wicked-crew 0.7.12 → 0.7.14

package/dist/api/routes.d.ts

@@ -1,7 +1,7 @@
 import type { FastifyInstance } from 'fastify';
 import { z } from 'zod';
 import { CoreAdapter } from '../core/adapter.js';
-import type { GateCache } from './gate-cache.js';
+import { type GateCache } from './gate-cache.js';
 import type { ElicitationCache } from './elicitation-cache.js';
 import { QeGateCache } from '../qe/gate-events.js';
 import { SeatHealthTracker } from './seat-health.js';
@@ -14,6 +14,7 @@ import { RetryIndex } from './retry-index.js';
 import { GroupIndex } from './group-index.js';
 import { GuidanceIndex } from './guidance-index.js';
 import { DeliveryIndex } from './delivery-index.js';
+import { DeliveryDerivationCache } from './delivery-cache.js';
 import { type DeliverExec, type WorktreeReprovisioner } from './post-hoc-deliver.js';
 import { type AuthMode } from './auth.js';
 export { API_PREFIX } from './api-prefix.js';
@@ -66,11 +67,11 @@ export declare const LaunchSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     problem: string;
     deliver?: "pr" | "none" | undefined;
+    repoRef?: string | undefined;
     projectId?: string | undefined;
     campaignId?: string | undefined;
     groupLabel?: string | undefined;
     workflow?: string | undefined;
-    repoRef?: string | undefined;
     clisJson?: string | undefined;
     sessionId?: string | undefined;
     retryOf?: string | undefined;
@@ -79,11 +80,11 @@ export declare const LaunchSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
 }, {
     problem: string;
     deliver?: "pr" | "none" | undefined;
+    repoRef?: string | undefined;
     projectId?: string | undefined;
     campaignId?: string | undefined;
     groupLabel?: string | undefined;
     workflow?: string | undefined;
-    repoRef?: string | undefined;
     clisJson?: string | undefined;
     sessionId?: string | undefined;
     retryOf?: string | undefined;
@@ -92,11 +93,11 @@ export declare const LaunchSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
 }>, {
     problem: string;
     deliver?: "pr" | "none" | undefined;
+    repoRef?: string | undefined;
     projectId?: string | undefined;
     campaignId?: string | undefined;
     groupLabel?: string | undefined;
     workflow?: string | undefined;
-    repoRef?: string | undefined;
     clisJson?: string | undefined;
     sessionId?: string | undefined;
     retryOf?: string | undefined;
@@ -105,11 +106,11 @@ export declare const LaunchSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
 }, {
     problem: string;
     deliver?: "pr" | "none" | undefined;
+    repoRef?: string | undefined;
     projectId?: string | undefined;
     campaignId?: string | undefined;
     groupLabel?: string | undefined;
     workflow?: string | undefined;
-    repoRef?: string | undefined;
     clisJson?: string | undefined;
     sessionId?: string | undefined;
     retryOf?: string | undefined;
@@ -118,11 +119,11 @@ export declare const LaunchSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
 }>, {
     problem: string;
     deliver?: "pr" | "none" | undefined;
+    repoRef?: string | undefined;
     projectId?: string | undefined;
     campaignId?: string | undefined;
     groupLabel?: string | undefined;
     workflow?: string | undefined;
-    repoRef?: string | undefined;
     clisJson?: string | undefined;
     sessionId?: string | undefined;
     retryOf?: string | undefined;
@@ -131,11 +132,11 @@ export declare const LaunchSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
 }, {
     problem: string;
     deliver?: "pr" | "none" | undefined;
+    repoRef?: string | undefined;
     projectId?: string | undefined;
     campaignId?: string | undefined;
     groupLabel?: string | undefined;
     workflow?: string | undefined;
-    repoRef?: string | undefined;
     clisJson?: string | undefined;
     sessionId?: string | undefined;
     retryOf?: string | undefined;
@@ -231,6 +232,12 @@ export interface RuntimeDeps {
      *  the same reason; defaults to the TTL-memoized `gitRunBranchIsEmpty` over the adapter's
      *  repo registry. */
     runBranchIsEmpty?: (repoRef: string, runId: string) => Promise<boolean>;
+    /** The background delivery-derivation cache (GET /runs p99): the run DTOs READ this instead
+     *  of running the two git probes above at assembly — `createServer` builds one over the
+     *  production probes, arms its sweep, and warms it at each run's terminal frame. A
+     *  directly-driven route set gets a COLD, unstarted one over the same injectable probes:
+     *  reads then answer the stat-only tri-state until a test sweeps or warms it explicitly. */
+    deliveryCache?: DeliveryDerivationCache;
     /** The post-hoc deliver exec (crew#393, `POST /runs/:id/deliver`) — spawns the hardened
      *  deliver script in a run's worktree. Injectable so route tests aim the spawn's HOME/PATH at
      *  a fixture (stub `gh`, local bare origin); defaults to the real `bash -lc` spawn. */

package/dist/api/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/api/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAmD,WAAW,EAA4E,MAAM,oBAAoB,CAAC;AAE5K,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAMnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAWrD,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAYtF,OAAO,EAAe,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAGnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGzE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAOL,KAAK,SAAS,EACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,aAAa,EAQd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAGL,KAAK,WAAW,EAEhB,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGvD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAgG7C;;;;;;;;;;;;GAYG;AAIH,eAAO,MAAM,YAAY;;;;;;;;IAQvB;+FAC2F;;IAE3F;;;;;;+CAM2C;;IAE3C;;0FAEsF;;IAEtF;;;;6FAIyF;;IAEzF;;wDAEoD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASpD,CAAC;AAEH,eAAO,MAAM,UAAU;;;;;;;;;EAGZ,CAAC;AAEZ;;yEAEyE;AACzE,eAAO,MAAM,cAAc;;;;;;EAEhB,CAAC;AAUZ,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;EAQpB,CAAC;AAOZ,4FAA4F;AAC5F,eAAO,MAAM,cAAc;;;;;;;;;EAGhB,CAAC;AAwBZ,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,QAAQ,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B;oGACgG;IAChG,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;sDAEkD;IAClD,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;uGACmG;IACnG,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;qBAEiB;IACjB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;4DAEwD;IACxD,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C;;oGAEgG;IAChG,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD;;;yBAGqB;IACrB,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE;;2FAEuF;IACvF,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;wGAEoG;IACpG,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C;2FACuF;IACvF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAC;IAC1E;;0DAEsD;IACtD,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;IAC3C;;gFAE4E;IAC5E,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,cAAc,CAAC;IAC3D;4FACwF;IACxF,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;mGAC+F;IAC/F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,gBAAgB,EAIlC,YAAY,GAAE,WAA+B,EAG7C,QAAQ,GAAE,iBAAqF,EAK/F,QAAQ,GAAE,YAA0D,EAGpE,OAAO,GAAE,WAAgB,GACxB,IAAI,CA27EN"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/api/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAmD,WAAW,EAA4E,MAAM,oBAAoB,CAAC;AAE5K,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAMnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAWrD,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAYtF,OAAO,EAAe,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAGnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGzE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAOL,KAAK,SAAS,EACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,aAAa,EAOd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAGL,KAAK,WAAW,EAEhB,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGvD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAgG7C;;;;;;;;;;;;GAYG;AAIH,eAAO,MAAM,YAAY;;;;;;;;IAQvB;+FAC2F;;IAE3F;;;;;;+CAM2C;;IAE3C;;0FAEsF;;IAEtF;;;;6FAIyF;;IAEzF;;wDAEoD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASpD,CAAC;AAEH,eAAO,MAAM,UAAU;;;;;;;;;EAGZ,CAAC;AAEZ;;yEAEyE;AACzE,eAAO,MAAM,cAAc;;;;;;EAEhB,CAAC;AAUZ,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;EAQpB,CAAC;AAOZ,4FAA4F;AAC5F,eAAO,MAAM,cAAc;;;;;;;;;EAGhB,CAAC;AAwBZ,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,QAAQ,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B;oGACgG;IAChG,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;sDAEkD;IAClD,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;uGACmG;IACnG,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;qBAEiB;IACjB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;4DAEwD;IACxD,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C;;oGAEgG;IAChG,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD;;;yBAGqB;IACrB,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE;;;;gGAI4F;IAC5F,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;2FAEuF;IACvF,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;wGAEoG;IACpG,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C;2FACuF;IACvF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAC;IAC1E;;0DAEsD;IACtD,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;IAC3C;;gFAE4E;IAC5E,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,cAAc,CAAC;IAC3D;4FACwF;IACxF,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;mGAC+F;IAC/F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,gBAAgB,EAIlC,YAAY,GAAE,WAA+B,EAG7C,QAAQ,GAAE,iBAAqF,EAK/F,QAAQ,GAAE,YAA0D,EAGpE,OAAO,GAAE,WAAgB,GACxB,IAAI,CAs+EN"}

package/dist/api/routes.js

@@ -7,6 +7,7 @@ import { isAbsolute, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { CampaignsUnsupportedError, ChatUnsupportedError, CoreAdapter, ElicitationUnsupportedError, SteeringUnsupportedError, humanGatePhaseIds } from '../core/adapter.js';
 import { codeGraphDb, requirementsGraph } from '../core/repoPaths.js';
+import { detectRefusal } from './gate-cache.js';
 import { QeGateCache } from '../qe/gate-events.js';
 import { buildAcceptanceView, resolveRunWorkflow } from '../qe/acceptance.js';
 import { buildEvidenceBundle, coreUnitId, evidenceFilename } from './evidence.js';
@@ -34,7 +35,8 @@ import { AcpFoldCache, EngineVersionCache, eventsDirOf, installedPackageVersion,
 import { RetryIndex } from './retry-index.js';
 import { GroupIndex } from './group-index.js';
 import { GuidanceIndex } from './guidance-index.js';
-import { DeliveryIndex, deliveryStateWithVacuity, gitRunBranchIsEmpty, gitWorktreeIsClean, isDeliverConflictStranded, prUrlFrom, } from './delivery-index.js';
+import { DeliveryIndex, gitRunBranchIsEmpty, gitWorktreeIsClean, isDeliverConflictStranded, prUrlFrom, } from './delivery-index.js';
+import { DeliveryDerivationCache } from './delivery-cache.js';
 import { gitReprovisionWorktree, runDeliverScript, } from './post-hoc-deliver.js';
 import { LOCAL_ACTOR } from './auth.js';
 // Re-exported so existing `import { API_PREFIX } from './routes.js'` callers keep working; the
@@ -262,6 +264,16 @@ runtime = {}) {
                 return repos.find((r) => r.id === repoRef)?.root_path;
             }),
     };
+    // The background layer that owns the git probes above (GET /runs p99): the run DTOs read it,
+    // the daemon's sweep/warm feed it. The default (a directly-driven route set) is COLD and
+    // unstarted — no background timer under a unit test, reads degrade to the stat-only
+    // tri-state — while `createServer` injects a started one over the production probes.
+    const deliveryCache = runtime.deliveryCache ??
+        new DeliveryDerivationCache({
+            listViews: () => adapter.sessionsDetail(),
+            probes: vacuityProbes,
+            isDelivered: (runId) => deliveryIndex.urlFor(runId) !== undefined,
+        });
     const deliverExec = runtime.deliverExec ?? runDeliverScript;
     const reprovisionWorktree = runtime.reprovisionWorktree ?? gitReprovisionWorktree;
     /** Repo root for a repo ref, from the registry — shared by the reprovision path below. */
@@ -275,7 +287,10 @@ runtime = {}) {
     // completed code run whose work is sitting unlifted in its worktree is VISIBLE on the wire,
     // legacy records included. The would-be-stranded runs are further split (crew#311): a
     // completed run whose worktree carries NO contribution at all reads `'vacuous'` — units all
-    // "done" with nothing produced must be LOUD on the wire, never silently green.
+    // "done" with nothing produced must be LOUD on the wire, never silently green. The vacuity
+    // split's git probes run in the BACKGROUND (delivery-cache.ts — GET /runs p99): DTO assembly
+    // reads the cache and degrades to the stat-only stranded/none label for at most one sweep
+    // tick on a miss, so the list fan-out never spawns git.
     // Applied at DTO assembly on exactly the two endpoints that serve the run DTO
     // (GET /runs + GET /runs/:id); the internal sessionsDetail() consumers are untouched.
     // crew#418 A: a `failed` run whose ONLY failure was the deliver phase's LIFT collision (a
@@ -303,16 +318,18 @@ runtime = {}) {
     };
     /** The run's delivery state, honest by construction (crew#393/#311/#418): a recorded PR wins
      *  (`'delivered'`); else a lift-conflict strand reads `'stranded'` from the branch; else the
-     *  worktree-stat derivation (stranded / vacuous / none). */
-    const resolveDelivery = async (view, conflictStrand) => {
+     *  delivery-derivation CACHE (a background-derived stranded / vacuous / none — GET /runs p99).
+     *  A cache miss answers the stat-only tri-state (one existsSync, the pre-crew#311 label) for
+     *  at most one sweep tick; the request path never spawns git and never awaits a derivation. */
+    const resolveDelivery = (view, conflictStrand) => {
         const url = deliveryIndex.urlFor(view.session.id);
         if (url !== undefined)
             return { delivery: 'delivered', deliverUrl: url };
         if (conflictStrand)
             return { delivery: 'stranded' };
-        return deliveryStateWithVacuity(view.session, undefined, vacuityProbes);
+        return deliveryCache.read(view.session);
     };
-    const decorateRun = async (view) => {
+    const decorateRun = (view) => {
         const conflictStrand = normalizeStranded(view);
         view.session.project_id = projects.index.projectOf(view.session.id) ?? null;
         const retryOf = retryIndex.retryOfFor(view.session.id);
@@ -330,7 +347,7 @@ runtime = {}) {
         const guidance = guidanceIndex.guidanceFor(view.session.id);
         if (guidance !== undefined)
             view.session.guidance = guidance;
-        const state = await resolveDelivery(view, conflictStrand);
+        const state = resolveDelivery(view, conflictStrand);
         view.session.delivery = state.delivery;
         if (state.deliverUrl !== undefined)
             view.session.deliverUrl = state.deliverUrl;
@@ -858,7 +875,7 @@ runtime = {}) {
     });
     // Run list (replaces GET /sessions). Actionable-first; reconciles the gate and elicitation caches
     // so that terminal-run entries are pruned even when their terminal CoreEvent was missed.
-    app.get(`${V}/runs`, { config: { manifest: { responseType: '{ runs: SessionView[] }', statusCodes: [200] } } }, async (req) => {
+    app.get(`${V}/runs`, { config: { manifest: { responseType: '{ runs: SessionView[] }', statusCodes: [200, 400] } } }, async (req, reply) => {
         const views = await adapter.sessionsDetail();
         gateCache.reconcile(views);
         elicitationCache.reconcile(views);
@@ -868,12 +885,35 @@ runtime = {}) {
         // resolve, not leak.
         // Fastify parses a REPEATED query param as string[] — normalize so `?include=archived`
         // and `?include=archived&include=archived` behave identically (Copilot).
-        const { include } = req.query;
+        const { include, limit } = req.query;
         const includeArchived = (Array.isArray(include) ? include : [include]).includes('archived');
+        // `?limit=N` — the top N AFTER the actionable-first sort below, so a capped poll still sees
+        // the runs that need a human before the terminal sediment. The default stays UNBOUNDED: the
+        // param used to be read by nobody (silently ignored — the full payload regardless), so an
+        // implicit cap would silently change results for un-migrated callers. A malformed value is
+        // refused loudly instead of ignored (the FINDING-031 posture: ignoring a field runs a
+        // different request than the caller sent) — and a repeated `?limit` is malformed too, since
+        // two caps are an ambiguity, not an idempotent repetition like `include`.
+        let cap;
+        if (limit !== undefined) {
+            // STRICT canonical decimal only (Copilot on #435): `Number(...)` also admits hex
+            // (`0x10`), exponent (`2e3`), signed (`+1`), and whitespace-padded spellings — surprising
+            // aliases a 400-on-malformed contract must refuse, not quietly honor. `0` is deliberately
+            // VALID and answers the empty list — a real non-negative integer, not a malformation —
+            // while non-canonical zeros (`00`, `01`) are refused with the rest.
+            const canonical = !Array.isArray(limit) && /^(0|[1-9][0-9]*)$/.test(limit);
+            if (!canonical) {
+                return reply.code(400).send({
+                    error: `Invalid ?limit — expected one non-negative decimal integer, got ${JSON.stringify(limit)}`,
+                });
+            }
+            cap = Number(limit);
+        }
         const visible = includeArchived
             ? views
             : views.filter((v) => v.session.archived_at == null);
-        return { runs: await Promise.all(sortActionableFirst(visible).map(decorateRun)) };
+        const ordered = sortActionableFirst(visible);
+        return { runs: (cap !== undefined ? ordered.slice(0, cap) : ordered).map(decorateRun) };
     });
     // ── Run archival (crew#265) — write-off, not delete ────────────────────────
     const ArchiveSchema = z.object({
@@ -933,7 +973,7 @@ runtime = {}) {
         const run = views.find((v) => v.session.id === id);
         if (!run)
             return reply.code(404).send({ error: 'Run not found' });
-        return { run: await decorateRun(run) };
+        return { run: decorateRun(run) };
     });
     // ── Post-hoc delivery (crew#393) — lift a stranded run's worktree into a PR ──
     // The recovery path for the run 83052f0b class: a COMPLETED repo-scoped run whose reviewable
@@ -1463,7 +1503,7 @@ runtime = {}) {
         // The 409 body carries the machine-readable pointer (`ResumeRefusal` in api-types).
         const terminal = run.session.status;
         if (terminal === 'completed' || terminal === 'cancelled') {
-            const state = await resolveDelivery(run, conflictStrand);
+            const state = resolveDelivery(run, conflictStrand);
             const recovery = terminal === 'completed' && state.delivery === 'stranded'
                 ? 'deliver'
                 : 'retry';
@@ -1562,11 +1602,16 @@ runtime = {}) {
             : null;
         const durableGate = durableRows?.find((r) => r.kind === 'gate');
         if (durableGate !== undefined) {
+            // This path builds the entry inline (not through `fold`), so it must run the SAME refusal
+            // detection (issue #419) — otherwise a gate served from the durable row after a restart would
+            // silently drop the warning that the live/replay paths carry.
+            const refusal = detectRefusal(durableGate.prompt);
             const entry = {
                 ord: durableGate.ord ?? 0,
                 prompt: durableGate.prompt,
                 lifecycle: 'open',
                 receivedAt: new Date(durableGate.created_at).toISOString(),
+                ...(refusal !== undefined ? { refusal } : {}),
             };
             gateCache.adopt(id, entry);
             return { runId: id, ...entry };
@@ -2434,7 +2479,7 @@ runtime = {}) {
         // The escalation ladder's knobs (crew#341). This trio lets the PLATFORM touch runs, so a
         // typo must be a 400, never a silently-dropped key that leaves the operator believing they
         // armed (or disarmed) automatic recovery. `workerStallEscalateMinutes: 0` is the explicit
-        // OFF spelling — and the shipped default is off (absent).
+        // OFF spelling — the shipped default is ON at 30 (perf#4), so 0 is how an operator disarms.
         if (Object.hasOwn(patch, 'workerStallEscalateMinutes')) {
             const mins = patch.workerStallEscalateMinutes;
             if (typeof mins !== 'number' || !Number.isInteger(mins) || mins < 0 || mins > 1440) {
@@ -2556,6 +2601,8 @@ runtime = {}) {
         groupIndex,
         deliveryUrlFor: (runId) => deliveryIndex.urlFor(runId),
         vacuity: vacuityProbes,
+        // A non-probe derivation throw in the rollup is a defect — error level, loud in diagnostics.
+        logDefect: (m) => app.log.error(m),
     });
     // ── Governance wiki management (wiki-mgmt) — scoreboard + honest empty-state meta ──────────
     // Browse (`GET /governance/rules` + facets) and retire (`DELETE /governance/rules/:id`) stay