pool reservations, watched the amendment be
+  accepted, and went on getting the old command. All three take the amendment
+  now, fanned out from one place, host side before the scheduler so that no
+  phase is dispatched against a definition half the system has not seen yet.
+
+- **Closing a terminal on a run now records the interruption.** `run` and
+  `serve` handle SIGHUP as well as SIGINT and SIGTERM — SIGHUP is what a
+  terminal sends when its window closes, and with no handler Node's default was
+  to die on the spot, running no teardown and writing no `run_ended`. Both
+  commands now mark their live runs interrupted before exiting and print the
+  `--resume` line for each, so a closed window leaves something recoverable
+  instead of a row nothing will ever move again.
+
+- **A member's reviews were counted as phases they took.** `node_crew` is
+  written for both seats — the reviewer's claim carries `role: 'reviewer'`, the
+  implementer's omits it — and the staffing rollup read neither, so every phase
+  a member reviewed was folded into the count of phases they implemented. On any
+  run with reviewers that inflated the number the rollup exists to put beside
+  the plan's estimate, and inflated `asPlanned`, which the run view divides by.
+  The two seats are counted apart now rather than one of them dropped: a review
+  is real work by a real member, and a member who only reviewed is neither a
+  phase-taker nor idle.
+
+- **An agent taking a lease left the resource panel showing the one before it.**
+  The scheduler's own gate-pool transitions are journalled as `gate_pool`
+  events, so the browser re-reads the snapshot when one lands. An agent's lease,
+  taken through `vinta-ai-maestro with`, was only a row in the `leases` table —
+  correct in the daemon's projection and announced to nobody. A projection
+  nobody is told changed is a projection nobody sees change, so the panel showed
+  whatever holders it had last time some unrelated event happened to arrive, and
+  the waits it was stalest about were the agent ones, which are the long ones.
+  The broker now journals `agent_lease` on both edges. A renewal writes nothing:
+  it is a heartbeat on a lease already reported, and journalling it would bury
+  the two rows that are transitions under a liveness log.
+
+- **An agent waiting for a semaphore could be overtaken without bound.** A
+  `vinta-ai-maestro with` wait is served in fifteen-second hops so no client
+  timeout has an opinion about it, and each hop used to abort the underlying
+  `pools.acquire`. Aborting leaves the pool queue, and the next POST re-entered
+  it — at the tail, behind every waiter that had arrived in the meantime. Since
+  a gate run holds a capacity-1 semaphore for minutes, an agent lost that race
+  on hop after hop while the scheduler's own in-process waiters, which never
+  leave the queue, did not. The pool's aging rule could not help: aging reserves
+  against waiters *behind* the aged one, and the waiters that overtook it are in
+  front of it. A `202` now carries a `waitToken` naming the wait, the client
+  sends it back, and the daemon keeps the one queue entry — one arrival time,
+  one place in line — across the whole wait. A parked wait whose client stops
+  hopping is reaped after a minute, releasing the slot if one was granted to it
+  while nobody was watching.
+
+- **The monitor's conversation could never be written on Windows.** It is kept
+  under a reserved node id that becomes a directory, and that id was
+  `monitor:conversation` — a colon, chosen because no phase id may contain one,
+  and the drive separator on Windows. `mkdir` failed with `ENOENT`, so every
+  question threw on its first append and the endpoint reported the monitor
+  unavailable. A colon is legal in a macOS or Linux filename, which is why no
+  machine the feature was built on ever saw it. The id is now
+  `_monitor-conversation`: still unrepresentable as a phase id, and legal
+  everywhere. Conversations recorded under the old id are not migrated.
+
+- **An implementer was told both to commit and never to commit.** The prompt
+  carried "never commit while a gate is red" beside "the turn is not complete
+  until `git status --porcelain` is empty of your work" — a contradiction
+  whenever the gate could not be turned green inside the turn, which is most of
+  why fix rounds exist. Agents obeyed the `never`, and the reviewer one node
+  later raised the BLOCKER it is told to raise for uncommitted work, spending a
+  fix round re-implementing code that was already on disk. A red gate now
+  changes the report and never the decision to commit: commit, and report
+  FAILURE saying what is still red.
+
+  The reviewer's side was a false BLOCKER independently of that. Any unclean
+  tree was a finding, and a lane's tree is never clean — the pool copies
+  configuration in, links dependency trees, and the gates leave build output
+  behind, none of which the implementer is allowed to stage. It is scoped to
+  the failure it was written for now: work that is in the tree and missing from
+  the diff.
+- **A live transcript stops following at entry sixty.** The effect that kept the
+  box on the newest row was keyed on how many rows were *shown*, which is
+  `min(entries, window)` — so it stopped changing the moment a transcript
+  outgrew one window, and the following died silently and permanently, including
+  after the operator scrolled back to the bottom to ask for it. Which is roughly
+  minute two of any real phase. It follows on the entry count now, growing the
+  window keeps the reader on the row they were reading instead of teleporting
+  them, and a **Jump to latest** button says so out loud rather than leaving a
+  60px band at the bottom of a scroller as the only way back in.
+
+- **The transcript spends its space on the noisiest rows.** An agent's answer,
+  its private reasoning and four hundred characters of tool-call JSON all
+  rendered as the same two lines at the same weight. Thinking is now small and
+  quiet, and a streamed thought is one row rather than the dozen events it
+  arrived as; tool calls and their results fold to the argument that says what
+  they did — a command, a path — and open individually or a whole kind at a time
+  from the panel header. Prose is untouched and never folds.
+
+- **A panel's expand control did nothing on the node view.** It expanded by
+  taking `col-span-full`, which on the run view bought a strip a third wider and
+  on the node view matched nothing at all — those panels sit in a flex column,
+  not a grid, so the only thing the button changed was the height of the
+  scroller inside it. It now opens the panel over the whole page through a
+  portal, so no scrolling ancestor can clip it, with Escape to leave and the
+  page behind it held still. A transcript that was following stays on its newest
+  row across the change.
+
+- **`doctor` checks that the shared servers answer.** It verified that binaries
+  existed and disk fitted, and never looked at a `server_url` — so a project
+  whose Postgres lives in another checkout's compose stack passed the preflight
+  with that stack down and died on the first `createdb`, before a worktree
+  existed. Each external database's server and each service URL is now probed
+  with a TCP connect, and a failure names the address that did not answer. A
+  compose-delivered database is deliberately not probed: the lane starts it.
+
+  The order matters as much as the check. `prepare_cmd` runs *before* the
+  preflight, so the check reports the world that hook just made rather than the
+  one in front of it.
+
+- **A service's `create_cmd` runs with the lane's environment.** `reset_cmd`
+  always had it and `create_cmd` did not, so a `create_cmd` that reached for
+  `docker compose` ran against the lane's own compose file with no project name
+  and no override — booting a stack on the project's fixed host ports, which is
+  the collision the override exists to prevent, caused by the step that sets a
+  lane up.
+
+- **`vinta-ai-maestro with` waits for the lock instead of giving up on it.** Its
+  usage said it blocked until the resource was granted, and it did — for about
+  five minutes, which is where Node's own `fetch` stops waiting for a response.
+  A test suite behind a capacity-1 semaphore beats that regularly. What the
+  agent saw was "could not reach the lease daemon", and what agents did with
+  that, repeatedly, was run the command without a lease: exactly the stampede
+  the pool exists to prevent, arrived at by an agent behaving reasonably.
+
+  The wait is the client's now. The daemon answers `202 still queued` within
+  seconds and **leaves its own queue behind it**, so nothing is granted to a
+  request that has gone away; the client loops until it is granted, saying so
+  once and then occasionally, so a transcript shows a wait rather than a
+  silence. Only answers that waiting cannot change — a resource this run does
+  not declare, a run that is no longer live — end it.
+
+  And when it does end that way, the refusal says what not to do about it.
+  "The resource lease was not granted" is an error with no alternative in it;
+  the rule against working around it now travels with the message rather than
+  sitting only in a prompt the agent read twenty minutes earlier. The prompt
+  says it too, including that waiting is the expected outcome and not a failure.
+
+- **A retry gets a fresh fix budget.** `fix_rounds` was set to 0 when a node was
+  created and never again, so a phase that spent its whole budget on attempt 1
+  began attempt 2 already exhausted — one review, one fix, and the exhaustion
+  transition fired straight back. Seen with `max_fix_rounds: 4`: the retry got a
+  single round before the operator was asked again, forty seconds of work
+  standing in for four rounds of it. A retry that inherits the reason the last
+  attempt ran out is not a retry. It resets wherever a node is re-driven from
+  its pipeline's initial state — a capacity refusal, an automatic retry, the
+  operator's answer, the `retry` verb — which is one place rather than four.
+
+- **The last fix is reviewed rather than failed unread.** `standard-phase`
+  checked the budget on the way *out* of `fix`, so the final fixer's work went
+  straight to `failed` with nothing looking at it. Two phases in one run ended
+  on a fixer reporting "all gates green, committed, tree clean" and were failed
+  anyway. The check now sits in front of the fixer, on both doors into it: every
+  fixer that runs is reviewed, and the review after the last one can still pass
+  the phase. Guarding only the review side left a red gate under a passing
+  reviewer looping forever, which is the other half of the same change.
+
+  `max_fix_rounds` still means the number of fixers a phase may spend. `0` now
+  means none, where before it let one run and failed the phase regardless.
+
+- **Agents are told not to background their work.** An implementer started five
+  commands with `run_in_background: true` and closed its turn with "I'll wait for
+  the test result notification before continuing to the outer gate". There is no
+  notification: a headless session ends when the turn ends and whatever it
+  backgrounded is killed with it. Three sessions ended with no report and no
+  commit, and the reviewer failed each for uncommitted work — true, and not the
+  cause. Nothing had said so, and believing a tool that offers backgrounding will
+  still be there afterwards is not unreasonable.
+
+- **The reviewer runs the gates instead of taking their word for it.** The prompt
+  asked it to confirm the outer gate was green, which an agent can do by reading
+  the implementer's report — one reused reviewer session reached a verdict in
+  under four minutes without running the project's tests at all. It is now asked
+  to run them, to say what they returned, and to treat being unable to run them
+  as a finding. Re-review rounds are asked again, because a session that
+  remembers running them last round is remembering a different tree.
+
+- **A retried phase keeps the commits the attempt before it made.** A failed
+  phase re-enters its pipeline at the initial state, which runs `git_branch`
+  again — and `checkout -B` moves an existing branch unconditionally, so attempt
+  2 began by resetting attempt 1's work to base. The files left the worktree,
+  the next reviewer correctly reported "phase not implemented at all", and the
+  fix budget burned re-implementing from nothing until the operator was asked. A
+  phase that produced real commits was guaranteed to lose them.
+
+  "Cold" was always meant to describe the agent's *session*, not its branch —
+  and the default policy targets environmental failures, which is exactly when
+  the previous attempt's code is worth keeping. A resumed branch is checked out,
+  never rebased onto a base that moved: a conflict there would fail the retry
+  during its setup, before the agent that might resolve it has run. A branch
+  that committed nothing is still moved up. Whether this is a second attempt is
+  read from the journal rather than from the ref, because a phase branch's name
+  carries the plan id and not the run id — an identically named branch left by
+  an earlier run must still be cut fresh. `node_assigned` now records
+  `previous_head`, so a reset that does happen is visible in the run rather than
+  only in a reflog.
+
+- **A phase is judged on commits, and the prompts finally say so.** An
+  implementer ran four sessions, reported `SUCCESS` with a green inner loop, and
+  never ran `git commit`: its deliverables were untracked files. The reviewer
+  reads the committed diff, so it saw an empty one and reported "not implemented
+  at all"; the fixer re-implemented, also without committing; the rounds ran out
+  and the lane was recycled over the files. Every instruction that agent had was
+  *about* committing — "never commit while a gate is red" — and none of them
+  said it had to.
+
+  Implementers and fixers, cold and continued, are now told that the phase is
+  reviewed and merged from commits on its branch, that an uncommitted file does
+  not exist as far as the run is concerned, and that the turn is not over until
+  `git status --porcelain` is empty of their work — staged by explicit path,
+  never `git add -A`, because a lane holds local files that are not theirs to
+  commit. The reviewer reads the working tree as well as the diff: a full tree
+  with an empty diff is a real failure and is *not* "not implemented", and the
+  difference decides whether the fixer writes the code again or simply commits
+  it.
+
+- **A recycled lane no longer deletes work nobody committed.** Both recycle
+  paths throw the working tree away. The tree is now committed first — with
+  plumbing, and **off the branch**, under `refs/vinta-ai-maestro/wip/`. On the
+  branch was the first implementation, and it was wrong: a lane's dirty tree
+  holds gate artifacts as often as deliverables, and a phase branch is the base
+  of its dependents, so one gate's scratch file reached the next phase and
+  failed a gate for a reason nothing in that phase caused. Nothing merges,
+  nothing reaches a dependent, and one `git restore --source <ref>` gets a file
+  back. Where the rescue itself fails, the recycle refuses and names the paths.
+
+  The retry question says how much is at stake: commits are kept, and *N*
+  uncommitted files in the lane will be set aside.
+
+- **`project.hooks: skip`.** Committing is not optional any more, and a
+  `language: system` pre-commit chain reads a never-committed-in worktree as a
+  fresh machine — one project's hooks built a 510 MB virtualenv before allowing
+  a first commit, per lane, after four attempts and a two-minute timeout. Set
+  per worktree, so the operator's own checkout keeps its hooks, and opt-in,
+  because hooks are usually there for a reason.
+
+- **`doctor` knows when a project needs docker compose.** It assembled its
+  options without a `project`, so `needsCompose` was handed `undefined` on every
+  invocation and reported "not required by this project" for a
+  compose-delivered database — and `run`'s own preflight did the same. A check
+  nothing can reach is worse than an absent one: it reads as a pass.
+
+- **A failing `setup_cmd` says why.** It carried a lane name and nothing else,
+  so the operator saw "could not provision the lane pool under …" and had to
+  replay the command by hand with the lane environment rebuilt to find a missing
+  settings module. It carries the exit code and a bounded stderr tail now — the
+  same class of thing as a harness refusal's own explanation, which this package
+  already decided to carry after an afternoon lost to the same silence.
+
+- **A lane the executor was not given is refused, not guessed.** It fell back to
+  the right directory with an *empty environment* — a gate running against the
+  wrong compose project and no forked connection string, with nothing anywhere
+  saying a lane was missing.
+
+- **The monitor reads, and does not run.** Its shell has no lane environment, so
+  the project's own commands run from it contend with the lanes instead of
+  observing them. One reported "the final gate fails on a port conflict" when no
+  gate had run at all, and the operator believed it. Gate results come from the
+  journal and the gate logs.
+
+- **`serve --host 0.0.0.0` prints a URL another machine can open.** Binding
+  every interface made the server report the wildcard back, so the line printed
+  for the operator to open — and share — was `http://0.0.0.0:<port>`, which
+  resolves for nobody. The bind is unchanged; the printed host is now this
+  machine's LAN address. The daemon still warns, because the token in that URL
+  is the only thing between the run and anyone who can reach the port.
+
+- **An agent can run a shell command.** `auto` mapped to the vendor's
+  `acceptEdits`, which accepts file *edits* and nothing else — a shell command
+  still goes to a permission prompt, and in `-p` there is nobody to answer one.
+  A run of eight phases died of it: the agents wrote their code and were then
+  refused `ruff`, `pytest`, `git add` and `docker compose`, **69 denials across
+  two lanes**, every gate failing on work that was never allowed to be checked.
+  `auto` now allows `Bash` in the policy file it already writes.
+
+  What that costs is worth stating plainly: **`Bash` was never confined to the
+  lane.** The deny list covers the file-editing tools and a shell redirection
+  walks through it, so allowing the shell allows commands on the machine.
+  `auto` has always promised exactly this in words — "the agent works unattended
+  inside its lane" — and this is the first version where the words are true.
+  `ask` still does not allow it: that mode exists for a human at the browser,
+  and the prompt is its purpose.
+
+- **A refusal says why, in the words the harness used.** `permission_denied`
+  carried a decision token and deliberately dropped the sentence beside it, on
+  §11 grounds. Then a run failed with forty-five denials reading
+  `reason: "other"`, and finding out what that meant cost an afternoon and a
+  rebuilt reproduction — the sentence said "this Bash command contains multiple
+  operations; the following parts require approval". §11 keeps repository
+  *contents* out of the record; a refusal's own explanation is not contents, and
+  the `tool_use` row above it already carries the path and the command verbatim.
+  Withholding it protected nothing and hid the one fact worth having.
+
+- **`serve` opens a run that has already finished.** The API resolved a run from
+  the in-memory registry *and* the journal and required both, so a daemon
+  started with nothing running listed the operator's history — the list reads
+  the journal — and then answered 404 for every run in it, under a message
+  saying the daemon was not running. Reads now need only the journal, which is
+  where a run's whole record lives and which outlives the daemon by design
+  (§5.3). Steering a finished run is still refused, with `409` rather than
+  `404`: the run exists, and saying it does not sends the operator hunting for a
+  typo instead of reading the status in front of them.
+
+- **Four places the UI asked the operator to work around it.** The transcript
+  opened at the *oldest* row it held, so a live agent's newest line — the one
+  the panel was opened to read — sat below the fold and every arriving entry
+  pushed it further down; it now opens at the newest and stays there, but only
+  while the operator is already at the bottom, because scrolling up is reading.
+  The `git diff` command overflowed its panel, uncopyable without selecting
+  blind, and now wraps. The shell's bounded column went from 1280px to 1600px:
+  1280 is a reading measure, and the Nodes table's columns are ids, lane names
+  and branch names, none of which can be abbreviated without losing what
+  identifies them. And the notification interval said "Remind every 5 min"
+  without ever saying what it would remind anyone about — it repeats the
+  notification for a phase that stopped to ask the operator something, until
+  they answer, which is what the options say now.
+
+- **A killed terminal releases its directory on Windows.** Two PTY tests failed
+  teardown with `EBUSY: rmdir`: killing a process there is not synchronous with
+  releasing what it held, so the conpty and its background child are gone as far
+  as the test is concerned while the OS still has the working directory open.
+
+- **A failed phase can be retried instead of ending the run.** `run` takes
+  `--on-failure <stop|ask>`. `stop` is the default and is what every run has
+  always done — the phase fails, its dependents block, the run finishes. `ask`
+  parks the node on a question instead: retry, retry with another member of the
+  crew, or stop.
+
+  It exists because the failures worth retrying are overwhelmingly
+  environmental — a permission wall, a grant nobody made, a gate whose service
+  was not up — and the only recovery was to start the whole plan again, running
+  every phase that had already succeeded a second time. Only pass `ask` when
+  somebody is watching: the run waits, which is exactly why it is not the
+  default.
+
+  The alternatives offered are **members of the crew, not models**. A staffed
+  run has no free-floating models in it — a phase is taken by a member, and the
+  tier floor that decides who may take it is the assigned member's own — so a
+  model is something the plan cannot express and nobody could be found to hold.
+  A member below the phase's tier is never offered: an operator answering a
+  question is not a reason to hand a phase to somebody the plan judged too
+  junior for it.
+
+  The retry starts **cold**, and everything the node held goes back before it
+  waits (§6.1) — an operator at lunch must not be holding a lane another phase
+  could use.
+
+- **A refusal nobody was asked about is now said out loud.** The adapter knew
+  about `permission_request`, a question waiting for an answer, and nothing
+  else. The refusal an operator actually hits is not a question: a read outside
+  the working directory is decided by the CLI and announced as
+  `permission_denied`, with no request to reply to. That frame was dropped at
+  the first `switch` — no event, no journal row, no transcript line. The new
+  `permission_denied` event carries the decision token (`workingDir`, `mode`)
+  and never the vendor's prose, which names the file being read (§11).
+
+- **A turn that ended blocked is no longer a turn that succeeded.** The CLI
+  says `status_category: "blocked"` one frame before reporting
+  `is_error: false`, and both are true from its side: it was asked for
+  something it could not do and said so. Taking the second at its word is how a
+  phase passed having written no code and then failed two steps later under
+  another name. A session that reported an error no longer ends `ok` — which
+  also makes a reviewer fail closed, since its verdict is read back out of a
+  transcript whose session did not end cleanly.
+
+- **An agent still could not write in its own lane.** The entry below passed
+  claude-code `--permission-mode auto`, which matched our own vocabulary for
+  "works unattended" and is not what the vendor means by the word: `auto` still
+  routes a write to a permission prompt, and in `-p` there is nobody to answer
+  one. Run against the CLI, a `Write` to the agent's *own working directory*
+  comes back denied with no reason attached — the same dead end, wearing the
+  word that made it look closed. `acceptEdits` is the mode under which that
+  write succeeds, and is what `auto` now maps to. The test covering this
+  asserted the word rather than the behaviour, so it pinned the bug in place.
+
+- **A phase can read the operator's checkout.** A lane is a worktree cut from a
+  branch, so anything uncommitted — a plan written this morning, a spec that
+  never leaves the operator's machine — is present where they are and absent
+  from every lane. Reaching for it was refused before the model saw a byte, with
+  a message that reads like a prompt awaiting an answer ("Claude requested
+  permissions to read from …, but you haven't granted it yet") when in fact
+  nothing is asking: the CLI denies it outright, emits no permission request,
+  and the session then ends *successfully*, having written nothing.
+
+  The repository root is now granted to every claude-code agent for **reading**.
+  Granting a directory also grants writing in it, and the lane sits inside the
+  directory being granted, so the grant is paired with a deny list that keeps
+  the lane the only writable place under it — the operator's source and every
+  sibling lane stay refused. That list names the *siblings* at each level down
+  to the lane rather than the root itself, because the vendor resolves deny
+  before allow with no carve-out: `deny: <repo>/**` plus `allow: <lane>/**`
+  refuses the lane too. Each of those facts was established by running the CLI.
+
+  **This covers the file-editing tools and not `Bash`.** A shell redirection was
+  never confined to the working directory and is not confined now; that boundary
+  is the OS's, and the vendor's sandbox that enforces it also switches off the
+  network a phase needs to install anything.
+
+  codex needed nothing: under `--approve-for-me` it already reads anywhere on
+  disk, which was confirmed the same way.
+
+- **An agent can write in its own lane.** Every adapter declared
+  `permissionControl: true` and passed no policy at all: claude-code was spawned
+  as `-p --output-format stream-json …` with no `--permission-mode`, and codex as
+  `exec --json` with no sandbox and no approval flag, under a comment saying it
+  took both on the command line. So a headless run asked before its first write,
+  emitted a `permission_request`, rendered it in the transcript — and nothing
+  anywhere answered. The phase failed reporting a permission system it could not
+  see, having written nothing.
+
+  `run` and `serve` now take `--permission <ask|auto|full>`, defaulting to
+  `auto`. **The operator sets it, never the workflow document**: the document is
+  committed and shared, and a file in a repository should not be able to tell
+  someone else's machine to run agents without approvals.
+
+  Both CLIs refuse combinations that looked reasonable, and both were found by
+  running them rather than reading them: codex rejects `--sandbox` alongside
+  `--approve-for-me`, and `codex exec resume` accepts neither — passing the
+  fresh-spawn policy there turned a `stale_session` refusal, which the scheduler
+  retries cold, into a `fatal` one that fails the node.
+
+  This reverses a documented decision. The README said the daemon passed no
+  permission flags and that a committed `.claude/settings.json` was what made a
+  run able to write; that is now the narrowing layer on top of a mode, not the
+  only thing standing between an agent and a blocked lane.
+- **`purge --lanes --branches` clears what a failed run leaves behind.** A run's
+  lane worktrees are not under `runs/`, so no purge ever reached them: three
+  failed attempts at one plan left twelve worktrees, twelve summaries, and a set
+  of `plan/<id>/phase-*` branches still checked out — which is what makes the
+  *next* run of that plan impossible, since git refuses to check out a branch a
+  second worktree holds.
+
+  One rule decides both: **never delete the only copy of work.** A phase can
+  leave work committed on its branch or uncommitted in its worktree, and both
+  count — so a branch carrying commits no other branch has is kept, a lane with
+  a dirty tree is kept, and each is listed with the command to remove it by
+  hand. Untracked files count as work: a phase that wrote three new modules and
+  never committed them is exactly the case worth protecting.
+
+  Emptiness is measured as "carries no commit another branch does not already
+  have", not as "merged into HEAD". The latter is relative to wherever the
+  operator is standing, so on a feature branch — the checkout this is most often
+  run from — every empty phase branch looked unmerged and nothing was ever
+  cleaned up.
+
+  `--dry-run` and `--yes` work as they already did, and a worktree that will not
+  go is named rather than counted.
+
+- **`doctor` now catches, before a lane exists, the failures that used to take a
+  run each.** Four consecutive runs of one plan failed four different ways, and
+  every one of them was knowable at minute zero from the workflow and the repo.
+  - **Every `prompt_ref` and `plan_context_ref` is resolved against
+    `base_branch`**, with `git cat-file -e`, which reads the branch's tree and
+    so cannot be satisfied by a working-tree copy — the working tree being
+    exactly what a lane will not have. It distinguishes the three cases, because
+    they have three different fixes: never committed, **staged but never
+    committed** (`git add` alone does not put a file in a branch), and committed
+    on a different branch. The last offers both routes out — merge it, or point
+    `base_branch` at the branch that has it — since only the operator knows
+    which they want.
+  - **Phase branches held by another worktree** are reported with the directory
+    to remove. Lane directories are named per run and phase branches per
+    workflow, so a failed run leaves worktrees holding the branch names the next
+    run will try to cut, and git refuses to check out a branch twice. Nothing
+    cleans those up: `purge` deletes run state under `.vinta-ai-maestro/runs/`,
+    and lane worktrees are not there. `doctor` does not delete them either — a
+    failed lane's worktree is the only place its state survives — but it now
+    names each one and the exact command.
+
+- **A failed node records why.** `node_status` carried `{"status":"failed"}` and
+  nothing else, so two runs failing for two unrelated reasons produced identical
+  journal rows and the cause survived only in the operator's terminal. The
+  reason is now persisted — **sanitized**, not raw: errors the package builds
+  itself are identifiers by construction and are kept verbatim, and anything
+  else is reduced to its kind, the rule `recycleStage` already followed. The
+  journal is durable and API-served, and an exception message from a dependency
+  is exactly how repository content gets into one. Blocked dependents record
+  which node blocked them.
+
+- **Two diagnostics that named the symptom and hid the cause.** Both came out of
+  one real run, and neither was a wrong answer — just an unusable one.
+  - **A phase whose plan is not committed** failed with `prompt_ref "…" names no
+    readable file`, against a path that was spelled correctly. A lane is a fresh
+    worktree of the base branch, so a plan sitting untracked in the operator's
+    checkout is in the one place the run cannot look. The message now names the
+    directory it resolved against and says why a plan is often not in it.
+  - **A lane summary the daemon could not accept** reported `summary unreadable`
+    and advised deleting the lane — which takes its forked databases with it,
+    over what turned out to be two wrong fields. `doctor` now names the fields
+    and what was expected, and offers repair before deletion. A file that does
+    not parse at all still reports as unreadable, because there is no field to
+    name. Neither message carries the offending *value*: a summary holds
+    database names and connection variables, and the value that failed
+    validation is the likeliest thing in it to be one.
+
+  `prepare-worktree` gained the rule that would have prevented the summary in
+  the first place — its `|` alternatives are closed sets read by machine, `null`
+  is how you say "none", and a strategy outside the set should be the closest
+  one plus a `note:` rather than a fourth word.
+
 - **`npx vinta-ai-maestro` now runs.** The published package pointed its `bin` at
   `src/cli/bin.ts` and relied on Node stripping the types at startup — which Node
   refuses to do anywhere under `node_modules`, unconditionally and with no flag to
@@ -654,7 +2094,6 @@ the project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   **Consumers**: re-sync to pick up the opt-in questions. E2E-disabled projects
   are unaffected (the e2e regions strip out as before).
 
-
 <!-- pre-release: 0.2.0-alpha6 on 2026-07-13 -->
 
 ### Changed
@@ -691,7 +2130,6 @@ the project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Added
 
-
 - **`handoff` foundation skill — session-continuation handoff docs between
   agents.** Write mode captures the current task (goal, verified-vs-unverified
   state, decisions + rejected alternatives, landmines, single concrete next