magi/

daemon.rs

//! The unattended scheduler and independently leased task workers.
//!
//! The scheduler chooses tasks and execution lanes; a detached worker owns each
//! queue claim, graph driver and outcome settlement. Replacing the scheduler
//! reconstructs occupied slots from live worker jobs, without touching their
//! attempts, passes or paid agent calls. Finite maintenance jobs follow the same
//! lifetime rule. Explicit parking is durable control, never an upgrade step.
//!
//! # A crashed worker is legible
//!
//! A task is written `Running`, with its run id, before graph execution. The
//! worker keeps its claim until the outcome is recorded. Recovery requires both
//! no live worker reservation and an obtainable task claim, and settles the
//! saved run through the same policy as a live finish. A scheduler's missing
//! heartbeat alone is never evidence that a run died.
//!
//! # Retries are bounded
//!
//! Every attempt at a task consumes one of [`Opts::max_attempts`], after which
//! the task is [`crate::queue::TaskStatus::Held`] for a human. The one
//! exception is a run that ended `Stalled`: the panel collapsed because the
//! agent CLIs hit their quota, which is a fact about the machine and not about
//! the task, so it must not spend an attempt. Without that exception a quota
//! outage would quietly hold the entire backlog, and the operator would come
//! back to a reset quota and nothing left that the loop is willing to run.

use std::path::{Path, PathBuf};
use std::sync::Arc;
use std::sync::atomic::{AtomicBool, Ordering};
use std::sync::{Mutex, MutexGuard};
use std::time::Duration;

use anyhow::{Context, Result, bail};
use jiff::Timestamp;
use serde::{Deserialize, Serialize};
use tokio::sync::Notify;

use crate::ask::{self, Questions};
use crate::clean;
use crate::conduct::Conductor;
use crate::config::{Config, MergeMode};
use crate::graph::Runner;
use crate::land;
use crate::notices::{self, Link, Notice};
use crate::queue::{Queue, Task, TaskStatus};
use crate::run::{Liveness, QuotaLoss, RunState, RunStatus};
use crate::triage;

/// On-disk format for [`Status`]. Bumped when a field's meaning changes.
pub const SCHEMA: u32 = 1;

/// How often the status file is refreshed. A reader treats a status file older
/// than [`STALE_SECS`] as "no daemon", so the heartbeat has to be brisk enough
/// that a busy daemon is never mistaken for a dead one.
pub const HEARTBEAT: Duration = Duration::from_secs(5);

/// How old a heartbeat may be before a reader calls the daemon dead. Six
/// missed beats: long enough to survive a slow filesystem, short enough that
/// a crashed daemon is not still reported as running a task.
///
/// The single threshold every reader shares — the web UI's `/api/health` and
/// `magi doctor` both call [`Reading::running`] rather than each comparing
/// against their own copy of this number, so a crashed daemon cannot look
/// alive on one screen and dead on another.
pub const STALE_SECS: i64 = 30;

/// Default queue poll interval.
pub const POLL: Duration = Duration::from_secs(5);

/// How old a claim has to be before startup sweeps it. Longer than any run
/// this graph plausibly takes, so a sweep cannot pull a task out from under a
/// daemon that is merely slow.
pub const STALE_CLAIM: Duration = Duration::from_secs(6 * 60 * 60);

/// How long a task may sit [`TaskStatus::Running`] with no live daemon's
/// heartbeat naming it before [`crate::conduct`] is shown it as stalled.
///
/// [`reclaim_orphaned_running`] settles most crashes immediately, on every
/// poll, by attempting the task's own claim: a dead pid is proof enough for
/// [`sweep_stale_claims`] to drop the lock the same tick, and the very next
/// claim attempt succeeds. But a lock whose pid cannot be parsed at all — an
/// empty or corrupt `.lock` file — falls back to [`STALE_CLAIM`]'s six-hour
/// age instead, since there is nothing else to check (see
/// [`sweep_stale_claims`]'s own doc). For as long as that lock survives, the
/// claim keeps failing and `reclaim_orphaned_running` correctly leaves the
/// task `running` — see
/// `stalled_tasks_still_reaches_a_task_reclaim_could_not_claim_yet` for
/// exactly this ordering. `stalled_tasks` is what surfaces that task to the
/// conductor well before the mechanical six-hour sweep would, and thirty
/// minutes is comfortably below `STALE_CLAIM` while still being generous
/// enough that a task merely late to publish its first [`HEARTBEAT`] is
/// never mistaken for abandoned.
pub const STALLED_RUNNING: Duration = Duration::from_secs(30 * 60);

/// What the loop is working on, for the status file.
#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
#[serde(default)]
pub struct Current {
    /// Worker reservation that produced this claim; absent on legacy drivers.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub worker: Option<String>,
    /// Task id being run.
    pub task: String,
    /// Run id the task produced.
    pub run: String,
}

/// The daemon's liveness, published to `<home>/daemon.json`.
///
/// This is the only interface between the loop and the web UI, which is why it
/// carries `updated_at` as well as `started_at`: a reader cannot tell a
/// running daemon from a `SIGKILL`ed one by the file's existence alone, but it
/// can compare the heartbeat against the clock.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Status {
    /// On-disk format version.
    pub schema: u32,
    /// Process id, so a human can find or kill the daemon.
    pub pid: u32,
    /// When this process started.
    pub started_at: Timestamp,
    /// Last heartbeat.
    pub updated_at: Timestamp,
    /// True when the queue has nothing runnable.
    pub idle: bool,
    /// Every task and run currently in flight. More than one entry means the
    /// loop is driving more than one run at once — see
    /// [`crate::config::Daemon::max_concurrent_runs`]. Empty, not absent, when
    /// nothing is running, so a reader never has to treat "no field" and "an
    /// empty list" as two different kinds of idle.
    pub current: Vec<Current>,
    /// Tasks that reached a terminal status in this process.
    pub completed: usize,
    /// Queue polls since start, so a wedged loop shows up as a frozen count.
    pub polls: u64,
    /// Effective startup capabilities of the question recovery loops.
    #[serde(default)]
    pub question_recovery: Option<crate::question_delivery::Recovery>,
    /// Independent-worker control protocol supported by this scheduler.
    #[serde(default)]
    pub worker_protocol: Option<u32>,
}

impl Status {
    /// A fresh, idle status for this process.
    #[must_use]
    pub fn new() -> Self {
        let now = Timestamp::now();
        Self {
            schema: SCHEMA,
            pid: std::process::id(),
            started_at: now,
            updated_at: now,
            idle: true,
            current: Vec::new(),
            completed: 0,
            polls: 0,
            question_recovery: None,
            worker_protocol: Some(1),
        }
    }
}

impl Default for Status {
    fn default() -> Self {
        Self::new()
    }
}

/// How the loop should behave.
#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(default)]
pub struct Opts {
    /// Repository used by tasks that name none.
    pub repo: PathBuf,
    /// Explicit `magi.toml`, instead of the discovered layer stack.
    pub config: Option<PathBuf>,
    /// Queue poll interval.
    pub poll: Duration,
    /// Attempts a task gets before it is held for a human.
    pub max_attempts: usize,
    /// Drain what is runnable now, then return, instead of waiting for more.
    pub once: bool,
    /// Merge mode override (`none`, `local`, `pr`); `None` keeps the config's.
    pub merge: Option<String>,
    /// Where the janitor's [`crate::clean::fold_orphaned_worktrees`] and
    /// [`crate::git::worktree_prune`] look for and reclaim worktrees.
    /// `None` resolves to [`crate::run::default_worktree_root`] - the
    /// operator's real `~/wt/<repo>` - the same way a run with no
    /// [`crate::config::Graph::worktree_root`] resolves its own. A caller
    /// that does not own that directory (a test, an embedding that manages
    /// worktrees itself) must set this, or every idle tick reclaims worktrees
    /// out from under whoever actually does.
    pub worktrees_root: Option<PathBuf>,
}

impl Default for Opts {
    fn default() -> Self {
        Self {
            repo: PathBuf::from("."),
            config: None,
            poll: POLL,
            max_attempts: 2,
            once: false,
            merge: None,
            worktrees_root: None,
        }
    }
}

impl Opts {
    fn absolute(&self) -> Result<Self> {
        let mut opts = self.clone();
        opts.repo = std::path::absolute(&opts.repo)?;
        opts.config = opts
            .config
            .as_deref()
            .map(std::path::absolute)
            .transpose()?;
        opts.worktrees_root = opts
            .worktrees_root
            .as_deref()
            .map(std::path::absolute)
            .transpose()?;
        Ok(opts)
    }
}

/// How many runs a plain `usize` from config may drive concurrently, floored
/// at one. A `0` in a config file would otherwise stall the loop entirely -
/// no runnable task could ever start - which is never what an operator who
/// wrote `0` meant.
fn max_concurrent(n: usize) -> usize {
    n.max(1)
}

/// Where the status file lives.
#[must_use]
pub fn status_path() -> PathBuf {
    crate::run::home().join("daemon.json")
}

/// Publish the status file for this process.
pub fn write_status(status: &Status) -> Result<()> {
    write_status_to(&status_path(), status)
}

/// Publish a status to an explicit path.
///
/// Written to a sibling `.tmp` and renamed, because the web UI reads this file
/// on every health poll and must never see a half-written one.
pub fn write_status_to(path: &Path, status: &Status) -> Result<()> {
    if let Some(parent) = path.parent() {
        std::fs::create_dir_all(parent).with_context(|| format!("create {}", parent.display()))?;
    }
    let body = serde_json::to_string_pretty(status).context("serialize daemon status")?;
    let tmp = path.with_extension("json.tmp");
    std::fs::write(&tmp, &body).with_context(|| format!("write {}", tmp.display()))?;
    std::fs::rename(&tmp, path).with_context(|| format!("replace {}", path.display()))?;
    Ok(())
}

/// Delete the status file. Called on the way out so a clean exit reads as
/// "no daemon" rather than as a daemon whose heartbeat merely stopped.
pub fn clear_status() {
    clear_status_at(&status_path());
}

/// Delete a status file at an explicit path, so the loop's teardown and
/// [`clear_status`] cannot drift apart: the loop is handed the path it
/// published to, and a test can watch a temp file disappear.
fn clear_status_at(path: &Path) {
    let _ = std::fs::remove_file(path);
}

/// A cooperative stop, shared with whoever asked the loop to run.
///
/// Cloning is how the request travels: [`serve_until`] keeps one handle, the
/// Ctrl-C listener and the web UI keep others, and every clone points at the
/// same flag. There is no channel because there is nothing to send — the only
/// message is "stop", it is idempotent, and a flag cannot be missed by a
/// receiver that was not listening yet.
///
/// A stop ends scheduler dispatch promptly. Its busy snapshot is observational:
/// detached task workers keep their own lifetimes and ownership after this
/// handle's scheduler exits.
#[derive(Debug, Clone, Default)]
pub struct Stop {
    /// Set once, never cleared: a stop is not something an operator takes back
    /// half way through, and a clearable flag would let a start racing a stop
    /// resurrect a loop that is already unwinding.
    stopped: Arc<AtomicBool>,
    /// Live task workers observed by the scheduler's latest dispatch snapshot.
    busy: Arc<std::sync::atomic::AtomicUsize>,
    /// Wakes the idle wait. Without this a stop would not be seen until the
    /// poll interval elapsed, and an operator tapping stop on a phone would
    /// watch a button do nothing for five seconds.
    wake: Arc<Notify>,
    /// Handed to the run in flight, so a stop can also mean "park at the next
    /// node boundary" instead of "finish the whole competition first".
    pause: crate::graph::Pause,
}

impl Stop {
    /// A stop nobody has asked for yet.
    #[must_use]
    pub fn new() -> Self {
        Self::default()
    }

    /// Ask the loop to stop. Idempotent, and safe to call before the loop
    /// starts: the flag is checked before the first poll.
    pub fn stop(&self) {
        self.stopped.store(true, Ordering::SeqCst);
        // `notify_one` rather than `notify_waiters` because the loop may not be
        // parked yet: this stores a permit, so a wait that registers a moment
        // later returns at once instead of sleeping out the whole interval.
        self.wake.notify_one();
    }

    /// Has a stop been asked for?
    #[must_use]
    pub fn stopped(&self) -> bool {
        self.stopped.load(Ordering::SeqCst)
    }

    /// Whether a requested scheduler retirement still has an active snapshot.
    /// Workers continue independently after the scheduler has retired.
    #[must_use]
    pub fn finishing(&self) -> bool {
        self.stopped() && self.busy_now()
    }

    /// Ask the loop to stop *and* the run in flight to park at its next node
    /// boundary.
    ///
    /// Unlike plain stop, explicit park asks workers to checkpoint at their
    /// existing safe boundaries. Binary replacement never needs a park.
    pub fn park(&self, cause: crate::run::ParkCause) {
        self.pause.park_for(cause);
        self.stop();
    }

    /// Has a park been asked for?
    #[must_use]
    pub fn parking(&self) -> bool {
        self.pause.parked()
    }

    /// The pause handle to give a runner.
    #[must_use]
    pub fn pause(&self) -> crate::graph::Pause {
        self.pause.clone()
    }

    /// Whether the scheduler's latest snapshot contains active task workers.
    #[must_use]
    pub fn busy_now(&self) -> bool {
        self.busy.load(Ordering::SeqCst) > 0
    }

    /// Wait out one poll interval, returning early once a stop is asked for.
    async fn idle(&self, poll: Duration) {
        tokio::select! {
            () = tokio::time::sleep(poll) => {}
            () = self.wake.notified() => {}
        }
    }
}

/// The daemon's published state, read permissively.
///
/// This mirrors [`Status`], but is a separate declaration on purpose: every
/// field defaults, so a status file from an older or newer magi still yields
/// a usable reading — one this build has never heard of — instead of a parse
/// error that hides the daemon entirely.
#[derive(Debug, Clone, Default, Deserialize)]
#[serde(default)]
pub struct Reading {
    /// Format version the daemon claims.
    pub schema: u32,
    /// Daemon process id, for an operator who wants to stop it.
    pub pid: Option<u32>,
    /// When that process started.
    pub started_at: Option<Timestamp>,
    /// Last heartbeat. Absent means the file is unusable, hence not running.
    pub updated_at: Option<Timestamp>,
    /// True when the queue had nothing runnable at the last poll.
    pub idle: bool,
    /// What the daemon is working on. Empty means idle; more than one entry
    /// means more than one run is in flight at once.
    ///
    /// `deserialize_with` rather than the plain derive: a daemon started
    /// before this field became a list is still out there writing the old
    /// shape — a single `{"task":...,"run":...}` object, or its absence —
    /// on every heartbeat until it is restarted, and a live process reading
    /// that file during the rollout must still see it as running rather than
    /// as absent. A bare type change here would fail the whole struct's
    /// deserialization on a type mismatch, defeating the permissiveness this
    /// type exists for.
    #[serde(deserialize_with = "de_current")]
    pub current: Vec<Current>,
    /// Tasks this daemon process has finished.
    pub completed: u64,
    /// Queue polls this daemon process has made.
    pub polls: u64,
    /// Effective startup capabilities of the question recovery loops.
    #[serde(default)]
    pub question_recovery: Option<crate::question_delivery::Recovery>,
    /// Independent-worker control protocol, absent on legacy embedded loops.
    pub worker_protocol: Option<u32>,
}

/// Accept the old single-`Current`-or-absent shape as well as the current
/// list, so a reader never has to know which build wrote the file.
fn de_current<'de, D>(deserializer: D) -> std::result::Result<Vec<Current>, D::Error>
where
    D: serde::Deserializer<'de>,
{
    #[derive(Deserialize)]
    #[serde(untagged)]
    enum Shape {
        Many(Vec<Current>),
        One(Current),
    }
    Ok(
        Option::<Shape>::deserialize(deserializer)?.map_or_else(Vec::new, |shape| match shape {
            Shape::Many(v) => v,
            Shape::One(c) => vec![c],
        }),
    )
}

impl Reading {
    /// Seconds since the last heartbeat, or `None` when there has never been
    /// one.
    #[must_use]
    pub fn age_secs(&self, now: Timestamp) -> Option<i64> {
        self.updated_at
            .map(|at| (now.as_second() - at.as_second()).max(0))
    }

    /// Whether the loop counts as running: a heartbeat no older than
    /// [`STALE_SECS`]. The alternative is a reader that claims a task is in
    /// progress hours after the daemon that owned it was killed.
    #[must_use]
    pub fn running(&self, now: Timestamp) -> bool {
        self.age_secs(now).is_some_and(|secs| secs <= STALE_SECS)
    }
}

/// Read `<home>/daemon.json` permissively, or `None` when there is nothing
/// usable there.
///
/// Missing, half-written and unparseable all collapse to `None`, because the
/// only question a reader asks is whether a daemon is alive, and a file it
/// cannot read is not evidence that one is.
#[must_use]
pub fn read_status(home: &Path) -> Option<Reading> {
    let body = std::fs::read_to_string(home.join("daemon.json")).ok()?;
    serde_json::from_str(&body).ok()
}

/// Read-only evidence of runs owned by a live daemon or independent worker.
///
/// CLI, sandboxed conversation controls and Web cleanup share this observation.
/// A stale daemon heartbeat does not invalidate a worker's OS-held lease.
/// Starting reservations and unknown worker state remain protected; observing
/// them never creates, reconciles or archives files in the worker store.
/// Callers interested in one identity use [`is_working_on`] or
/// [`is_working_on_task`].
#[must_use]
pub fn current_work(home: &Path, now: Timestamp) -> Vec<Current> {
    let mut current = read_status(home)
        .filter(|reading| reading.running(now))
        .map(|reading| reading.current)
        .unwrap_or_default();
    let workers = crate::worker::observe_active(home).and_then(|jobs| {
        jobs.into_iter()
            .filter(|job| job.kind == "task")
            .map(|job| {
                let request: TaskWorker = serde_json::from_value(job.payload)?;
                let run = Queue::at(request.queue)
                    .get(&request.task)
                    .ok()
                    .and_then(|task| task.runs.last().cloned())
                    .unwrap_or_default();
                Ok(Current {
                    worker: Some(job.id),
                    task: request.task,
                    run,
                })
            })
            .collect::<Result<Vec<_>>>()
    });
    match workers {
        Ok(workers) => {
            for worker in workers {
                if !current.iter().any(|claim| {
                    claim.task == worker.task
                        && claim.run == worker.run
                        && claim.worker == worker.worker
                }) {
                    current.push(worker);
                }
            }
        }
        Err(error) => {
            // This API gates destructive cleanup. Unknown worker ownership
            // protects every known task/run instead of pretending it is idle.
            tracing::error!("cannot determine active workers: {error:#}");
            current.extend(
                Queue::at(home.join("queue"))
                    .list()
                    .into_iter()
                    .map(|task| Current {
                        worker: None,
                        task: task.id,
                        run: task.runs.last().cloned().unwrap_or_default(),
                    }),
            );
            current.extend(
                crate::run::list_ids_in(&home.join("runs"))
                    .into_iter()
                    .map(|run| Current {
                        worker: None,
                        task: String::new(),
                        run,
                    }),
            );
        }
    }
    current
}

/// Whether a live daemon is working on this run at this moment.
#[must_use]
pub fn is_working_on(home: &Path, run: &str, now: Timestamp) -> bool {
    current_work(home, now).iter().any(|c| c.run == run)
}

/// Admission may ignore only this process's confirmed worker reservation.
/// Keep anonymous/legacy daemon claims and every other worker, even for the
/// same task. The run's execution lease and process identity are checked by
/// the caller under the owner lock as well.
pub(crate) fn is_working_on_other(home: &Path, run: &str, now: Timestamp) -> Result<bool> {
    // A helper or test may inherit an identity from a different run store.
    // That identity grants no exception here; retain all ownership evidence.
    let same_home = std::env::var_os("MAGI_WORKER_HOME")
        .is_some_and(|worker_home| Path::new(&worker_home) == home);
    let caller = if same_home {
        crate::worker::current_job(home)?
    } else {
        None
    }
    .filter(|job| {
        job.kind == "task"
            && job.status == crate::worker::Status::Running
            && job.pid == Some(std::process::id())
    });
    Ok(other_claims_run(
        &current_work(home, now),
        run,
        caller.as_ref().map(|job| job.id.as_str()),
    ))
}

fn other_claims_run(claims: &[Current], run: &str, caller: Option<&str>) -> bool {
    claims
        .iter()
        .any(|claim| claim.run == run && !(caller.is_some() && claim.worker.as_deref() == caller))
}

/// Whether a live daemon is working on a run whose short id is this one.
///
/// For a worktree that has no run record to compare against at all -
/// [`crate::clean::fold_orphaned_worktrees`]'s whole reason to exist - a full
/// id is not available to hand to [`is_working_on`]. The short id is: a run's
/// worktree bay is named after it (see [`crate::run::RunState::worktree_root`]),
/// and it is exactly the gap between the daemon claiming a task and
/// `RunState::new` saving the first `run.json` that this exists to protect -
/// a run genuinely in flight but invisible to a scan of `runs/`.
#[must_use]
pub fn is_working_on_short(home: &Path, short: &str, now: Timestamp) -> bool {
    current_work(home, now)
        .iter()
        .any(|c| crate::run::short_of(&c.run) == short)
}

/// Whether a live daemon is working on this task at this moment.
#[must_use]
pub fn is_working_on_task(home: &Path, task: &str, now: Timestamp) -> bool {
    current_work(home, now).iter().any(|c| c.task == task)
}

/// Remove claim files whose owner is provably dead, or that have simply
/// outlived `older_than`, and return the task ids swept.
///
/// A daemon killed with `SIGKILL` never runs [`crate::queue::Claim`]'s
/// destructor, and the orphaned `.lock` file would make its task permanently
/// unclaimable — the backlog would stop for good at exactly the task that was
/// in flight when the machine went down.
///
/// The pid recorded in the lock is the authority whenever it can be read at
/// all; age is only a fallback for when it cannot be.
///
/// - **A parseable pid wins outright.** [`crate::proc::pid_alive`] decides,
///   full stop — dead sweeps the lock immediately, regardless of age; alive
///   protects it, regardless of age. This is what lets a lock be reclaimed in
///   seconds instead of waiting out [`STALE_CLAIM`]: a lock made 33 minutes
///   before this daemon even started, next to a `queued` task, no longer has
///   to sit for six hours before anything notices its owner is gone.
/// - **A pid that cannot be parsed at all** — an empty or corrupt lock file —
///   falls back to `older_than`, since there is nothing else to check.
///
/// Age must never override a *positive* liveness confirmation. `sweep`
/// polls concurrently with independently running task workers. A worker may
/// legitimately run longer than `older_than`; its live pid must still protect
/// its claim. Age alone must never turn that claim into a second task attempt,
/// which [`reclaim_orphaned_running`] would then read as abandoned and hand
/// to a second attempt — two `Runner`s writing the same `run.json` and the
/// same worktree at once. `pid_alive` answering "alive" for anything it
/// cannot determine (a live process, a pid this build cannot check, one
/// under another account) is exactly what keeps that path from ever
/// firing on a guess.
///
/// [`STALE_CLAIM`] itself stays large: a helper program missing or its
/// output unreadable must not be license to guess, and the risk of an
/// unparseable lock outliving a genuinely dead owner is bounded by an order
/// of magnitude above any plausible run rather than by a positive check.
///
/// Runs on every poll, not only at startup — a daemon up for days must keep
/// noticing a lock some other, now-dead, daemon left behind just as readily
/// as one it trips over on the way up.
pub fn sweep_stale_claims(queue: &Queue, older_than: Duration) -> Vec<String> {
    sweep_stale_claims_with(queue, older_than, crate::proc::pid_alive)
}

/// [`sweep_stale_claims`] with its process-query boundary supplied by the
/// caller. This keeps the lock policy testable where process listing is
/// unavailable, while production still uses the platform query above.
fn sweep_stale_claims_with<F>(queue: &Queue, older_than: Duration, pid_alive: F) -> Vec<String>
where
    F: Fn(u32) -> bool,
{
    let this_process = std::process::id();
    let mut swept: Vec<String> = std::fs::read_dir(queue.root())
        .into_iter()
        .flatten()
        .flatten()
        .map(|e| e.path())
        .filter(|p| p.extension().is_some_and(|x| x == "lock"))
        .filter(|p| {
            match std::fs::read_to_string(p)
                .ok()
                .and_then(|body| body.trim().parse::<u32>().ok())
            {
                // This process wrote it and is asking the question right
                // now, so it is definitionally still alive - settled without
                // spawning a helper process at all.
                Some(pid) if pid == this_process => false,
                Some(pid) => !pid_alive(pid),
                None => p
                    .metadata()
                    .and_then(|m| m.modified())
                    .and_then(|t| t.elapsed().map_err(std::io::Error::other))
                    .is_ok_and(|age| age >= older_than),
            }
        })
        .filter(|p| std::fs::remove_file(p).is_ok())
        .filter_map(|p| {
            p.file_stem()
                .and_then(|s| s.to_str())
                .map(std::borrow::ToOwned::to_owned)
        })
        .collect();
    swept.sort_unstable();
    swept
}

/// Is `task` stalled: [`TaskStatus::Running`], past [`STALLED_RUNNING`], with
/// no live daemon's heartbeat naming it? Deterministic — no model call, and
/// the exact test [`stalled_tasks`] uses to decide what `crate::conduct` is
/// shown.
fn is_stalled(task: &Task, home: &Path, now: Timestamp) -> bool {
    task.status == TaskStatus::Running
        && (now.as_second() - task.updated_at.as_second()) >= STALLED_RUNNING.as_secs() as i64
        && !is_working_on_task(home, &task.id, now)
}

/// Every task [`is_stalled`] right now — "止まったタスク" in
/// `crate::conduct`'s vocabulary.
fn stalled_tasks(queue: &Queue, home: &Path, now: Timestamp) -> Vec<Task> {
    queue
        .list()
        .into_iter()
        .filter(|t| is_stalled(t, home, now))
        .collect()
}

/// Runnable tasks a dependency can still be set on — "runnable なタスク" in
/// `crate::conduct`'s vocabulary. Deliberately `Queued` only, not
/// `Failed`-and-so-also-runnable: a task that already attempted and lost
/// belongs in [`finished_tasks`], where the question is a recovery, not a
/// dependency.
fn queued_tasks(queue: &Queue) -> Vec<Task> {
    queue
        .list()
        .into_iter()
        .filter(|t| t.status == TaskStatus::Queued)
        .collect()
}

/// `Failed`/`Held` tasks nobody has decided a recovery for yet — "終わった
/// タスク" in `crate::conduct`'s vocabulary.
fn finished_tasks(queue: &Queue) -> Vec<Task> {
    queue
        .list()
        .into_iter()
        .filter(|t| matches!(t.status, TaskStatus::Failed | TaskStatus::Held))
        .collect()
}

/// Deterministically resolve `Task::blocked_by`: a dependency task that
/// reached `Done`, or a question that was answered, is removed — no model
/// involved, on every poll. An answered question's content is copied onto
/// the task ([`Task::record_answer`]) before its id is dropped, so it
/// reaches the next `crate::conduct` prompt and the next run's instruction
/// (see [`instruction_for`]) rather than only clearing the block.
///
/// A `blocked_by` id that names neither an existing task nor an existing
/// question - `magi task rm` (or an operator by hand) deleted it while this
/// task was still waiting - is caught before any of that: it can never
/// become `Done` or `Answered`, so the ordinary loop below would otherwise
/// leave the task `blocked` forever with nothing to notice. Such a task is
/// quarantined to a machine hold instead ([`crate::queue::missing_blocker_hold_reason`]),
/// which puts it in front of `crate::triage::run_once`'s own walk the next
/// time it runs - see that module's doc for why the choice is "ask a human",
/// never "assume the missing dependency was satisfied and unblock anyway".
fn resolve_blockers(queue: &Queue, questions: &Questions) {
    for listed in queue.list() {
        if listed.status != TaskStatus::Blocked || listed.blocked_by.is_empty() {
            continue;
        }
        let Ok(_claim) = queue.claim(&listed.id) else {
            continue;
        };
        let Ok(mut task) = queue.get(&listed.id) else {
            continue;
        };
        if task.status != TaskStatus::Blocked {
            continue;
        }
        // A dependency deleted on purpose is released, not held - and before
        // the missing check, so a pass that races the delete (or a claim that
        // made `Queue::remove` skip this task) settles it quietly.
        let deleted = queue.apply_deleted_blockers(&mut task, questions);
        if !deleted.is_empty() {
            record(queue, &mut task);
            for id in &deleted {
                queue.note_dependency_deleted(&task, id);
            }
            if task.status != TaskStatus::Blocked {
                continue;
            }
        }
        let missing = crate::queue::missing_blockers(queue, questions, &task.blocked_by);
        if !missing.is_empty() {
            let language = language_of(&task, Path::new("."));
            let mut cause = missing.clone();
            cause.sort();
            cause.dedup();
            task.notice_cause(&format!("missing-blockers:{}", cause.join(",")), None, None);
            task.hold_machine(Some(crate::queue::missing_blocker_hold_reason_in(
                &task.blocked_by,
                &missing,
                &language,
            )));
            record(queue, &mut task);
            continue;
        }
        // A conductor question nobody answered in time is retired by the
        // waiter, and nothing else would ever move the task it blocks.
        if let Some(q) = task.blocked_by.iter().find_map(|id| {
            let crate::queue::Dependency::Question(full) =
                crate::queue::dependency(queue, questions, id)
            else {
                return None;
            };
            questions.get(&full).ok().filter(|q| {
                q.node == crate::conduct::NODE && q.status == ask::QuestionStatus::Abandoned
            })
        }) {
            let language = language_of(&task, Path::new("."));
            task.notice_cause(&format!("unanswered-question:{}", q.id), None, None);
            task.hold_machine(Some(unanswered_question_hold_reason(&q, &language)));
            record(queue, &mut task);
            continue;
        }
        let mut changed = false;
        for id in task.blocked_by.clone() {
            let resolved = crate::queue::dependency(queue, questions, &id);
            if let crate::queue::Dependency::Task(full) = &resolved {
                if queue
                    .get(full)
                    .is_ok_and(|dep| dep.status == TaskStatus::Done)
                {
                    task.unblock(&id);
                    changed = true;
                }
                continue;
            }
            if let crate::queue::Dependency::Question(full) = resolved
                && let Ok(q) = questions.get(&full)
                && q.status == ask::QuestionStatus::Answered
            {
                // The action sweep releases conductor blockers atomically
                // with their selected operation. A fresh deputy lease must
                // never leave an answered hold temporarily runnable.
                if q.node == crate::conduct::NODE
                    && q.chosen_action().is_some()
                    && !task.action_applied(&q.id)
                {
                    continue;
                }
                let answer = match &q.answer {
                    Some(ask::Answer::Choice(c) | ask::Answer::Text(c)) => c.clone(),
                    None => String::new(),
                };
                task.record_answer(q.summary.clone(), answer);
                task.unblock(&id);
                changed = true;
            }
        }
        if changed {
            record(queue, &mut task);
        }
    }
}

/// The `hold_reason` of a task whose conductor question went unanswered.
fn unanswered_question_hold_reason(q: &ask::Question, language: &str) -> String {
    if crate::lang::is_japanese(language) {
        format!(
            "質問 {} 「{}」 に期限内の回答がなく、取り下げられました - `magi task triage` を参照",
            q.short(),
            q.summary
        )
    } else {
        format!(
            "question {} \"{}\" went unanswered and was abandoned - see `magi task triage`",
            q.short(),
            q.summary
        )
    }
}

/// Where `q`'s chosen action stands for `task`. `daemon_will_act` is false
/// for several unrelated reasons, and the waiter must not read them alike.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub(crate) enum ActionStanding {
    /// The answer carries no action: the waiter delivers it as before.
    NoAction,
    /// The daemon will apply it (not applied, task idle, current attempt).
    Pending,
    /// Already applied (`Task::actions_applied`): the daemon has acted, so
    /// delivering the word to the old seat would run it beside the new work.
    Applied,
    /// The question is about an earlier attempt than the task's latest.
    Stale,
    /// The task is running / blocked / done: the daemon defers for now.
    Busy,
}

impl ActionStanding {
    /// The daemon has acted or will act: the waiter must not deliver.
    pub(crate) fn daemon_owns(self) -> bool {
        matches!(self, Self::Pending | Self::Applied | Self::Stale)
    }
}

/// Classify `q`'s chosen action against `task`. `Stale` is judged before
/// `Busy`: a question about an earlier attempt must be stopped even while a
/// newer competition is running.
pub(crate) fn action_standing(task: &Task, q: &ask::Question) -> ActionStanding {
    if q.chosen_action().is_none() {
        ActionStanding::NoAction
    } else if task.action_applied(&q.id) {
        ActionStanding::Applied
    } else if q.node != crate::conduct::NODE && task.runs.last() != Some(&q.run) {
        ActionStanding::Stale
    } else if matches!(
        task.status,
        TaskStatus::Running | TaskStatus::Blocked | TaskStatus::Done
    ) {
        ActionStanding::Busy
    } else {
        ActionStanding::Pending
    }
}

/// What [`decide_action`] concluded about one answered question.
#[derive(Debug, Clone, PartialEq, Eq)]
enum ActionDecision {
    /// Nothing to do now (no action, already applied, or the task is busy).
    Skip,
    /// Continue the named run instead of competing again.
    Resume(String),
    /// Requeue as a fresh competition.
    Requeue,
    /// Hold the task by explicit operator choice.
    Hold,
    /// Close the task as done.
    Done,
    /// The question is about an earlier attempt than the task's latest; it
    /// is recorded as handled and changes nothing.
    Stale,
    /// The action cannot be carried out; hold the task and say why. Never
    /// falls back to something else, because the operator chose this one.
    Refuse(String),
}

/// Decide what the choice answered on `q` means for `task`. Pure: `load`
/// reads a run's state, as with [`unfinished_run_with`].
///
/// `Resume` only fires on the task's *latest* run, and only while that run
/// could actually make progress ([`RunStatus::resumable`], not released, review
/// budget left); an answer naming anything else is refused rather than
/// reinterpreted as a fresh competition.
fn decide_action<F>(task: &Task, q: &ask::Question, p: &Phrases, load: F) -> ActionDecision
where
    F: FnOnce(&str) -> Result<RunState>,
{
    let Some(action) = q.chosen_action() else {
        return ActionDecision::Skip;
    };
    if task.action_applied(&q.id)
        || matches!(
            task.status,
            TaskStatus::Running | TaskStatus::Blocked | TaskStatus::Done
        )
    {
        return ActionDecision::Skip;
    }
    // A question about an earlier attempt must not act on a newer one. A
    // conductor question is keyed by the task id, not a run, so it is exempt.
    if q.node != crate::conduct::NODE && task.runs.last() != Some(&q.run) {
        return ActionDecision::Stale;
    }
    let repair = q.node == land::APPROVAL_NODE && q.resolution().as_deref() == Some(land::REPAIR);
    let stopping = q.node == land::APPROVAL_NODE
        && q.resolution()
            .as_deref()
            .is_some_and(crate::merge_decision::stops);
    // Repair and stop actions are new decisions on an existing approval card. A
    // manual hold before that answer must not discard it just because the
    // card predates the hold. Keep the older policy for other choice actions.
    let decision_at = if repair || stopping {
        q.answered_at.unwrap_or(q.asked_at)
    } else {
        q.asked_at
    };
    if task.operator_decided_at.is_some_and(|at| at > decision_at) {
        return if repair || stopping {
            ActionDecision::Refuse(format!(
                "{} answer {} was superseded by a later operator decision; the task stays held. Inspect `magi show {}`; if this action is still wanted, explicitly release the existing owner with `magi task release {}`",
                if repair { "repair" } else { "stop" },
                q.id,
                q.run,
                task.id
            ))
        } else {
            ActionDecision::Stale
        };
    }
    match action {
        a if a.maintenance() => ActionDecision::Skip,
        ask::ChoiceAction::ResumeRun { .. }
        | ask::ChoiceAction::ReleaseTask { .. }
        | ask::ChoiceAction::RerunChecks { .. }
        | ask::ChoiceAction::AbandonRun { .. } => unreachable!(),
        ask::ChoiceAction::Requeue => ActionDecision::Requeue,
        ask::ChoiceAction::Hold => ActionDecision::Hold,
        ask::ChoiceAction::Done => ActionDecision::Done,
        ask::ChoiceAction::Resume { run } => {
            if task.runs.last() != Some(run) {
                return ActionDecision::Refuse((p.resume_not_latest)(
                    q.short(),
                    ask::short_id(run),
                ));
            }
            match load(run) {
                Ok(s) if stopping => {
                    if s.merge_decision.as_ref().is_some_and(|d| d.closed)
                        || !s
                            .land_approval
                            .as_ref()
                            .is_some_and(|binding| binding.question == q.id)
                    {
                        ActionDecision::Stale
                    } else if s.liveness(false) == Liveness::Live {
                        ActionDecision::Skip
                    } else if s.status == RunStatus::Landing
                        && !s.released()
                        && s.retired_to.is_none()
                    {
                        ActionDecision::Resume(run.clone())
                    } else {
                        ActionDecision::Refuse("Owner stop decision cannot resume its original landing execution; inspect the existing run. No replacement or merge was started.".into())
                    }
                }
                Ok(s)
                    if q.node == land::APPROVAL_NODE
                        && q.resolution().as_deref() == Some(land::REPAIR) =>
                {
                    if s.merge_repairs.iter().any(|r| r.question == q.id)
                        || s.land_approval.as_ref().is_some_and(|a| a.question != q.id)
                    {
                        // A live/manual driver already consumed or superseded
                        // this answer. Do not hold its fresh approval wait.
                        ActionDecision::Stale
                    } else if s.liveness(false) == Liveness::Live {
                        ActionDecision::Skip
                    } else if s.status != RunStatus::Landing
                        || s.released()
                        || s.reviews.is_empty()
                        || !implementers_match(task, &s)
                        || !s
                            .land_approval
                            .as_ref()
                            .is_some_and(|a| a.question == q.id && !a.head.is_empty())
                    {
                        ActionDecision::Refuse(format!(
                            "repair question {} no longer names a supported current approval on run {}; inspect `magi show {}` and restore the existing owner's approval before retrying; do not file another task",
                            q.id, run, run
                        ))
                    } else {
                        ActionDecision::Resume(run.clone())
                    }
                }
                Ok(s) if s.liveness(false) == Liveness::Live => {
                    ActionDecision::Refuse("run already has a live driver".into())
                }
                Ok(s) if crate::handover::can_resume(&s) => ActionDecision::Resume(run.clone()),
                Ok(_) => ActionDecision::Refuse((p.resume_cannot_progress)(
                    q.short(),
                    ask::short_id(run),
                )),
                Err(e) => ActionDecision::Refuse((p.resume_unreadable)(
                    q.short(),
                    ask::short_id(run),
                    &format!("{e:#}"),
                )),
            }
        }
    }
}

/// The fixed prose the daemon writes into [`Task::last_error`] and
/// [`Task::hold_reason`], in the language of `[graph] language`. Same shape as
/// `triage::Wording` and `land::Words`: only English and Japanese are
/// translated, anything else falls back to English.
///
/// Rendered when the reason is *generated*, so a reason keeps the language it
/// was written in if the setting changes later. The notification frame
/// (`Task <id> is held:`) is not here and stays English.
///
/// Deliberately **not** translated, because other code reads them back by
/// string: the disk gate prefixes (`triage::is_disk_hold`), `out of attempts`
/// and `gate red`. IDs, node names, paths and external error text are embedded
/// as they are.
struct Phrases {
    /// `{}` = status label, then the detail.
    graph_stopped: fn(&str, &str) -> String,
    quorum_lost: &'static str,
    /// Followed by the seats' names.
    quota_took_out: &'static str,
    /// Followed by the status label.
    run_ended: &'static str,
    /// Followed by the question's short id.
    waiting_for_answer: &'static str,
    recovered_running: &'static str,
    no_run_to_recover: &'static str,
    could_not_start: &'static str,
    resume_not_latest: fn(&str, &str) -> String,
    resume_cannot_progress: fn(&str, &str) -> String,
    resume_unreadable: fn(&str, &str, &str) -> String,
    /// A takeover refusal: the operator-facing text. English is the error's own
    /// `Display`; a translation keeps the machine detail apart in parentheses.
    handover_refused: fn(&crate::handover::Refused) -> String,
    /// Appended to a refused handover's hold reason (leading space included).
    handover_hint: &'static str,
    /// (seats that never answered, review rounds) for the review loop's
    /// "refusing to call it clean" stop.
    reviewers_never_answered: fn(usize, usize) -> String,
}

const PHRASES_EN: Phrases = Phrases {
    graph_stopped: |status, detail| {
        format!("the graph stopped at `{status}` without reaching a terminal status: {detail}")
    },
    quorum_lost: "the judging panel lost its quorum",
    quota_took_out: "; quota took out ",
    run_ended: "run ended ",
    waiting_for_answer: " - waiting for operator answer to question ",
    recovered_running: "recovered a `running` task whose daemon never recorded the outcome: ",
    no_run_to_recover: "task was `running` with no live daemon and no readable \
                        run to recover; held for a human to check what happened",
    could_not_start: "could not start the run: ",
    resume_not_latest: |q, run| {
        format!("question {q} asked to resume run {run}, which is not this task's latest run")
    },
    resume_cannot_progress: |q, run| {
        format!("question {q} asked to resume run {run}, which cannot make progress")
    },
    resume_unreadable: |q, run, e| {
        format!("question {q} asked to resume run {run}, which could not be read: {e}")
    },
    handover_refused: |r| r.to_string(),
    handover_hint: " (clean up the other worktree, then release the task from the queue)",
    reviewers_never_answered: |missing, rounds| {
        format!(
            "{missing} reviewer seat(s) never answered after {rounds} rounds; \
             refusing to call it clean"
        )
    },
};

const PHRASES_JA: Phrases = Phrases {
    graph_stopped: |status, detail| {
        format!("グラフが終端状態に達しないまま `{status}` で停止しました: {detail}")
    },
    quorum_lost: "審査パネルが定足数を失いました",
    quota_took_out: "。クォータで脱落: ",
    run_ended: "run 終了: ",
    waiting_for_answer: " - オペレーターの回答待ち: 質問 ",
    recovered_running: "daemon が結果を記録しないまま `running` だったタスクを回収しました: ",
    no_run_to_recover: "タスクは `running` でしたが、生きた daemon も回収できる run も見つかりません。\
                        何が起きたか人が確認するため保留にしました",
    could_not_start: "run を開始できませんでした: ",
    resume_not_latest: |q, run| {
        format!(
            "質問 {q} は run {run} の再開を求めましたが、これはタスクの最新の run ではありません"
        )
    },
    resume_cannot_progress: |q, run| {
        format!("質問 {q} は run {run} の再開を求めましたが、これは進行できません")
    },
    resume_unreadable: |q, run, e| {
        format!("質問 {q} は run {run} の再開を求めましたが、読み込めませんでした: {e}")
    },
    handover_refused: |r| {
        use crate::handover::Refused;
        match r {
            Refused::Foreign { branch, path, why } => format!(
                "ブランチ `{branch}` は {path} にチェックアウトされており、magi は自動では\
                 削除しません。不要なら `git worktree remove` でその worktree を削除して\
                 から、やり直してください（詳細: {why}）"
            ),
            Refused::Unsafe { branch, path, why } => format!(
                "ブランチ `{branch}` は {path} にチェックアウトされています。そこの作業を\
                 コミットか破棄したうえで `git worktree remove` で worktree を削除する\
                 か、run を破棄してよいと伝えてから、やり直してください（詳細: {why}）"
            ),
            Refused::ReleaseFailed { branch, path, run } => format!(
                "ブランチ `{branch}` は {path} で run {run} がチェックアウトしており、その\
                 worktree の解放に失敗したか、変更が見つかりました（未コミットの変更が\
                 ある worktree は git が削除を拒否します）。worktree はそのまま残しました"
            ),
        }
    },
    handover_hint: "（他の worktree を片付けてから、タスクをキューから解放してください）",
    reviewers_never_answered: |missing, rounds| {
        format!(
            "{missing} 席のレビュアーが {rounds} ラウンドの間に一度も回答しなかったため、\
             クリーンとは認めません"
        )
    },
};

fn phrases(language: &str) -> &'static Phrases {
    if crate::lang::is_japanese(language) {
        &PHRASES_JA
    } else {
        &PHRASES_EN
    }
}

/// The language of the repository a task belongs to, read best-effort for the
/// paths that have no run (and so no config of their own) to ask. An unreadable
/// config is English, not an error: a hold reason must still get written.
fn language_of(task: &Task, fallback: &Path) -> String {
    crate::lang::of_repo(&repo_for(task, fallback))
}

/// The task an answered question speaks for: the one whose runs include the
/// question's run, or - for a conductor question, filed under the task's own
/// id - the task with that id.
pub(crate) fn task_of_question<'a>(tasks: &'a [Task], q: &ask::Question) -> Option<&'a Task> {
    if q.node == crate::conduct::NODE {
        return tasks.iter().find(|t| t.id == q.run);
    }
    tasks.iter().find(|t| t.runs.contains(&q.run))
}

/// Legacy conductor prose never becomes a maintenance command by inference.
/// Replace unsupported open labels under the question lock before dispatch.
fn repair_choice_offers(questions: &Questions) {
    for q in questions.list().into_iter().filter(|q| {
        q.status.open()
            && q.node == crate::conduct::NODE
            && q.choices
                .iter()
                .any(|c| crate::choice_effect::describe(q, c).is_none())
    }) {
        let _ = questions.update(&q.id, |current| {
            if current.status.open() {
                crate::choice_effect::executable_conductor(current);
                if let Some(deputy) = &mut current.deputy {
                    deputy.brief = crate::deputy::brief(
                        &current.run,
                        &current.detail,
                        &current.choices,
                        &current.actions,
                    );
                }
            }
            Ok(())
        });
    }
}

/// Apply answered typed choices. Only the daemon calls this in production;
/// deputies settle the question and never execute its actions.
pub async fn apply_choice_actions(queue: &Queue, questions: &Questions, home: &Path) {
    apply_maintenance_choices(queue, questions, home).await;
    apply_task_choice_actions(queue, questions, home);
}

/// Apply bounded maintenance effects independently of question ownership: a
/// release watcher need not have a queue task, and a predecessor is another run.
async fn apply_maintenance_choices(queue: &Queue, questions: &Questions, home: &Path) {
    for q in questions.list() {
        let Some(action) = q.chosen_action().filter(|a| a.maintenance()) else {
            continue;
        };
        // Receipt paths use question IDs, whose format is independent of run
        // IDs. Apply the question store's filename safety rule to both eras.
        if asker_may_still_read(questions, &q, home) || !ask::valid_asset_name(&q.id) {
            continue;
        }
        let dir = home.join("choice-actions");
        if std::fs::create_dir_all(&dir).is_err() {
            continue;
        }
        let Ok(lock) = std::fs::OpenOptions::new()
            .create(true)
            .truncate(false)
            .write(true)
            .open(dir.join(format!("{}.lock", q.id)))
        else {
            continue;
        };
        if crate::pr_head::try_lock_file(&lock).is_err() {
            continue;
        }
        let fresh = !home
            .join("choice-actions")
            .join(format!("{}.json", q.id))
            .exists();
        let result = async {
            let receipt = dir.join(format!("{}.json", q.id));
            if receipt.exists() {
                let prior: serde_json::Value = serde_json::from_slice(&std::fs::read(&receipt)?)?;
                anyhow::ensure!(
                    prior.get("status").and_then(|s| s.as_str()) == Some("applied"),
                    "previous maintenance attempt did not confirm completion; inspect its receipt"
                );
                return Ok::<_, anyhow::Error>(());
            }
            // Never retry an uncertain external effect. The receipt is written
            // before calling gh, exactly like release_watch's rerun record.
            let record = |status: &str| -> anyhow::Result<()> {
                let tmp = receipt.with_extension("tmp");
                std::fs::write(
                    &tmp,
                    serde_json::to_vec(&serde_json::json!({
                        "action": action, "status": status,
                    }))?,
                )?;
                std::fs::rename(tmp, &receipt)?;
                Ok(())
            };
            let applied = async {
                match action {
                    ask::ChoiceAction::ResumeRun { run } => {
                        crate::resume::validate(home, run)?;
                        record("started")?;
                        if !crate::resume::pin_queued(queue, run, Some(q.asked_at), Some(&q.id))? {
                            crate::resume::validate_unqueued(home, run)?;
                            crate::resume::start(home, run.clone()).await?;
                        }
                    }
                    ask::ChoiceAction::ReleaseTask {
                        task,
                        held_at,
                        reason,
                    } => {
                        anyhow::ensure!(
                            queue.resolve_id(task)? == *task,
                            "task action requires an exact task ID"
                        );
                        let _claim = queue.claim(task)?;
                        let mut task = queue.get(task)?;
                        if task.action_applied(&q.id) {
                            return Ok(());
                        }
                        // Filing this conductor question temporarily wraps the
                        // original hold in a Blocked state. Restore only that
                        // exact blocker on the local copy before checking the
                        // hold binding; unrelated waits never authorize release.
                        if q.node == crate::conduct::NODE
                            && q.run == task.id
                            && task.status == TaskStatus::Blocked
                            && task.blocked_from == Some(TaskStatus::Held)
                            && task.blocked_by.as_slice() == [q.id.as_str()]
                        {
                            task.unblock(&q.id);
                        }
                        anyhow::ensure!(
                            task.status == TaskStatus::Held
                                && task.held_at == Some(*held_at)
                                && task.hold_reason.as_deref() == reason.as_deref()
                                && task.operator_decided_at.is_none_or(|at| at <= q.asked_at),
                            "task no longer has the hold this question names"
                        );
                        task.release_operator("choice", Some(&q.id));
                        task.mark_action_applied(&q.id);
                        queue.put(&mut task)?;
                    }
                    ask::ChoiceAction::AbandonRun { run } => {
                        record("started")?;
                        crate::driver::abandon_proven_dead(home, run)?;
                    }
                    ask::ChoiceAction::RerunChecks {
                        repo,
                        pr,
                        head,
                        runs,
                    } => {
                        rerun_checks_once(home, &q.id, repo, pr, head, runs, || record("started"))
                            .await?;
                    }
                    _ => unreachable!(),
                }
                Ok::<_, anyhow::Error>(())
            }
            .await;
            match applied {
                Ok(()) => record("applied"),
                Err(e) => {
                    record(&format!("refused or failed: {e:#}"))?;
                    Err(e)
                }
            }
        }
        .await;
        // Retire the originating blocker as well as the target operation.
        // A foreign resume leaves its issuer held instead of competing beside
        // the execution just started. Other successful maintenance lets the
        // original task retry its normal, guarded path.
        if home
            .join("choice-actions")
            .join(format!("{}.json", q.id))
            .exists()
            && let Some(listed) = task_of_question(&queue.list(), &q)
            && !listed.action_applied(&q.id)
            && let Ok(_claim) = queue.claim(&listed.id)
            && let Ok(mut origin) = queue.get(&listed.id)
        {
            if !origin.operator_held()
                && origin.operator_decided_at.is_none_or(|at| at <= q.asked_at)
                && !matches!(origin.status, TaskStatus::Running | TaskStatus::Done)
            {
                if result.is_err() || matches!(action, ask::ChoiceAction::ResumeRun { .. }) {
                    origin.hold_machine(Some(format!(
                        "Maintenance choice {} settled; inspect its target before releasing this task",
                        q.id
                    )));
                } else {
                    origin.unblock(&q.id);
                }
            }
            origin.mark_action_applied(&q.id);
            let _ = queue.put(&mut origin);
        }
        if let Err(e) = result
            && fresh
        {
            notices::raise_in(
                home,
                Notice::warn(
                    &format!("action:{}", q.id),
                    format!("Choice action {} was not completed: {e:#}", q.id),
                )
                .link(if q.run_names_task() {
                    Link::Task { id: q.run.clone() }
                } else {
                    Link::Run { id: q.run.clone() }
                }),
            );
        }
    }
}

/// Rerun the named failed workflow runs of a pull request, each at most once
/// per `request` (a question id, or a chat operation identity). The head,
/// lifecycle and failed state are re-read from the forge first; `started` is
/// called once those checks pass and before the first external call, and the
/// ledger entry is written before every `gh` call, so an uncertain result is
/// never repeated automatically.
pub(crate) async fn rerun_checks_once(
    home: &Path,
    request: &str,
    repo: &Path,
    pr: &str,
    head: &str,
    runs: &[String],
    started: impl FnOnce() -> anyhow::Result<()>,
) -> anyhow::Result<()> {
    use crate::release_watch::{GhForge, ReleaseForge};
    anyhow::ensure!(
        !runs.is_empty()
            && runs.len() <= 20
            && runs
                .iter()
                .all(|r| !r.is_empty() && r.bytes().all(|b| b.is_ascii_digit()))
            && !pr.starts_with('-'),
        "invalid rerun targets"
    );
    let snap = GhForge.snapshot(repo, pr).await?;
    anyhow::ensure!(
        snap.head == head && snap.state == crate::land::PrLifecycle::Open,
        "pull request head or lifecycle changed"
    );
    anyhow::ensure!(
        runs.iter().all(|r| snap
            .checks
            .iter()
            .any(|c| c.run.as_ref() == Some(r) && crate::release_watch::is_failed(c.verdict))),
        "named workflow is no longer failed on this pull request"
    );
    started()?;
    let dir = home.join("choice-actions");
    std::fs::create_dir_all(&dir)?;
    let rerun_lock = std::fs::OpenOptions::new()
        .create(true)
        .truncate(false)
        .write(true)
        .open(dir.join("reruns.lock"))?;
    crate::pr_head::try_lock_file(&rerun_lock)?;
    let ledger = dir.join("reruns.json");
    let mut recorded: std::collections::BTreeSet<String> = if ledger.exists() {
        serde_json::from_slice(&std::fs::read(&ledger)?)?
    } else {
        Default::default()
    };
    for run in runs {
        let key = serde_json::to_string(&(request, repo, pr, head, run))?;
        if !recorded.insert(key) {
            continue;
        }
        let tmp = ledger.with_extension("tmp");
        std::fs::write(&tmp, serde_json::to_vec(&recorded)?)?;
        std::fs::rename(tmp, &ledger)?;
        GhForge.rerun(repo, run).await?;
    }
    Ok(())
}

/// Carry out the [`ask::ChoiceAction`] attached to each answered choice, once.
///
/// Runs on every poll before the conductor looks at the queue. The task is
/// re-read under its claim, so a task somebody completed or held by hand in
/// the meantime is judged on what it is now. `Resume` releases the task and
/// records a pinned [`crate::queue::OperatorResume`], which `crate::conduct`
/// honours (no re-hold, no requeue) until the task runs and [`attempt`]'s
/// ordinary `unfinished_run` logic resumes that same run.
pub(crate) fn apply_task_choice_actions(queue: &Queue, questions: &Questions, home: &Path) {
    let tasks = queue.list();
    for q in questions.list() {
        // Dismissal is committed by the question writer, never a resume.
        if q.resolution().as_deref() == Some(crate::merge_decision::DISMISS) {
            continue;
        }
        if q.chosen_action().is_none_or(|a| a.maintenance()) {
            continue;
        }
        let Some(listed) = task_of_question(&tasks, &q) else {
            if q.node == land::APPROVAL_NODE
                && q.resolution().as_deref().is_some_and(|choice| {
                    choice == land::REPAIR || crate::merge_decision::stops(choice)
                })
            {
                notices::raise_in(
                    home,
                    Notice::warn(
                        &format!("repair-owner:{}", q.id),
                        format!(
                            "Approval action is waiting: no task owns run {}. Inspect `magi show {}` and restore its original queue owner; do not file a competing task.",
                            q.run, q.run
                        ),
                    ).link(Link::Run { id: q.run.clone() }),
                );
            }
            continue;
        };
        if listed.action_applied(&q.id) {
            continue;
        }
        let Ok(_claim) = queue.claim(&listed.id) else {
            continue;
        };
        let Ok(mut task) = queue.get(&listed.id) else {
            continue;
        };
        // Work only on this local copy until the action can be committed.
        // In particular, a fresh lease below leaves the persisted task blocked.
        if q.node == crate::conduct::NODE && task.status == TaskStatus::Blocked {
            let blockers: Vec<_> = task
                .blocked_by
                .iter()
                .filter(|id| {
                    crate::queue::dependency(queue, questions, id)
                        == crate::queue::Dependency::Question(q.id.clone())
                })
                .cloned()
                .collect();
            if !blockers.is_empty() {
                for id in blockers {
                    task.unblock(&id);
                }
                let answer = match &q.answer {
                    Some(ask::Answer::Choice(c) | ask::Answer::Text(c)) => c.clone(),
                    None => String::new(),
                };
                task.record_answer(q.summary.clone(), answer);
            }
        }
        let language = language_of(&task, Path::new("."));
        let decision = decide_action(&task, &q, phrases(&language), |id| {
            RunState::load_under(id, home)
        });
        let ran = matches!(
            decision,
            ActionDecision::Resume(_)
                | ActionDecision::Requeue
                | ActionDecision::Hold
                | ActionDecision::Done
        );
        if ran && asker_may_still_read(questions, &q, home) {
            // The asking process or its seat can still take the word; act
            // once it has gone quiet. Bound on the remaining window: the
            // check is not atomic with the write below, so an asker that
            // takes the word in between (at most one poll, never more than
            // `ask::LEASE_TTL`) only prints it - it never touches the task,
            // and `Task::actions_applied` under the claim keeps the action to
            // one application. The waiter does not deliver an answer that
            // carries an action (`waiter::decide_owned`), so it cannot race.
            continue;
        }
        let done = matches!(decision, ActionDecision::Done);
        match decision {
            ActionDecision::Skip => continue,
            ActionDecision::Resume(run) => {
                task.release_operator("choice", Some(&q.id));
                task.resume_override = Some(crate::queue::OperatorResume {
                    question_id: q.id.clone(),
                    at: Timestamp::now(),
                    conductor_rehold: None,
                    forced: true,
                    pinned_run: Some(run),
                });
            }
            ActionDecision::Stale => {}
            ActionDecision::Requeue => {
                task.release_operator("choice-requeue", Some(&q.id));
                task.requeue();
            }
            ActionDecision::Hold => task.hold_manual(Some(q.summary.clone())),
            ActionDecision::Done => task.succeed(),
            ActionDecision::Refuse(why) => {
                if task.operator_held() {
                    // A rejected answer does not release the operator's hold
                    // or reclassify it as recoverable by the conductor.
                    task.hold_reason = Some(match task.hold_reason.take() {
                        Some(reason) => format!("{reason}\n\n{why}"),
                        None => why,
                    });
                } else {
                    task.notice_cause(&format!("resume-refused:{}", q.id), None, None);
                    task.hold_machine(Some(why));
                }
                notices::raise(
                    Notice::warn(
                        &format!("action:{}", q.id),
                        "An answer asked the daemon to resume a run that cannot be resumed; the task stays held.",
                    )
                    .link(Link::Task {
                        id: task.id.clone(),
                    }),
                );
            }
        }
        task.mark_action_applied(&q.id);
        // The applied id travels with the transition, so a failed save loses
        // neither and the answer is acted on at the next poll.
        record(queue, &mut task);
        if done && queue.get(&task.id).is_ok_and(|t| t.action_applied(&q.id)) {
            supersede_prior_runs(&task, home);
        }
        // Delivery is only a note of who has read the answer; the task's own
        // mark above is the authority. Best effort.
        let _ = questions.update(&q.id, |r| {
            r.answer_delivered = true;
            Ok(())
        });
    }
}

/// Whether something may still read the answer to `q`: a fresh lease, or the
/// asking seat still listed as active in its run (its CLI can outlive the
/// `magi ask` that was killed).
fn asker_may_still_read(questions: &Questions, q: &ask::Question, home: &Path) -> bool {
    let now = Timestamp::now();
    if questions.read_lease(&q.id).is_some_and(|l| l.fresh(now)) {
        return true;
    }
    q.node != crate::conduct::NODE
        && RunState::load_under(&q.run, home).is_ok_and(|s| {
            s.seats_active()
                .any(|(k, a)| *k == q.seat && a.remaining_secs(now) > 0)
        })
}

/// Retire an unanswered conductor question after its task no longer refers to
/// it. Conductor questions use the task id in `Question::run`, so run-based
/// cleanup cannot observe a manual release or completion.
///
/// Restricted to `Question::node == crate::conduct::NODE`: an ordinary run's
/// own question also carries a `run`, and a run id that happens to collide
/// with some task's id is not this loop's business — only a conductor
/// question actually uses the task id that way. One `Questions::list()` scan
/// is taken up front and matched against the in-memory task set, rather than
/// calling `Questions::open_for` (a full disk scan on its own) once per task.
fn reconcile_task_questions(queue: &Queue, questions: &Questions) {
    let tasks = queue.list();
    let by_id: std::collections::BTreeMap<&str, &Task> =
        tasks.iter().map(|t| (t.id.as_str(), t)).collect();
    let referenced: Vec<&str> = tasks
        .iter()
        .flat_map(|task| task.blocked_by.iter().map(String::as_str))
        .collect();

    for mut question in questions.list() {
        if !question.status.open() || question.node != crate::conduct::NODE {
            continue;
        }
        // Keep questions a task still names, including when the reference
        // moved to a dependent task.
        // Preserve even ambiguous references: retiring a possibly referenced
        // question is unsafe until the operator disambiguates it.
        if referenced
            .iter()
            .any(|id| question.id.starts_with(id) || question.id.ends_with(id))
        {
            continue;
        }
        let Some(task) = by_id.get(question.run.as_str()) else {
            continue;
        };
        question.abandon(format!(
            "task {} no longer waits for this answer",
            task.short()
        ));
        if let Err(e) = questions.put(&mut question) {
            tracing::warn!(
                "could not retire question {} for task {}: {e:#}",
                question.short(),
                task.short()
            );
        }
    }
}

/// What a finished run tells the queue about the task it came from.
///
/// A struct rather than a fourth and fifth boolean argument: the two flags
/// answer different questions about the same run, and a call site passing
/// `(…, true, false)` is one transposition away from refunding attempts
/// forever.
#[derive(Debug, Clone, Copy)]
pub struct Verdict {
    /// Where the graph stopped.
    pub status: RunStatus,
    /// The run opened a pull request.
    pub left_pr: bool,
    /// At least one seat was lost to a rate limit.
    pub quota_hit: bool,
    /// The run parked at a node boundary because it was asked to.
    pub parked: bool,
    /// The run never produced a single candidate a judge could look at.
    ///
    /// Distinct from `quota_hit`: a run can lose a seat to a rate limit and
    /// still have another candidate worth judging, in which case the loss was
    /// not the reason nothing came of the run. This is `true` only when the
    /// implement wave ended with nothing viable at all.
    pub no_viable_candidates: bool,
}

/// Record a finished run against the task it came from.
///
/// Kept pure and separate from the loop because this mapping *is* the retry
/// policy, and a policy that can only be exercised by spawning a graph is a
/// policy nobody checks. The table:
///
/// | run status                           | task becomes        | attempt spent |
/// |---------------------------------------|---------------------|---------------|
/// | parked at a boundary                  | `Parked` (requeued) | **no**        |
/// | `Merged`, `Ready`                      | `Done`               | yes          |
/// | `AlreadyInBase`                        | `Done`, with a note  | **no**        |
/// | `Stalled`, quota hit                   | `Failed` (requeued) | **no**        |
/// | `Failed`, quota hit, no viable cand.   | `Failed` (requeued) | **no**        |
/// | `Stalled`, no quota                    | `Failed`, or `Held`  | yes          |
/// | `Blocked` with a PR                    | `Held`               | yes          |
/// | `Blocked`, `Failed` otherwise          | `Failed`, or `Held`  | yes          |
/// | `VerifiedNoop`                          | `Held`               | yes          |
/// | anything non-terminal                  | `Failed`, or `Held`  | yes          |
///
/// The `VerifiedNoop` row is independent of the `Failed`-quota row above it,
/// deliberately: every candidate agreeing there is nothing to write is not a
/// machine fact about a rate limit, it is an unverified claim about the
/// *task* that a human still has to check — see [`RunStatus::VerifiedNoop`]'s
/// own doc and [`Task::handed_off`]. `Held` rather than `Done` on purpose: the
/// claim could be wrong (a misread instruction, a stale check), and closing
/// the task automatically on an implementer's say-so would be the exact
/// failure mode task 391f's own audit was raised to avoid. `attempt spent` is
/// `yes` here for the same reason it is on the `Blocked`-with-a-PR row just
/// above, which settles through the same [`Task::handed_off`]: `Held` is not
/// `Failed`-and-requeued, so nothing retries this task on the same unverified
/// claim regardless of whether the one already-spent attempt is refunded, and
/// [`Task::release`] resets the count to zero anyway the moment a human looks
/// at the evidence and lets it run again.
///
/// The `Stalled`-quota and `Failed`-quota rows are the ones worth reading
/// twice, together. A quorum lost to rate limits is a property of the machine
/// and not of the task, so the attempt is refunded and a reset quota picks
/// the work up where it stopped — and that is just as true when every
/// implement seat lost the same race and `after_implement` bails with nothing
/// to judge, which surfaces as `Failed` rather than `Stalled` but is the same
/// machine fact. The `no_viable_candidates` guard is what keeps that row
/// narrow: a `Failed` run that produced a real candidate which then lost for
/// some other reason still spends the attempt, exactly like the quorum lost
/// to judges that answered with the wrong shape is ordinary flakiness, and
/// refunding *that* takes the bound off the retry loop entirely: run e633
/// stalled with `quota: []` after two judges wrote unusable JSON, was
/// refunded, and the next attempt paid for a fresh hour-long implement wave
/// before it could fail the same way. `max_attempts` exists precisely so
/// that cannot repeat forever.
///
/// A non-terminal status means `execute` returned while the graph was still
/// mid-flight, which is a bug rather than a verdict; it is treated as a
/// failure so that a task cannot loop on it either.
///
/// `left_pr` splits the `Blocked` row, and it is the difference between a run
/// that failed and a run that finished into a gate. See [`Task::handed_off`].
pub fn settle(task: &mut Task, verdict: Verdict, detail: &str, max_attempts: usize) {
    settle_in(task, verdict, detail, max_attempts, &PHRASES_EN)
}

/// [`settle`], with the daemon's own fixed prose in `p`'s language.
fn settle_in(task: &mut Task, verdict: Verdict, detail: &str, max_attempts: usize, p: &Phrases) {
    // A parked run is the operator's own doing, and its work is intact on
    // disk. The task goes back in line with its attempt refunded so the next
    // loop resumes the same run - which `one_task` prefers over competing
    // again - and so that swapping the binary a few times cannot exhaust a
    // budget meant for agents that actually misbehaved.
    if verdict.parked {
        task.park(detail);
        return;
    }
    match verdict.status {
        RunStatus::Merged | RunStatus::Ready
            if task.pr_recovery.as_ref().is_some_and(|s| {
                s.disposition != Some(crate::pr_recovery::Disposition::Review)
            }) =>
        {
            task.hold_manual(Some("Public delivery is not confirmed. Inspect the selected PR and run, then use recover-pr --disposition land with the intended source and validation configuration.".into()));
        }
        RunStatus::Merged | RunStatus::Ready => task.succeed(),
        RunStatus::AlreadyInBase => task.already_landed(detail),
        RunStatus::Stalled if verdict.quota_hit => task.stall(detail),
        RunStatus::Failed if verdict.quota_hit && verdict.no_viable_candidates => {
            task.stall(detail)
        }
        RunStatus::Stalled | RunStatus::Failed => task.fail(detail, max_attempts),
        RunStatus::Blocked if verdict.left_pr => task.handed_off(detail),
        RunStatus::Blocked => task.fail(detail, max_attempts),
        RunStatus::VerifiedNoop => task.handed_off(detail),
        other => task.fail((p.graph_stopped)(label(other), detail), max_attempts),
    }
}

/// Rewrite this task's now-moot earlier attempts — [`Task::superseded_attempts`]
/// — from `Blocked`/`Stalled` to [`RunStatus::Superseded`], once the task
/// itself has actually finished *and* its own last attempt is provably why:
/// this loads that run and requires `Merged`/`Ready` before touching
/// anything earlier in `runs`, since `Task::succeed` can also be called
/// directly on a task whose last attempt never landed at all.
///
/// Called right after whatever call set `task.status` to
/// [`TaskStatus::Done`] — this module's own `settle`'s callers below and
/// `reclaim`'s, but also every other place a task can be closed by hand
/// without the loop ever settling it itself: `magi task done`
/// (`main::TaskCmd::Done`) and `POST /api/queue/{id}/done`
/// (`web::queue_done`). Closing a task by hand — after confirming a manual
/// GitHub merge, say, exactly the workflow this repository's own
/// "Landing a run's winner by hand" documents — is just as much "this task's
/// story is over" as a daemon-driven `Merged`/`Ready` is, and skipping it
/// there would leave every earlier attempt stuck at `Blocked`/`Stalled`
/// forever, which is the exact backlog this status exists to clear. `pub`
/// for those two out-of-module callers; everything else about this stays
/// internal bookkeeping.
///
/// A run something is still actually driving is left alone: a
/// task cannot be `Done` while one of its *own* attempts is still in flight,
/// so a live one at this point can only be an unrelated process — a manual
/// `--resume` of this old, now-moot run — and rewriting under it would just
/// be undone (back to `Blocked`/`Stalled`, or worse) the next time that
/// process itself saves. This is the same `daemon_claims` + [`RunState::liveness`]
/// pair `run_report`/`run_detail` use for the same question elsewhere:
/// `is_working_on` alone only ever proves a *daemon* claim, not a `magi run
/// --resume` invoked by hand outside it, which `liveness` also checks via
/// the run's own recorded `driver_pid`. Anything not `Blocked` or `Stalled`
/// (already terminal in some other way, or itself mid-run) is left untouched
/// too.
///
/// Best-effort, like the rest of this module's bookkeeping: a load or save
/// failure here is a `tracing::warn`, not a failed settle, and the next time
/// this same task's completion is recorded — or a daemon restart replays
/// `reclaim_orphaned_running` — is another chance to catch up. There is no
/// separate reconciliation pass; if that gap ever matters in practice, one
/// can be added then.
///
/// `home` is a parameter, not the process-global [`crate::run::home`], for
/// the same reason [`RunState::save_under`] takes one: `web::queue_done`
/// calls this with `ui.home`, which is `crate::run::home()` in a real
/// process but a fixture's own directory under test — falling through to
/// the global there would read and write through whichever home some other
/// test in the same binary happened to pin into that `OnceLock` first, not
/// the run this call actually means.
pub fn supersede_prior_runs(task: &Task, home: &Path) {
    let now = Timestamp::now();
    // `Task::superseded_attempts` cannot tell a loop-driven `Done` (always
    // right behind a `Merged`/`Ready` verdict) from one set directly by
    // `magi task done`/its web equivalent/the conductor on a task whose last
    // recorded attempt never actually landed - that requires reading the
    // run itself, which is exactly what this does before trusting anything
    // in `runs` is safe to relabel.
    let last_run_succeeded = task
        .runs
        .last()
        .and_then(|id| RunState::load_under(id, home).ok())
        .is_some_and(|s| matches!(s.status, RunStatus::Merged | RunStatus::Ready));
    for id in task.superseded_attempts(last_run_succeeded) {
        let mut state = match RunState::load_under(id, home) {
            Ok(s) => s,
            Err(e) => {
                tracing::warn!("could not load run {id} to mark it superseded: {e:#}");
                continue;
            }
        };
        if !matches!(state.status, RunStatus::Blocked | RunStatus::Stalled) {
            continue;
        }
        let daemon_claims = is_working_on(home, id, now);
        if state.liveness(daemon_claims) == Liveness::Live {
            continue;
        }
        state.status = RunStatus::Superseded;
        if let Err(e) = state.save_under(home) {
            tracing::warn!("could not mark run {id} superseded: {e:#}");
        }
    }
}

/// Catch up every `Done` task [`supersede_prior_runs`] could not fully
/// finish the moment it was called, because one of its earlier attempts was
/// still live then - a `magi run --resume` invoked by hand on an old run,
/// most likely.
///
/// That skip is correct at the time (rewriting under a run something is
/// still actively saving would just be undone), but a task only ever
/// reaches `Done` once, so without this nothing would ever look at it
/// again: if that manual process later ends anywhere other than
/// `Merged`/`Ready` - abandoned, or landed as another `Blocked` - the
/// skipped attempt would sit at `Blocked`/`Stalled` forever, exactly the
/// backlog this status exists to clear. Called on the same idle-only
/// cadence as [`janitor`], next to it rather than folded into it: this
/// walks `queue` and `janitor` never otherwise needs one.
///
/// Simply re-running [`supersede_prior_runs`] over every `Done` task with
/// more than one attempt, every pass: each call is a handful of local file
/// reads bounded by that task's own attempt count, the same order of cost
/// [`clean::fold_due`] already pays scanning every run on disk on the same
/// cadence, and a task already fully resolved costs one failed liveness
/// check turned no-op the moment its lingering attempt is no longer live.
fn resweep_superseded_attempts(queue: &Queue, home: &Path) {
    for task in queue.list() {
        if task.status != TaskStatus::Done || task.runs.len() < 2 {
            continue;
        }
        supersede_prior_runs(&task, home);
    }
}

/// [`settle`], plus attaching the run's own [`diagnostic`] excerpt once the
/// task ends up held.
///
/// The one place [`attempt`] (a live finish) and [`reclaim`] (recovering one a
/// dead daemon never got back to) share this, so the two cannot drift into
/// disagreeing about which held tasks get a diagnostic.
fn settle_and_diagnose(
    task: &mut Task,
    verdict: Verdict,
    detail: &str,
    max_attempts: usize,
    state: &RunState,
) {
    let p = phrases(&state.config.graph.language);
    // Shared by normal completion and crash recovery, under the task claim.
    // No new attempt can own the task until the old driver has exited.
    if let Some(d) = &state.merge_decision {
        use crate::merge_decision as md;
        if task.runs.last().is_some_and(|id| id != &state.id) {
            return;
        }
        if (d.choice == md::WITHDRAW && d.closed) || d.choice == md::DISMISS {
            task.succeed();
        } else if let Some(agent) = md::selected_agent(&d.choice).filter(|_| d.closed) {
            if state.liveness(false) != Liveness::Dead {
                task.hold_manual(Some("Previous driver is still live; replacement held until it exits. Release the task after checking the driver.".into()));
                return;
            }
            let replacement = md::Replacement {
                question: d.question.clone(),
                run: state.id.clone(),
                pr: d.target.pr.clone(),
                agent: agent.to_owned(),
                context: format!(
                    "Previous PR: {}. Previous run: {}. Owner requested a new implementation.\nReview evidence:\n{}",
                    d.target.pr,
                    state.id,
                    serde_json::to_string(&state.reviews).unwrap_or_default()
                ),
            };
            task.requeue();
            task.pr_recovery = None;
            task.review_of = None;
            task.replacement = Some(replacement);
        } else {
            task.hold_manual(Some(if d.choice.eq_ignore_ascii_case(land::HOLD) {
                format!("Decision held by owner; no further repair or merge work. {}", state.merge.as_ref().map_or("", |m| m.detail.as_str()))
            } else { format!("PR closure was not confirmed. Task held; inspect the existing run before starting replacement work. {}", state.merge.as_ref().map_or("", |m| m.detail.as_str())) }));
        }
        task.mark_action_applied(&d.question);
        if let Some(pass) = state.passes.last() {
            task.record_pass_at(
                &state.id,
                pass.index,
                Some(pass.started_at),
                task.attempts,
                None,
            );
        }
        return;
    }
    if let Some(replacement) = &task.replacement
        && !state.parked
        && state.resource_block.is_none()
        && (state.viable().is_empty()
            || (state.status == RunStatus::Blocked && state.tally.is_none()))
    {
        task.hold_manual(Some(format!("Selected implementer `{}` was unavailable, failed or hit quota before producing a viable implementation. No other implementer was dispatched. Inspect the run, restore availability, then explicitly release this task.", replacement.agent)));
        return;
    }
    let attempts_before = task.attempts;
    // A run that stopped because a shared resource stayed busy was never a
    // failure of the task or of an agent. Earlier nodes may have run; only
    // the blocked operation lacks a result. The attempt is
    // refunded and the task is held by the machine, under a reason `triage`
    // can re-check, so the same run resumes with the same agents once the
    // resource is free. A park request still wins (it is the operator's).
    if let Some(block) = state.resource_block.as_ref().filter(|_| !verdict.parked) {
        task.notice_cause(
            &format!("resource:{}:{}", block.kind, block.node),
            None,
            None,
        );
        task.last_error = Some(detail.to_owned());
        task.diagnostic = None;
        task.attempts = task.attempts.saturating_sub(1);
        if block.kind == "disk pressure" {
            task.hold_machine(Some(format!(
                "{}{}",
                crate::disk::RUNNING_PRESSURE,
                block.detail
            )));
        } else {
            task.hold_machine(Some(format!(
                "{}{}; no attempt was spent; resume to retry the affected operation",
                crate::cache::RESOURCE_HOLD,
                block.description()
            )));
        }
        if let Some(pass) = state.passes.last() {
            task.record_pass_at(
                &state.id,
                pass.index,
                Some(pass.started_at),
                attempts_before,
                None,
            );
        }
        return;
    }
    let unresolved = task.hold_notice_cause.clone();
    if !verdict.parked
        && task
            .pr_recovery
            .as_ref()
            .is_some_and(|s| s.disposition != Some(crate::pr_recovery::Disposition::Review))
        && matches!(
            verdict.status,
            RunStatus::Ready | RunStatus::Merged | RunStatus::AlreadyInBase
        )
    {
        if state.pr_recovery == task.pr_recovery && state.public_delivery_complete() {
            task.succeed();
        } else {
            task.hold_manual(Some("Selected PR delivery is incomplete: local review or publication is not a confirmed public merge. Inspect the run and PR; use recover-pr --disposition land with --source-head <reviewed-full-SHA> and the required verification configuration. No automatic new attempt will start.".into()));
        }
    } else if !verdict.parked
        && task.pr_recovery.is_some()
        && matches!(
            verdict.status,
            RunStatus::Blocked | RunStatus::Failed | RunStatus::Gating
        )
        && !verdict.quota_hit
    {
        task.hold_unrequested_retry(Some(format!("Selected recovery stopped: {detail}. Inspect the retained source and run; correct the cause before explicitly releasing or selecting again. No automatic replacement will start.")));
    } else {
        settle_in(task, verdict, detail, max_attempts, p);
    }
    if !verdict.parked
        && !verdict.quota_hit
        && matches!(
            verdict.status,
            RunStatus::Blocked | RunStatus::Failed | RunStatus::Stalled
        )
    {
        task.recovery_failed(state);
    }
    if state.prep_failure.is_some() {
        // Minting a run whose candidates could not be prepared is not work
        // on a newly approved attempt. Keep the unresolved outcome anchor.
        task.hold_notice_cause = unresolved;
        task.startup_notice_cause("startup-candidates");
    }
    // Written here, where the refund (or not) is decided, so the history is a
    // fact and not a later guess from the run's status.
    if let Some(pass) = state.passes.last() {
        let parked = match &pass.end {
            Some(crate::run::PassEnd::Parked { cause }) => Some(cause.clone()),
            _ => None,
        };
        task.record_pass_at(
            &state.id,
            pass.index,
            Some(pass.started_at),
            attempts_before,
            parked,
        );
    }
    if task.status == TaskStatus::Held {
        if state.prep_failure.is_none() {
            task.notice_cause(
                label(verdict.status),
                Some(&state.id),
                state.passes.last().map(|p| p.index),
            );
        }
        task.diagnostic = diagnostic(state);
        note_open_question(task, &state.id, p);
    }
}

/// If `task` is held with a `magi ask` question still open on `run`, name the
/// question in [`Task::hold_reason`] rather than leaving the hold reading
/// only [`describe`]'s run summary.
///
/// This is the shape task 20260928-191407-05fd left underspecified: an
/// implementer settled a verified no-op and filed a question for the
/// operator, and the hold that followed said nothing about the question
/// waiting on them. Appended, not substituted - [`crate::triage`] parses the
/// existing text ([`is_disk_hold`](crate::triage), the answered-question
/// marker) and must keep seeing it unchanged.
///
/// Best-effort: an unreadable question store must not stop a run from
/// settling, so this is a no-op rather than a propagated error when
/// [`crate::run::try_home`] has nothing to offer or the store is empty.
fn note_open_question(task: &mut Task, run: &str, p: &Phrases) {
    let Some(home) = crate::run::try_home() else {
        return;
    };
    let open = Questions::at(home.join("questions")).open_for(run);
    let Some(q) = open.first() else {
        return;
    };
    let mut decisions: Vec<_> = open.iter().map(|q| q.id.as_str()).collect();
    decisions.sort_unstable();
    task.notice_cause(
        &format!("questions:{}", decisions.join(",")),
        Some(run),
        None,
    );
    let base = task.hold_reason.clone().unwrap_or_default();
    task.hold_reason = Some(format!("{base}{}{}", p.waiting_for_answer, q.short()));
}

/// Reconcile a task left at [`TaskStatus::Running`] by a daemon that never
/// got back to [`settle`] for it — a crash, a `SIGKILL`, or a run carried on
/// by some other means entirely, like a manual `magi run` resume that
/// finishes the graph outside the queue's bookkeeping.
///
/// Pure and separate from [`reclaim_orphaned_running`] for the same reason
/// `settle` is separate from `attempt`: a task recovered this way must land
/// exactly where a live daemon would have put it — the same policy table,
/// not a second one that quietly drifts from it — and that is only checkable
/// without spawning a real run.
fn reclaim(task: &mut Task, last_run: Option<RunState>, max_attempts: usize, language: &str) {
    match last_run {
        Some(state) => {
            let verdict = Verdict {
                status: state.status,
                left_pr: state.pr.is_some(),
                quota_hit: !state.quota.is_empty(),
                parked: state.parked,
                no_viable_candidates: state.viable().is_empty(),
            };
            let detail = format!(
                "{}{}",
                phrases(&state.config.graph.language).recovered_running,
                describe(&state)
            );
            settle_and_diagnose(task, verdict, &detail, max_attempts, &state);
        }
        None => {
            // No run, so no config of its own: `language` is the task's
            // repository's setting, read by the caller.
            let why = phrases(language).no_run_to_recover;
            task.last_error = Some(why.to_owned());
            // The phone shows `hold_reason`, so a task held by the machine
            // says why there too and not only in `last_error`.
            task.notice_cause("missing-run", None, None);
            task.hold_machine(Some(why.to_owned()));
        }
    }
}

/// Find every task left at `running` that no live process is actually
/// driving, and settle each one against whatever its last run became.
///
/// # Why a claim is proof, not a guess
///
/// [`poll`] takes a task's [`Queue::claim`] *before* [`Task::start`] writes
/// `running`, and the guard is held for the task's whole time in that status:
/// `attempt` does not return, and the loop does not move past the scope
/// holding the claim, until the run has settled. So a `running` task whose
/// lock is gone cannot have a live owner — this process or any other —
/// without needing a staleness threshold or a pid check the way
/// [`sweep_stale_claims`] does for the narrower case of a lock left next to a
/// task that never got as far as `running` at all. Taking the claim here is
/// the whole test: it either fails, because something really does hold it
/// and the task is left alone, or it succeeds, which is the proof — and it is
/// kept for the rest of the decision so nothing else can start a competing
/// run while this one is being written.
///
/// Called on every poll, not only at startup, for the reason
/// [`sweep_stale_claims`] now is too: a daemon that has been up for days must
/// keep noticing this, not only on the one morning it happened to restart.
fn reclaim_orphaned_running(
    queue: &Queue,
    max_attempts: usize,
    live_workers: &std::collections::BTreeSet<String>,
) -> Vec<String> {
    let mut reclaimed = Vec::new();
    for listed in queue.list() {
        if listed.status != TaskStatus::Running || live_workers.contains(&listed.id) {
            continue;
        }
        let Ok(_claim) = queue.claim(&listed.id) else {
            continue;
        };
        // Re-read under the claim: a release or an edit landed by a human
        // between the listing above and the claim just taken must not be
        // clobbered by a decision based on the stale copy.
        let Ok(mut task) = queue.get(&listed.id) else {
            continue;
        };
        if task.status != TaskStatus::Running {
            continue;
        }
        let last_run = task.runs.last().and_then(|id| RunState::load(id).ok());
        // `execute` normally abandons a run's own open questions the moment
        // `status` lands somewhere non-resumable (see `graph::Runner::settle_questions`),
        // but a daemon that crashed *inside* that path - mid `land`'s CI wait,
        // say - can leave a `run.json` already at `Merged`/`Ready`/`Failed`
        // with the question still `open`, because the process died before
        // reaching that call. `reclaim` itself stays pure on purpose (see its
        // own doc), so the same cleanup runs here instead, against the run
        // this reclaim is already reading. `settle_run` costs nothing when
        // `execute` already got there first.
        if let Some(state) = &last_run
            && let Err(e) = ask::Questions::open().settle_run(&state.id, state.status)
        {
            tracing::warn!("abandon questions for {}: {e:#}", state.id);
        }
        let language = if last_run.is_none() {
            language_of(&task, Path::new("."))
        } else {
            String::new()
        };
        reclaim(&mut task, last_run, max_attempts, &language);
        if task.status == TaskStatus::Done {
            supersede_prior_runs(&task, &crate::run::home());
        }
        record(queue, &mut task);
        reclaimed.push(task.id.clone());
    }
    reclaimed
}

/// Find every run whose `run.json` is provably dead — every seat it still
/// lists as [`crate::run::RunState::active`] has overrun its own timeout, and
/// [`crate::run::RunState::liveness`] reads [`crate::run::Liveness::Dead`],
/// not merely "no daemon claims it" — and fail it, clearing the leftover
/// active seats so the run stops reading as `implementing` (or whichever
/// node) forever.
///
/// [`reclaim_orphaned_running`] settles the *task* a dead daemon left
/// `running`, using whatever `run.json` already says — but nothing in that
/// path, nor in [`reclaim`], ever writes back to the run itself (`reclaim`
/// stays pure on purpose, see its own doc), so a `run.json` a killed process
/// never got back to sits exactly where it was left: `active` full of seats
/// nobody will ever answer for, `status` stuck on whatever node was in
/// flight. `magi show` already tells an operator this in prose (`no live
/// daemon claims this run right now`); this is what makes that fact durable
/// on disk, the same way a task's own `TaskStatus::Running` does not get to
/// stay stuck once nothing is driving it.
///
/// Runs on every poll, not only at startup, for the reason
/// [`sweep_stale_claims`] and [`reclaim_orphaned_running`] already are: a
/// daemon up for days must keep noticing a run some other, now-dead, daemon
/// left behind just as readily as one it trips over on the way up.
///
/// Walks `home.join("runs")` directly and reads each `run.json` on its own,
/// rather than the process-global [`RunState::load`] / [`crate::run::list_ids`] —
/// the same reason [`crate::clean`]'s housekeeping passes take an explicit
/// `runs` directory instead: `home` here is a parameter precisely so a test
/// can point it away from the operator's real history (see [`drive`]'s own
/// doc), and a scan that fell through to the global home anyway would walk
/// whichever directory some *other* process or test pinned into that
/// `OnceLock` first — mutating runs this call was never handed.
fn reclaim_abandoned_runs(home: &Path, now: Timestamp) -> Vec<String> {
    reclaim_abandoned_runs_with(
        home,
        now,
        crate::proc::pid_status,
        crate::proc::process_started_at,
    )
}

/// [`reclaim_abandoned_runs`] with its `driver_pid` liveness/identity queries
/// supplied by the caller — mirrors [`sweep_stale_claims_with`], which exists
/// for the identical reason: this sweep's real damage (wiping a run's active
/// seats and failing it) has to be provable against an injected answer in a
/// test, not just the real process table.
fn reclaim_abandoned_runs_with<F, G>(
    home: &Path,
    now: Timestamp,
    query: F,
    identity: G,
) -> Vec<String>
where
    F: Fn(u32) -> Option<bool>,
    G: Fn(u32) -> Option<String>,
{
    let mut abandoned = Vec::new();
    for entry in std::fs::read_dir(home.join("runs"))
        .into_iter()
        .flatten()
        .flatten()
    {
        let id = entry.file_name().to_string_lossy().into_owned();
        if !crate::run::is_run_id(&id) {
            continue;
        }
        // Serialize the proof and save with claims and takeover: a new
        // execution must not be overwritten after the liveness observation.
        let Ok(_owner) = crate::pr_head::owner_lock(home, &id) else {
            continue;
        };
        // Unreadable is `clean::fold_due`'s problem, not this one's — see
        // that module's docs for why a run this cannot parse is left alone
        // rather than guessed at. A different schema number is not that: this
        // touches only `status` and `active`, never a field whose meaning a
        // schema bump changed, so an old record's values serve this exactly
        // as well as a current one's (see `clean::read_state`'s own doc for
        // the same reasoning applied to folding).
        let Ok(body) = std::fs::read_to_string(entry.path().join("run.json")) else {
            continue;
        };
        let Ok(mut state) = serde_json::from_str::<RunState>(&body) else {
            continue;
        };
        if state.driver_exited || state.status.done() || !state.active_all_overrun(now) {
            continue;
        }
        // Not `!is_working_on(..)` alone: that is only "no *daemon* claims
        // it", which is also the normal, healthy shape of a manual `magi
        // run` / `magi review` sharing this same home — this scan walks
        // every run on disk, not only ones this daemon itself started. Such
        // a run's active seats can legitimately sit past their own timeout
        // for a little while (the CLI finishing up, its result still being
        // collected) without the process driving it having died. `liveness`
        // is what actually tells the two apart, by corroborating
        // `driver_pid` against the process it names — see its own doc. Only
        // its strongest, provable answer licenses wiping this run's active
        // seats and failing it out from under whatever is still running it.
        let daemon_claims = is_working_on(home, &id, now);
        if state.liveness_under_with(home, daemon_claims, &query, &identity)
            != crate::run::Liveness::Dead
        {
            continue;
        }
        state.abandon("daemon");
        if let Err(e) = state.save_under(home) {
            tracing::warn!("could not persist abandoned run {id}: {e:#}");
            continue;
        }
        // This run never passes through `Runner::execute` again, so its end
        // is announced here.
        if let Some(notice) = notices::run_ended(&state) {
            notices::raise_in(home, notice);
        }
        // The seat that asked is gone for good now, exactly like any other
        // door `graph::Runner::settle_questions` closes the moment `status`
        // lands somewhere non-resumable - see that method's own doc. Nothing
        // else reaches this one before the next `janitor()` startup pass
        // (`clean::abandon_settled_questions`), and a daemon that stays up
        // for days must not leave an open question badging the operator
        // until it happens to restart.
        if let Err(e) = Questions::at(home.join("questions")).settle_run(&id, state.status) {
            tracing::warn!("abandon questions for {id}: {e:#}");
        }
        abandoned.push(id);
    }
    abandoned
}

#[derive(Debug, Clone, Serialize, Deserialize)]
struct TaskWorker {
    opts: Opts,
    queue: PathBuf,
    task: String,
    #[serde(default)]
    lane: PermitKind,
    #[serde(default)]
    standalone: bool,
}

fn task_jobs(home: &Path) -> Result<Vec<crate::worker::Job>> {
    Ok(crate::worker::active(home)?
        .into_iter()
        .filter(|job| job.kind == "task")
        .collect())
}

fn owned_task_jobs(home: &Path) -> Result<Vec<crate::worker::Job>> {
    task_jobs(home)?
        .into_iter()
        .filter_map(
            |job| match serde_json::from_value::<TaskWorker>(job.payload.clone()) {
                Ok(request) if !request.standalone => Some(Ok(job)),
                Ok(_) => None,
                Err(error) => Some(Err(error.into())),
            },
        )
        .collect()
}

/// Whether an independent scheduler can be controlled without its web parent.
#[must_use]
pub fn managed(home: &Path) -> bool {
    match crate::worker::active(home) {
        Err(error) => {
            tracing::error!("cannot determine scheduler ownership: {error:#}");
            true
        }
        Ok(jobs) if jobs.iter().any(|j| j.kind == "scheduler") => true,
        Ok(_) => {
            read_status(home).is_some_and(|r| r.worker_protocol == Some(1))
                && crate::worker::try_lease(home, "scheduler").map_or(true, |lease| lease.is_none())
        }
    }
}

/// Start a detached, singleton scheduler using this executable generation.
pub async fn spawn_detached(home: &Path, opts: &Opts) -> Result<crate::worker::Job> {
    anyhow::ensure!(
        crate::worker::control(home, "scheduler")?.is_none() || !managed(home),
        "the scheduler is stopping; wait for retirement before starting it again"
    );
    crate::worker::spawn(
        home,
        "scheduler",
        "scheduler",
        serde_json::to_value(opts.absolute()?)?,
    )
    .await
}

fn park_request_path(home: &Path, job: &crate::worker::Job) -> PathBuf {
    home.join("worker-parks").join(format!("{}.json", job.id))
}

fn request_task_park(
    home: &Path,
    job: &crate::worker::Job,
    cause: crate::run::ParkCause,
) -> Result<()> {
    let path = park_request_path(home, job);
    std::fs::create_dir_all(path.parent().context("worker park directory")?)?;
    std::fs::write(path, serde_json::to_vec(&cause)?)?;
    crate::worker::request(home, &job.key, crate::worker::Control::Park)
}

/// Stop dispatch immediately; only an explicit park reaches existing workers.
pub fn request_control(home: &Path, control: crate::worker::Control) -> Result<()> {
    if control == crate::worker::Control::Park {
        for job in owned_task_jobs(home)? {
            request_task_park(home, &job, crate::run::ParkCause::Operator)?;
        }
    }
    crate::worker::request(home, "scheduler", control)
}

/// Replace the scheduler, leaving all active task and conversation jobs alone.
pub async fn restart_detached(home: &Path) -> Result<()> {
    let active = crate::worker::active(home)?;
    let prior = active.into_iter().find(|job| job.kind == "scheduler");
    if prior.is_none() && !managed(home) {
        return Ok(());
    }
    let opts: Opts = match prior {
        Some(job) => serde_json::from_value(job.payload)?,
        None => serde_json::from_slice(&std::fs::read(home.join("scheduler-options.json"))?)?,
    };
    request_control(home, crate::worker::Control::Stop)?;
    loop {
        let reserved = crate::worker::active(home)?
            .iter()
            .any(|job| job.kind == "scheduler");
        if !reserved && crate::worker::try_lease(home, "scheduler")?.is_some() {
            break;
        }
        tokio::time::sleep(Duration::from_millis(100)).await;
    }
    spawn_detached(home, &opts).await?;
    Ok(())
}

/// Hidden worker dispatch entry. The worker infrastructure owns its job lease.
pub async fn run_scheduler_worker(home: &Path, payload: serde_json::Value) -> Result<()> {
    let opts: Opts = serde_json::from_value(payload)?;
    let _ = home;
    serve_until(opts, Stop::new()).await
}

/// Execute and settle one task with the queue claim owned by this process.
pub async fn run_task_worker(home: &Path, payload: serde_json::Value) -> Result<()> {
    let request: TaskWorker = serde_json::from_value(payload)?;
    let queue = Queue::at(request.queue);
    let key = format!("task:{}", request.task);
    let job = task_jobs(home)?
        .into_iter()
        .find(|job| job.key == key)
        .context("task worker reservation is missing")?;
    let park_path = park_request_path(home, &job);
    // The spawning CLI/scheduler still owns the claim until spawn acknowledges
    // our durable reservation. Never execute before that ownership hand-off.
    let _claim = loop {
        match queue.claim(&request.task) {
            Ok(claim) => break claim,
            // Only contention (the claim file exists) is worth waiting out; an
            // I/O failure must end this worker instead of pinning its lane.
            Err(e) if e.chain().any(|c| c.is::<std::io::Error>()) => {
                return Err(e.context("claim the task for its worker"));
            }
            Err(_) => {
                sweep_stale_claims(&queue, STALE_CLAIM);
                tokio::time::sleep(Duration::from_millis(50)).await;
            }
        }
    };
    let mut task = queue.get(&request.task)?;
    if !task.status.runnable()
        || (!request.standalone
            && request.lane
                != permit_kind(land_resume_state(&task) == LandResume::Ready, task.urgent))
    {
        return Ok(());
    }
    let stop = Stop::new();
    let watcher = {
        let home = home.to_path_buf();
        let stop = stop.clone();
        let park_path = park_path.clone();
        tokio::spawn(async move {
            loop {
                if crate::worker::control(&home, &key).ok().flatten().is_some() {
                    let cause = std::fs::read(&park_path)
                        .ok()
                        .and_then(|body| serde_json::from_slice(&body).ok())
                        .unwrap_or(crate::run::ParkCause::Operator);
                    stop.park(cause);
                    return;
                }
                tokio::time::sleep(Duration::from_millis(200)).await;
            }
        })
    };
    let quota = if request.standalone {
        run_claimed_until(&request.opts, &queue, &mut task, &stop).await
    } else {
        let status = Arc::new(Mutex::new(Status::new()));
        Box::pin(attempt(
            &request.opts,
            &queue,
            &status,
            &stop,
            crate::graph::Pause::new(),
            &mut task,
        ))
        .await
    };
    watcher.abort();
    let _ = std::fs::remove_file(park_path);
    persist_cooldown(home, &quota).await?;
    Ok(())
}

/// Launch the standalone task worker with a claim-to-reservation handoff.
/// Returns only after the worker owns a durable execution reservation.
pub async fn spawn_claimed(
    home: &Path,
    opts: &Opts,
    queue: &Queue,
    task: &Task,
    claim: crate::queue::Claim,
) -> Result<crate::worker::Job> {
    let request = TaskWorker {
        opts: opts.absolute()?,
        queue: std::path::absolute(queue.root())?,
        task: task.id.clone(),
        lane: permit_kind(land_resume_state(task) == LandResume::Ready, task.urgent),
        standalone: true,
    };
    let job = crate::worker::spawn(
        home,
        "task",
        &format!("task:{}", task.id),
        serde_json::to_value(request)?,
    )
    .await?;
    drop(claim);
    Ok(job)
}

/// Transfer a standalone caller's claim only after the detached worker is live,
/// then follow that worker to its final (non-automatically-retrying) outcome.
pub async fn run_detached_claimed(
    opts: &Opts,
    queue: &Queue,
    task: &mut Task,
    claim: crate::queue::Claim,
) -> Result<()> {
    let home = crate::run::home();
    let job = spawn_claimed(&home, opts, queue, task, claim).await?;
    loop {
        // Reconcile execution leases even without a scheduler. A dead worker
        // must become a reported failure, never an infinite persisted wait.
        crate::worker::active(&home)?;
        let current = crate::worker::get(&home, &job.id)?;
        if matches!(
            current.status,
            crate::worker::Status::Finished | crate::worker::Status::Failed
        ) {
            *task = queue.get(&task.id)?;
            anyhow::ensure!(
                current.status != crate::worker::Status::Failed,
                "task worker failed: {}",
                current.result.as_deref().unwrap_or("unknown failure")
            );
            return Ok(());
        }
        tokio::time::sleep(Duration::from_millis(200)).await;
    }
}

async fn persist_cooldown(home: &Path, quota: &[QuotaLoss]) -> Result<()> {
    if let Some(until) = cooldown_until(quota, Timestamp::now()) {
        let _lease = loop {
            if let Some(lease) = crate::worker::try_lease(home, "task-quota-cooldown")? {
                break lease;
            }
            tokio::time::sleep(Duration::from_millis(10)).await;
        };
        if read_cooldown(home)?.is_none_or(|previous| previous < until) {
            let path = home.join("task-quota-cooldown.json");
            let temporary = path.with_extension("json.tmp");
            std::fs::write(&temporary, serde_json::to_vec(&until)?)?;
            std::fs::rename(temporary, path)?;
        }
    }
    Ok(())
}

fn read_cooldown(home: &Path) -> Result<Option<Timestamp>> {
    match std::fs::read(home.join("task-quota-cooldown.json")) {
        Ok(body) => Ok(Some(serde_json::from_slice(&body)?)),
        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(None),
        Err(error) => Err(error.into()),
    }
}

/// Run the loop until Ctrl-C, or until the queue drains with [`Opts::once`].
///
/// A thin wrapper over [`serve_until`] with a stop nothing but Ctrl-C ever
/// sets, so there is one loop body rather than two that drift apart the first
/// time the retry policy changes on only one of them.
pub async fn serve(opts: Opts) -> Result<()> {
    tracing::info!(
        "automatic update and restart requires magi web; standalone serve does not restart"
    );
    serve_until(opts, Stop::new()).await
}

/// [`serve`], but stopping when `stop` is set as well as on Ctrl-C.
///
/// A stop retires dispatch promptly, including while a worker launch is being
/// acknowledged. Already reserved workers own their attempts independently and
/// finish with their started executable. Explicit park additionally forwards
/// durable park requests; neither scheduler retirement nor update does so.
///
/// While the queue is empty the stop is honoured within one wakeup rather than
/// one poll interval: the wait is a `select!` against [`Stop`]'s notify, so a
/// caller that taps stop does not sit through the remainder of a sleep.
pub async fn serve_until(opts: Opts, stop: Stop) -> Result<()> {
    let opts = opts.absolute()?;
    let home = crate::run::home();
    let _scheduler = crate::worker::try_lease(&home, "scheduler")?
        .context("another scheduler already owns this home")?;
    if let Some(reading) = read_status(&home)
        && legacy_scheduler_running(&reading, Timestamp::now(), std::process::id())
    {
        bail!("a legacy scheduler is still running; stop it before starting independent dispatch");
    }
    if !crate::worker::active(&home)?
        .iter()
        .any(|job| job.kind == "scheduler")
    {
        crate::worker::clear_control(&home, "scheduler")?;
    }
    std::fs::write(
        home.join("scheduler-options.json"),
        serde_json::to_vec(&opts)?,
    )?;
    let control = {
        let home = home.clone();
        let stop = stop.clone();
        tokio::spawn(async move {
            loop {
                match crate::worker::control(&home, "scheduler").ok().flatten() {
                    Some(crate::worker::Control::Park) => {
                        let _ = request_control(&home, crate::worker::Control::Park);
                        stop.park(crate::run::ParkCause::Operator);
                        break;
                    }
                    Some(crate::worker::Control::Stop) => {
                        stop.stop();
                        break;
                    }
                    None => {}
                }
                tokio::time::sleep(Duration::from_millis(100)).await;
            }
        })
    };
    let signal = {
        let stop = stop.clone();
        tokio::spawn(async move {
            if tokio::signal::ctrl_c().await.is_ok() {
                stop.stop();
                tracing::info!("scheduler shutdown requested; independent workers continue");
            }
        })
    };

    let worktrees_root = opts
        .worktrees_root
        .clone()
        .unwrap_or_else(crate::run::default_worktree_root);
    let outcome = drive(
        &opts,
        &Queue::open(),
        &status_path(),
        &crate::run::home(),
        &worktrees_root,
        &stop,
    )
    .await;

    signal.abort();
    control.abort();
    outcome
}

/// The loop proper: setup, poll, teardown, with the queue and the status file
/// supplied rather than discovered.
///
/// All three of `home`, `worktrees_root` and the queue/status paths are
/// parameters rather than resolved here, for the same reason:
/// [`crate::run::home`] is process-global and its override is a `OnceLock`,
/// so a unit test that pinned it would fight every other test in the binary,
/// and a loop that resolved its own worktree bay could only be exercised
/// against the operator's real `~/wt/<repo>` - publishing over a live
/// daemon's status file, claiming tasks out of a live backlog, and, since
/// [`janitor`] runs on every idle tick, reclaiming worktrees out from under
/// whatever the operator actually has on disk.
async fn drive(
    opts: &Opts,
    queue: &Queue,
    status_file: &Path,
    home: &Path,
    worktrees_root: &Path,
    stop: &Stop,
) -> Result<()> {
    // The status file is a *snapshot*, not a stream of events: a reader only
    // ever wants the latest values, and every tick rewrites the whole file
    // anyway. A shared `Mutex<Status>` therefore says exactly what is meant,
    // while an mpsc channel would force the loop to re-send unchanged fields on
    // every heartbeat — or the heartbeat to keep its own shadow copy of them —
    // for no gain. The lock is only ever held across a field assignment, never
    // across an await.
    let recovery_cfg = prepare(&opts.repo, opts).ok();
    let daemon_cfg = recovery_cfg
        .as_ref()
        .map(|c| c.daemon.clone())
        .unwrap_or_default();
    let reconciled = crate::driver::reconcile(home);
    if !reconciled.is_empty() {
        tracing::info!(runs = ?reconciled, "reconciled stopped run drivers at startup");
    }
    let mut initial_status = Status::new();
    let owned = owned_task_jobs(home)?;
    initial_status.current = current_work(home, Timestamp::now())
        .into_iter()
        .filter(|current| {
            owned
                .iter()
                .any(|job| job.key.strip_prefix("task:") == Some(current.task.as_str()))
        })
        .collect();
    initial_status.idle = initial_status.current.is_empty();
    initial_status.question_recovery = Some(crate::question_delivery::Recovery::new(
        recovery_cfg.as_ref(),
        daemon_cfg.max_deputies,
    ));
    let status = Arc::new(Mutex::new(initial_status));
    write_status_to(status_file, &lock(&status)).context("publish the daemon status file")?;
    let beat = tokio::spawn(heartbeat(Arc::clone(&status), status_file.to_path_buf()));

    // Read once at startup, not per task: how many runs this loop drives at
    // once is a property of the machine running it, not of whichever
    // repository a given task happens to name - see
    // `Config::daemon.max_concurrent_runs`'s doc for why that is a machine
    // fact in the same sense the agent roster is.
    let concurrency = max_concurrent(daemon_cfg.max_concurrent_runs);

    tracing::info!(
        "magi serve: queue {} (poll {}s, {} attempts per task, {} run(s) at once{})",
        queue.root().display(),
        opts.poll.as_secs(),
        opts.max_attempts,
        concurrency,
        if daemon_cfg.pause_for_interrupts {
            ", interrupts enabled"
        } else {
            ""
        }
    );

    let outcome = tokio::select! {
        outcome = poll(opts, queue, &status, home, worktrees_root, stop, DispatchLimits {
            max_concurrent: concurrency,
            pause_for_interrupts: daemon_cfg.pause_for_interrupts,
            recovery_cfg,
        }) => outcome,
        () = async {
            while !stop.stopped() {
                tokio::time::sleep(Duration::from_millis(25)).await;
            }
        } => {
            if stop.parking() {
                request_control(home, crate::worker::Control::Park)?;
            }
            Ok(())
        }
    };

    stop.busy.store(0, Ordering::SeqCst);
    beat.abort();
    clear_status_at(status_file);
    outcome
}

/// The checkouts the release watcher covers and `[daemon] release_stall_minutes`,
/// re-read each lap. An unreadable config yields `0` minutes: the watcher idles.
pub(crate) fn release_watch_settings_from_config(
    home: &Path,
    repo: &Path,
    cfg: &Config,
) -> (Vec<PathBuf>, u64) {
    let mut paths: Vec<PathBuf> = crate::repos::scan(&cfg.repos.roots)
        .into_iter()
        .map(|r| r.path)
        .collect();
    // Repositories the daemon has worked in, wherever they live: a task may
    // name one outside `[repos] roots`, and its release PR must be watched too.
    let mut known: Vec<PathBuf> = Queue::at(home.join("queue"))
        .list()
        .into_iter()
        .map(|t| t.repo)
        .collect();
    let runs = home.join("runs");
    for id in crate::run::list_ids_in(&runs) {
        let repo = std::fs::read_to_string(runs.join(&id).join("run.json"))
            .ok()
            .and_then(|s| serde_json::from_str::<serde_json::Value>(&s).ok())
            .and_then(|v| v.get("repo")?.as_str().map(PathBuf::from));
        known.extend(repo);
    }
    for k in known {
        let k = k.canonicalize().unwrap_or(k);
        if k.join(".git").exists() && !paths.contains(&k) {
            paths.push(k);
        }
    }
    let own = repo.canonicalize().unwrap_or_else(|_| repo.to_path_buf());
    if !paths.contains(&own) {
        paths.push(own);
    }
    (paths, cfg.daemon.release_stall_minutes)
}

/// Per-repo bound on one `git fetch`, so a dead remote cannot stall the pass.
const FETCH_TIMEOUT: Duration = Duration::from_secs(30);

/// Refresh the status file on a fixed tick.
///
/// Separate from the loop because a run takes tens of minutes: a status file
/// written only between tasks would look stale for the whole of every run, and
/// a reader would report the daemon dead exactly while it was busiest.
async fn heartbeat(status: Arc<Mutex<Status>>, path: PathBuf) {
    loop {
        tokio::time::sleep(HEARTBEAT).await;
        let snapshot = {
            let mut guard = lock(&status);
            guard.updated_at = Timestamp::now();
            guard.clone()
        };
        if let Err(e) = write_status_to(&path, &snapshot) {
            // A failed heartbeat must not take the daemon down: the loop is the
            // product, the status file is only the window onto it.
            tracing::warn!("could not refresh the daemon status file: {e:#}");
        }
    }
}

/// Whether a task's last run is sitting in `land`'s merge-approval wait, and
/// if so, whether that wait is over.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
enum LandResume {
    /// The task's last run is not parked on a land approval; schedule it
    /// like any other candidate.
    NotLanding,
    /// Parked in `land`, waiting on a question nobody has answered yet.
    /// Left alone: attempting it now would only re-observe the same pull
    /// request and park again, spending a `gh` call on a decision that has
    /// not changed since the last time this was checked.
    StillWaiting,
    /// Parked in `land`, and the question is settled - answered or
    /// abandoned. Resuming this is the one kind of candidate that must not
    /// wait on a free [`Config::daemon`] concurrency slot: see [`poll`].
    Ready,
}

/// Classify a runnable candidate by whether it is parked on a land-merge
/// approval. Read-only - no claim taken, nothing written - so it is cheap
/// enough to call on every candidate, every poll.
fn land_resume_state(task: &Task) -> LandResume {
    let Some(run_id) = task.runs.last() else {
        return LandResume::NotLanding;
    };
    let Ok(state) = RunState::load(run_id) else {
        return LandResume::NotLanding;
    };
    if !state.parked {
        return LandResume::NotLanding;
    }
    if state.status == RunStatus::Landing
        && state.land_approval.as_ref().is_some_and(|binding| {
            ask::Questions::open()
                .get(&binding.question)
                .is_ok_and(|q| {
                    q.run == state.id
                        && q.resolution()
                            .as_deref()
                            .is_some_and(crate::merge_decision::stops)
                })
        })
    {
        return LandResume::Ready;
    }
    if !implementers_match(task, &state) {
        return LandResume::NotLanding;
    }
    // Parked in `land` on the merge approval, or at `merge` on the owner's
    // word about a title/body the posting gate withheld. Told apart by the
    // run's own record, not by a status both can share.
    let node = if state.status == RunStatus::Landing {
        land::APPROVAL_NODE
    } else if state.github_text.as_ref().is_some_and(|g| !g.resolved) {
        crate::github_text::ASK_NODE
    } else {
        return LandResume::NotLanding;
    };
    let store = ask::Questions::open();
    let waiting = store
        .list()
        .into_iter()
        .filter(|q| &q.run == run_id && q.node == node)
        .max_by(|a, b| a.id.cmp(&b.id));
    let Some(mut q) = waiting else {
        return LandResume::Ready;
    };
    if !q.status.open() {
        // Repair spends agent resources and must obey concurrency and quota
        // waits; only a merge/hold decision may use the decision-only lane.
        if q.resolution().as_deref() == Some(land::REPAIR) {
            return if state.liveness(false) == Liveness::Live {
                LandResume::StillWaiting
            } else {
                LandResume::NotLanding
            };
        }
        return LandResume::Ready;
    }
    // `ask::ask_and_wait`'s own deadline is what used to retire a question
    // nobody ever answered; land's approval bypasses that wait entirely (see
    // `land::approval_gate`), so the same deadline has to be enforced here
    // instead, or `graph.answer_timeout` silently stops meaning anything for
    // a land approval and a run can sit `StillWaiting` forever with nobody
    // told to look at it.
    let timeout = Duration::from_secs(state.config.graph.answer_timeout);
    let elapsed = Timestamp::now().as_second() - q.asked_at.as_second();
    if elapsed >= 0 && elapsed as u64 >= timeout.as_secs() {
        q.abandon(format!(
            "no answer within {}s of asking",
            timeout.as_secs().max(1)
        ));
        // If this can't be persisted, do not treat the wait as settled on a
        // guess: fall through and try again next poll.
        if store.put(&mut q).is_ok() {
            return LandResume::Ready;
        }
    }
    LandResume::StillWaiting
}

/// How often the loop rechecks for new work while something it already
/// started is still running, rather than sleeping out the whole
/// [`Opts::poll`] interval.
///
/// Short on purpose: this is what lets a land-merge approval that comes back
/// while another task is mid-competition be noticed and resumed within a
/// fraction of a second, not within the next multi-second poll.
const RECHECK_WHILE_BUSY: Duration = Duration::from_millis(200);

/// How often [`poll`] rechecks the shared build cache against its cap at a
/// boundary between runs (see [`maybe_prune_cache_between_runs`]), instead of
/// waiting for the queue to run dry.
///
/// A queue that never empties means the `janitor` call at the bottom of this
/// loop's fully-idle branch can go unreached for as long as the backlog
/// lasts. Five minutes is far below a single gate's own 1200s timeout, so a
/// cache that started the day at its 10 GiB cap cannot grow anywhere near the
/// 81.8 GiB an idle-only check let it reach before this existed, and it is
/// well above the cost of a `dir_size` walk over a multi-gigabyte cache, so a
/// backlog of short tasks does not pay for that walk on every poll.
const CACHE_CHECK_INTERVAL_SECS: u64 = 5 * 60;

/// State of [`poll`]'s own interrupt-scheduling sequence - see
/// [`crate::config::Daemon::pause_for_interrupts`]. Advanced once per tick by
/// [`advance_interrupt`] and consulted by [`interrupt_gate`], both pure and
/// both kept free of `Task`'s non-identity fields on purpose: every decision
/// here turns only on task ids and which ones are in flight, so the "never
/// more than one run at once" and "exactly one resume" invariants can be
/// pinned down with a plain `#[test]`, no `Runner`, no tokio, no fixture
/// queue - which is exactly the coverage this feature's first two attempts
/// were missing.
///
/// Persisted after every transition, so scheduler replacement preserves the
/// interrupt's exclusive turn and the interrupted task's priority resume.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
enum Interrupt {
    /// No interrupt sequence in progress. Ordinary dispatch applies.
    Idle,
    /// `interrupt_task` is runnable and exactly one other run is in flight;
    /// `parked` names that one task's id. Dispatch is withheld from
    /// everyone, including `interrupt_task` itself, until it has left
    /// flight - only then is `interrupt_task` let through.
    ///
    /// `parked` is a `Vec` rather than a bare id for symmetry with
    /// [`Interrupt::Running`] and [`Interrupt::Resuming`], but
    /// [`advance_interrupt`]'s own `Idle` branch only ever starts a sequence
    /// when exactly one run is in flight, so it is guaranteed to hold
    /// exactly one entry in practice - see that branch's own doc for why
    /// more than one is deliberately never attempted.
    Parking {
        parked: Vec<String>,
        interrupt_task: String,
    },
    /// `interrupt_task` is dispatched and in flight alone. Dispatch is
    /// withheld from everyone until it leaves flight - merged, failed, held,
    /// it makes no difference - at which point the sequence moves to
    /// [`Interrupt::Resuming`], never straight back to [`Interrupt::Idle`]:
    /// going straight to `Idle` would hand `parked` back to ordinary
    /// priority-order dispatch, where a higher-priority task filed in the
    /// meantime could start ahead of it.
    Running {
        parked: Vec<String>,
        interrupt_task: String,
    },
    /// `interrupt_task` left flight; `parked` still names the one run this
    /// sequence owes a resume. Dispatch is withheld from everyone except
    /// that task - see [`interrupt_gate`] - so the resume this feature
    /// promises is never raced by, or run alongside, an unrelated candidate.
    /// Ends the moment it is seen in flight, or - see `advance_interrupt`'s
    /// own doc on abandonment - the moment it is no longer runnable at all.
    Resuming { parked: Vec<String> },
}

/// One tick of the interrupt scheduler's own state machine. Pure: `in_flight`
/// and `runnable` are read-only snapshots of this tick's reality, and the
/// only side effect the caller still owes the world is asking whichever
/// `Pause` handles `parked` names to actually park - see [`poll`]'s own call
/// site.
///
/// `runnable` only has to carry `id` and `interrupt`; the whole [`Task`] is
/// accepted rather than a narrower type because that is what [`poll`] already
/// has on hand from [`runnable`], and building a second, smaller list on
/// every tick just to satisfy this signature would cost more than it proves.
///
/// Abandonment: [`Interrupt::Parking`] and [`Interrupt::Resuming`] both fall
/// back to a task they are waiting on no longer being [`runnable`] - held,
/// blocked, deleted, or finished by some other means entirely, all of which
/// an operator can do to a task sitting in the queue with no claim on it at
/// all, at any moment, interrupt sequence or not. Without this check the
/// sequence would wait forever for a dispatch that can never come, and
/// `interrupt_gate` would withhold every other task in the queue right along
/// with it - a single `magi task hold` on the wrong id turning into a
/// daemon that never dispatches anything again.
fn advance_interrupt(state: Interrupt, in_flight: &[String], runnable: &[Task]) -> Interrupt {
    match state {
        Interrupt::Idle => {
            // Not just "something to interrupt": exactly one thing. More
            // than one run in flight only happens above the default
            // `max_concurrent_runs = 1`, and `parked` guarantees "exactly
            // one resume, never run alongside anything else" only because
            // it is only ever seeded with exactly one id - see
            // `Interrupt::Resuming`'s own doc on why releasing more than one
            // parked id back to ordinary dispatch cannot be made safe
            // against that same setting's own extra concurrency slots.
            // Waiting here for the herd to settle to one is the
            // simplification this feature's own constraints ask for rather
            // than a second concurrency model to reconcile with the first.
            if in_flight.len() != 1 {
                return Interrupt::Idle;
            }
            match runnable.iter().find(|t| t.interrupt) {
                Some(t) => Interrupt::Parking {
                    parked: in_flight.to_vec(),
                    interrupt_task: t.id.clone(),
                },
                None => Interrupt::Idle,
            }
        }
        Interrupt::Parking {
            parked,
            interrupt_task,
        } => {
            if in_flight.iter().any(|id| parked.contains(id)) {
                // Still waiting for what was in flight to actually stop.
                Interrupt::Parking {
                    parked,
                    interrupt_task,
                }
            } else if in_flight.contains(&interrupt_task) {
                Interrupt::Running {
                    parked,
                    interrupt_task,
                }
            } else if runnable.iter().any(|t| t.id == interrupt_task) {
                // The parked run(s) are gone, but the interrupt task has not
                // been dispatched yet on this tick - `interrupt_gate` is
                // what lets it through next.
                Interrupt::Parking {
                    parked,
                    interrupt_task,
                }
            } else {
                // The interrupt task itself is no longer runnable - see this
                // function's own doc on abandonment. The parked run(s) still
                // get their guaranteed resume; there is simply no interrupt
                // to run ahead of them any longer.
                Interrupt::Resuming { parked }
            }
        }
        Interrupt::Running {
            parked,
            interrupt_task,
        } => {
            if in_flight.contains(&interrupt_task) {
                Interrupt::Running {
                    parked,
                    interrupt_task,
                }
            } else {
                // The interrupt task's own run reached a terminal status,
                // whichever one - this is the *only* trigger that moves the
                // sequence on, driven straight off the same in-flight
                // bookkeeping `poll` already reaps every tick, not a second,
                // independent poll of anything.
                Interrupt::Resuming { parked }
            }
        }
        Interrupt::Resuming { parked } => {
            if in_flight.iter().any(|id| parked.contains(id)) {
                // One of the parked runs has been dispatched - the resume
                // this sequence owed is fulfilled. Whatever else is left in
                // `parked` (ordinarily nothing, at the default concurrency
                // of one) rejoins ordinary priority-order dispatch, same as
                // any other runnable task.
                Interrupt::Idle
            } else if runnable.iter().any(|t| parked.contains(&t.id)) {
                Interrupt::Resuming { parked }
            } else {
                // Abandonment (see this function's own doc): nothing left in
                // `parked` is even runnable any longer.
                Interrupt::Idle
            }
        }
    }
}

/// [`Interrupt`], but with [`crate::config::Daemon::pause_for_interrupts`]
/// folded in: disabled, the sequence can never leave [`Interrupt::Idle`], so
/// a task marked [`Task::interrupt`] on a daemon that has not opted in is
/// indistinguishable from any other runnable task - exactly the "off does
/// nothing" this feature promises.
fn advance_interrupt_tick(
    enabled: bool,
    state: Interrupt,
    in_flight: &[String],
    runnable: &[Task],
) -> Interrupt {
    if !enabled {
        return Interrupt::Idle;
    }
    advance_interrupt(state, in_flight, runnable)
}

/// Which of this tick's runnable candidates the interrupt sequence actually
/// allows to be dispatched. Pure, and separate from [`advance_interrupt`] so
/// each half is assertable on its own: this is the half that keeps a
/// competition and an interrupt from ever running at the same moment.
fn interrupt_gate(state: &Interrupt, in_flight: &[String], candidates: Vec<Task>) -> Vec<Task> {
    match state {
        Interrupt::Idle => candidates,
        Interrupt::Parking {
            parked,
            interrupt_task,
        } => {
            if in_flight.iter().any(|id| parked.contains(id)) {
                Vec::new()
            } else {
                candidates
                    .into_iter()
                    .filter(|t| &t.id == interrupt_task)
                    .collect()
            }
        }
        Interrupt::Running { .. } => Vec::new(),
        // At most one: even if `parked` names more than one id (more than
        // one run was in flight when the sequence began, only possible
        // above the default `max_concurrent_runs = 1`), only the first match
        // is offered. Capping this to a single candidate - not merely to
        // `parked`'s own ids - is what makes "exactly one resume, never two
        // dispatched together" true regardless of how many ordinary slots
        // happen to be free this tick.
        Interrupt::Resuming { parked } => candidates
            .into_iter()
            .find(|t| parked.contains(&t.id))
            .into_iter()
            .collect(),
    }
}

/// The daemon-loop knobs [`poll`] needs from [`crate::config::Daemon`],
/// bundled into one parameter so `poll`'s own signature stays readable -
/// see [`drive`]'s call site for where these are actually read.
struct DispatchLimits {
    /// How many *ordinary* candidates run at once. See
    /// [`crate::config::Daemon::max_concurrent_runs`].
    max_concurrent: usize,
    /// See [`crate::config::Daemon::pause_for_interrupts`].
    pause_for_interrupts: bool,
    recovery_cfg: Option<Config>,
}

/// Which semaphore, if any, dispatching a candidate should draw its permit
/// from.
///
/// Pure and separate from [`poll`]'s loop body for the same reason
/// [`advance_interrupt`] is: the choice between "skip the ordinary pool
/// entirely", "spend the one urgent slot" and "spend an ordinary slot" is
/// exactly the policy this feature adds, and a policy only exercisable by
/// running the whole loop is a policy nobody checks.
#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
enum PermitKind {
    /// A land-merge resume (see [`LandResume::Ready`]): bypasses every slot.
    /// Checked first - a task can be both a land resume and marked
    /// [`Task::urgent`], and the resume's own "must not queue behind
    /// anything" guarantee takes precedence.
    None,
    /// [`Task::urgent`]: the one extra slot in `urgent_sem`, spent instead of
    /// (never in addition to trying) the ordinary pool. This is what lets
    /// an urgent task dispatch while every ordinary slot is already checked
    /// out, and what stops a second urgent task from opening a third run: it
    /// waits on this same one-slot semaphore rather than falling through to
    /// the ordinary one.
    Urgent,
    /// The ordinary `max_concurrent_runs` pool - unaffected by either of the
    /// above.
    #[default]
    Ordinary,
}

/// [`PermitKind`] for one candidate. `priority` is [`LandResume::Ready`]'s
/// own boolean, already computed by the caller from [`land_resume_state`].
fn permit_kind(priority: bool, urgent: bool) -> PermitKind {
    if priority {
        PermitKind::None
    } else if urgent {
        PermitKind::Urgent
    } else {
        PermitKind::Ordinary
    }
}

fn available_slots(requests: &[TaskWorker], limit: usize) -> (usize, usize) {
    let (ordinary, urgent) = requests.iter().filter(|request| !request.standalone).fold(
        (0usize, 0usize),
        |(ordinary, urgent), request| match request.lane {
            PermitKind::Ordinary => (ordinary + 1, urgent),
            PermitKind::Urgent => (ordinary, urgent + 1),
            PermitKind::None => (ordinary, urgent),
        },
    );
    (
        limit.saturating_sub(ordinary),
        1usize.saturating_sub(urgent),
    )
}

struct DispatchClaim {
    task: Task,
    claim: crate::queue::Claim,
    permit: Option<tokio::sync::OwnedSemaphorePermit>,
}

/// Claim and re-read before choosing a lane: a queue listing may predate an
/// urgent toggle. All unsuccessful paths release the claim without an attempt.
fn claim_dispatch(
    queue: &Queue,
    candidate: &Task,
    cooling_down: bool,
    ordinary: &Arc<tokio::sync::Semaphore>,
    urgent: &Arc<tokio::sync::Semaphore>,
) -> Option<DispatchClaim> {
    let Ok(claim) = queue.claim(&candidate.id) else {
        tracing::info!("task {} is claimed elsewhere; skipping", candidate.short());
        return None;
    };
    let task = match queue.get(&candidate.id) {
        Ok(t) if t.status.runnable() => t,
        Ok(_) => return None,
        Err(e) => {
            tracing::warn!("could not re-read task {}: {e:#}", candidate.short());
            return None;
        }
    };
    let resume = land_resume_state(&task);
    if resume == LandResume::StillWaiting {
        return None;
    }
    let priority = resume == LandResume::Ready;
    if !priority && cooling_down {
        return None;
    }
    // Never borrow an ordinary slot when the single urgent slot is busy.
    // Keep scanning other candidates when either pool has no free slot.
    let permit = match permit_kind(priority, task.urgent) {
        PermitKind::None => None,
        PermitKind::Urgent => Some(Arc::clone(urgent).try_acquire_owned().ok()?),
        PermitKind::Ordinary => Some(Arc::clone(ordinary).try_acquire_owned().ok()?),
    };
    // Persist the dispatch order under the claim, before config discovery or
    // coordination waits can reorder concurrent starts.
    let stamp = Timestamp::now();
    let mut task = task;
    task.dispatched_at = Some(stamp);
    if let Err(e) = queue.modify(&task.id, |t| {
        t.dispatched_at = Some(stamp);
        true
    }) {
        tracing::warn!("could not record dispatch order of {}: {e:#}", task.short());
    }
    Some(DispatchClaim {
        task,
        claim,
        permit,
    })
}

/// Poll the queue until stopped, factored out so [`drive`] owns only setup and
/// teardown and cannot skip the teardown on an early return.
///
/// `limits.max_concurrent` bounds how many *ordinary* candidates run at once,
/// see [`crate::config::Daemon::max_concurrent_runs`]. A run parked on a
/// land approval that has since been answered is dispatched outside that
/// bound the moment [`land_resume_state`] reports it [`LandResume::Ready`]:
/// the whole point of parking there is that it must not queue behind
/// whatever else the loop happens to be running, even at the default of one.
/// A [`Task::urgent`] candidate is exempt from the same bound the same way,
/// through its own one-slot `urgent_sem` (see [`permit_kind`]). Every one of
/// these exemptions is still subject to the interrupt gate below, urgent
/// included: a land-resume or urgent candidate is exactly as much "something
/// else running" as an ordinary one from the interrupt sequence's point of
/// view, and letting either slip through while a run is being parked, or
/// while the interrupt task itself has the floor, is precisely the second
/// run 75dd's own "at most one run, ever, at once" guarantee must never
/// allow - see [`Interrupt`]'s own doc.
#[derive(Serialize, Deserialize)]
struct ServiceWorker {
    opts: Opts,
    queue: PathBuf,
    worktrees_root: PathBuf,
    operation: String,
}

fn load_conductor(home: &Path) -> Result<Conductor> {
    match std::fs::read(home.join("conductor-state.json")) {
        Ok(body) => serde_json::from_slice(&body).context("read conductor state"),
        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(Conductor::new()),
        Err(error) => Err(error.into()),
    }
}

fn conductor_work(queue: &Queue, home: &Path) -> (Vec<Task>, Vec<Task>, Vec<Task>) {
    let live: std::collections::BTreeSet<_> = current_work(home, Timestamp::now())
        .into_iter()
        .map(|c| c.task)
        .collect();
    let stalled = stalled_tasks(queue, home, Timestamp::now());
    let stalled_ids: std::collections::BTreeSet<_> = stalled.iter().map(|t| t.id.clone()).collect();
    let finished = finished_tasks(queue)
        .into_iter()
        .filter(|t| !live.contains(&t.id) && !stalled_ids.contains(&t.id))
        .filter(|t| !awaiting_resume_with(t, |id| RunState::load_under(id, home)))
        .collect();
    let queued = queued_tasks(queue)
        .into_iter()
        .filter(|t| !live.contains(&t.id))
        .collect();
    (queued, stalled, finished)
}

async fn start_service(
    home: &Path,
    opts: &Opts,
    queue: &Queue,
    worktrees_root: &Path,
    operation: &str,
    cfg: Option<&Config>,
    busy: bool,
) -> Result<()> {
    // Fetch policy is live configuration, unlike question recovery capacity.
    // Reload before both cadence and eligibility, including disabled -> enabled.
    let fetch_cfg = if operation == "fetch" {
        match prepare(&opts.repo, opts) {
            Ok(cfg) => Some(cfg),
            Err(error) => {
                tracing::warn!("could not reload periodic fetch configuration: {error:#}");
                return Ok(());
            }
        }
    } else {
        None
    };
    let cfg = fetch_cfg.as_ref().or(cfg);
    let ticks = home.join("service-ticks");
    std::fs::create_dir_all(&ticks)?;
    let receipt = ticks.join(format!("daemon-{operation}"));
    let last = std::fs::read(&receipt)
        .ok()
        .and_then(|body| serde_json::from_slice::<Timestamp>(&body).ok());
    let interval = match operation {
        "disk-pressure" => 30,
        "cache" => CACHE_CHECK_INTERVAL_SECS,
        "fetch" => cfg.map_or(60, |cfg| cfg.repos.fetch_interval.max(1)),
        _ => opts.poll.as_secs().max(1),
    };
    let now = Timestamp::now();
    if !cache_check_due(last, now, interval) {
        return Ok(());
    }
    let key = format!("service:daemon-{operation}");
    if crate::worker::active(home)?
        .iter()
        .any(|job| job.key == key)
    {
        return Ok(());
    }
    let eligible = match operation {
        "conductor" => {
            let (queued, stalled, finished) = conductor_work(queue, home);
            !(queued.is_empty() && stalled.is_empty() && finished.is_empty())
                && load_conductor(home)?.worth_a_look(queue, &stalled, &finished)
        }
        "maintenance" => Questions::at(home.join("questions"))
            .list()
            .iter()
            .any(|q| {
                q.chosen_action().is_some_and(|action| action.maintenance())
                    && !home
                        .join("choice-actions")
                        .join(format!("{}.json", q.id))
                        .exists()
            }),
        "housekeeping" => !busy && runnable(queue).is_empty(),
        "cache" => {
            !busy
                && !runnable(queue).is_empty()
                && cfg.is_some_and(|cfg| cfg.disk.cache_limit_bytes > 0)
        }
        "disk-pressure" => busy,
        "fetch" => {
            cfg.is_some_and(|cfg| cfg.repos.fetch_interval > 0 && !cfg.repos.roots.is_empty())
        }
        _ => false,
    };
    if !eligible {
        return Ok(());
    }
    let request = ServiceWorker {
        opts: opts.absolute()?,
        queue: std::path::absolute(queue.root())?,
        worktrees_root: std::path::absolute(worktrees_root)?,
        operation: operation.to_owned(),
    };
    if let Err(error) =
        crate::worker::spawn(home, "daemon-service", &key, serde_json::to_value(request)?).await
    {
        tracing::warn!(operation, "could not launch daemon service: {error:#}");
    }
    std::fs::write(receipt, serde_json::to_vec(&now)?)?;
    Ok(())
}

/// Finite maintenance jobs survive scheduler replacement without duplicating
/// agent calls or cancelling an operation between its effect and receipt.
pub async fn run_service_worker(home: &Path, payload: serde_json::Value) -> Result<()> {
    let request: ServiceWorker = serde_json::from_value(payload)?;
    let opts = &request.opts;
    let queue = Queue::at(request.queue);
    let questions = Questions::at(home.join("questions"));
    match request.operation.as_str() {
        "maintenance" => apply_maintenance_choices(&queue, &questions, home).await,
        "conductor" => {
            let path = home.join("conductor-state.json");
            let mut conductor = load_conductor(home)?;
            let (queued, stalled, finished) = conductor_work(&queue, home);
            if !(queued.is_empty() && stalled.is_empty() && finished.is_empty())
                && conductor.worth_a_look(&queue, &stalled, &finished)
            {
                let cfg = prepare(&opts.repo, opts)?;
                conductor
                    .maybe_run(
                        &cfg,
                        &opts.repo,
                        &queue,
                        &questions,
                        home,
                        &queued,
                        &stalled,
                        &finished,
                        opts.max_attempts,
                    )
                    .await;
                let temporary = path.with_extension("json.tmp");
                std::fs::write(&temporary, serde_json::to_vec(&conductor)?)?;
                std::fs::rename(temporary, path)?;
            }
        }
        "fetch" => {
            let cfg = prepare(&opts.repo, opts)?;
            if cfg.repos.fetch_interval > 0 && !cfg.repos.roots.is_empty() {
                let outcome = clean::fetch_origins(&cfg.repos.roots, FETCH_TIMEOUT, || false).await;
                tracing::debug!("fetch origins: {outcome:?}");
            }
        }
        "cache" => {
            if task_jobs(home)?.is_empty() {
                let mut checked = None;
                maybe_prune_cache_between_runs(
                    &opts.repo,
                    opts,
                    home,
                    &Stop::new(),
                    &mut checked,
                    Timestamp::now(),
                )
                .await;
            }
        }
        "disk-pressure" => {
            if let Ok(cfg) = prepare(&opts.repo, opts) {
                crate::retention::sweep(home, &cfg.disk, Timestamp::now()).await;
                if let Err(e) = clean::prune_cache_if_over_limit(&cfg, home) {
                    tracing::warn!("disk pressure cache cleanup failed: {e:#}");
                }
                for current in current_work(home, Timestamp::now()) {
                    if let Ok(state) = RunState::load_under(&current.run, home)
                        && let Some(reason) = disk_gate(&state.repo, &state.config)
                    {
                        for job in owned_task_jobs(home)?.into_iter().filter(|job| {
                            job.key.strip_prefix("task:") == Some(current.task.as_str())
                        }) {
                            request_task_park(
                                home,
                                &job,
                                crate::run::ParkCause::Interrupt {
                                    reason: reason.clone(),
                                },
                            )?;
                        }
                        notices::raise_in(
                            home,
                            Notice::warn(
                                "disk:pressure",
                                "Disk pressure persists after cleanup; active workers were asked to checkpoint and park. New starts and resumes wait for free space.",
                            ),
                        );
                    }
                }
            }
        }
        "housekeeping" => {
            if task_jobs(home)?.is_empty() {
                if let Ok(cfg) = prepare(&opts.repo, opts) {
                    crate::retention::sweep(home, &cfg.disk, Timestamp::now()).await;
                }
                janitor(&opts.repo, opts, home, &request.worktrees_root).await;
                resweep_superseded_attempts(&queue, home);
                triage_held(&queue, home, opts).await;
            }
        }
        operation => bail!("unknown daemon service {operation}"),
    }
    Ok(())
}

/// Only a different request under the same key is a dispatch handoff race.
/// Our own unacknowledged reservation is a startup failure, not competing work:
/// stop dispatch without fencing it, so an already detached child may still run.
fn task_worker_spawn_error(home: &Path, request: &TaskWorker, error: anyhow::Error) -> Result<()> {
    let key = format!("task:{}", request.task);
    let payload = serde_json::to_value(request)?;
    if crate::worker::active(home)?
        .iter()
        .any(|job| job.key == key && job.kind == "task" && job.payload != payload)
    {
        tracing::warn!(
            "task {} acquired a competing worker reservation: {error:#}",
            crate::run::short_of(&request.task)
        );
        return Ok(());
    }
    tracing::error!("task worker startup stopped dispatch: {error:#}");
    notices::raise_in(
        home,
        Notice::error(
            "loop:worker-startup",
            // Startup diagnostics may contain private child-process details;
            // keep them in the local error/log rather than the chat or notifier.
            format!("Task {} worker could not be started or acknowledged. Scheduler dispatch stopped; already reserved workers may still complete. Inspect the local execution log and reservation worker.log for startup details.", request.task),
        ).link(Link::Task { id: request.task.clone() }),
    );
    Err(error).with_context(|| {
        format!(
            "cannot start task {} worker; dispatcher stopped; any unacknowledged reservation remains occupied",
            crate::run::short_of(&request.task)
        )
    })
}

async fn poll(
    opts: &Opts,
    queue: &Queue,
    status: &Arc<Mutex<Status>>,
    home: &Path,
    worktrees_root: &Path,
    stop: &Stop,
    limits: DispatchLimits,
) -> Result<()> {
    let mut attempted = Vec::new();
    let interrupt_path = home.join("scheduler-interrupt.json");
    let mut interrupt = match std::fs::read(&interrupt_path) {
        Ok(body) => serde_json::from_slice(&body).context("read scheduler interrupt state")?,
        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Interrupt::Idle,
        Err(error) => return Err(error.into()),
    };
    let mut previous = std::collections::BTreeSet::<String>::new();
    while !stop.stopped() {
        let jobs: Vec<_> = crate::worker::active(home)?
            .into_iter()
            .filter(|job| job.kind == "task")
            .collect();
        let requests: Vec<_> = jobs
            .iter()
            .map(|job| {
                serde_json::from_value::<TaskWorker>(job.payload.clone())
                    .with_context(|| format!("read live task worker {}", job.id))
            })
            .collect::<Result<_>>()?;
        let live: std::collections::BTreeSet<_> = requests.iter().map(|r| r.task.clone()).collect();
        let owned: std::collections::BTreeSet<_> = requests
            .iter()
            .filter(|r| !r.standalone)
            .map(|r| r.task.clone())
            .collect();
        let current: Vec<_> = requests
            .iter()
            .zip(&jobs)
            .filter(|(request, _)| !request.standalone)
            .map(|(request, job)| Current {
                worker: Some(job.id.clone()),
                task: request.task.clone(),
                run: queue
                    .get(&request.task)
                    .ok()
                    .and_then(|task| task.runs.last().cloned())
                    .unwrap_or_default(),
            })
            .collect();
        {
            let mut snapshot = lock(status);
            snapshot.polls += 1;
            snapshot.completed += previous.difference(&owned).count();
            snapshot.current = current;
            snapshot.idle = owned.is_empty();
        }
        previous = owned.clone();
        stop.busy.store(owned.len(), Ordering::SeqCst);

        // Slots are reconstructed from durable reservations and OS-held worker
        // leases, not this scheduler's lifetime or mutable task urgency.
        let (ordinary, urgent) = available_slots(&requests, limits.max_concurrent);
        let sem = Arc::new(tokio::sync::Semaphore::new(ordinary));
        let urgent_sem = Arc::new(tokio::sync::Semaphore::new(urgent));
        let mut permits = Vec::new();
        sweep_stale_claims(queue, STALE_CLAIM);
        reclaim_orphaned_running(queue, opts.max_attempts, &live);
        reclaim_abandoned_runs(home, Timestamp::now());
        let questions = Questions::at(home.join("questions"));

        // Deterministic: no model, run before the conductor sees anything so
        // its input reflects the queue's current, already-resolved state.
        crate::task_chat::sweep(
            queue,
            &crate::talk::Talks::at(home.join("talks")),
            &questions,
            home,
        );
        repair_choice_offers(&questions);
        resolve_blockers(queue, &questions);
        apply_task_choice_actions(queue, &questions, home);
        triage::apply_answers(queue, &questions);
        reconcile_task_questions(queue, &questions);
        let talks = crate::talk::Talks::at(home.join("talks"));
        crate::chat_notify::sweep(queue, &talks, home);
        crate::notice_delivery::sweep(queue, &talks, home, &opts.repo);
        crate::chat_watch::sweep(home, &talks);
        let mut turns = tokio::task::JoinSet::new();
        crate::chat_notify::start_turns(&talks, stop.parking(), &mut turns);
        // start_turns dispatches detached turns; no paid work lives in this set.
        while turns.join_next().await.is_some() {}

        crate::consult::start_services(
            home,
            &opts.repo,
            limits.recovery_cfg.as_ref(),
            opts.config.as_deref(),
        )
        .await?;
        for operation in [
            "conductor",
            "maintenance",
            "housekeeping",
            "disk-pressure",
            "cache",
            "fetch",
        ] {
            start_service(
                home,
                opts,
                queue,
                worktrees_root,
                operation,
                limits.recovery_cfg.as_ref(),
                !live.is_empty(),
            )
            .await?;
        }
        let latest = crate::worker::active(home)?;
        if latest.iter().any(|job| job.key == "service:daemon-cache")
            || latest
                .iter()
                .any(|job| job.kind == "task" && !jobs.iter().any(|known| known.id == job.id))
        {
            stop.idle(RECHECK_WHILE_BUSY.min(opts.poll)).await;
            continue;
        }
        let candidates: Vec<Task> = runnable(queue)
            .into_iter()
            .filter(|task| !live.contains(&task.id))
            .filter(|task| !opts.once || !attempted.contains(&task.id))
            .collect();
        let in_flight: Vec<_> = owned.iter().cloned().collect();
        let prior_interrupt = std::mem::discriminant(&interrupt);
        interrupt = advance_interrupt_tick(
            limits.pause_for_interrupts,
            interrupt,
            &in_flight,
            &candidates,
        );
        // Same-variant transitions preserve their identities. Only an actual
        // transition needs a durable write, atomically before sending controls.
        if prior_interrupt != std::mem::discriminant(&interrupt) {
            let temporary = interrupt_path.with_extension("json.tmp");
            std::fs::write(&temporary, serde_json::to_vec(&interrupt)?)?;
            std::fs::rename(temporary, &interrupt_path)?;
        }
        if let Interrupt::Parking {
            parked,
            interrupt_task,
        } = &interrupt
        {
            for job in jobs.iter().filter(|job| {
                parked
                    .iter()
                    .any(|id| job.key.strip_prefix("task:") == Some(id.as_str()))
            }) {
                if crate::worker::control(home, &job.key)?.is_none() {
                    request_task_park(
                        home,
                        job,
                        crate::run::ParkCause::Interrupt {
                            reason: format!(
                                "task {} asked to run first",
                                crate::run::short_of(interrupt_task)
                            ),
                        },
                    )?;
                }
            }
        }
        let candidates = interrupt_gate(&interrupt, &in_flight, candidates);
        let cooling = read_cooldown(home)?.is_some_and(|until| Timestamp::now() < until);
        let mut started = false;
        let mut resync = false;
        for candidate in candidates {
            if stop.stopped() {
                break;
            }
            let Some(DispatchClaim {
                task,
                claim,
                permit,
            }) = claim_dispatch(queue, &candidate, cooling, &sem, &urgent_sem)
            else {
                continue;
            };
            if crate::worker::active(home)?
                .iter()
                .any(|job| job.kind == "task" && !jobs.iter().any(|known| known.id == job.id))
            {
                drop(claim);
                resync = true;
                break;
            }
            let lane = permit_kind(land_resume_state(&task) == LandResume::Ready, task.urgent);
            let request = TaskWorker {
                opts: opts.absolute()?,
                queue: std::path::absolute(queue.root())?,
                task: task.id.clone(),
                lane,
                standalone: false,
            };
            // Keep the claim until spawn acknowledges the worker's durable
            // reservation. The worker then claims and re-reads before attempt.
            if let Err(error) = crate::worker::spawn(
                home,
                "task",
                &format!("task:{}", task.id),
                serde_json::to_value(&request)?,
            )
            .await
            {
                task_worker_spawn_error(home, &request, error)?;
                drop(claim);
                resync = true;
                break;
            }
            drop(claim);
            permits.extend(permit);
            attempted.push(task.id);
            started = true;
        }
        if started || resync {
            continue;
        }
        if owned.is_empty() && opts.once {
            while crate::worker::active(home)?
                .iter()
                .any(|job| job.key == "service:daemon-housekeeping")
            {
                stop.idle(RECHECK_WHILE_BUSY).await;
                if stop.stopped() {
                    return Ok(());
                }
            }
            break;
        }
        stop.idle(if live.is_empty() {
            opts.poll
        } else {
            RECHECK_WHILE_BUSY.min(opts.poll)
        })
        .await;
    }
    // Dropping a scheduler only drops dispatch bookkeeping. The workers own
    // every queue claim and Runner driver lease through outcome settlement.
    stop.busy.store(0, Ordering::SeqCst);
    Ok(())
}

/// A maintenance pass may briefly own the same record while a worker starts.
/// Wait without blocking the executor or charging an agent attempt, then read
/// ownership again under the acquired lock. Other I/O failures still fail closed.
async fn resume_owner_lock(home: &Path, id: &str) -> Result<crate::pr_head::OwnerLock> {
    let busy = |error: &anyhow::Error| {
        error.downcast_ref::<std::io::Error>().is_some_and(|error| {
            error.kind() == std::io::ErrorKind::WouldBlock
                || cfg!(windows) && error.raw_os_error() == Some(33)
        })
    };
    match crate::pr_head::owner_lock(home, id) {
        Ok(lock) => return Ok(lock),
        Err(error) if busy(&error) => {}
        Err(error) => return Err(error),
    }
    let wait = RunState::load_under(id, home)?
        .config
        .graph
        .timeout_resource_wait;
    crate::pr_head::owner_lock_wait(home, id, Duration::from_secs(wait)).await
}

/// Historical successors do not revoke a still-resumable public owner. Scan
/// under the same lock as publication/driver claims, and fail closed on unknown
/// history before spending another attempt.
async fn public_resume_owner(
    home: &Path,
    runs: &[String],
    repo: &Path,
) -> Result<Option<RunState>> {
    let mut owner = None;
    for id in runs.iter().collect::<std::collections::BTreeSet<_>>() {
        let _lock = resume_owner_lock(home, id).await?;
        let state = RunState::load_under(id, home)?;
        if state.released()
            || state.retired_to.is_some()
            || state.pr_taken_over_by.is_some()
            || !crate::handover::landing_checkpoint(&state)
        {
            continue;
        }
        anyhow::ensure!(
            crate::git::toplevel(&state.repo).await?.canonicalize()?
                == crate::git::toplevel(repo).await?.canonicalize()?,
            "public owner repository differs; inspect run lineage"
        );
        anyhow::ensure!(
            owner.is_none(),
            "multiple retained public owners; inspect run lineage"
        );
        anyhow::ensure!(
            crate::handover::can_resume(&state),
            "public owner cannot resume"
        );
        let claimed = is_working_on_other(home, id, Timestamp::now())?;
        anyhow::ensure!(
            state.liveness_under(home, claimed) == crate::run::Liveness::Dead,
            "public owner's driver is live or unknown; wait before retrying"
        );
        owner = Some(state);
    }
    Ok(owner)
}

/// Run one claimed task to a terminal status and record the outcome.
///
/// Every transition is flushed to the queue as it happens, so the state on disk
/// is what actually occurred rather than what this process still intends to
/// write.
async fn attempt(
    opts: &Opts,
    queue: &Queue,
    status: &Arc<Mutex<Status>>,
    stop: &Stop,
    interrupt_pause: crate::graph::Pause,
    task: &mut Task,
) -> Vec<QuotaLoss> {
    let repo = repo_for(task, &opts.repo);
    tracing::info!(
        "task {} — {} (repo {})",
        task.short(),
        task.title,
        repo.display()
    );

    let public_owner = match public_resume_owner(&crate::run::home(), &task.runs, &repo).await {
        Ok(owner) => owner,
        Err(e) => {
            task.hold_machine(Some(format!(
                "Cannot verify existing public owner: {e:#}; no attempt started."
            )));
            record(queue, task);
            return Vec::new();
        }
    };
    let resume_runs = public_owner
        .as_ref()
        .map(|s| vec![s.id.clone()])
        .unwrap_or_else(|| task.runs.clone());

    // A stop spends no agent resources and uses the saved landing owner.
    // Current roster edits, missing attachments or a failed config fetch must
    // never turn it into a new implementation, or prevent a PR from closing.
    if let Some(previous) = resume_runs.last().and_then(|id| RunState::load(id).ok())
        && previous
            .merge_decision
            .as_ref()
            .is_some_and(|decision| !decision.closed)
        && previous.status != RunStatus::Landing
        && !crate::merge_decision::resumable_hold(&previous)
    {
        task.hold_unrequested_retry(Some(format!("The existing owner stop decision remains held. Inspect run {} and its PR; request an explicit fresh review/decision before further work. No replacement or merge was started.", previous.id)));
        record(queue, task);
        return Vec::new();
    }
    let stop_owner = resume_runs
        .last()
        .and_then(|id| RunState::load(id).ok())
        .filter(|state| {
            crate::merge_decision::resumable_hold(state)
                || state.status == RunStatus::Landing
                    && state.land_approval.as_ref().is_some_and(|binding| {
                        Questions::open().get(&binding.question).is_ok_and(|q| {
                            q.run == state.id
                                && q.resolution()
                                    .as_deref()
                                    .is_some_and(crate::merge_decision::stops)
                        })
                    })
        });
    if let Some(owner) = stop_owner {
        let mut runner = match Runner::resume(&owner.id) {
            Ok(runner) => runner,
            Err(e) => {
                task.hold_manual(Some(format!("Cannot stop the existing landing owner: {e:#}. No replacement or merge was started.")));
                record(queue, task);
                return Vec::new();
            }
        };
        runner.on_pause(stop.pause());
        runner.watch_interrupt(interrupt_pause);
        let quota_before = runner.state.quota.clone();
        task.start(owner.id.clone());
        record(queue, task);
        lock(status).current.push(Current {
            worker: None,
            task: task.id.clone(),
            run: owner.id,
        });
        runner.state.next_pass_task_entry = true;
        let result = runner.execute().await;
        return finish_attempt(
            opts.max_attempts,
            queue,
            task,
            &runner.state,
            &quota_before,
            result,
        );
    }

    if let Some(owner) = &public_owner
        && (task.fresh_start || !may_resume_run(owner, task))
    {
        task.hold_machine(Some(format!("Existing PR belongs to run {}; resume its authorized instructions or explicitly resolve its owner decision before starting a successor. No attempt started.", owner.id)));
        record(queue, task);
        return Vec::new();
    }

    let unfinished = (!task.fresh_start)
        .then(|| unfinished_run(&resume_runs, task.short()))
        .flatten()
        .filter(|id| RunState::load(id).is_ok_and(|run| may_resume_run(&run, task)));
    let previous = resume_runs.last().and_then(|id| RunState::load(id).ok());
    if !task.fresh_start
        && task.pr_recovery.is_none()
        && task.review_branch.is_none()
        && task.resume_override.is_none()
        && previous
            .as_ref()
            .is_some_and(|run| run.retired_to.is_some())
        && unfinished.is_none()
    {
        task.hold_unrequested_retry(Some("Recorded recovery authority is unavailable, no longer resumable or no longer authorized for these instructions. Inspect the retained lineage and select a recovery source explicitly; no replacement competition was started.".into()));
        record(queue, task);
        return Vec::new();
    }

    let saved_recovery = previous.as_ref().filter(|run| {
        task.replacement.is_none()
            && task.pr_recovery.as_ref().is_some_and(|selected| {
                selected.check_task(&task.id, &task.instruction).is_ok()
                    && selected_starter(selected, Some(run), unfinished.as_deref())
                        == Starter::Resume(run.id.clone())
            })
    });

    // The repository's magi.toml comes from `<remote>/<base>`, fetched now. A
    // failure here is the network's or the operator's, not the task's: hold
    // without spending an attempt, never fall back to a possibly stale copy.
    let explicit = match &task.overrides {
        Some(o) if !o.inherit_daemon_options => o.config.as_deref(),
        Some(_) => opts.config.as_deref(),
        None => opts.config.as_deref(),
    };
    let (mut config, layers) = if let Some(run) = saved_recovery {
        // A matching resume owns its resolved configuration and evidence;
        // current layers and inherited overrides only configure new work.
        let mut saved = run.clone();
        if let Err(e) = saved.configure_recovery_resume() {
            task.hold_manual(Some(format!("[recovery] saved run {} cannot resume: {e:#}. Inspect its saved configuration and evidence before requesting a new selection.", run.id)));
            record(queue, task);
            return Vec::new();
        }
        (saved.config, Vec::new())
    } else {
        let (mut config, layers) = match Config::discover_fetched(&repo, explicit).await {
            Ok(loaded) => loaded,
            Err(e) => {
                let reason = format!("[config] {e:#}");
                record_config_failure(task, &e);
                task.last_error = Some(reason.clone());
                task.hold_machine(Some(reason));
                record(queue, task);
                return Vec::new();
            }
        };
        if let Err(e) = apply_options(&mut config, opts, task) {
            task.hold_manual(Some(format!(
                "[config] {e:#}; correct the merge override before releasing the task"
            )));
            record(queue, task);
            return Vec::new();
        }
        if let Some(selected) = &task.pr_recovery
            && let Err(e) = selected.configure(&mut config)
        {
            task.hold_manual(Some(format!("[recovery] {e:#}. No run started; select the PR again with an explicit disposition and corrected configuration.")));
            record(queue, task);
            return Vec::new();
        }
        (config, layers)
    };
    let config_evidence = crate::pr_recovery::ConfigEvidence {
        layers,
        overrides: task.overrides.clone(),
        daemon_merge: task
            .overrides
            .as_ref()
            .is_none_or(|o| o.inherit_daemon_options)
            .then(|| opts.merge.clone())
            .flatten(),
    };
    apply_task_implementers(&mut config, task);
    if let Some(replacement) = &task.replacement {
        let safe = RunState::load(&replacement.run).is_ok_and(|old| {
            old.liveness(false) == Liveness::Dead
                && old.merge_decision.as_ref().is_some_and(|d| {
                    d.closed
                        && d.question == replacement.question
                        && d.replacement_run.as_ref().is_none_or(|run| {
                            task.runs.last() == Some(run)
                                && RunState::load(run).is_ok_and(|current| {
                                    current.replaces.as_ref().is_some_and(|pin| {
                                        pin.question == replacement.question
                                            && pin.agent == replacement.agent
                                    })
                                })
                        })
                })
        });
        if !safe {
            task.hold_manual(Some("Replacement ownership cannot be confirmed, or a replacement run was already minted before a crash. Inspect the task and its linked runs; no second replacement was started.".into()));
            record(queue, task);
            return Vec::new();
        }
        match config.agent(&replacement.agent) {
            Ok(agent) if crate::agent::installed(agent) => {}
            _ => {
                task.hold_manual(Some(format!("Selected implementer `{}` is unavailable or no longer configured. No substitute was dispatched. Restore it and explicitly release the task.", replacement.agent)));
                record(queue, task);
                return Vec::new();
            }
        }
        config.graph.implementers = 1;
        config.graph.land_approval = true;
        config.merge.mode = MergeMode::Pr;
        config.graph.selected_implementer = Some(replacement.agent.clone());
    }
    let p = phrases(&config.graph.language);
    let start_failed = p.could_not_start;
    // Resolve once for both admission and settlement. The inputs are the
    // task's explicit sources (never prose), plus an explicit review source's
    // current head; review-only runs may rebase later, and neither fact can
    // refund a failed automatic generation.
    if let Ok(base) =
        crate::git::merge_base_branch(&repo, &config.merge.remote, config.merge.base.as_deref())
            .await
        && let Ok(head) =
            crate::git::rev_parse(&repo, &format!("{}/{}", config.merge.remote, base)).await
    {
        let mut inputs = crate::queue::recovery_inputs(&task.sources);
        if let Some(branch) = task.review_of.as_ref().or(task.review_branch.as_ref()) {
            let source = crate::git::rev_parse(&repo, branch)
                .await
                .unwrap_or_default();
            inputs.push_str(&format!(";review:{branch}:{source}"));
        }
        if let Some(reason) = task.recovery_exhausted(
            &head,
            &inputs,
            task.attempt_limit
                .map_or(opts.max_attempts, std::num::NonZeroUsize::get),
        ) {
            task.hold_unrequested_retry(Some(reason));
            record(queue, task);
            return Vec::new();
        }
        task.recovery_admission = Some(crate::queue::RecoveryAdmission { base: head, inputs });
    }

    // The free-space gate, checked *before* anything is minted: a task that
    // waits out a full disk costs nothing yet, and must not spend an attempt
    // or start a run the machine cannot finish. Held tasks stay in the list
    // for the human to see, and `magi task release` re-queues them when space
    // comes back - the same recovery as any other hold. A volume whose free
    // space cannot be measured closes the gate too: starting a run blind on a
    // disk that may be full is how the machine ends up with 6.7 GB free.
    if let Some(reason) = disk_gate(&repo, &config) {
        task.notice_cause("disk-space", None, None);
        task.last_error = Some(reason.clone());
        task.hold_machine(Some(reason.clone()));
        record(queue, task);
        tracing::warn!("holding {} for want of disk space: {reason}", task.short());
        // Stable wording - the free-space figures live in the task's hold
        // reason, and changing numbers would relight the bell every poll.
        notices::raise(
            Notice::warn(
                &format!("disk:{}", repo.display()),
                format!("Task {} held for want of free disk space: {reason}. Free some, then release it from the queue.", task.id),
            )
            .link(Link::Task {
                id: task.id.clone(),
            }),
        );
        return Vec::new();
    }

    // A resumable run of this task is carried on, never re-competed. The
    // candidates are built and paid for, and a fresh competition races a
    // second implementation against them.
    //
    // Two runs paid for that lesson. Run 01c2 was blocked and the loop
    // started 3cbf on the same task a moment later, duplicating two and a
    // half hours of agent work. Then b25f stalled on a judge that timed out
    // and one that answered with no JSON - `quota: 0`, so nothing the machine
    // was to blame for - and 4043 started **one second** later, buying three
    // fresh implementations to reach the same panel. `RunStatus::resumable`
    // rather than `!done()` is what catches the second case: a stall is
    // terminal, and its cheap recovery re-asks only the absent seats.
    //
    // A load failure is warned about rather than silently read as "not
    // resumable": the alternative is exactly what let a schema mismatch on
    // run `eba2` fall through to a full re-competition with nobody told why.
    // `crate::conduct` is what actually offers a better answer than
    // `Runner::start` here (see `Recovery::Review`), once this task's next
    // failure shows it up as `held`/`failed` with the run state unreadable.
    // `crate::conduct` chose `Review` for this task on an earlier cycle: its
    // branch survived, and this reopens exactly that branch as a
    // review-only pass rather than resuming or competing again. Consumed
    // (cleared) here whichever way this goes, so it never outlives this one
    // attempt - see `queue::Task::review_branch`.
    let review_branch = take_review_branch(task, previous.as_ref());
    let branch_exists = match &review_branch {
        Some(branch) => crate::git::branch_exists(&repo, branch)
            .await
            .unwrap_or(false),
        None => false,
    };
    // An explicit `magi review <branch>` is reviewed whatever happens to the
    // branch unless an explicit implementer change requires fresh work. An
    // unfinished run of the same task still wins, so a retry resumes.
    let proposed = review_retry_starter(
        task,
        previous.as_ref(),
        review_branch.as_deref(),
        branch_exists,
        unfinished.as_deref(),
    );
    let retry_selected = task.replacement.is_some()
        && task.resumption.is_some()
        && !task.fresh_start
        && previous.as_ref().is_some_and(|run| {
            run.replaces.is_some()
                && ((run.status == RunStatus::Failed && run.viable().is_empty())
                    || (run.status == RunStatus::Blocked && run.tally.is_none()))
        });
    let stop_pin = task
        .resume_override
        .as_ref()
        .filter(|pin| {
            Questions::open().get(&pin.question_id).is_ok_and(|q| {
                q.node == land::APPROVAL_NODE
                    && q.resolution()
                        .as_deref()
                        .is_some_and(crate::merge_decision::stops)
            })
        })
        .and_then(|pin| pin.pinned_run.clone());
    let starter = if let Some(owner) = &public_owner {
        Starter::Resume(owner.id.clone())
    } else if let Some(run) = stop_pin {
        // Stop actions resume their exact owner even after seat-count edits;
        // they must never fall through to implementation or a takeover.
        Starter::Resume(run)
    } else if retry_selected {
        Starter::Resume(previous.as_ref().unwrap().id.clone())
    } else if let Some(selected) = &task.pr_recovery {
        if selected.check_task(&task.id, &task.instruction).is_ok() {
            selected_starter(selected, previous.as_ref(), unfinished.as_deref())
        } else {
            Starter::Review(selected.branch.clone())
        }
    } else {
        starter_with_implementers(task, previous.as_ref(), proposed)
    };
    // An explicit resume pin must never degrade into a new competition or
    // takeover, including when its run stops being eligible after the answer.
    if let Some(pin) = &task.resume_override
        && let Some(run) = &pin.pinned_run
        && starter != Starter::Resume(run.clone())
    {
        let run = run.clone();
        task.notice_cause("resume-owner", Some(&run), None);
        task.hold_machine(Some(format!(
            "pinned run cannot resume; inspect `magi show {run}` and restore the existing run before `magi task release {}`; no replacement task was started",
            task.id
        )));
        record(queue, task);
        return Vec::new();
    }
    if task.replacement.is_some()
        && previous.as_ref().is_some_and(|run| run.replaces.is_some())
        && starter != Starter::Resume(previous.as_ref().unwrap().id.clone())
    {
        task.hold_manual(Some("The selected replacement already has an attempt. It cannot be resumed safely; inspect its saved pin and restore the existing run. No additional replacement was started.".into()));
        record(queue, task);
        return Vec::new();
    }
    if let Some(reason) = retained_attempt_hold(
        task,
        &starter,
        config.disk.retained_attempt_limit,
        RunState::load,
    ) {
        // The review choice was consumed above. Preserve it across this hold
        // so a later release cannot silently become a fresh implementation.
        if let Starter::Review(branch) = &starter {
            task.review_branch = Some(branch.clone());
        }
        task.hold_unrequested_retry(Some(reason));
        record(queue, task);
        return Vec::new();
    }
    // Absolute paths of the files the task was filed with, re-read from the
    // task now so a file attached while it was held reaches a resumed run
    // too. A stored name whose file has gone is an error before any agent is
    // paid for, never a silent omission the implementer cannot notice.
    let attachments = match task_attachments(queue, task) {
        Ok(a) => a,
        Err(e) => {
            task.attempts += 1;
            task.fail_startup_target(
                "startup-attachments",
                e.name.clone(),
                format!("{start_failed}{e:#}"),
                opts.max_attempts,
            );
            record(queue, task);
            return Vec::new();
        }
    };
    let startup_pause = stop.pause();
    let startup_interrupt = interrupt_pause.clone();
    let wait = crate::repo_lock::WaitPolicy::new(
        Duration::from_secs(config.graph.timeout_resource_wait),
        move || startup_pause.parked() || startup_interrupt.parked(),
    );
    // Startup includes review takeover and recovery. Do not embed its large
    // future in both the wait scope and the surrounding attempt stack frame.
    let started = wait.scope(Box::pin(async { match &starter {
        Starter::Review(_) if task.pr_recovery.is_some() => {
            let selected = task.pr_recovery.clone().expect("selected recovery");
            match selected.check_task(&task.id, &task.instruction) {
                Ok(()) => Runner::recover_pr(&repo, &task.id, selected, config)
                    .await
                    .map(|mut r| {
                        r.state.attachments = attachments.clone();
                        r
                    }),
                Err(e) => Err(e),
            }
        }
        Starter::Review(branch) => {
            tracing::info!(
                "task {} reopens `{branch}` as a review-only pass",
                task.short()
            );
            // Every earlier attempt is superseded by the one being minted
            // now, so a branch one of them still holds may be taken over.
            let takeover = crate::handover::Takeover {
                earlier: task.earlier_attempts().to_vec(),
                home: crate::run::home(),
                choice: take_divergence_answer(branch, &config.merge.remote, task),
                task_instruction: Some(instruction_for(task)),
            };
            Runner::review_taking_over(
                &repo,
                branch,
                config,
                Some(takeover),
                crate::run::Origin::queue(&task.id),
            )
            .await
        }
        Starter::Resume(id) => {
            tracing::info!("resuming run {id} rather than competing again");
            Runner::resume(id).and_then(|mut r| {
                if retry_selected {
                    // The explicit queue release retries this same pinned
                    // implementation, preserving the attempt and worktrees.
                    for candidate in &mut r.state.candidates {
                        candidate.failed = None;
                        candidate.empty = false;
                        candidate.commits = 0;
                    }
                    r.state.status = RunStatus::Implementing;
                    r.state.event("implement", "owner released the held selected implementer; retrying the same attempt without fallback");
                }
                if r.state.prep_complete == Some(false) && r.state.candidates.is_empty() {
                    r.state.sources = task.sources.clone();
                }
                if r.state.prep_failure.is_some() {
                    let approval = task
                        .resumption
                        .as_ref()
                        .context("preparation retry requires an explicit task release")?;
                    r.retry_preparation(approval.at)?;
                }
                if let Some(instruction) =
                    prepare_instruction(&starter, Some(&r.state.instruction), task)
                {
                    r.state.instruction = instruction;
                }
                r.state.attachments = attachments.clone();
                if task.replacement.is_some() {
                    r.state.config.merge.mode = MergeMode::Pr;
                    r.state.config.graph.land_approval = true;
                }
                // Replacements publish a new PR and ask again. Selected PR
                // recoveries keep their saved disposition; ordinary runs can
                // retain the task's merge override.
                if task.replacement.is_none() && task.pr_recovery.is_none() && let Some(mode) = task
                    .overrides
                    .as_ref()
                    .and_then(|o| o.merge.as_deref())
                    .and_then(|m| merge_mode(m).ok())
                {
                    r.state.config.merge.mode = mode;
                }
                Ok(r)
            })
        }
        Starter::Start => {
            if let Some(branch) = &review_branch {
                tracing::warn!(
                    "conductor chose review for task {} but branch `{branch}` no longer \
                     exists; requeuing as a fresh competition instead",
                    task.short()
                );
            }
            let instruction = prepare_instruction(&starter, None, task)
                .unwrap_or_else(|| task.instruction.clone());
            Runner::start_naming(
                &repo,
                instruction,
                &task.title,
                config,
                crate::run::Origin::queue(&task.id),
            )
            .await
            .map(|mut r| {
                r.state.attachments = attachments.clone();
                r.state.sources = task.sources.clone();
                r
            })
        }
    }})).await;
    let mut runner = match started {
        Ok(r) => r,
        Err(e) if e.is::<crate::repo_lock::ResourceBlocked>() => {
            task.last_error = Some(e.to_string());
            if stop.parking() || interrupt_pause.parked() {
                let attempts = task.attempts;
                task.park(e.to_string());
                // Startup has not spent an attempt to refund.
                task.attempts = attempts;
            } else {
                task.hold_machine(Some(format!("{}{e}", crate::cache::RESOURCE_HOLD)));
            }
            record(queue, task);
            return Vec::new();
        }
        // A branch an earlier attempt still holds and magi will not release
        // by itself is the operator's call, not a failed attempt: hold the
        // task with the reason, spend nothing, and say so on the bell.
        Err(e) if task.pr_recovery.is_some() => {
            task.startup_notice_cause("startup-public-head");
            task.attempts += 1;
            if let Some(partial) = e.downcast_ref::<crate::pr_recovery::StartupFailed>() {
                task.link_run(&partial.run);
                task.record_pass(&partial.run, 0, task.attempts, None);
            }
            task.last_error = Some(format!("{start_failed}{e:#}"));
            task.hold_unrequested_retry(Some(format!(
                "Selected public-head recovery could not start: {e:#}. Correct the cause and use `magi task recover-pr` with the approved public head; automatic recovery is stopped."
            )));
            record(queue, task);
            return Vec::new();
        }
        Err(e) if e.downcast_ref::<crate::handover::Refused>().is_some() => {
            let detail = match e.downcast_ref::<crate::handover::Refused>() {
                Some(r) => (p.handover_refused)(r),
                None => format!("{e:#}"),
            };
            task.startup_notice_cause("startup-handover");
            let reason = format!("{start_failed}{detail}");
            task.last_error = Some(reason.clone());
            // Consumed above by `take`; keep it so the released task retries
            // as a review of this same branch.
            let branch = match &starter {
                Starter::Review(branch) => Some(branch.clone()),
                _ => None,
            };
            // The hold's own `task:<id>` notice (raised by `Queue::put`) is the
            // one page; the guidance rides in the reason, fixed per state so a
            // re-put never changes the wording and relights it.
            task.hold_for_handover(branch, format!("{reason}{}", p.handover_hint));
            record(queue, task);
            tracing::warn!(
                "holding {} for a branch it cannot take over: {e:#}",
                task.short()
            );
            return Vec::new();
        }
        // A branch that differs between here and the remote in ways magi
        // cannot prove are the same change is a decision for the owner, not a
        // failed attempt: ask with both sides laid out, spend no attempt, and
        // let the answer requeue the task.
        Err(e) if e.downcast_ref::<crate::reconcile::Diverged>().is_some() => {
            let d = e
                .downcast_ref::<crate::reconcile::Diverged>()
                .expect("checked by the guard");
            let mut q = ask::Question::new(
                task.id.clone(),
                crate::reconcile::NODE.to_owned(),
                crate::reconcile::SEAT.to_owned(),
                d.summary(),
                d.detail(),
                d.choices(),
            );
            match Questions::open().put(&mut q) {
                Ok(()) => {
                    task.last_error = Some(format!("{e:#}"));
                    // Consumed above by `take`; the answer has to reach a review
                    // of this same branch, so keep pointing the task at it.
                    task.review_branch = Some(d.branch.clone());
                    task.review_instruction = Some(task.instruction.clone());
                    task.block(vec![q.id.clone()], Some(d.summary()));
                }
                Err(put) => {
                    tracing::warn!("could not file the divergence question: {put:#}");
                    task.attempts += 1;
                    task.fail_startup(
                        "startup-question-store",
                        format!("{start_failed}{e:#}"),
                        opts.max_attempts,
                    );
                }
            }
            record(queue, task);
            return Vec::new();
        }
        Err(e) => {
            // The answer was stale and nothing was applied: keep pointing at
            // the branch so the next attempt asks again against its new tips.
            // Nothing went wrong with the task, so no attempt is spent: a
            // budget one short of its limit must not hold it instead of
            // letting the question be asked again.
            if e.downcast_ref::<crate::reconcile::Stale>().is_some()
                && let Starter::Review(branch) = &starter
            {
                task.review_branch = Some(branch.clone());
                task.review_instruction = Some(task.instruction.clone());
                task.last_error = Some(format!("{start_failed}{e:#}"));
                task.status = crate::queue::TaskStatus::Failed;
                record(queue, task);
                return Vec::new();
            }
            task.attempts += 1;
            task.last_error = Some(format!("{start_failed}{e:#}"));
            task.startup_notice_cause("startup-source");
            task.hold_unrequested_retry(Some(format!(
                "Startup failed: {e:#}. Correct the startup source or configuration, then explicitly release the task; automatic recovery is stopped."
            )));
            record(queue, task);
            return Vec::new();
        }
    };
    if task.pr_recovery.is_some() && !matches!(starter, Starter::Resume(_)) {
        runner.state.recovery_config = Some(config_evidence);
    }
    if let Some(replacement) = &task.replacement {
        if matches!(starter, Starter::Start) {
            runner.state.instruction.push_str(&format!(
                "\n\n# Replacement review context\n{}",
                replacement.context
            ));
        }
        runner.state.replaces = Some(replacement.clone());
        runner.state.config.graph.selected_implementer = Some(replacement.agent.clone());
        if let Ok(mut old) = RunState::load(&replacement.run)
            && let Some(d) = &mut old.merge_decision
        {
            d.replacement_run = Some(runner.state.id.clone());
            old.event(
                "replacement",
                format!(
                    "replacement run {} owns the next attempt; old PR remains closed",
                    runner.state.id
                ),
            );
            if let Err(e) = old.save() {
                task.hold_manual(Some(format!(
                    "Could not link replacement history: {e}; no agents dispatched"
                )));
                record(queue, task);
                return Vec::new();
            }
        }
    }
    runner.state.task_instruction = Some(task.instruction.clone());
    // The follow-up depth is fixed now, while the task certainly exists:
    // deleting it later must not reset the cap (`crate::followup`).
    runner.state.followup_generation = Some(task.followup.as_ref().map_or(0, |f| f.generation));
    if runner.state.origin_chat.is_none() {
        runner.state.origin_chat = task.chat_talk().map(str::to_owned);
    }
    // A stop that means "park" reaches the graph through this handle.
    runner.on_pause(stop.pause());
    // `poll`'s interrupt scheduler reaches this one run - and no other -
    // through this handle. See `Pause`'s own doc for why these are never
    // the same one.
    runner.watch_interrupt(interrupt_pause);

    // `start` has minted the run, so the task can now point at it. Persisting
    // `Running` before `execute` is what makes a crash mid-run legible.
    let run = runner.state.id.clone();
    task.start(run.clone());
    record(queue, task);
    lock(status).current.push(Current {
        worker: None,
        task: task.id.clone(),
        run,
    });

    // `RunState::quota` is the run's whole history across every resume, so
    // only what this execution added may arm the cooldown or earn a refund.
    let quota_before = runner.state.quota.clone();
    runner.state.next_pass_task_entry = true;
    let result = runner.execute().await;
    finish_attempt(
        opts.max_attempts,
        queue,
        task,
        &runner.state,
        &quota_before,
        result,
    )
}

/// Settle `task` after its run executed: the verdict, the diagnosis, the
/// supersession of earlier attempts and the save. Shared by the loop and by
/// `magi run --resume`, so an attempt is counted one way wherever it ran.
/// Returns the quota losses this execution added to the run.
pub fn finish_attempt(
    max_attempts: usize,
    queue: &Queue,
    task: &mut Task,
    state: &RunState,
    quota_before: &[QuotaLoss],
    result: Result<()>,
) -> Vec<QuotaLoss> {
    let detail = match result {
        Ok(()) => describe(state),
        Err(e) => format!("{e:#}"),
    };
    let fresh = losses_this_attempt(quota_before, &state.quota);
    let verdict = Verdict {
        status: state.status,
        // A run that opened a pull request handed its work over, whatever the
        // gate then decided about merging it.
        left_pr: state.pr.is_some(),
        // Only a rate limit earns the task its attempt back - and only one
        // suffered now: a refund justified by a previous session's loss is
        // the same mistake as re-arming the cooldown from it. A stalled run
        // resumed without hitting quota again therefore spends its attempt,
        // like any other failure of the task's own.
        quota_hit: !fresh.is_empty(),
        // A run that parked was asked to stop; that is not a failure and must
        // not spend an attempt, or replacing the binary a few times would
        // exhaust a task's budget without an agent ever misbehaving.
        parked: state.parked,
        // A quota loss that left nothing viable is the same machine fact as a
        // `Stalled` quota loss; see `settle`'s doc table.
        no_viable_candidates: state.viable().is_empty(),
    };
    if let Some(replacement) = &state.replaces
        && let Some(pr) = &state.pr
        && let Ok(mut old) = RunState::load(&replacement.run)
        && let Some(d) = &mut old.merge_decision
    {
        d.replacement_pr = Some(pr.url.clone());
        let _ = old.save();
    }
    settle_and_diagnose(task, verdict, &detail, max_attempts, state);
    if state.status == RunStatus::Blocked && state.prep_failure.is_some() {
        task.hold_unrequested_retry(Some(format!(
            "Candidate setup failed: {detail}. Correct the explicit sources with `magi task sources {}` (README, \"Use\": implementation imports), or select a complete implementation with `magi task recover-pr`, then explicitly release the task.",
            task.short()
        )));
    }
    if task.status == TaskStatus::Done {
        supersede_prior_runs(task, &crate::run::home());
    }
    record(queue, task);
    tracing::info!(
        "task {} is {} after run {} ({})",
        task.short(),
        task.status.as_str(),
        state.short(),
        label(state.status)
    );
    fresh
}

/// A task a hand-started run leaves runnable (failed with attempts to spare,
/// or requeued) is **held**: nobody asked for a retry, and a loop starting
/// later must not spend agent calls on it. `magi task release` retries.
pub fn hold_if_runnable(queue: &Queue, task: &mut Task) {
    // Parked work (including legacy Failed records with a parked run) is a
    // checkpoint or owner handoff, not an unrequested retry.
    if matches!(task.status, TaskStatus::Queued | TaskStatus::Failed)
        && !awaiting_resume_with(task, RunState::load)
        // A run parked on the owner's word about a withheld PR title/body
        // resumes via `land_resume_state`, including review-only tasks that
        // `awaiting_resume_with` does not consider.
        && withheld_text_wait(task).is_none()
        && !(task.fresh_start && task.replacement.is_some())
    {
        let why = task.last_error.clone().map_or_else(
            || "the run did not finish".to_owned(),
            |e| format!("the run did not finish: {e}"),
        );
        task.hold_unrequested_retry(Some(format!(
            "{why}. It was started by hand, so it is not retried \
             automatically; `magi task release` retries it."
        )));
        record(queue, task);
    }
}

/// Whether an attempt at a task whose newest run is `run` would resume that
/// run rather than start a fresh competition. `magi run --resume` hands a run
/// to a live loop only when this holds.
#[must_use]
pub fn loop_would_resume(run: &str) -> bool {
    unfinished_run(&[run.to_owned()], crate::run::short_of(run)).is_some()
}

/// A loop in another process that is alive right now: a fresh heartbeat in
/// `<home>/daemon.json` published by a pid that is not `own_pid`. `Some(pid)`
/// carries the pid it published (`None` inside when it published none - a
/// fresh heartbeat is still evidence of a live loop).
///
/// The one judgement of "is somebody else serving this queue", shared by the
/// web UI's refusal to start a second loop and by `magi run` / `magi review`
/// deciding whether to hand a task to the loop. A claim file proves nothing
/// here: whether a claim succeeds says nothing about whether its owner lives.
#[must_use]
pub fn foreign_loop(
    reading: Option<&Reading>,
    now: Timestamp,
    own_pid: u32,
) -> Option<Option<u32>> {
    let reading = reading.filter(|r| r.running(now))?;
    match reading.pid {
        Some(pid) if pid == own_pid => None,
        pid => Some(pid),
    }
}

fn legacy_scheduler_running(reading: &Reading, now: Timestamp, own_pid: u32) -> bool {
    reading.worker_protocol != Some(1)
        && (foreign_loop(Some(reading), now, own_pid).is_some()
            || reading
                .pid
                .is_some_and(|pid| pid != own_pid && crate::proc::pid_alive(pid)))
}

/// Low-level claimed-task execution shared by the detached standalone worker
/// and focused lifecycle fixtures. The caller must retain the queue claim for
/// this entire call. CLI callers transfer ownership through
/// [`run_detached_claimed`] instead of executing inside their own runtime.
///
/// The one deliberate difference from the loop: a task the attempt leaves
/// runnable (failed with attempts to spare, or requeued) is **held** instead.
/// Nobody asked for a retry, and a daemon starting later must not spend agent
/// calls re-running a hand-started task behind the operator's back;
/// `magi task release` is the explicit retry.
pub async fn run_claimed(opts: &Opts, queue: &Queue, task: &mut Task) {
    run_claimed_until(opts, queue, task, &Stop::new()).await;
}

async fn run_claimed_until(
    opts: &Opts,
    queue: &Queue,
    task: &mut Task,
    stop: &Stop,
) -> Vec<QuotaLoss> {
    let status = Arc::new(Mutex::new(Status::new()));
    // An attempt embeds startup and graph futures. Keep it off the standalone
    // caller's stack, on both the initial execution and withheld-text resume.
    let mut quota = Box::pin(attempt(
        opts,
        queue,
        &status,
        stop,
        crate::graph::Pause::new(),
        task,
    ))
    .await;
    // A run parked on the owner's word about a withheld PR title/body has no
    // daemon to finish it. Nobody else will enforce `answer_timeout`, so wait
    // here with the claim still held, and resume once the question is settled
    // (answered, or abandoned at its deadline -> the neutral text).
    // A rejected reply files one more question (the gate asks at most twice),
    // so after a resume the run may be waiting again: keep going, with a fresh
    // limit for the new question. `resumes` bounds it even if a resume parks
    // without asking anything new.
    let mut resumes = 0;
    while resumes < MAX_WITHHELD_RESUMES && !stop.parking() {
        let Some(timeout) = withheld_text_wait(task) else {
            break;
        };
        eprintln!(
            "waiting for the owner's answer on a withheld pull request text \
             (up to {timeout}s; Ctrl-C leaves the run parked for a later `magi serve`)"
        );
        // The deadline abandons the question itself; the extra margin only
        // covers an abandon that could not be saved.
        let limit = std::time::Instant::now() + Duration::from_secs(timeout + 60);
        let ready = loop {
            match land_resume_state(task) {
                LandResume::StillWaiting
                    if !stop.parking() && std::time::Instant::now() < limit =>
                {
                    tokio::time::sleep(WITHHELD_POLL).await;
                }
                LandResume::Ready => break true,
                _ => break false,
            }
        };
        if !ready || stop.parking() {
            break;
        }
        resumes += 1;
        quota.extend(
            Box::pin(attempt(
                opts,
                queue,
                &status,
                stop,
                crate::graph::Pause::new(),
                task,
            ))
            .await,
        );
    }
    hold_if_runnable(queue, task);
    quota
}

/// Resumes an in-process run makes for withheld-text questions: the gate asks
/// at most twice, plus one for a resume that asks nothing new.
const MAX_WITHHELD_RESUMES: u32 = 3;

/// How often an in-process run rechecks its withheld-text question.
const WITHHELD_POLL: Duration = Duration::from_secs(15);

/// The `answer_timeout` (seconds) of the task's last run when that run is
/// parked on an unresolved withheld-text question; `None` otherwise.
fn withheld_text_wait(task: &Task) -> Option<u64> {
    let id = task.runs.last()?;
    let s = RunState::load(id).ok()?;
    (s.parked && s.github_text.as_ref().is_some_and(|g| !g.resolved))
        .then_some(s.config.graph.answer_timeout)
}

/// The quota losses `after` holds that `before` did not: what one execution
/// suffered, as opposed to the run's history.
///
/// Compared by value rather than by length or position because
/// `Runner::recover_stall` drops a `QuotaLoss` when its seat ranks again, so
/// the vector can shrink and shift under a resume. A retried seat that hits
/// quota again is a `push` with a new `at`, so it shows up as new here.
/// `reclaim` deliberately keeps reading the whole history: after a crash there
/// is no attempt boundary to diff against.
fn losses_this_attempt(before: &[QuotaLoss], after: &[QuotaLoss]) -> Vec<QuotaLoss> {
    after
        .iter()
        .filter(|q| !before.contains(q))
        .cloned()
        .collect()
}

/// When the loop-wide quota cooldown should end, given this attempt's losses;
/// `None` when there were none. Reset-hint parsing and the cap live here.
fn cooldown_until(quota: &[QuotaLoss], now: Timestamp) -> Option<Timestamp> {
    if quota.is_empty() {
        return None;
    }
    let with_hint = quota.iter().find(|q| q.reset.is_some());
    let reset_at = with_hint.and_then(|q| parse_reset_hint(q.reset.as_deref()?, now, q.at));
    let wait = quota_wait(reset_at, now, QUOTA_WAIT_FALLBACK, QUOTA_WAIT_CAP);
    let secs = i64::try_from(wait.as_secs()).unwrap_or(i64::MAX);
    Some(
        now.checked_add(jiff::SignedDuration::from_secs(secs))
            .unwrap_or(Timestamp::MAX),
    )
}

/// An explicit task count must agree with a run before any resume.
fn implementers_match(task: &Task, state: &RunState) -> bool {
    task.replacement.as_ref().map_or_else(
        || {
            task.implementers()
                .is_none_or(|n| n == state.config.graph.implementers)
        },
        |replacement| {
            state.config.graph.selected_implementer.as_deref() == Some(&replacement.agent)
                && state.config.graph.implementers == 1
        },
    )
}

/// Never resume or take over candidate work built for a different seat count.
fn starter_with_implementers(
    task: &Task,
    previous: Option<&RunState>,
    proposed: Starter,
) -> Starter {
    if previous.is_some_and(|s| !implementers_match(task, s)) {
        task.review_of
            .as_ref()
            .map_or(Starter::Start, |branch| Starter::Review(branch.clone()))
    } else {
        proposed
    }
}

/// Apply this task's explicit count to the new attempt, without changing defaults.
fn apply_task_implementers(config: &mut Config, task: &Task) {
    if let Some(n) = task.implementers() {
        config.graph.implementers = n;
    }
}

/// [`prepare`] for one task: its own `--config` and command-line overrides
/// (`Task::overrides`, filed by `magi run` / `magi review`) take precedence
/// over the loop's, so handing a hand-started task to a daemon changes nothing
/// about what it does.
#[cfg(test)]
fn prepare_for(repo: &Path, opts: &Opts, task: &Task) -> Result<Config> {
    let explicit = match &task.overrides {
        Some(o) if !o.inherit_daemon_options => o.config.as_deref(),
        _ => opts.config.as_deref(),
    };
    let (mut config, _) = Config::discover(repo, explicit)?;
    apply_options(&mut config, opts, task)?;
    Ok(config)
}

fn apply_options(config: &mut Config, opts: &Opts, task: &Task) -> Result<()> {
    if task
        .overrides
        .as_ref()
        .is_none_or(|o| o.inherit_daemon_options)
        && let Some(mode) = opts.merge.as_deref()
    {
        config.merge.mode = merge_mode(mode)?;
    }
    if let Some(o) = &task.overrides {
        o.apply(config);
    }
    Ok(())
}

/// Load the config for a task's repository, with the merge override applied.
fn prepare(repo: &Path, opts: &Opts) -> Result<Config> {
    let (mut config, _layers) = Config::discover(repo, opts.config.as_deref())?;
    if let Some(mode) = &opts.merge {
        config.merge.mode = merge_mode(mode)?;
    }
    Ok(config)
}

/// Prune the shared build cache at a between-runs boundary. The detached cache
/// service checks authoritative task jobs first; dispatch waits for that finite
/// service, so scheduler replacement cannot turn a compile into idle cleanup.
/// Its durable service cadence preserves [`CACHE_CHECK_INTERVAL_SECS`].
async fn maybe_prune_cache_between_runs(
    repo: &Path,
    opts: &Opts,
    home: &Path,
    stop: &Stop,
    last_checked: &mut Option<Timestamp>,
    now: Timestamp,
) {
    if stop.stopped() || !cache_check_due(*last_checked, now, CACHE_CHECK_INTERVAL_SECS) {
        return;
    }
    *last_checked = Some(now);
    let cfg = match prepare(repo, opts) {
        Ok(cfg) => cfg,
        Err(e) => {
            tracing::warn!("cache check: no config: {e:#}");
            return;
        }
    };
    match clean::prune_cache_if_over_limit(&cfg, home) {
        Ok(Some(pruned)) if pruned.files > 0 => tracing::info!(
            "housekeep: pruned {} file(s) ({} bytes) from the shared cache between runs",
            pruned.files,
            pruned.freed
        ),
        Ok(_) => {}
        Err(e) => {
            tracing::warn!("housekeep: prune cache: {e:#}");
            notices::raise_in(
                home,
                Notice::warn(
                    "housekeep:cache",
                    format!(
                        "Pruning the shared build cache failed: {}. Disk usage may keep growing.",
                        e.to_string()
                            .lines()
                            .next()
                            .unwrap_or("unknown cleanup error")
                    ),
                ),
            );
        }
    }
}

/// Whether [`maybe_prune_cache_between_runs`] should re-measure the cache
/// now, given when it last did (if ever). Pure, so the cadence is asserted
/// directly rather than by waiting out real minutes in a test.
fn cache_check_due(last_checked: Option<Timestamp>, now: Timestamp, interval_secs: u64) -> bool {
    last_checked.is_none_or(|last| clean::due(now, last, interval_secs))
}

/// The disk janitor, with its housekeeping logged rather than fatal.
///
/// Called only at the loop's idle points, for the reason the caller documents:
/// a prune racing a live compile would delete files mid-build. The config is
/// re-read on every call because the repository that just ran may not be the
/// daemon's own default, and the cache directory is a repository fact.
///
/// `home` and `worktrees_root` are parameters rather than [`crate::run::home`]
/// and [`crate::run::default_worktree_root`] read here, for the same reason
/// [`drive`] takes its queue and status file rather than resolving them: a
/// test driving the loop must not reach through to the operator's real home
/// or worktree bay just because the janitor runs on every idle tick.
/// `worktrees_root` staying unread by [`clean::fold_due`] once made this easy
/// to get wrong silently - a test's `home` was already isolated, but nothing
/// exercised the parameter next to it, so a real worktree bay stayed wired in
/// underneath. The moment [`clean::fold_orphaned_worktrees`] started reading
/// it for real, every test in this file that drives the loop at all started
/// sweeping the operator's actual `~/wt/<repo>` instead of a fixture's.
async fn janitor(repo: &Path, opts: &Opts, home: &Path, worktrees_root: &Path) {
    let cfg = match prepare(repo, opts) {
        Ok(cfg) => cfg,
        Err(e) => {
            tracing::warn!("housekeep: no config: {e:#}");
            return;
        }
    };
    // A run's own worktree lives under `config.graph.worktree_root` when the
    // repository sets one - the same precedence `RunState::worktree_root`
    // uses - and `worktrees_root` only stands in for the *default* an
    // unconfigured repository resolves to (see this function's own
    // parameter, or the test fixture wiring one to a fake path). Housekeeping
    // that always swept the default regardless of this override would never
    // see, and so never reclaim, a single worktree for a repository that
    // relocated them elsewhere.
    let worktrees_root = cfg.graph.worktree_root.as_deref().unwrap_or(worktrees_root);
    let out = clean::housekeep(&cfg, home, worktrees_root, repo, Timestamp::now()).await;
    // Reported whenever there is anything to say, not only when `folded > 0`:
    // the incident this exists to prevent was 90 of 93 runs skipped and 0
    // folded, on every single pass, for months - a report gated on `folded`
    // would have stayed silent through every one of them.
    if out.folded > 0 || out.unreadable > 0 || out.orphaned_worktrees > 0 {
        let mut extra = Vec::new();
        if out.unreadable > 0 {
            extra.push(format!("{} unreadable", out.unreadable));
        }
        if out.orphaned_worktrees > 0 {
            extra.push(format!("{} orphaned worktree(s)", out.orphaned_worktrees));
        }
        let detail = if extra.is_empty() {
            String::new()
        } else {
            format!(" ({})", extra.join(", "))
        };
        tracing::info!("housekeep: folded {} run(s){detail}", out.folded);
    }
    if out.external_merges_recorded > 0 {
        tracing::info!(
            "housekeep: recorded {} run(s) as merged externally",
            out.external_merges_recorded
        );
    }
    if out.stale_pr_states_repaired > 0 {
        tracing::info!(
            "housekeep: rewrote {} run record(s) whose pull request had already settled",
            out.stale_pr_states_repaired
        );
    }
    if out.cache_files > 0 {
        tracing::info!(
            "housekeep: pruned {} file(s) ({} bytes) from the shared cache",
            out.cache_files,
            out.cache_freed
        );
    }
    if out.questions_abandoned > 0 {
        tracing::info!(
            "housekeep: abandoned {} question(s) left open by a finished run",
            out.questions_abandoned
        );
    }
}

/// Run [`triage::run_once`] and log whatever it did, the same "only when
/// there is something to say" rule [`janitor`] follows for its own report.
///
/// Called at the same idle points as [`janitor`] - once per full poll
/// interval, never mid-attempt - for the same reason: it is not liveness
/// critical, and a task's own `hold_reason` string is the one thing this
/// would otherwise re-check (via [`crate::disk::free_bytes`]) on every busy
/// tick for no benefit.
async fn triage_held(queue: &Queue, home: &Path, opts: &Opts) {
    let questions = Questions::at(home.join("questions"));
    let report = triage::run_once(queue, &questions, opts.config.as_deref(), Timestamp::now());
    if report.is_empty() {
        return;
    }
    if !report.quarantined.is_empty() {
        tracing::info!(
            "triage: held {} blocked task(s) whose blocked-on task or \
             question no longer exists: {}",
            report.quarantined.len(),
            report.quarantined.join(", ")
        );
    }
    if !report.resumed.is_empty() {
        tracing::info!(
            "triage: resumed {} held task(s) whose machine hold had resolved: {}",
            report.resumed.len(),
            report.resumed.join(", ")
        );
    }
    if !report.asked.is_empty() {
        tracing::info!(
            "triage: asked about {} held task(s): {}",
            report.asked.len(),
            report.asked.join(", ")
        );
    }
    if !report.answered.is_empty() {
        tracing::info!(
            "triage: applied {} operator answer(s): {}",
            report.answered.len(),
            report.answered.join(", ")
        );
    }
}

/// The free-space gate: what stands between this task and a new run, if
/// anything. `Some(reason)` holds the task; `None` lets it start.
///
/// A zero [`Config::disk::min_free_bytes`] opens the gate unconditionally -
/// the operator opted out. A measurement failure is a gate, not a pass: both
/// sides of "cannot tell" are served by not starting.
pub(crate) fn disk_gate(repo: &Path, config: &Config) -> Option<String> {
    disk_gate_with(repo, config, crate::disk::free_bytes)
}

/// [`disk_gate`] with its free-space measurement supplied by the caller, so a
/// test can assert the exact wiring `attempt` runs - config's threshold in,
/// task-holding reason out - without asking the real machine's disk anything.
fn disk_gate_with<F: Fn(&Path) -> Result<u64>>(
    repo: &Path,
    config: &Config,
    free_bytes: F,
) -> Option<String> {
    let min = config.disk.min_free_bytes;
    if min == 0 {
        return None;
    }
    let mut paths = vec![repo.to_owned()];
    if let Some(cache) = config.cache_dir() {
        paths.push(cache);
    }
    if let Some(root) = &config.graph.worktree_root {
        paths.push(root.clone());
    }
    for path in paths {
        let probe = if path == repo {
            path.as_path()
        } else {
            path.ancestors().find(|p| p.exists()).unwrap_or(&path)
        };
        let reason = match free_bytes(probe) {
            Ok(free) => crate::disk::gate_in(free, min, &config.graph.language),
            Err(e) => Some(crate::disk::unmeasured_in(
                probe,
                &e,
                &config.graph.language,
            )),
        };
        if reason.is_some() {
            return reason;
        }
    }
    None
}

/// How long to wait before offering another task when a run lost a seat to a
/// rate limit and its [`QuotaLoss::reset`] carried no hint [`parse_reset_hint`]
/// could read, or carried nothing at all. Long enough that a quota outage
/// cannot burn through a whole backlog in the few seconds each doomed attempt
/// takes to fail; short enough that a quota which clears early is not left
/// idle for the fallback's sake.
const QUOTA_WAIT_FALLBACK: Duration = Duration::from_secs(5 * 60);

/// Longest a parsed reset hint may push the wait out to. The hint comes from
/// the CLI's own words, not a contract, so a parsing slip that lands a day
/// away must not leave the loop asleep for a day.
const QUOTA_WAIT_CAP: Duration = Duration::from_secs(30 * 60);

/// How long [`poll`] should wait before offering the next task, after a run
/// lost at least one seat to a rate limit.
///
/// Pure and separate from the loop so the policy can be exercised without a
/// real quota outage. `reset_at` is the time [`parse_reset_hint`] made of the
/// CLI's free-text hint, if it could; `fallback` is what to wait when there is
/// nothing to parse, or the parsed time has already passed; `cap` bounds how
/// far a parsed hint is trusted to push the wait out.
fn quota_wait(
    reset_at: Option<Timestamp>,
    now: Timestamp,
    fallback: Duration,
    cap: Duration,
) -> Duration {
    match reset_at {
        Some(at) if at > now => {
            let secs = u64::try_from(at.as_second() - now.as_second()).unwrap_or(0);
            Duration::from_secs(secs).min(cap)
        }
        _ => fallback,
    }
}

/// Best-effort reading of a [`QuotaLoss::reset`] hint into a concrete time.
///
/// `reset` is deliberately free text — see [`crate::agent::Quota`], which
/// explains why parsing it exactly "would be a bug factory" — so this only
/// recognises the shapes actually observed in the wild, and returns `None`
/// for anything else rather than guess at a format nobody has seen.
///
/// `recorded` is when the loss was noted ([`QuotaLoss::at`]). It anchors the
/// relative shape (`"in 1h2m49s"`, agy's), which counts from the moment the CLI
/// said it, not from whenever this loop happens to read it: anchoring on `now`
/// would push the reset later on every read and would read an already-elapsed
/// reset as still in the future. (A long hint is still clamped by
/// [`QUOTA_WAIT_CAP`]; the anchor matters for short hints and elapsed ones.)
fn parse_reset_hint(text: &str, now: Timestamp, recorded: Timestamp) -> Option<Timestamp> {
    parse_reset_hint_zoned(text, now)
        .or_else(|| parse_reset_hint_dated(text))
        .or_else(|| parse_reset_hint_relative(text, recorded))
}

/// agy's shape: `"in 1h2m49s"` - `in`, then hours/minutes/seconds, each unit
/// optional but at least one required, in that order. A bare number or any
/// unknown unit is refused.
fn parse_reset_hint_relative(text: &str, recorded: Timestamp) -> Option<Timestamp> {
    let rest = text.trim().trim_end_matches('.').strip_prefix("in ")?;
    let mut rest = rest.trim();
    if rest.is_empty() {
        return None;
    }
    let mut total: i64 = 0;
    let mut matched = false;
    for (unit, secs) in [('h', 3600), ('m', 60), ('s', 1)] {
        if let Some((digits, tail)) = rest.split_once(unit)
            && !digits.is_empty()
            && digits.bytes().all(|b| b.is_ascii_digit())
        {
            total += digits.parse::<i64>().ok()?.checked_mul(secs)?;
            rest = tail;
            matched = true;
        }
    }
    if !rest.is_empty() || !matched {
        return None;
    }
    recorded
        .checked_add(jiff::SignedDuration::from_secs(total))
        .ok()
}

/// Reads a 12-hour `"H:MMam/pm"` clock reading (whitespace trimmed,
/// case-insensitive) into a 24-hour hour and minute. Shared by every
/// reset-hint shape below.
fn parse_12h_clock(clock: &str) -> Option<(i8, i8)> {
    let clock = clock.trim().to_lowercase();
    let (digits, pm) = clock
        .strip_suffix("am")
        .map(|d| (d, false))
        .or_else(|| clock.strip_suffix("pm").map(|d| (d, true)))?;
    let (h, m) = digits.trim().split_once(':')?;
    let mut hour: i8 = h.trim().parse().ok()?;
    let minute: i8 = m.trim().parse().ok()?;
    if !(1..=12).contains(&hour) || !(0..=59).contains(&minute) {
        return None;
    }
    if pm && hour != 12 {
        hour += 12;
    } else if !pm && hour == 12 {
        hour = 0;
    }
    Some((hour, minute))
}

/// The Claude CLI's shape: `"H:MMam/pm (Zone)"`, naming only a clock reading
/// and a zone, never a date. A clock reading already past today is read as
/// tomorrow's: a CLI naming a same-day reset that has already gone by means
/// the window rolled over while nothing was watching.
fn parse_reset_hint_zoned(text: &str, now: Timestamp) -> Option<Timestamp> {
    let open = text.find('(')?;
    let close = text.rfind(')')?;
    if close <= open {
        return None;
    }
    let zone = text[open + 1..close].trim();
    let (hour, minute) = parse_12h_clock(&text[..open])?;
    let tz = jiff::tz::TimeZone::get(zone).ok()?;
    let candidate = now
        .to_zoned(tz)
        .with()
        .hour(hour)
        .minute(minute)
        .second(0)
        .millisecond(0)
        .microsecond(0)
        .nanosecond(0)
        .build()
        .ok()?;
    let mut at = candidate.timestamp();
    if at <= now {
        at += jiff::SignedDuration::from_hours(24);
    }
    Some(at)
}

/// The Codex CLI's shape: `"Mon DDth, YYYY H:MMam/pm"` (English month
/// abbreviation, an ordinal day, a 4-digit year, a 12-hour clock reading),
/// with no zone at all — unlike [`parse_reset_hint_zoned`], so there is no
/// "already past today" correction to make: the year already disambiguates
/// it. Scanned as a five-word window so it can be pulled out of the middle
/// of a full sentence, e.g. Codex's actual wording: "...or try again at Sep
/// 19th, 2026 5:10 PM." The result is read as UTC, same as this crate reads
/// any other timestamp with no zone attached.
fn parse_reset_hint_dated(text: &str) -> Option<Timestamp> {
    let words: Vec<&str> = text.split_whitespace().collect();
    if words.len() < 5 {
        return None;
    }
    (0..=words.len() - 5)
        .find_map(|start| parse_dated_window(&words[start..start + 5], words.get(start + 5)))
}

/// One five-word window: month, `"DDth,"`, `"YYYY"`, `"H:MM"`, `"am/pm"`. A
/// parenthesis right after the window is refused rather than ignored — it
/// reads as an explicit zone annotation on a shape that otherwise carries
/// none, and guessing UTC anyway would be exactly the silent misread this
/// module's parsing otherwise avoids.
fn parse_dated_window(window: &[&str], trailing: Option<&&str>) -> Option<Timestamp> {
    if trailing.is_some_and(|next| next.starts_with('(')) {
        return None;
    }
    let month = month_number(window[0])?;
    let day_token = window[1].strip_suffix(',')?.to_lowercase();
    let day_digits = ["st", "nd", "rd", "th"]
        .iter()
        .find_map(|suffix| day_token.strip_suffix(*suffix))?;
    let day: i8 = day_digits.parse().ok()?;
    let year_token = window[2];
    if year_token.len() != 4 || !year_token.bytes().all(|b| b.is_ascii_digit()) {
        return None;
    }
    let year: i16 = year_token.parse().ok()?;
    // The am/pm word carries the sentence's own trailing punctuation, e.g.
    // the period ending "...at Sep 19th, 2026 5:10 PM." — strip it before
    // reusing the same 12-hour clock reader the bracketed shape uses.
    let ampm = window[4].trim_matches(|c: char| !c.is_ascii_alphabetic());
    let (hour, minute) = parse_12h_clock(&format!("{}{}", window[3], ampm))?;
    let date = jiff::civil::Date::new(year, month, day).ok()?;
    let candidate = date
        .at(hour, minute, 0, 0)
        .to_zoned(jiff::tz::TimeZone::UTC)
        .ok()?;
    Some(candidate.timestamp())
}

/// The 3-letter English month abbreviation [`parse_reset_hint_dated`] reads,
/// case-insensitively, into a 1-based month number.
fn month_number(name: &str) -> Option<i8> {
    const NAMES: [&str; 12] = [
        "jan", "feb", "mar", "apr", "may", "jun", "jul", "aug", "sep", "oct", "nov", "dec",
    ];
    let lower = name.to_lowercase();
    NAMES
        .iter()
        .position(|n| *n == lower.as_str())
        .map(|i| i as i8 + 1)
}

/// Test probe for the shared resume policy's review-budget exclusion.
#[cfg(test)]
fn exhausted_review_budget(state: &RunState) -> bool {
    // A run whose task-head publication failed has nothing left to review:
    // resuming it only retries the publication, so it is never "exhausted".
    !crate::handover::can_resume(state)
        && state.status == RunStatus::Blocked
        && !state.released()
        && state.retired_to.is_none()
}

/// This task's *most recent* run, if resuming it would actually make
/// progress. `short` is only for the warning's own message.
///
/// Only ever `runs.last()` — never a search back through older history.
/// `runs` accumulates one entry per fresh `Runner::start`/`Runner::review`
/// mint, oldest first, and every entry before the last one was already
/// superseded at the moment it was minted: the daemon only ever starts a new
/// run when the previous one was not worth resuming (unresumable, exhausted,
/// or unreadable), or when `crate::conduct::Recovery::Review` deliberately
/// opens a fresh review-only run alongside an older, already-failed
/// competition. Searching further back would let an old run that merely
/// *looks* resumable — a `Stalled` competition an earlier `Review` pass left
/// behind, say — get resumed instead of the fresh competition
/// `crate::conduct::Recovery::Requeue` actually promised, reviving history
/// nothing asked to revisit.
///
/// Two runs paid for the "prefer resuming over restarting" half of this
/// lesson, which is why this still checks `runs.last()` rather than always
/// restarting. Run 01c2 was blocked and the loop started 3cbf on the same
/// task a moment later, duplicating two and a half hours of agent work. Then
/// b25f stalled on a judge that timed out and one that answered with no JSON
/// — `quota: 0`, so nothing the machine was to blame for — and 4043 started
/// **one second** later, buying three fresh implementations to reach the
/// same panel. `RunStatus::resumable` rather than `!done()` is what catches
/// the second case: a stall is terminal, and its cheap recovery re-asks only
/// the absent seats. [`crate::handover::can_resume`] supplies the other half: a run
/// that is technically `resumable()` but provably cannot progress must not
/// count as "unfinished" either, or `Recovery::Requeue` becomes a silent
/// no-op instead of the fresh competition it promises.
///
/// A load failure is warned about rather than silently read as "not
/// resumable": the alternative is exactly what let a schema mismatch on run
/// `eba2` fall through to a full re-competition with nobody told why.
/// `crate::conduct` is what actually offers a better answer than
/// `Runner::start` here (see `Recovery::Review`), once this task's next
/// failure shows it up as `held`/`failed` with the run state unreadable.
fn unfinished_run(runs: &[String], short: &str) -> Option<String> {
    unfinished_run_with(runs, short, RunState::load)
}

/// [`unfinished_run`] with an injected state reader. Tests provide their
/// fixtures directly rather than touching the process-global run home.
pub(crate) fn unfinished_run_with<F>(runs: &[String], short: &str, mut load: F) -> Option<String>
where
    F: FnMut(&str) -> Result<RunState>,
{
    let mut id = runs.last()?.clone();
    let mut visited = std::collections::BTreeSet::new();
    let mut repo = None;
    loop {
        if !runs.contains(&id) || !visited.insert(id.clone()) {
            tracing::warn!("invalid or cyclic recovery authority for task {short}");
            return None;
        }
        let state = match load(&id) {
            Ok(state) if state.id == id => state,
            Ok(_) => return None,
            Err(e) => {
                tracing::warn!("could not read run {id} for task {short}: {e:#}");
                return None;
            }
        };
        if repo.as_ref().is_some_and(|repo| *repo != state.repo) {
            return None;
        }
        repo = Some(state.repo.clone());
        if let Some(authority) = state.retired_to {
            id = authority;
            continue;
        }
        return (crate::handover::can_resume(&state)
            && state.liveness(false) != crate::run::Liveness::Live)
            .then_some(id);
    }
}

/// Is `task` a parked (or, from an older build, failed) task whose last run was parked at a node boundary, so
/// that [`attempt`] will resume it on its own?
///
/// Mirrors [`unfinished_run_with`]'s own conditions (plus `parked`, and no
/// pending review choice, which [`choose_starter`] ranks first). Pure, with an
/// injected reader like its sibling. An unreadable run is not awaiting
/// anything: it keeps going to the conductor as before.
fn awaiting_resume_with<F>(task: &Task, load: F) -> bool
where
    F: FnOnce(&str) -> Result<RunState>,
{
    // `Failed` stays: a record an older build wrote for a parked run.
    if !matches!(task.status, TaskStatus::Parked | TaskStatus::Failed)
        || task.fresh_start
        || task.review_branch.is_some()
    {
        return false;
    }
    let Some(id) = task.runs.last() else {
        return false;
    };
    load(id).is_ok_and(|s| s.parked && crate::handover::can_resume(&s))
}

/// Which of the three ways [`attempt`] can mint or continue a run this task
/// should use.
#[derive(Debug, Clone, PartialEq, Eq)]
enum Starter {
    /// `crate::graph::Runner::review` against a branch `crate::conduct` chose
    /// and that still exists.
    Review(String),
    /// `crate::graph::Runner::resume` on an unfinished run of this task.
    Resume(String),
    /// `crate::graph::Runner::start`: a fresh competition.
    Start,
}

/// A second bound independent of inputs and the resettable failure counter.
/// Count recovery records, not history entries: resuming appends the same id.
/// Unknown history is not evidence that a new set of worktrees is affordable.
fn retained_attempt_hold(
    task: &Task,
    starter: &Starter,
    limit: usize,
    mut load: impl FnMut(&str) -> Result<RunState>,
) -> Option<String> {
    if limit == 0 || matches!(starter, Starter::Resume(_)) {
        return None;
    }
    let mut retained = 0;
    for id in task.runs.iter().collect::<std::collections::BTreeSet<_>>() {
        let state = match load(id) {
            Ok(state) if state.id == *id => state,
            _ => {
                return Some(format!(
                    "[recovery-backlog] Cannot verify historical run {id}. Restore its record and inspect the recovery lineage before starting another attempt. Existing history was retained."
                ));
            }
        };
        if state.retired_to.is_some() || state.released() {
            continue;
        }
        // Neither a completed status nor an empty candidate array proves that
        // all recovery sources (including unrecorded preparation) were retired.
        retained += 1;
    }
    (retained >= limit).then(|| format!(
        "[recovery-backlog] {retained} unretired attempts reach the limit of {limit}. Resume an existing recovery owner or inspect the lineage and retire proved-obsolete attempts before creating another run. Releases, refunds and changed upstream inputs do not reset this limit. No source or historical report was removed."
    ))
}

/// A selected public implementation overrides every historical candidate and pin.
fn selected_starter(
    selected: &crate::pr_recovery::Selection,
    previous: Option<&RunState>,
    unfinished: Option<&str>,
) -> Starter {
    if let Some(id) = unfinished
        && previous.is_some_and(|r| {
            r.id == id && r.pr_recovery.as_ref() == Some(selected) && r.reviewed_commits.is_some()
        })
    {
        Starter::Resume(id.to_owned())
    } else {
        Starter::Review(selected.branch.clone())
    }
}

/// The owner's answer to this branch's divergence question, consumed from the
/// task so a later, different divergence asks again. The runner applies it
/// (see `Runner::review_taking_over`), after the earlier worktree is released.
fn take_divergence_answer(
    branch: &str,
    remote: &str,
    task: &mut Task,
) -> Option<crate::reconcile::Choice> {
    let summary = crate::reconcile::summary_for(branch, remote);
    let (idx, choice) = task.answers.iter().enumerate().rev().find_map(|(i, a)| {
        (a.question == summary)
            .then(|| crate::reconcile::Choice::from_answer(&a.answer))
            .flatten()
            .map(|c| (i, c))
    })?;
    task.answers.remove(idx);
    Some(choice)
}

/// Decide which of [`Runner::review`], [`Runner::resume`] or [`Runner::start`]
/// this attempt should use. Pure, and separate from [`attempt`], so the
/// routing itself is assertable without spawning a real graph or a git
/// process: `attempt`'s own `crate::git::branch_exists` call has already
/// happened by the time this is called.
///
/// `review_branch` wins whenever `branch_exists` confirms it; a `review_branch`
/// whose branch is gone falls all the way through to [`Starter::Start`], not
/// to [`Starter::Resume`] — `crate::conduct` chose review over resuming the
/// old (likely `Blocked`) run in the first place, and a branch that vanished
/// out from under that choice is not evidence resuming it would fare better.
fn choose_starter(
    review_branch: Option<&str>,
    branch_exists: bool,
    unfinished: Option<&str>,
) -> Starter {
    match review_branch {
        Some(branch) if branch_exists => Starter::Review(branch.to_owned()),
        Some(_) => Starter::Start,
        None => match unfinished {
            Some(id) => Starter::Resume(id.to_owned()),
            None => Starter::Start,
        },
    }
}

/// Reuse a compatible latest review owner instead of taking its checked-out
/// branch into a new run. Different branches and changed criteria still use
/// the ordinary review/takeover policy.
fn review_retry_starter(
    task: &Task,
    previous: Option<&RunState>,
    branch: Option<&str>,
    exists: bool,
    unfinished: Option<&str>,
) -> Starter {
    if let Some(run) = previous
        && unfinished == Some(run.id.as_str())
        && run.reviewed_commits.is_some()
        && branch.is_some_and(|branch| {
            exists && run.candidates.len() == 1 && run.candidates[0].branch == branch
        })
        && may_resume_run(run, task)
    {
        return Starter::Resume(run.id.clone());
    }
    match (branch, unfinished, &task.review_of) {
        (None, None, Some(branch)) => Starter::Review(branch.clone()),
        _ => choose_starter(branch, exists, unfinished),
    }
}

/// Consume a retained review only while its authored criteria still match.
fn take_review_branch(task: &mut Task, previous: Option<&RunState>) -> Option<String> {
    let branch = task.review_branch.take();
    let instruction = task.review_instruction.take();
    branch.filter(|branch| match &instruction {
        Some(authored) => *authored == task.instruction,
        // Legacy retained branches must agree with their prior run; only an
        // explicitly pinned review can proceed without recoverable provenance.
        None => previous.map_or_else(
            || task.review_of.as_ref() == Some(branch),
            |run| compatible_run_instruction(run, task),
        ),
    })
}

/// A current explicit pin can select an otherwise incompatible run. Edits
/// and subsequent approvals invalidate pins selected for earlier criteria.
fn may_resume_run(run: &RunState, task: &Task) -> bool {
    task.resume_override
        .as_ref()
        .is_some_and(|r| r.pinned_run.as_ref() == Some(&run.id))
        || compatible_run_instruction(run, task)
}

/// Review scaffolding is execution context, not evidence of an operator edit.
pub(crate) fn compatible_run_instruction(run: &RunState, task: &Task) -> bool {
    if let Some(authored) = &run.task_instruction {
        return compatible_instruction(authored, task);
    }
    if compatible_instruction(&run.instruction, task) {
        return true;
    }
    // Recognize only the existing generated review shapes on legacy runs.
    // Ordinary authored text with a similar heading is left intact.
    if run.reviewed_commits.is_some() {
        if let Some((authored, _)) = run.instruction.split_once("\n\n# Work already on branch `") {
            return strip_answers_block(authored, task).trim() == task.instruction.trim();
        }
        if let Some(branch) = &task.review_of {
            let canonical = format!(
                "Review the branch `{branch}` (review-only: no implementation, no judging)."
            );
            let generated = format!(
                "Review the work already on branch `{branch}`. There is no task statement: what the change claims to do is whatever its commits say.\n\n"
            );
            return task.instruction == canonical && run.instruction.starts_with(&generated);
        }
    }
    false
}

/// Compare authored instructions, excluding answer blocks appended by the daemon.
pub(crate) fn compatible_instruction(old: &str, task: &Task) -> bool {
    strip_answers_block(old, task) == task.instruction
}

/// Which repository a task runs in. A task that names none — the normal case
/// for one filed from a phone — runs in the daemon's own default.
fn repo_for(task: &Task, fallback: &Path) -> PathBuf {
    if task.repo.as_os_str().is_empty() || task.repo == Path::new(".") {
        return fallback.to_path_buf();
    }
    task.repo.clone()
}

/// The header [`append_answers`] appends operator answers under. Shared with
/// [`strip_answers_block`] so a resumed run's instruction can be refreshed
/// rather than grown a new block on every resume.
const ANSWERS_HEADER: &str = "\n\n# Operator answers\n\n";

/// Render the first `count` answers in the block appended to an instruction.
fn answers_block(task: &Task, count: usize) -> String {
    let mut s = ANSWERS_HEADER.to_owned();
    for a in &task.answers[..count] {
        s.push_str(&format!("- {}: {}\n", a.question, a.answer));
    }
    s
}

/// Render the approval independently of transient task state, so historical
/// suffixes remain recognizable after another explicit release.
fn resumption_block(r: &crate::queue::Resumption) -> String {
    format!(
        "\n\n# Explicit operator resumption\n\nGeneration {} at {} approved this instruction:\n{}\n\
         Earlier answers (first {}) are audit history; their waiting premises are superseded by this approval.\n",
        r.generation, r.at, r.instruction, r.answers_through,
    )
}

/// Append audit answers and the latest explicit approval to the instruction.
fn append_answers(base: &str, task: &Task) -> String {
    let mut s = base.to_owned();
    if !task.answers.is_empty() {
        s.push_str(&answers_block(task, task.answers.len()));
    }
    if let Some(r) = &task.resumption {
        s.push_str(&resumption_block(r));
    }
    s
}

/// Drop the prior answer block only when it is exactly the suffix this task
/// could have appended on an earlier resume. An `ANSWERS_HEADER` written by
/// the task author is ordinary instruction text, not a block to remove.
fn strip_answers_block<'a>(instruction: &'a str, task: &Task) -> &'a str {
    let mut instruction = instruction;
    for approval in task
        .resumption
        .iter()
        .chain(task.resumption_history.iter().rev())
    {
        if let Some(base) = instruction.strip_suffix(&resumption_block(approval)) {
            instruction = base;
            break;
        }
    }
    for count in (1..=task.answers.len()).rev() {
        let block = answers_block(task, count);
        if let Some(base) = instruction.strip_suffix(&block) {
            return base;
        }
    }
    instruction
}

/// The instruction handed to `Runner::start`: the task's own text, plus any
/// operator answers `crate::conduct` collected for it (see
/// [`Task::answers`]), so a decision the operator actually made reaches the
/// implementers rather than only clearing the block that was waiting on it.
///
/// Appended rather than merged into [`Task::instruction`] itself, so the
/// task's own record stays exactly what its author wrote.
fn instruction_for(task: &Task) -> String {
    append_answers(&task.instruction, task)
}

/// The instruction a resumed run should carry on with: whatever it already
/// had, refreshed with the task's *current* operator answers.
///
/// A resumable run's own `RunState::instruction` predates any answer
/// `crate::conduct` collects after the run parks, so resuming it unchanged —
/// the behaviour before this function existed — silently drops the very
/// decision the operator made to unblock it. Re-stripping any block this
/// function appended on an earlier resume before re-appending the current
/// list (rather than blindly appending again) is what keeps a task resumed
/// three times over three answered questions from carrying the same answer
/// three times.
fn resumed_instruction(old_instruction: &str, task: &Task) -> String {
    append_answers(strip_answers_block(old_instruction, task), task)
}

/// Preserve the producer's verified boundary and target, independent of prose.
fn record_config_failure(task: &mut Task, error: &anyhow::Error) {
    let failure = error.downcast_ref::<crate::config::ConfigFailure>();
    task.notice_cause(failure.map_or("config-load", |f| f.stage), None, None);
    if let Some(cause) = task.hold_notice_cause.as_mut() {
        cause.target = failure.map(|f| f.target.clone());
    }
}

#[derive(Debug, thiserror::Error)]
#[error("attachment `{name}` is recorded on the task but {path} is missing")]
struct MissingAttachment {
    name: String,
    path: PathBuf,
}

/// The task's attachments as absolute paths, each checked to still exist.
fn task_attachments(
    queue: &Queue,
    task: &Task,
) -> std::result::Result<Vec<PathBuf>, MissingAttachment> {
    let paths = queue.attachment_paths(task);
    for (name, path) in task.attachments.iter().zip(&paths) {
        if !path.is_file() {
            return Err(MissingAttachment {
                name: name.clone(),
                path: path.clone(),
            });
        }
    }
    Ok(paths)
}

/// What [`attempt`] should tell a [`Starter`] about `task`'s current operator
/// answers before handing it to `Runner` — the actual boundary between
/// [`choose_starter`]'s routing and the graph, factored out so it is
/// assertable without a real repository, git branch, or agent CLI.
///
/// `Starter::Review` deliberately answers `None`: `Runner::review` builds its
/// instruction from the reviewed branch's own commit log because there is no
/// task statement to speak of for hand-written work, and splicing operator
/// answers into that text would contradict the very message it sends
/// reviewers ("there is no task statement").
fn prepare_instruction(
    starter: &Starter,
    old_instruction: Option<&str>,
    task: &Task,
) -> Option<String> {
    match starter {
        Starter::Start => Some(instruction_for(task)),
        Starter::Resume(_) => Some(resumed_instruction(
            old_instruction.expect("a resumed run always has a prior instruction"),
            task,
        )),
        Starter::Review(_) => None,
    }
}

/// Persist a transition. A queue write failure is logged rather than fatal: the
/// run already happened, and taking the daemon down would only add a lost
/// backlog to a full disk.
fn record(queue: &Queue, task: &mut Task) {
    if let Err(e) = queue.put(task) {
        tracing::error!("could not record task {}: {e:#}", task.short());
        let notice = Notice::error(
            "loop:record",
            format!(
                "Task {} state could not be saved: {}. Check the disk.",
                task.id,
                e.to_string().lines().next().unwrap_or("unknown save error")
            ),
        )
        .link(Link::Task {
            id: task.id.clone(),
        });
        // The queue lives at `<home>/queue`, so its parent is the home.
        match queue.root().parent().filter(|p| !p.as_os_str().is_empty()) {
            Some(home) => notices::raise_in(home, notice),
            None => notices::raise(notice),
        }
    }
}

/// Every runnable task, in the order the loop should try them.
///
/// The head of this list is exactly what [`Queue::next_runnable`] offers; the
/// tail exists so that a claim somebody else holds costs the loop the next
/// candidate rather than a whole poll interval of idleness.
fn runnable(queue: &Queue) -> Vec<Task> {
    let mut tasks: Vec<Task> = queue
        .list()
        .into_iter()
        .filter(|t| t.status.runnable())
        .collect();
    tasks.sort_unstable_by(crate::queue::dispatch_order);
    tasks
}

/// Why a run ended where it did, in one line, for [`Task::last_error`].
///
/// A stalled run names the seats the quota took out: "out of quota" is not
/// actionable, while "judge-2, judge-3 hit a limit" tells the operator which
/// agent to replace or which plan to top up.
///
/// Uses [`RunStatus::display_label`] rather than [`label`]/`as_str` on
/// purpose: unlike `label`'s other callers (an internal log line, an
/// already-a-bug fallback message), this string becomes `Task::last_error`
/// verbatim, which the phone renders in the same alarm-styled box an
/// ordinary failure gets — see `web::tests` and `assets/ui/app.js`'s
/// `.err` styling. A bare `verified_noop` there would read exactly like the
/// failure this whole feature exists to tell apart from one.
fn describe(state: &RunState) -> String {
    let p = phrases(&state.config.graph.language);
    let mut detail = if state.status == RunStatus::Stalled {
        let mut seats: Vec<&str> = state.quota.iter().map(|q| q.seat.as_str()).collect();
        seats.sort_unstable();
        seats.dedup();
        if seats.is_empty() {
            p.quorum_lost.to_owned()
        } else {
            format!("{}{}{}", p.quorum_lost, p.quota_took_out, seats.join(", "))
        }
    } else {
        format!("{}{}", p.run_ended, state.status.display_label())
    };
    if let Some(last) = state.events.last() {
        // The review loop's "never answered" stop is the one event worth
        // translating; it is recognised from structured state, not by
        // matching the English event text (which stays as recorded).
        let unanswered = state
            .reviews
            .last()
            .filter(|r| {
                state.status == RunStatus::Blocked
                    && last.node == "review"
                    && r.incomplete()
                    && r.blocking == 0
                    && r.round == state.config.graph.review_rounds
                    && r.e2e.iter().all(crate::run::CommandOutcome::ok)
            })
            .map(|r| (r.expected - r.answered, r.round));
        match unanswered {
            Some((missing, rounds)) if crate::lang::is_japanese(&state.config.graph.language) => {
                detail.push_str(&format!(
                    " ({}: {})",
                    last.node,
                    (p.reviewers_never_answered)(missing, rounds)
                ));
            }
            _ => detail.push_str(&format!(" ({}: {})", last.node, last.message)),
        }
    }
    detail.push_str(&format!(" [run {}]", state.id));
    detail
}

/// Upper bound on [`Task::diagnostic`]'s length, in bytes.
///
/// The task file lives in the backlog indefinitely; a diagnostic is an
/// excerpt of the run's own `artifacts/`, not a copy of them, so this has to
/// stay small regardless of how much a gate command or a candidate printed.
const DIAGNOSTIC_MAX: usize = 4_000;

/// Tail kept from a single failing command's output inside a diagnostic.
/// Smaller than [`crate::graph`]'s own `OUTPUT_TAIL` on purpose: this is a
/// pointer for a human deciding whether to go read the full artifact by hand,
/// not a replacement for reading it.
const DIAGNOSTIC_OUTPUT_TAIL: usize = 800;

/// Assemble a bounded diagnostic excerpt from a held task's own run, so
/// `magi task show` says more than the one-line reason in [`describe`].
///
/// The one-liner answers "where did the run stop"; this answers "what would a
/// human have found opening `artifacts/` by hand" — the point of the whole
/// feature is the case that one-liner actively misleads on: a run held as "no
/// candidate produced a change" can mean the implementer actually finished
/// the task (opened a PR, merged it, tagged a release) and only left a clean
/// local worktree behind, which reads as "nothing happened" unless someone
/// goes and reads what the agent actually said. `None` when the run carries
/// none of the three shapes this recognises — an ordinary run held for
/// something not diagnosable from `RunState` alone still explains itself
/// through `Task::last_error`.
fn diagnostic(state: &RunState) -> Option<String> {
    let mut parts: Vec<String> = Vec::new();

    // Gate failure: which check(s), and the tail of what each printed.
    for o in state.gate.iter().filter(|o| !o.ok()) {
        parts.push(format!(
            "gate `{}` failed ({}):\n{}",
            o.command,
            notices::exit_status(o.code),
            crate::run::tail(&o.output_tail, DIAGNOSTIC_OUTPUT_TAIL)
        ));
    }

    // The land loop gave up because the fixer declined while checks were
    // still red: the message already names them (see `land::run`).
    if let Some(last) = state
        .events
        .iter()
        .rev()
        .find(|e| e.node == "land" && e.message.contains("fixer produced no commit"))
    {
        parts.push(last.message.clone());
    }

    // No viable candidate: every implementer's own final word, sanitized the
    // same way a judge would have read it, so a run that actually finished
    // the job does not read as an unexplained failure. A verified no-op is
    // called out ahead of its own summary and apart from an ordinary
    // failure's `why` — this is the one candidate shape whose diagnostic a
    // human is expected to actually judge, not just skim.
    if state.viable().is_empty() {
        for c in &state.candidates {
            if let Some(evidence) = &c.verified_noop {
                parts.push(format!(
                    "candidate {} (agent-verified no-op, unconfirmed by magi): {evidence}",
                    c.label
                ));
            } else if !c.summary.trim().is_empty() {
                parts.push(format!("candidate {}: {}", c.label, c.summary.trim()));
            } else if let Some(why) = &c.failed {
                parts.push(format!("candidate {}: {why}", c.label));
            }
        }
    }

    if parts.is_empty() {
        return None;
    }
    // `run::tail` prefixes an "N earlier bytes omitted" marker whose own
    // length depends on N, so asking it for exactly `DIAGNOSTIC_MAX` can come
    // back slightly over. Leave it enough room to always land under the
    // limit.
    Some(crate::run::tail(
        &parts.join("\n\n"),
        DIAGNOSTIC_MAX.saturating_sub(100),
    ))
}

/// Stable lower-case name for a run status, for an internal log line and the
/// "graph stopped without reaching a terminal status" bug message in
/// [`settle`] — never for [`Task::last_error`] itself; see [`describe`]'s own
/// doc for why that one reads [`RunStatus::display_label`] instead. One
/// definition of a status's name, on the type that owns it: this table used
/// to live here as a second copy, and a status renamed in one place would
/// have gone on reading correctly in the other.
fn label(status: RunStatus) -> &'static str {
    status.as_str()
}

/// Parse a merge mode override.
pub(crate) fn merge_mode(mode: &str) -> Result<MergeMode> {
    match mode {
        "none" => Ok(MergeMode::None),
        "local" => Ok(MergeMode::Local),
        "pr" => Ok(MergeMode::Pr),
        other => bail!("unknown merge mode `{other}`; expected none, local or pr"),
    }
}

/// Take the status lock, recovering from a poisoned one.
///
/// A panic elsewhere must not silently stop the heartbeat: the status is plain
/// data, and the worst a poisoned lock can hold is a stale timestamp.
fn lock<T>(mutex: &Mutex<T>) -> MutexGuard<'_, T> {
    mutex
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::queue::{Source, TaskStatus};
    use crate::run::{Candidate, CommandOutcome};
    use pretty_assertions::assert_eq;

    fn task() -> Task {
        Task::new(
            "add retries".to_owned(),
            "add retries".to_owned(),
            PathBuf::from("/repo"),
            Source::Human,
        )
    }

    fn starting_task_reservation(home: &Path, request: &TaskWorker) -> crate::worker::Job {
        let job = crate::worker::Job {
            id: "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa".into(),
            sequence: 1,
            kind: "task".into(),
            key: format!("task:{}", request.task),
            payload: serde_json::to_value(request).unwrap(),
            generation: "a".repeat(64),
            version: None,
            status: crate::worker::Status::Starting,
            result: None,
            pid: None,
            created_at: u64::try_from(Timestamp::now().as_second()).unwrap(),
            finished_at: None,
        };
        let dir = home.join("workers/jobs").join(&job.id);
        std::fs::create_dir_all(&dir).unwrap();
        std::fs::write(dir.join("job.json"), serde_json::to_vec(&job).unwrap()).unwrap();
        job
    }

    #[test]
    fn an_unacknowledged_own_reservation_stops_dispatch_without_cancelling_the_child() {
        let home = tempfile::tempdir().unwrap();
        let request = TaskWorker {
            opts: Opts::default(),
            queue: home.path().join("queue"),
            task: "startup".into(),
            lane: PermitKind::Ordinary,
            standalone: false,
        };
        let job = starting_task_reservation(home.path(), &request);
        let error = task_worker_spawn_error(
            home.path(),
            &request,
            anyhow::anyhow!("worker startup is unacknowledged: private-error-detail"),
        )
        .expect_err("our own reservation must not turn a failed spawn into a resync");
        let active = crate::worker::active(home.path()).unwrap();
        assert_eq!(active.len(), 1);
        assert_eq!(active[0].id, job.id);
        assert_eq!(active[0].status, crate::worker::Status::Starting);
        assert!(
            crate::worker::control(home.path(), &job.key)
                .unwrap()
                .is_none()
        );
        let notices = notices::Notices::at(home.path().join("notifications")).list();
        assert_eq!(notices.len(), 1);
        assert_eq!(notices[0].key, "loop:worker-startup");
        assert!(!notices[0].message.contains("private-error-detail"));
        assert!(notices[0].message.contains(&request.task));
        assert!(
            notices[0]
                .message
                .contains("could not be started or acknowledged")
        );
        assert!(notices[0].message.contains("worker.log"));
        assert_eq!(
            notices[0].link,
            Some(Link::Task {
                id: request.task.clone()
            })
        );
        assert!(format!("{error:#}").contains("private-error-detail"));
    }

    #[test]
    fn a_standalone_handoff_reservation_resyncs_dispatch_without_replacing_it() {
        let home = tempfile::tempdir().unwrap();
        let mut request = TaskWorker {
            opts: Opts::default(),
            queue: home.path().join("queue"),
            task: "handoff".into(),
            lane: PermitKind::Ordinary,
            standalone: true,
        };
        let job = starting_task_reservation(home.path(), &request);
        request.standalone = false;
        task_worker_spawn_error(
            home.path(),
            &request,
            anyhow::anyhow!("operation key is already reserved for a different request"),
        )
        .expect("a different standalone request is the handoff race, not our startup failure");
        let active = crate::worker::active(home.path()).unwrap();
        assert_eq!(active.len(), 1);
        assert_eq!(active[0].id, job.id);
        assert_eq!(active[0].payload, job.payload);
        assert!(
            notices::Notices::at(home.path().join("notifications"))
                .list()
                .is_empty()
        );
    }

    #[test]
    fn starting_worker_projects_the_previous_run_without_owning_its_execution() {
        let home = tempfile::tempdir().unwrap();
        let queue = Queue::at(home.path().join("queue"));
        let mut task = task();
        task.runs = vec!["previous".into()];
        queue.put(&mut task).unwrap();
        let request = TaskWorker {
            opts: Opts::default(),
            queue: home.path().join("queue"),
            task: task.id.clone(),
            lane: PermitKind::Ordinary,
            standalone: false,
        };
        let job = starting_task_reservation(home.path(), &request);
        let claims = current_work(home.path(), Timestamp::now());
        assert_eq!(claims.len(), 1);
        assert_eq!(claims[0].worker.as_deref(), Some(job.id.as_str()));
        assert_eq!(claims[0].run, "previous");
        assert!(other_claims_run(&claims, "previous", None));
        // Only after confirming the executing caller may admission ignore
        // this exact projection. Cleanup continues to observe it as live.
        assert!(!other_claims_run(&claims, "previous", Some(&job.id)));
        assert!(is_working_on(home.path(), "previous", Timestamp::now()));
    }

    #[test]
    fn admission_excludes_only_the_callers_exact_reservation() {
        let own = Current {
            worker: Some("own".into()),
            task: "same-task".into(),
            run: "previous".into(),
        };
        assert!(!other_claims_run(
            std::slice::from_ref(&own),
            "previous",
            Some("own")
        ));
        assert!(other_claims_run(
            std::slice::from_ref(&own),
            "previous",
            None
        ));
        for worker in [None, Some("other".into())] {
            let other = Current {
                worker,
                ..own.clone()
            };
            assert!(other_claims_run(
                &[own.clone(), other],
                "previous",
                Some("own")
            ));
        }
        let legacy: Current =
            serde_json::from_str(r#"{"task":"same-task","run":"previous"}"#).unwrap();
        assert!(other_claims_run(&[legacy], "previous", Some("own")));
    }

    #[test]
    fn review_retry_resumes_only_the_matching_authorized_latest_owner() {
        let mut task = task();
        let mut run = run_state(RunStatus::Reviewing);
        run.task_instruction = Some(task.instruction.clone());
        run.reviewed_commits = Some(vec!["committed-fix".into()]);
        let branch = "magi/test/B";
        run.candidates.push(crate::run::Candidate {
            branch: branch.into(),
            ..candidate('B', "preserved work", false, None)
        });
        task.runs = vec![run.id.clone()];
        let unfinished = unfinished_run_with(&task.runs, task.short(), |_| Ok(run.clone()));
        assert_eq!(
            review_retry_starter(&task, Some(&run), Some(branch), true, unfinished.as_deref()),
            Starter::Resume(run.id.clone())
        );
        assert!(matches!(
            review_retry_starter(
                &task,
                Some(&run),
                Some("different"),
                true,
                unfinished.as_deref()
            ),
            Starter::Review(_)
        ));
        assert_eq!(
            review_retry_starter(
                &task,
                Some(&run),
                Some(branch),
                false,
                unfinished.as_deref()
            ),
            Starter::Start
        );
        task.instruction.push_str(" changed criteria");
        assert!(matches!(
            review_retry_starter(&task, Some(&run), Some(branch), true, unfinished.as_deref()),
            Starter::Review(_)
        ));
        assert!(matches!(
            review_retry_starter(&task, Some(&run), Some(branch), true, None),
            Starter::Review(_)
        ));
    }

    #[test]
    fn a_live_worker_reservation_prevents_reclaim_before_its_task_claim() {
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().join("queue"));
        let mut task = task();
        task.status = TaskStatus::Running;
        task.attempts = 1;
        queue.put(&mut task).unwrap();
        let live = std::collections::BTreeSet::from([task.id.clone()]);
        assert!(reclaim_orphaned_running(&queue, 2, &live).is_empty());
        drop(queue.claim(&task.id).unwrap());
        let saved = queue.get(&task.id).unwrap();
        assert_eq!(saved.status, TaskStatus::Running);
        assert_eq!(saved.attempts, 1);
        assert!(saved.last_error.is_none());
    }

    #[test]
    fn standalone_workers_do_not_consume_scheduler_lanes() {
        let request = |task: &str, lane, standalone| TaskWorker {
            opts: Opts::default(),
            queue: PathBuf::from("/queue"),
            task: task.to_owned(),
            lane,
            standalone,
        };
        let mut jobs = vec![
            request("ordinary", PermitKind::Ordinary, false),
            request("standalone-urgent", PermitKind::Urgent, true),
            request("standalone-ordinary", PermitKind::Ordinary, true),
            request("decision", PermitKind::None, false),
        ];
        assert_eq!(available_slots(&jobs, 2), (1, 1));
        jobs.push(request("urgent", PermitKind::Urgent, false));
        assert_eq!(available_slots(&jobs, 2), (1, 0));
        assert_eq!(available_slots(&jobs, 0), (0, 0));
    }

    #[test]
    fn a_live_legacy_scheduler_blocks_migration_even_with_a_stale_heartbeat() {
        let now = Timestamp::now();
        let mut reading = Reading {
            pid: Some(std::process::id()),
            updated_at: Some(now - jiff::SignedDuration::from_secs(STALE_SECS + 1)),
            ..Reading::default()
        };
        assert!(!reading.running(now));
        assert!(legacy_scheduler_running(&reading, now, 0));
        reading.worker_protocol = Some(1);
        assert!(!legacy_scheduler_running(&reading, now, 0));
    }

    #[test]
    fn selected_public_head_overrides_historical_resume_and_pin() {
        let mut t = task();
        let mut old = run_state(RunStatus::Blocked);
        let selection = crate::pr_recovery::Selection {
            url: "url".into(),
            branch: format!("magi/task-{}", t.id),
            head: "a".repeat(40),
            source_head: None,
            source_run: None,
            source_proof: None,
            disposition: Some(crate::pr_recovery::Disposition::Review),
            instruction: t.instruction.clone(),
            approved_at: Timestamp::now(),
        };
        t.resume_override = Some(crate::queue::OperatorResume {
            pinned_run: Some(old.id.clone()),
            question_id: "choice".into(),
            at: Timestamp::now(),
            conductor_rehold: None,
            forced: false,
        });
        assert_eq!(
            selected_starter(&selection, Some(&old), Some(&old.id)),
            Starter::Review(selection.branch.clone())
        );
        old.pr_recovery = Some(selection.clone());
        assert_eq!(
            selected_starter(&selection, Some(&old), Some(&old.id)),
            Starter::Review(selection.branch.clone())
        );
        old.reviewed_commits = Some(vec!["implementation".into()]);
        assert_eq!(
            selected_starter(&selection, Some(&old), Some(&old.id)),
            Starter::Resume(old.id.clone())
        );
        let mut changed = selection.clone();
        changed.head = "b".repeat(40);
        assert_eq!(
            selected_starter(&changed, Some(&old), Some(&old.id)),
            Starter::Review(changed.branch)
        );
    }

    #[test]
    fn candidate_transplant_failure_is_one_actionable_hold() {
        let dir = tempfile::tempdir().unwrap();
        let q = Queue::at(dir.path().join("queue"));
        let mut t = task();
        let mut state = run_state(RunStatus::Blocked);
        state.event("prep", "cannot apply referenced commit: conflict");
        state.prep_failure = Some("conflict".into());
        t.start(state.id.clone());
        finish_attempt(3, &q, &mut t, &state, &[], Err(anyhow::anyhow!("conflict")));
        assert_eq!(t.attempts, 1);
        assert_eq!(t.status, TaskStatus::Held);
        assert!(t.operator_held());
        assert!(!t.status.runnable());
        assert!(t.hold_reason.as_deref().unwrap().contains("recover-pr"));
        let first = t.chat_notice_key().unwrap();
        t.chat_notices.push(first.clone());
        t.release_operator("test", None);
        state.id = "another-unprepared-run".into();
        t.start(state.id.clone());
        finish_attempt(
            3,
            &q,
            &mut t,
            &state,
            &[],
            Err(anyhow::anyhow!("still conflicts")),
        );
        assert_eq!(
            t.chat_notice_key().as_ref(),
            Some(&first),
            "no work happened"
        );
        t.release_operator("test", None);
        state.prep_failure = None;
        state.status = RunStatus::Failed;
        state.begin_pass();
        t.start(state.id.clone());
        finish_attempt(
            1,
            &q,
            &mut t,
            &state,
            &[],
            Err(anyhow::anyhow!("new gate failure")),
        );
        let failure = t.chat_notice_key().unwrap();
        assert_ne!(failure, first, "approved recovery reached a real failure");
        t.release_operator("test", None);
        state.begin_pass();
        t.start(state.id.clone());
        finish_attempt(
            1,
            &q,
            &mut t,
            &state,
            &[],
            Err(anyhow::anyhow!("new failure on resume")),
        );
        assert_ne!(
            t.chat_notice_key().as_ref(),
            Some(&failure),
            "a new settled pass"
        );
    }

    #[test]
    fn revised_resumption_invalidates_old_pins_and_preserves_unchanged_pins() {
        for source in ["cli", "web"] {
            let mut t = task();
            let mut run = run_state(RunStatus::Blocked);
            run.instruction = "Run A original criteria".into();
            run.task_instruction = Some(run.instruction.clone());
            t.start(run.id.clone());
            t.release_operator("choice", Some("resume-question"));
            t.resume_override = Some(crate::queue::OperatorResume {
                question_id: "resume-question".into(),
                at: Timestamp::now(),
                conductor_rehold: None,
                forced: true,
                pinned_run: Some(run.id.clone()),
            });
            t.hold_machine(Some("not enough free space to start a run".into()));
            let mut unchanged = t.clone();
            unchanged
                .edit("title changed".into(), unchanged.instruction.clone())
                .unwrap();
            unchanged.release_operator(source, None);
            assert_eq!(
                unchanged
                    .resume_override
                    .as_ref()
                    .unwrap()
                    .pinned_run
                    .as_deref(),
                Some(run.id.as_str())
            );
            assert!(!compatible_run_instruction(&run, &unchanged));
            assert!(may_resume_run(&run, &unchanged));

            t.edit(
                "approved recovery".into(),
                "Reuse measured PR head B; fix Clippy; review".into(),
            )
            .unwrap();
            assert!(t.resume_override.is_none());
            t.release_operator(source, None);
            let reloaded: Task = serde_json::from_str(&serde_json::to_string(&t).unwrap()).unwrap();
            assert!(reloaded.resume_override.is_none());
            assert!(!may_resume_run(&run, &reloaded));
            let unfinished =
                unfinished_run_with(&reloaded.runs, reloaded.short(), |_| Ok(run.clone()))
                    .filter(|_| may_resume_run(&run, &reloaded));
            assert_eq!(
                choose_starter(None, false, unfinished.as_deref()),
                Starter::Start
            );
            assert!(instruction_for(&reloaded).starts_with("Reuse measured PR head B"));
            assert_eq!(
                reloaded.resumption_history[0].question_id.as_deref(),
                Some("resume-question")
            );

            // A revision already persisted with the old approval/pin is also
            // invalidated when the new operator release is recorded.
            unchanged.instruction = "Reuse measured PR head B".into();
            unchanged.hold_machine(Some("disk hold".into()));
            unchanged.release_operator(source, None);
            assert!(unchanged.resume_override.is_none());
            assert!(!may_resume_run(&run, &unchanged));
        }
    }

    #[test]
    fn resumption_preserves_generated_review_runs_and_rejects_revised_targets() {
        let mut t = task();
        let mut run = run_state(RunStatus::Blocked);
        t.review_of = Some("approved-head".into());
        t.instruction =
            "Review the branch `approved-head` (review-only: no implementation, no judging)."
                .into();
        run.instruction = "Review the work already on branch `approved-head`. There is no task statement: what the change claims to do is whatever its commits say.\n\nCommit log".into();
        run.reviewed_commits = Some(vec!["Commit log".into()]);
        t.start(run.id.clone());
        t.hold_machine(Some("interrupted review".into()));
        t.release_operator("cli", None);
        assert!(
            compatible_run_instruction(&run, &t),
            "legacy explicit review remains resumable"
        );
        let unfinished = unfinished_run_with(&t.runs, t.short(), |_| Ok(run.clone()))
            .filter(|_| compatible_run_instruction(&run, &t));
        assert_eq!(
            choose_starter(None, false, unfinished.as_deref()),
            Starter::Resume(run.id.clone())
        );
        run.task_instruction = Some(t.instruction.clone());
        assert!(compatible_run_instruction(&run, &t));
        let reloaded: RunState =
            serde_json::from_str(&serde_json::to_string(&run).unwrap()).unwrap();
        assert!(compatible_run_instruction(&reloaded, &t));
        t.edit(
            "new approved head".into(),
            "Reuse measured PR head B".into(),
        )
        .unwrap();
        assert!(!compatible_run_instruction(&run, &t));

        // Legacy recovery reviews retain the task criteria ahead of the log.
        t.review_of = None;
        t.instruction = "Fix Clippy on approved head".into();
        run.task_instruction = None;
        run.instruction = format!(
            "{}\n\n# Work already on branch `approved-head` (commit subjects)\n\nCommit log",
            t.instruction
        );
        assert!(compatible_run_instruction(&run, &t));
        t.instruction.push('\n');
        assert!(
            compatible_run_instruction(&run, &t),
            "legacy generated review trimmed the original criteria"
        );
        t.hold_for_handover(Some("approved-head".into()), "refused".into());
        let mut unchanged = t.clone();
        assert_eq!(
            take_review_branch(&mut unchanged, Some(&run)).as_deref(),
            Some("approved-head")
        );
        t.edit("new plan".into(), "Reuse measured PR head B".into())
            .unwrap();
        assert!(take_review_branch(&mut t, Some(&run)).is_none());
        assert!(!compatible_run_instruction(&run, &t));
        t.review_branch = Some("approved-head".into());
        t.review_instruction = None;
        assert!(
            take_review_branch(&mut t, Some(&run)).is_none(),
            "legacy retained candidate cannot replace a revised approved head"
        );
    }

    #[test]
    fn resumption_actions_survive_automatic_holds_of_hand_started_runs() {
        crate::run::pin_test_home();
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().join("queue"));
        for resume in [true, false] {
            let state = run_state(RunStatus::Blocked);
            let mut t = task();
            t.start(state.id.clone());
            let action = if resume {
                ask::ChoiceAction::Resume {
                    run: state.id.clone(),
                }
            } else {
                ask::ChoiceAction::Requeue
            };
            let mut q = action_question(&state.id, action);
            q.status = ask::QuestionStatus::Open;
            q.answer = None;
            q.answered_at = None;
            t.fail("run stopped with a question", 3);
            hold_if_runnable(&queue, &mut t);
            assert!(t.operator_decided_at.is_none());
            assert!(t.operator_held());
            q.answer(ask::Answer::Choice(q.choices[0].clone())).unwrap();
            let expected = if resume {
                ActionDecision::Resume(state.id.clone())
            } else {
                ActionDecision::Requeue
            };
            assert_eq!(
                decide_action(&t, &q, phrases("en"), |_| Ok(state.clone())),
                expected
            );
            t.hold_manual(Some("later explicit hold".into()));
            assert_eq!(
                decide_action(&t, &q, phrases("en"), |_| Ok(state.clone())),
                ActionDecision::Stale
            );
        }
    }

    #[test]
    fn explicit_resumption_keeps_revised_instruction_and_audit_answers() {
        let mut t = task();
        t.answers.push(crate::queue::AnsweredQuestion {
            question: "Inspect the remote?".into(),
            answer: "Inspect then wait".into(),
        });
        let old = instruction_for(&t);
        assert!(compatible_instruction(&old, &t));
        t.instruction = "Reuse approved PR head and review".into();
        t.release_operator("cli", None);
        assert!(!compatible_instruction(&old, &t));
        let approved = instruction_for(&t);
        assert!(approved.contains("waiting premises are superseded"));
        assert!(compatible_instruction(&approved, &t));
        assert_eq!(resumed_instruction(&approved, &t), approved);
        t.release_operator("web", None);
        assert!(compatible_instruction(&approved, &t));
        assert_eq!(t.resumption_history.len(), 1);
        t.start("run".into());
        assert!(instruction_for(&t).contains("Explicit operator resumption"));
    }

    /// A run that stopped on an infrastructure wait asked no agent anything:
    /// the task is held by the machine under a `[resource]` reason (resumable,
    /// re-checked by triage), and the attempt it started is given back.
    #[test]
    fn a_resource_blocked_run_holds_its_task_and_spends_no_attempt() {
        let mut state = RunState::new(
            PathBuf::from("/repo"),
            "main".to_owned(),
            "abc1234".to_owned(),
            "task".to_owned(),
            Config::default(),
        );
        state.status = RunStatus::Blocked;
        state.resource_block = Some(crate::run::ResourceBlock {
            cause: crate::run::ResourceBlockCause::Other,
            node: "graft".to_owned(),
            kind: "shared build cache".to_owned(),
            detail: "timed out".to_owned(),
            at: jiff::Timestamp::now(),
        });
        let mut t = task();
        t.start("20260902-000000-aaaa".to_owned());
        assert_eq!(t.attempts, 1);
        let verdict = Verdict {
            status: RunStatus::Blocked,
            left_pr: false,
            quota_hit: false,
            parked: false,
            no_viable_candidates: false,
        };
        settle_and_diagnose(&mut t, verdict, "blocked", 2, &state);
        assert_eq!(t.status, TaskStatus::Held);
        assert_eq!(t.attempts, 0, "the attempt is refunded");
        assert!(t.hold_reason.as_deref().unwrap().starts_with("[resource] "));
        assert!(
            !t.operator_held(),
            "a machine hold, released without a human"
        );

        let mut selected = task();
        selected.start("20260902-000000-cccc".into());
        selected.replacement = Some(crate::merge_decision::Replacement {
            question: "fixture".into(),
            run: "earlier".into(),
            pr: "https://example.invalid/pr/1".into(),
            agent: "selected".into(),
            context: "fixture".into(),
        });
        state.resource_block.as_mut().unwrap().kind = "repository coordination".into();
        settle_and_diagnose(&mut selected, verdict, "blocked", 2, &state);
        assert_eq!(selected.attempts, 0);
        assert!(
            !selected.operator_held(),
            "a selected agent also retains a machine resource hold"
        );
        assert!(
            selected
                .hold_reason
                .as_deref()
                .unwrap()
                .starts_with("[resource] ")
        );

        // A park request outranks it: still the operator's doing.
        let mut p = task();
        p.start("20260902-000000-bbbb".to_owned());
        settle_and_diagnose(
            &mut p,
            Verdict {
                parked: true,
                ..verdict
            },
            "parked",
            2,
            &state,
        );
        assert_eq!(p.status, TaskStatus::Parked);
        assert_eq!(
            p.attempts, 0,
            "parking refunds once rather than also settling the resource hold"
        );
    }

    #[test]
    fn record_failure_notice_links_the_task() {
        let dir = tempfile::tempdir().unwrap();
        // A regular file where the queue directory should be makes every
        // `put` fail, on every platform and whoever runs the test.
        std::fs::write(dir.path().join("queue"), b"not a directory").unwrap();
        let queue = Queue::at(dir.path().join("queue"));
        let mut t = interrupt_task("rec-fail-1");
        record(&queue, &mut t);

        let found = crate::notices::Notices::at(dir.path().join("notifications")).list();
        assert_eq!(found.len(), 1);
        assert_eq!(found[0].key, "loop:record");
        assert_eq!(
            found[0].link,
            Some(Link::Task {
                id: "rec-fail-1".to_owned()
            })
        );
    }

    /// A runnable task marked to interrupt, with an id fixed for assertions
    /// rather than the random one [`Task::new`] mints.
    fn interrupt_task(id: &str) -> Task {
        let mut t = task();
        t.id = id.to_owned();
        t.interrupt = true;
        t
    }

    /// An ordinary runnable task with an id fixed for assertions.
    fn task_with_id(id: &str) -> Task {
        let mut t = task();
        t.id = id.to_owned();
        t
    }

    /// A runnable task marked `--urgent`, with an id fixed for assertions.
    fn urgent_task(id: &str) -> Task {
        let mut t = task();
        t.id = id.to_owned();
        t.urgent = true;
        t
    }

    #[test]
    fn upgrade_resume_dispatch_keeps_claim_and_lane_limits() {
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().join("queue"));
        let mut parked = task_with_id("parked");
        parked.start("run".into());
        parked.park("upgrade");
        parked.record_pass_at(
            "run",
            0,
            Some(Timestamp::now()),
            1,
            Some(crate::run::ParkCause::Upgrade {
                from: "old".into(),
                to: None,
            }),
        );
        let mut fresh = task_with_id("fresh");
        fresh.priority = 100;
        let mut urgent_task = urgent_task("urgent");
        for t in [&mut parked, &mut fresh, &mut urgent_task] {
            queue.put(t).unwrap();
        }
        let ordinary = Arc::new(tokio::sync::Semaphore::new(1));
        let urgent = Arc::new(tokio::sync::Semaphore::new(1));
        let candidates = runnable(&queue);
        assert_eq!(candidates[0].id, parked.id);
        let first = claim_dispatch(&queue, &candidates[0], false, &ordinary, &urgent).unwrap();
        assert!(claim_dispatch(&queue, &fresh, false, &ordinary, &urgent).is_none());
        assert!(claim_dispatch(&queue, &urgent_task, false, &ordinary, &urgent).is_some());
        drop(first);
        let claimed_elsewhere = queue.claim(&parked.id).unwrap();
        let next = runnable(&queue)
            .into_iter()
            .find_map(|t| claim_dispatch(&queue, &t, false, &ordinary, &urgent))
            .unwrap();
        assert_eq!(next.task.id, fresh.id);
        assert_eq!(queue.get(&parked.id).unwrap().attempts, 0);
        drop(claimed_elsewhere);
        drop(next);
        assert!(claim_dispatch(&queue, &parked, true, &ordinary, &urgent).is_none());
    }

    #[test]
    fn urgent_dispatch_has_one_extra_slot_and_never_uses_a_stale_flag() {
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().join("queue"));
        let ordinary = Arc::new(tokio::sync::Semaphore::new(1));
        let urgent = Arc::new(tokio::sync::Semaphore::new(1));
        let occupied = Arc::clone(&ordinary).try_acquire_owned().unwrap();
        let mut first = task();
        queue.put(&mut first).unwrap();
        let stale_plain = queue.get(&first.id).unwrap();
        first.set_urgent(true).unwrap();
        queue.put(&mut first).unwrap();
        let dispatched = claim_dispatch(&queue, &stale_plain, false, &ordinary, &urgent).unwrap();
        let mut second = urgent_task("second");
        queue.put(&mut second).unwrap();
        assert!(claim_dispatch(&queue, &second, false, &ordinary, &urgent).is_none());
        drop(queue.claim(&second.id).unwrap());
        assert_eq!(queue.get(&second.id).unwrap().attempts, 0);
        drop(dispatched);
        let stale_urgent = queue.get(&first.id).unwrap();
        first.set_urgent(false).unwrap();
        queue.put(&mut first).unwrap();
        assert!(claim_dispatch(&queue, &stale_urgent, false, &ordinary, &urgent).is_none());
        assert_eq!(urgent.available_permits(), 1);
        drop(queue.claim(&first.id).unwrap());
        drop(occupied);
    }

    #[test]
    fn urgent_dispatch_uses_saved_lane_and_releases_unsuccessful_claims() {
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().join("queue"));
        let ordinary = Arc::new(tokio::sync::Semaphore::new(1));
        let urgent = Arc::new(tokio::sync::Semaphore::new(1));
        let mut t = task();
        queue.put(&mut t).unwrap();
        for enabled in [true, false] {
            let stale = queue.get(&t.id).unwrap();
            t.set_urgent(enabled).unwrap();
            queue.put(&mut t).unwrap();
            assert_ne!(stale.urgent, enabled);
            let DispatchClaim {
                task: fresh,
                claim,
                permit,
            } = claim_dispatch(&queue, &stale, false, &ordinary, &urgent).unwrap();
            assert_eq!(fresh.urgent, enabled);
            assert_eq!(ordinary.available_permits(), usize::from(enabled));
            assert_eq!(urgent.available_permits(), usize::from(!enabled));
            assert!(queue.claim(&t.id).is_err());
            assert_eq!(fresh.attempts, stale.attempts);
            drop((claim, permit));
            assert_eq!(ordinary.available_permits(), 1);
            assert_eq!(urgent.available_permits(), 1);
        }
        t.set_urgent(true).unwrap();
        queue.put(&mut t).unwrap();
        let occupied = Arc::clone(&urgent).try_acquire_owned().unwrap();
        assert!(claim_dispatch(&queue, &t, false, &ordinary, &urgent).is_none());
        assert_eq!(ordinary.available_permits(), 1, "no ordinary fallback");
        drop(queue.claim(&t.id).unwrap());
        assert_eq!(queue.get(&t.id).unwrap().attempts, t.attempts);
        drop(occupied);
        assert!(claim_dispatch(&queue, &t, true, &ordinary, &urgent).is_none());
        drop(queue.claim(&t.id).unwrap());
        let held = queue.claim(&t.id).unwrap();
        assert!(claim_dispatch(&queue, &t, false, &ordinary, &urgent).is_none());
        drop(held);
        t.status = TaskStatus::Held;
        queue.put(&mut t).unwrap();
        assert!(claim_dispatch(&queue, &t, false, &ordinary, &urgent).is_none());
        drop(queue.claim(&t.id).unwrap());
        std::fs::remove_file(queue.path_of(&t.id)).unwrap();
        assert!(claim_dispatch(&queue, &t, false, &ordinary, &urgent).is_none());
        drop(queue.claim(&t.id).unwrap());
        assert_eq!(urgent.available_permits(), 1);
    }

    /// The land-resume exemption wins outright, whether or not the candidate
    /// also happens to be marked [`Task::urgent`]: a resume's own "must not
    /// queue behind anything" guarantee cannot be weaker just because the
    /// same task was also filed with `--urgent`.
    #[test]
    fn permit_kind_prefers_a_land_resume_over_the_urgent_slot() {
        assert_eq!(permit_kind(true, false), PermitKind::None);
        assert_eq!(permit_kind(true, true), PermitKind::None);
    }

    /// The one property this whole feature exists for: `--urgent` draws from
    /// its own slot, never the ordinary `max_concurrent_runs` pool - and an
    /// ordinary candidate draws from the ordinary pool exactly as before,
    /// untouched by the urgent slot's existence.
    #[test]
    fn permit_kind_separates_urgent_from_ordinary() {
        assert_eq!(permit_kind(false, true), PermitKind::Urgent);
        assert_eq!(permit_kind(false, false), PermitKind::Ordinary);
    }

    /// The exact wiring `attempt` runs before minting anything: a config's
    /// `min_free_bytes` in, a task-holding reason naming both numbers out.
    /// Free space is injected rather than asked of the real disk - the point
    /// of [`disk_gate_with`] existing separately from [`disk_gate`] - so this
    /// is deterministic on every machine this test runs on, never dependent
    /// on how full the CI runner's own disk happens to be.
    #[test]
    fn disk_gate_with_holds_a_task_below_the_threshold_and_names_both_numbers() {
        let cfg = Config::default();
        let repo = Path::new("/any/repo/path");

        let reason =
            disk_gate_with(repo, &cfg, |_| Ok(1024)).expect("must hold below the threshold");
        assert!(reason.contains("1024"), "{reason}");
        assert!(
            reason.contains(&cfg.disk.min_free_bytes.to_string()),
            "{reason}"
        );

        assert_eq!(
            disk_gate_with(repo, &cfg, |_| Ok(cfg.disk.min_free_bytes)),
            None,
            "exactly at the floor is open"
        );
        assert_eq!(
            disk_gate_with(repo, &cfg, |_| Ok(cfg.disk.min_free_bytes + 1)),
            None,
            "comfortably above the floor is open"
        );
    }

    #[test]
    fn disk_gate_with_opens_unconditionally_when_the_operator_opted_out() {
        let mut cfg = Config::default();
        cfg.disk.min_free_bytes = 0;
        let repo = Path::new("/any/repo/path");
        assert_eq!(
            disk_gate_with(repo, &cfg, |_| Ok(0)),
            None,
            "a zero floor never measures at all"
        );
    }

    #[test]
    fn disk_gate_with_closes_rather_than_starts_blind_when_it_cannot_measure() {
        let cfg = Config::default();
        let repo = Path::new("/any/repo/path");
        let reason = disk_gate_with(repo, &cfg, |_| Err(anyhow::anyhow!("no df on this box")))
            .expect("a measurement failure must close the gate, not open it");
        assert!(reason.contains("could not measure"), "{reason}");
    }

    #[test]
    fn no_interrupt_task_leaves_the_sequence_idle_even_with_something_in_flight() {
        let ordinary = task();
        let next = advance_interrupt(
            Interrupt::Idle,
            std::slice::from_ref(&ordinary.id),
            std::slice::from_ref(&ordinary),
        );
        assert_eq!(next, Interrupt::Idle);
    }

    #[test]
    fn an_interrupt_task_with_nothing_in_flight_never_starts_a_sequence() {
        // Nothing to interrupt - this is just an ordinary candidate, and the
        // loop's normal dispatch will pick it up like any other.
        let marked = interrupt_task("marked");
        let next = advance_interrupt(Interrupt::Idle, &[], std::slice::from_ref(&marked));
        assert_eq!(next, Interrupt::Idle);
    }

    #[test]
    fn an_interrupt_task_with_something_in_flight_starts_parking_it() {
        let marked = interrupt_task("marked");
        let next = advance_interrupt(
            Interrupt::Idle,
            &["running".to_owned()],
            std::slice::from_ref(&marked),
        );
        assert_eq!(
            next,
            Interrupt::Parking {
                parked: vec!["running".to_owned()],
                interrupt_task: "marked".to_owned(),
            }
        );
    }

    /// R1-1-2 / R2-1-2: above the default `max_concurrent_runs`, more than
    /// one run can be in flight when a task becomes runnable and marked.
    /// Parking all of them would mean `Resuming` later has more than one id
    /// to release back to ordinary dispatch, which cannot be made safe
    /// against that same setting's own extra concurrency slots letting two
    /// of them start together - see `advance_interrupt`'s own `Idle` branch.
    /// The simplification the task's own constraints ask for: do not begin
    /// a sequence at all until the herd settles back to exactly one.
    #[test]
    fn more_than_one_run_in_flight_never_starts_an_interrupt_sequence() {
        let marked = interrupt_task("marked");

        let two = advance_interrupt(
            Interrupt::Idle,
            &["a".to_owned(), "b".to_owned()],
            std::slice::from_ref(&marked),
        );
        assert_eq!(two, Interrupt::Idle);

        let none = advance_interrupt(Interrupt::Idle, &[], std::slice::from_ref(&marked));
        assert_eq!(none, Interrupt::Idle, "nothing to interrupt either");
    }

    #[test]
    fn parking_holds_until_every_parked_id_has_actually_left_flight() {
        let state = Interrupt::Parking {
            parked: vec!["running".to_owned()],
            interrupt_task: "marked".to_owned(),
        };
        // Still in flight: no change.
        let still_going = advance_interrupt(state.clone(), &["running".to_owned()], &[]);
        assert_eq!(still_going, state);

        // Left flight, but the interrupt task has not been dispatched yet on
        // this tick - stays `Parking` so `interrupt_gate` can let it through,
        // as long as it is still runnable.
        let stopped_but_not_yet_dispatched =
            advance_interrupt(state.clone(), &[], &[interrupt_task("marked")]);
        assert_eq!(stopped_but_not_yet_dispatched, state);

        // Left flight, and the interrupt task is now in flight itself.
        let dispatched = advance_interrupt(state, &["marked".to_owned()], &[]);
        assert_eq!(
            dispatched,
            Interrupt::Running {
                parked: vec!["running".to_owned()],
                interrupt_task: "marked".to_owned(),
            }
        );
    }

    #[test]
    fn the_sequence_moves_to_resuming_the_instant_the_interrupt_tasks_own_run_leaves_flight() {
        let state = Interrupt::Running {
            parked: vec!["running".to_owned()],
            interrupt_task: "marked".to_owned(),
        };
        let still_running = advance_interrupt(state.clone(), &["marked".to_owned()], &[]);
        assert_eq!(still_running, state);

        // Whatever it ended as - merged, failed, held - is not this
        // function's concern: leaving flight is the only trigger, driven
        // straight off the same in-flight list `poll` already reaps. It does
        // not go straight to `Idle`: see `Interrupt::Running`'s own doc for
        // why that would let an unrelated task start ahead of, or alongside,
        // the guaranteed resume.
        let ended = advance_interrupt(state, &[], &[task_with_id("running")]);
        assert_eq!(
            ended,
            Interrupt::Resuming {
                parked: vec!["running".to_owned()]
            }
        );
    }

    #[test]
    fn resuming_ends_the_instant_a_parked_task_is_seen_in_flight() {
        let state = Interrupt::Resuming {
            parked: vec!["running".to_owned()],
        };
        let still_waiting = advance_interrupt(state.clone(), &[], &[task_with_id("running")]);
        assert_eq!(still_waiting, state);

        let dispatched = advance_interrupt(state, &["running".to_owned()], &[]);
        assert_eq!(dispatched, Interrupt::Idle);
    }

    /// R1-2-1: an interrupt task that stops being runnable - held, blocked,
    /// or otherwise moved on by an operator with no claim standing in the
    /// way - must not wedge the sequence (and so the whole loop's dispatch,
    /// via `interrupt_gate`) waiting forever for a dispatch that can never
    /// come. The parked run still gets its resume.
    #[test]
    fn an_interrupt_task_that_stops_being_runnable_abandons_the_wait_without_losing_the_parked_run()
    {
        let state = Interrupt::Parking {
            parked: vec!["running".to_owned()],
            interrupt_task: "marked".to_owned(),
        };
        // `marked` has been held/blocked/deleted since the sequence began:
        // it no longer appears in `runnable` at all.
        let next = advance_interrupt(state, &[], &[]);
        assert_eq!(
            next,
            Interrupt::Resuming {
                parked: vec!["running".to_owned()]
            },
            "abandoning the interrupt must not abandon the resume it owes"
        );
    }

    /// The same abandonment, one step later: `Resuming` itself must not wait
    /// forever for a parked task that has since become unrunnable.
    #[test]
    fn resuming_abandons_a_parked_task_that_stops_being_runnable() {
        let state = Interrupt::Resuming {
            parked: vec!["running".to_owned()],
        };
        let next = advance_interrupt(state, &[], &[]);
        assert_eq!(
            next,
            Interrupt::Idle,
            "nothing is left to wait for; the loop must not stay wedged"
        );
    }

    #[test]
    fn disabled_by_config_the_sequence_can_never_leave_idle() {
        let marked = interrupt_task("marked");
        let next = advance_interrupt_tick(
            false,
            Interrupt::Idle,
            &["running".to_owned()],
            std::slice::from_ref(&marked),
        );
        assert_eq!(
            next,
            Interrupt::Idle,
            "an unmarked, unconfigured daemon must behave exactly as before"
        );
    }

    #[test]
    fn the_gate_blocks_everyone_while_something_parked_is_still_in_flight() {
        let state = Interrupt::Parking {
            parked: vec!["running".to_owned()],
            interrupt_task: "marked".to_owned(),
        };
        let candidates = vec![interrupt_task("marked"), task()];
        let allowed = interrupt_gate(&state, &["running".to_owned()], candidates);
        assert!(
            allowed.is_empty(),
            "nothing may dispatch - not even the interrupt task itself - \
             until the parked run has actually stopped"
        );
    }

    /// `interrupt_gate` knows nothing about [`Task::urgent`] and must not
    /// grow a special case for it: an urgent candidate that is not the
    /// interrupt task withholds exactly like an ordinary one for as long as
    /// the parked run it is racing has not actually left flight. A version
    /// of this feature once bypassed the gate for urgent candidates, on the
    /// theory that a genuinely separate concurrency lane could not collide
    /// with 75dd's own; it could, and did - the bypassed task dispatched
    /// alongside a run 75dd's own state machine had only *asked* to park,
    /// not yet confirmed gone, which is exactly the second run
    /// `Interrupt::Parking`'s own doc says must never happen. There is no
    /// tick during Parking/Running/Resuming where letting an extra
    /// candidate through is safe, urgent or not - the parked run may still
    /// be genuinely mid-call.
    #[test]
    fn urgent_gains_no_exemption_from_an_active_interrupt_sequence() {
        for state in [
            Interrupt::Parking {
                parked: vec!["running".to_owned()],
                interrupt_task: "marked".to_owned(),
            },
            Interrupt::Running {
                parked: vec!["running".to_owned()],
                interrupt_task: "marked".to_owned(),
            },
            Interrupt::Resuming {
                parked: vec!["running".to_owned()],
            },
        ] {
            let candidates = vec![
                interrupt_task("marked"),
                urgent_task("hot"),
                task_with_id("ordinary"),
            ];
            let allowed = interrupt_gate(&state, &["running".to_owned()], candidates);
            assert!(
                !allowed.iter().any(|t| t.id == "hot"),
                "an urgent candidate must wait out the same gate as anything \
                 else while the run it would run alongside has not actually \
                 left flight, for state {state:?}: {allowed:?}"
            );
        }
    }

    /// The one case where marking a task `--urgent` and `interrupt` at once
    /// is not redundant: once the interrupt sequence's own guaranteed
    /// resume/dispatch actually admits the task, it is unaffected by also
    /// carrying `urgent` - `interrupt_gate` decides purely on identity,
    /// never on the urgent flag.
    #[test]
    fn a_task_marked_both_urgent_and_interrupt_is_admitted_once_the_gate_itself_says_so() {
        let state = Interrupt::Resuming {
            parked: vec!["hot".to_owned()],
        };
        let candidates = vec![urgent_task("hot"), task()];
        let allowed = interrupt_gate(&state, &[], candidates);
        assert_eq!(
            allowed.iter().filter(|t| t.id == "hot").count(),
            1,
            "the gate's own decision is unaffected by the urgent flag: {allowed:?}"
        );
    }

    #[test]
    fn the_gate_lets_only_the_interrupt_task_through_once_parked_work_has_stopped() {
        let state = Interrupt::Parking {
            parked: vec!["running".to_owned()],
            interrupt_task: "marked".to_owned(),
        };
        let other = task();
        let candidates = vec![interrupt_task("marked"), other.clone()];
        let allowed = interrupt_gate(&state, &[], candidates);
        assert_eq!(allowed.len(), 1);
        assert_eq!(allowed[0].id, "marked");
    }

    #[test]
    fn the_gate_blocks_everyone_while_the_interrupt_task_itself_is_in_flight() {
        let state = Interrupt::Running {
            parked: vec!["running".to_owned()],
            interrupt_task: "marked".to_owned(),
        };
        let candidates = vec![task(), task()];
        let allowed = interrupt_gate(&state, &["marked".to_owned()], candidates);
        assert!(allowed.is_empty());
    }

    /// R1-1-1 / R1-1-2: even when more than one task was in flight when the
    /// sequence began (only reachable above the default
    /// `max_concurrent_runs = 1`), `Resuming` offers at most one of them -
    /// never both in the same tick, which is what "exactly one resume, no
    /// simultaneous run" actually requires structurally rather than by
    /// coincidence of how many ordinary slots happen to be free.
    #[test]
    fn the_gate_offers_at_most_one_candidate_while_resuming_even_with_two_parked() {
        let state = Interrupt::Resuming {
            parked: vec!["a".to_owned(), "c".to_owned()],
        };
        let candidates = vec![task_with_id("a"), task_with_id("c"), task_with_id("other")];
        let allowed = interrupt_gate(&state, &[], candidates);
        assert_eq!(
            allowed.len(),
            1,
            "at most one candidate may be offered while resuming: {allowed:?}"
        );
        assert_eq!(allowed[0].id, "a");
    }

    #[test]
    fn the_gate_offers_nothing_while_resuming_if_no_parked_task_is_runnable() {
        let state = Interrupt::Resuming {
            parked: vec!["a".to_owned()],
        };
        let allowed = interrupt_gate(&state, &[], vec![task_with_id("other")]);
        assert!(allowed.is_empty());
    }

    /// The invariant the completion criteria ask for by name: across a whole
    /// simulated sequence, there is never a tick where the gate would let
    /// through both the parked run's resume and the interrupt task, and
    /// exactly one candidate resumes the instant the interrupt task's run
    /// ends - never zero, never more than one.
    #[test]
    fn a_full_sequence_never_gates_two_runs_through_at_once_and_resumes_exactly_one() {
        let running = task(); // id: whatever `Task::new` minted
        let marked = interrupt_task("marked");

        let mut state = Interrupt::Idle;
        // Tick 1: `running` is in flight, `marked` becomes runnable.
        let in_flight = vec![running.id.clone()];
        state = advance_interrupt_tick(true, state, &in_flight, std::slice::from_ref(&marked));
        let gated = interrupt_gate(&state, &in_flight, vec![marked.clone(), running.clone()]);
        assert!(gated.is_empty(), "still waiting on `running` to park");

        // Tick 2: `running` parked and left flight; nothing dispatched yet.
        state = advance_interrupt_tick(true, state, &[], &[marked.clone(), running.clone()]);
        let gated = interrupt_gate(&state, &[], vec![marked.clone(), running.clone()]);
        assert_eq!(
            gated.iter().map(|t| t.id.as_str()).collect::<Vec<_>>(),
            vec!["marked"],
            "only the interrupt task may be offered to the dispatcher now"
        );

        // Tick 3: `marked` is now in flight (dispatched from tick 2's gate).
        state = advance_interrupt_tick(
            true,
            state,
            &["marked".to_owned()],
            std::slice::from_ref(&running),
        );
        let gated = interrupt_gate(
            &state,
            &["marked".to_owned()],
            vec![marked.clone(), running.clone()],
        );
        assert!(
            gated.is_empty(),
            "the parked run must not be offered back while the interrupt \
             task is still running"
        );

        // Tick 4: `marked`'s run reached a terminal status and left flight.
        // A higher-priority ordinary task `other` is also runnable now - it
        // must not be let through instead of, or alongside, `running`.
        let other = task_with_id("other");
        state = advance_interrupt_tick(true, state, &[], &[running.clone(), other.clone()]);
        assert_eq!(
            state,
            Interrupt::Resuming {
                parked: vec![running.id.clone()]
            }
        );
        let gated = interrupt_gate(&state, &[], vec![other.clone(), running.clone()]);
        assert_eq!(
            gated.iter().map(|t| t.id.as_str()).collect::<Vec<_>>(),
            vec![running.id.as_str()],
            "exactly the parked run resumes - not the unrelated task, even \
             though it was offered first"
        );

        // Tick 5: `running` is now in flight (dispatched from tick 4's
        // gate). Only now does the sequence end and ordinary dispatch fully
        // resume.
        state = advance_interrupt_tick(
            true,
            state,
            std::slice::from_ref(&running.id),
            std::slice::from_ref(&other),
        );
        assert_eq!(state, Interrupt::Idle);
        let gated = interrupt_gate(
            &state,
            std::slice::from_ref(&running.id),
            vec![other.clone()],
        );
        assert_eq!(
            gated.iter().map(|t| t.id.as_str()).collect::<Vec<_>>(),
            vec![other.id.as_str()],
            "ordinary dispatch is unrestricted again"
        );
    }

    #[test]
    fn every_run_status_settles_the_task_it_came_from() {
        // run status, resulting task status, attempts still standing after one
        let table = [
            (RunStatus::Merged, TaskStatus::Done, 1),
            (RunStatus::Ready, TaskStatus::Done, 1),
            (RunStatus::Stalled, TaskStatus::Failed, 0),
            (RunStatus::Blocked, TaskStatus::Failed, 1),
            (RunStatus::Failed, TaskStatus::Failed, 1),
            (RunStatus::VerifiedNoop, TaskStatus::Held, 1),
            (RunStatus::Prep, TaskStatus::Failed, 1),
            (RunStatus::Implementing, TaskStatus::Failed, 1),
            (RunStatus::Judging, TaskStatus::Failed, 1),
            (RunStatus::Deliberating, TaskStatus::Failed, 1),
            (RunStatus::Voting, TaskStatus::Failed, 1),
            (RunStatus::Reviewing, TaskStatus::Failed, 1),
            (RunStatus::Gating, TaskStatus::Failed, 1),
        ];
        for (run, want, attempts) in table {
            let mut t = task();
            t.start("20260902-000000-aaaa".to_owned());
            settle(
                &mut t,
                Verdict {
                    status: run,
                    left_pr: false,
                    parked: false,
                    quota_hit: matches!(run, RunStatus::Stalled),
                    no_viable_candidates: false,
                },
                "why",
                2,
            );
            assert_eq!(t.status, want, "task status after {}", label(run));
            assert_eq!(t.attempts, attempts, "attempts after {}", label(run));
        }
    }

    #[test]
    fn a_quota_stall_costs_the_task_no_attempt_but_a_block_does() {
        let mut stalled = task();
        stalled.start("20260902-000000-aaaa".to_owned());
        settle(
            &mut stalled,
            Verdict {
                status: RunStatus::Stalled,
                left_pr: false,
                parked: false,
                quota_hit: true,
                no_viable_candidates: false,
            },
            "quota",
            1,
        );
        assert_eq!(stalled.attempts, 0);
        assert!(
            stalled.status.runnable(),
            "a machine problem must leave the task in line"
        );

        let mut blocked = task();
        blocked.start("20260902-000000-aaaa".to_owned());
        settle(
            &mut blocked,
            Verdict {
                status: RunStatus::Blocked,
                left_pr: false,
                parked: false,
                quota_hit: false,
                no_viable_candidates: false,
            },
            "findings open",
            1,
        );
        assert_eq!(blocked.attempts, 1);
        assert_eq!(
            blocked.status,
            TaskStatus::Held,
            "the last attempt hands the task to a human"
        );
    }

    #[test]
    fn a_run_that_opened_a_pull_request_is_never_re_competed() {
        // Attempts to spare: without the pull request this task would go
        // straight back in line and run the whole competition again.
        let mut delivered = task();
        delivered.start("20260903-080619-01c2".to_owned());
        settle(
            &mut delivered,
            Verdict {
                status: RunStatus::Blocked,
                left_pr: true,
                parked: false,
                quota_hit: false,
                no_viable_candidates: false,
            },
            "no check status",
            4,
        );
        assert_eq!(
            delivered.status,
            TaskStatus::Held,
            "a pull request waiting on CI or a person is not a retryable failure"
        );
        assert!(
            !delivered.status.runnable(),
            "the loop must not pick this task up again"
        );
        assert_eq!(
            delivered.last_error.as_deref(),
            Some("no check status"),
            "the operator needs to be told what the gate was waiting for"
        );

        // The same status without a pull request is a plain failure, and with
        // attempts left it is retried.
        let mut empty_handed = task();
        empty_handed.start("20260903-080619-01c2".to_owned());
        settle(
            &mut empty_handed,
            Verdict {
                status: RunStatus::Blocked,
                left_pr: false,
                parked: false,
                quota_hit: false,
                no_viable_candidates: false,
            },
            "findings open",
            4,
        );
        assert_eq!(empty_handed.status, TaskStatus::Failed);
        assert!(empty_handed.status.runnable());
    }

    #[test]
    fn a_verified_noop_run_hands_off_rather_than_closing_or_auto_retrying() {
        // Every candidate agreed, with evidence, that nothing belonged in the
        // worktree. That is not a confirmed success to close automatically -
        // a human still has to check the claim - and it is not an ordinary
        // failure either, so this settles exactly like a pull request nobody
        // merged yet: `Held`, same as `Blocked` with a PR.
        let mut noop = task();
        noop.start("20260912-131304-391f".to_owned());
        settle(
            &mut noop,
            Verdict {
                status: RunStatus::VerifiedNoop,
                left_pr: false,
                parked: false,
                quota_hit: false,
                no_viable_candidates: true,
            },
            "candidate A: already fixed by b32cfc4, on main",
            4,
        );
        assert_eq!(
            noop.status,
            TaskStatus::Held,
            "an unverified claim is a request for a human, not a failure"
        );
        assert!(
            !noop.status.runnable(),
            "the loop must not requeue this on the same unverified claim"
        );
        // `Task::release` resets attempts to zero the moment a human looks at
        // the evidence and lets it run again, so it does not matter here
        // whether the one attempt already spent stays spent - what matters is
        // that nothing retries this task unattended in the meantime.
        assert_eq!(noop.attempts, 1);
    }

    #[test]
    fn parking_costs_the_task_no_attempt_and_leaves_it_in_line() {
        // Parking is the operator asking for the process back - to replace the
        // binary, most of all. The run's work is intact on disk, so this is
        // not a failed attempt, and charging for it would mean a few upgrades
        // could exhaust a budget meant for agents that misbehaved.
        let mut parked = task();
        parked.start("20260903-183634-2d98".to_owned());
        settle(
            &mut parked,
            Verdict {
                status: RunStatus::Implementing,
                left_pr: false,
                quota_hit: false,
                parked: true,
                no_viable_candidates: false,
            },
            "parked after `implementing`",
            2,
        );
        assert_eq!(parked.attempts, 0, "a park is refunded");
        assert!(
            parked.status.runnable(),
            "and the task stays in line so the next loop resumes its run"
        );
        assert_eq!(parked.status, TaskStatus::Parked);
        assert_eq!(
            parked.park_reason.as_deref(),
            Some("parked after `implementing`"),
            "the card says where it stopped"
        );
        assert_eq!(parked.last_error, None, "nothing failed");

        // Without the park flag the same non-terminal status is what it always
        // was: `execute` returning mid-flight, which is a bug and spends an
        // attempt so a task cannot loop on it forever.
        let mut broken = task();
        broken.start("20260903-183634-2d98".to_owned());
        settle(
            &mut broken,
            Verdict {
                status: RunStatus::Implementing,
                left_pr: false,
                quota_hit: false,
                parked: false,
                no_viable_candidates: false,
            },
            "returned mid-flight",
            2,
        );
        assert_eq!(broken.attempts, 1);
    }

    #[test]
    fn only_a_rate_limit_buys_the_task_its_attempt_back() {
        // Run e633: quorum lost because two judges answered with the wrong
        // JSON shape, `quota: []`. Refunding that takes the bound off the
        // retry loop, and each retry pays for a fresh hour-long implement
        // wave before it can fail the same way.
        let mut flaky = task();
        flaky.start("20260903-123023-e633".to_owned());
        settle(
            &mut flaky,
            Verdict {
                status: RunStatus::Stalled,
                left_pr: false,
                parked: false,
                quota_hit: false,
                no_viable_candidates: false,
            },
            "verdict rests on 1 of 3 judges",
            2,
        );
        assert_eq!(
            flaky.attempts, 1,
            "flakiness spends an attempt, so `max_attempts` still bounds it"
        );
        assert!(flaky.status.runnable(), "and it is still worth retrying");

        // The same status, lost to a rate limit, is the machine's fault.
        let mut limited = task();
        limited.start("20260903-123023-e633".to_owned());
        settle(
            &mut limited,
            Verdict {
                status: RunStatus::Stalled,
                left_pr: false,
                parked: false,
                quota_hit: true,
                no_viable_candidates: false,
            },
            "judge-2, judge-3 out of quota",
            2,
        );
        assert_eq!(limited.attempts, 0, "a quota window is refunded");
        assert!(limited.status.runnable());

        // And the bound really binds: a task that keeps stalling on flakiness
        // reaches a human instead of running the roster forever.
        let mut worn = task();
        for _ in 0..2 {
            worn.release();
        }
        worn.start("20260903-123023-e633".to_owned());
        worn.attempts = 2;
        settle(
            &mut worn,
            Verdict {
                status: RunStatus::Stalled,
                left_pr: false,
                parked: false,
                quota_hit: false,
                no_viable_candidates: false,
            },
            "no quorum again",
            2,
        );
        assert_eq!(worn.status, TaskStatus::Held);
        assert!(!worn.status.runnable());
    }

    #[test]
    fn a_quota_wipeout_that_leaves_nothing_to_judge_also_costs_no_attempt() {
        // The implement wave loses every seat to the same rate limit and
        // `after_implement` bails with nothing viable, which surfaces as
        // `Failed` rather than `Stalled`. That is the same machine fact the
        // `Stalled`-quota row already refunds, and must be refunded the same
        // way, or a quota outage quietly holds every task it touches instead
        // of leaving them in line for the reset.
        let mut wiped_out = task();
        wiped_out.start("20260907-025000-a1b2".to_owned());
        settle(
            &mut wiped_out,
            Verdict {
                status: RunStatus::Failed,
                left_pr: false,
                parked: false,
                quota_hit: true,
                no_viable_candidates: true,
            },
            "no candidate produced a change; nothing to judge",
            2,
        );
        assert_eq!(wiped_out.attempts, 0, "a total quota wipeout is refunded");
        assert!(
            wiped_out.status.runnable(),
            "a machine problem must leave the task in line"
        );

        // This is the exemption that must stay narrow: a candidate that did
        // produce a change, and then failed for some other reason, still
        // spends the attempt even though a seat elsewhere hit its quota.
        // Otherwise every ordinary failure that happens to share a run with
        // an unrelated rate limit would be refunded for free.
        let mut partial_progress = task();
        partial_progress.start("20260907-025500-c3d4".to_owned());
        settle(
            &mut partial_progress,
            Verdict {
                status: RunStatus::Failed,
                left_pr: false,
                parked: false,
                quota_hit: true,
                no_viable_candidates: false,
            },
            "gate failed on the winning candidate",
            2,
        );
        assert_eq!(
            partial_progress.attempts, 1,
            "a candidate that actually produced a change spends the attempt \
             even though some other seat hit its quota"
        );
        assert!(partial_progress.status.runnable());
    }

    #[test]
    fn reclaim_refunds_a_recovered_quota_wipeout_the_same_way_a_live_settle_does() {
        // `reclaim` builds its own `Verdict` from a `RunState` it loads off
        // disk, and that construction must reach the same conclusion as the
        // one `attempt` builds from a live run, or a crash at exactly the
        // wrong moment gives a recovered task a different policy than one a
        // daemon finished settling itself.
        let mut t = task();
        t.start("20260907-025000-a1b2".to_owned());
        let mut state = run_state(RunStatus::Failed);
        state.quota.push(QuotaLoss {
            seat: "cand-a".to_owned(),
            node: "implement".to_owned(),
            at: Timestamp::now(),
            reset: None,
        });
        assert!(
            state.viable().is_empty(),
            "no candidate was added, so nothing is viable"
        );
        reclaim(&mut t, Some(state), 2, "en");
        assert_eq!(t.attempts, 0, "a recovered quota wipeout is refunded");
        assert!(t.status.runnable());
    }

    #[test]
    fn a_held_task_is_never_offered_to_the_loop() {
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().to_path_buf());
        for (n, priority) in [(1, 0), (2, 5), (3, 5)] {
            let mut t = task();
            t.id = format!("2026090{n}-000000-000{n}");
            t.priority = priority;
            queue.put(&mut t).unwrap();
        }
        let mut held = task();
        held.id = "20260909-000000-9999".to_owned();
        held.priority = 99;
        held.hold_machine(None);
        queue.put(&mut held).unwrap();

        let order: Vec<String> = runnable(&queue).into_iter().map(|t| t.id).collect();
        assert_eq!(order.len(), 3);
        assert!(!order.contains(&held.id));
        assert_eq!(
            order.first().cloned(),
            queue.next_runnable().map(|t| t.id),
            "the loop's first candidate is exactly what the queue offers"
        );
        assert_eq!(
            order,
            vec![
                "20260902-000000-0002".to_owned(),
                "20260903-000000-0003".to_owned(),
                "20260901-000000-0001".to_owned(),
            ],
            "priority first, then oldest, so nothing starves"
        );
    }

    #[test]
    fn sweep_removes_an_old_unparseable_lock_and_keeps_a_live_one() {
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().to_path_buf());
        let mut old = task();
        old.id = "20260101-000000-old0".to_owned();
        queue.put(&mut old).unwrap();
        let mut fresh = task();
        fresh.id = "20260101-000000-new0".to_owned();
        queue.put(&mut fresh).unwrap();

        // No parseable pid at all, so age is the only signal there is to
        // check - unlike a real `Queue::claim`, which always names a real,
        // and therefore alive, pid this test cannot fake as dead.
        std::fs::write(dir.path().join(format!("{}.lock", old.id)), "not a pid").unwrap();
        std::thread::sleep(Duration::from_millis(60));
        let live = queue.claim(&fresh.id).unwrap();

        let swept = sweep_stale_claims(&queue, Duration::from_millis(50));
        assert_eq!(swept, vec![old.id.clone()]);
        assert!(
            queue.claim(&old.id).is_ok(),
            "an unparseable lock older than the threshold is swept"
        );
        assert!(
            queue.claim(&fresh.id).is_err(),
            "a live pid protects its lock regardless of age"
        );
        drop(live);
    }

    #[test]
    fn an_old_lock_whose_pid_is_still_alive_is_never_swept_by_age_alone() {
        // A live worker's claim remains authoritative even beyond the sweep's
        // age limit. Sweeping it would permit a second competing attempt.
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().to_path_buf());
        let mut t = task();
        t.id = "20260101-000000-live".to_owned();
        queue.put(&mut t).unwrap();

        let claim = queue.claim(&t.id).unwrap();
        std::thread::sleep(Duration::from_millis(60));

        let swept = sweep_stale_claims(&queue, Duration::from_millis(50));
        assert!(
            swept.is_empty(),
            "a lock naming a live pid must never be swept by age, no matter how old: {swept:?}"
        );
        assert!(
            queue.claim(&t.id).is_err(),
            "the lock still protects its task"
        );
        drop(claim);
    }

    /// このテストプロセスにはなり得ない決定的なフィクスチャ PID。
    /// OS 上の状態は意図的に無関係で、各利用箇所が方針問い合わせを注入する。
    fn injected_dead_pid() -> u32 {
        std::process::id().checked_add(1).unwrap_or(1)
    }

    #[test]
    fn a_lock_naming_a_dead_pid_is_swept_at_once_regardless_of_age() {
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().to_path_buf());
        let mut t = task();
        t.id = "20260101-000000-dead".to_owned();
        queue.put(&mut t).unwrap();
        let dead_pid = injected_dead_pid();

        // Written directly rather than through `Queue::claim`, which would
        // stamp this test process's own very much alive pid and defeat the
        // point: this is what a `.lock` left by a `SIGKILL`ed daemon looks
        // like moments after it died, not six hours later.
        std::fs::write(
            dir.path().join(format!("{}.lock", t.id)),
            dead_pid.to_string(),
        )
        .unwrap();

        let swept = sweep_stale_claims_with(&queue, Duration::from_secs(6 * 60 * 60), |pid| {
            pid != dead_pid
        });
        assert_eq!(
            swept,
            vec![t.id.clone()],
            "a dead owner is reclaimed immediately, not after STALE_CLAIM"
        );
        assert!(queue.claim(&t.id).is_ok(), "the task is claimable again");
    }

    #[test]
    fn sweeping_on_every_poll_catches_a_lock_that_appears_after_the_first_sweep() {
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().to_path_buf());
        let mut t = task();
        t.id = "20260101-000000-late".to_owned();
        queue.put(&mut t).unwrap();
        let dead_pid = injected_dead_pid();

        // Tick one, standing in for the sweep `poll` already runs at
        // startup: nothing to find yet.
        assert!(
            sweep_stale_claims(&queue, Duration::from_secs(6 * 60 * 60)).is_empty(),
            "nothing has claimed the task yet"
        );

        // A second daemon claims the task and dies before it ever writes
        // `running`, well after this loop's own startup sweep already ran.
        std::fs::write(
            dir.path().join(format!("{}.lock", t.id)),
            dead_pid.to_string(),
        )
        .unwrap();

        // Tick two, standing in for a poll long into this daemon's uptime:
        // the same function, called again, notices what only just appeared -
        // proving the sweep is not a one-shot startup check.
        let swept = sweep_stale_claims_with(&queue, Duration::from_secs(6 * 60 * 60), |pid| {
            pid != dead_pid
        });
        assert_eq!(swept, vec![t.id.clone()]);
    }

    #[test]
    fn a_running_task_behind_a_dead_daemons_lock_recovers_once_swept_and_keeps_its_history() {
        // `reclaim_orphaned_running` looks up the task's last run, which
        // touches `run::home()`; the first call anywhere in this binary wins,
        // so this is a no-op if another test already pinned one, and either
        // way the run id below is never written under it.
        crate::run::pin_test_home();
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().to_path_buf());
        let mut t = task();
        t.id = "20260101-000000-crsh".to_owned();
        t.status = TaskStatus::Running;
        t.attempts = 1;
        // No `run.json` behind this id: standing in for a run this test does
        // not need to make readable, since the point is the lock, not the
        // recovery table `reclaim` already has its own tests for.
        t.runs.push("20260904-000000-4043".to_owned());
        queue.put(&mut t).unwrap();
        let dead_pid = injected_dead_pid();

        // The crashed daemon's own claim, naming a pid nothing on the
        // machine holds anymore.
        std::fs::write(
            dir.path().join(format!("{}.lock", t.id)),
            dead_pid.to_string(),
        )
        .unwrap();

        // Before the lock is swept the task looks claimed, and
        // `reclaim_orphaned_running` must leave it alone - this is exactly
        // the bug: a `running` task stranded behind a dead daemon's lock,
        // invisible to the claim-as-proof check because the lock outlived
        // the process that wrote it.
        assert!(reclaim_orphaned_running(&queue, 2, &Default::default()).is_empty());
        assert_eq!(queue.get(&t.id).unwrap().status, TaskStatus::Running);

        let swept = sweep_stale_claims_with(&queue, Duration::from_secs(6 * 60 * 60), |pid| {
            pid != dead_pid
        });
        assert_eq!(swept, vec![t.id.clone()]);

        let reclaimed = reclaim_orphaned_running(&queue, 2, &Default::default());
        assert_eq!(reclaimed, vec![t.id.clone()]);
        let after = queue.get(&t.id).unwrap();
        assert_eq!(
            after.status,
            TaskStatus::Held,
            "no run.json to recover from, so a human is asked"
        );
        assert_eq!(
            after.runs,
            vec!["20260904-000000-4043".to_owned()],
            "the crashed run's id is kept as evidence, not discarded"
        );
    }

    #[test]
    fn a_lock_is_kept_when_the_process_query_is_unavailable() {
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().to_path_buf());
        let mut t = task();
        t.id = "20260101-000000-unknown".to_owned();
        queue.put(&mut t).unwrap();
        let dead_pid = injected_dead_pid();
        std::fs::write(
            dir.path().join(format!("{}.lock", t.id)),
            dead_pid.to_string(),
        )
        .unwrap();

        let swept = sweep_stale_claims_with(&queue, Duration::ZERO, |_| true);
        assert!(swept.is_empty(), "an unknown pid must keep its lock");
        assert!(queue.claim(&t.id).is_err(), "the lock remains protective");
    }

    fn run_state_in(status: RunStatus, language: &str) -> RunState {
        let mut s = run_state(status);
        s.config.graph.language = language.to_owned();
        s
    }

    fn unstarted_verdict(status: RunStatus) -> Verdict {
        Verdict {
            status,
            left_pr: false,
            quota_hit: false,
            parked: false,
            no_viable_candidates: false,
        }
    }

    #[test]
    fn an_already_in_base_run_finishes_the_task_without_spending_an_attempt() {
        let mut t = task();
        t.attempts = 1;
        settle_in(
            &mut t,
            unstarted_verdict(RunStatus::AlreadyInBase),
            "already in main",
            1,
            phrases("en"),
        );
        assert_eq!(t.status, TaskStatus::Done);
        assert_eq!(t.attempts, 0);
    }

    #[test]
    fn settle_renders_the_non_terminal_reason_in_the_configured_language() {
        let reason = |language: &str| {
            let mut t = task();
            settle_in(
                &mut t,
                unstarted_verdict(RunStatus::Judging),
                "boom",
                1,
                phrases(language),
            );
            t.last_error.or(t.hold_reason).unwrap_or_default()
        };
        assert!(
            reason("en").starts_with("the graph stopped at `"),
            "{}",
            reason("en")
        );
        assert!(reason("ja").starts_with("グラフが終端状態に達しないまま"));
        assert!(reason("日本語").contains("boom"));
        assert_eq!(reason("fr"), reason("en"));
    }

    #[test]
    fn describe_follows_the_run_language_and_keeps_the_run_id() {
        let en = describe(&run_state_in(RunStatus::Stalled, "en"));
        assert!(en.starts_with("the judging panel lost its quorum"), "{en}");
        let ja = describe(&run_state_in(RunStatus::Stalled, "ja"));
        assert!(ja.starts_with("審査パネルが定足数を失いました"), "{ja}");
        assert!(ja.contains("[run "), "{ja}");
        let ended = describe(&run_state_in(RunStatus::Failed, "jp"));
        assert!(ended.starts_with("run 終了: "), "{ended}");
        let mut de = run_state_in(RunStatus::Failed, "de");
        let mut en = run_state_in(RunStatus::Failed, "en");
        de.id = "same".to_owned();
        en.id = "same".to_owned();
        assert_eq!(describe(&de), describe(&en));
    }

    #[test]
    fn handover_refusals_follow_the_language_and_keep_the_detail_apart() {
        use crate::handover::Refused;
        let cases = [
            Refused::Foreign {
                branch: "b".into(),
                path: "/w/x".into(),
                why: "made by hand".into(),
            },
            Refused::Unsafe {
                branch: "b".into(),
                path: "/w/x".into(),
                why: "its worktree has uncommitted changes (a.rs)".into(),
            },
            Refused::ReleaseFailed {
                branch: "b".into(),
                path: "/w/x".into(),
                run: "ab12".into(),
            },
        ];
        for r in &cases {
            let en = (phrases("en").handover_refused)(r);
            assert_eq!(en, r.to_string());
            let ja = (phrases("ja").handover_refused)(r);
            assert!(
                !ja.contains("is checked out") && !ja.contains("try again"),
                "{ja}"
            );
            assert!(ja.contains("`b`") && ja.contains("/w/x"), "{ja}");
            if let Refused::Foreign { why, .. } | Refused::Unsafe { why, .. } = r {
                assert!(ja.contains(&format!("（詳細: {why}）")), "{ja}");
            }
        }
        assert!(phrases("en").handover_hint.contains("release the task"));
        assert!(phrases("ja").handover_hint.contains("解放"));
    }

    #[test]
    fn describe_translates_the_unanswered_reviewer_stop_only_in_ja() {
        let build = |lang: &str| {
            let mut s = run_state_in(RunStatus::Blocked, lang);
            s.id = "same".to_owned();
            s.config.graph.review_rounds = 3;
            let mut r = review_round(3);
            r.expected = 3;
            r.answered = 1;
            s.reviews.push(r);
            s.event(
                "review",
                "2 reviewer seat(s) never answered after 3 rounds; refusing to call it clean",
            );
            s
        };
        let en = describe(&build("en"));
        assert!(en.contains("(review: 2 reviewer seat(s) never answered after 3 rounds; refusing to call it clean)"), "{en}");
        let ja = describe(&build("ja"));
        assert!(ja.contains("2 席のレビュアーが 3 ラウンド"), "{ja}");
        assert!(!ja.contains("never answered"), "{ja}");
        assert!(ja.contains("[run "), "{ja}");

        // An incomplete panel whose verification failed is a different stop:
        // the real event must survive in ja too.
        let mut failed = build("ja");
        failed.reviews[0].e2e.push(crate::run::CommandOutcome {
            command: "cargo test".to_owned(),
            code: Some(1),
            output_tail: String::new(),
            duration_ms: 0,
            resource_blocked: false,
        });
        failed.event("review", "stopped; e2e failed: cargo test");
        let ja = describe(&failed);
        assert!(ja.contains("stopped; e2e failed: cargo test"), "{ja}");
        assert!(!ja.contains("席のレビュアー"), "{ja}");
    }

    #[test]
    fn refusals_and_recovery_prose_follow_the_language() {
        let t = held_task_with("r1");
        let q = action_question(
            "r1",
            ask::ChoiceAction::Resume {
                run: "r1".to_owned(),
            },
        );
        let refuse = |p: &Phrases| match decide_action(&t, &q, p, |_: &str| bail!("gone")) {
            ActionDecision::Refuse(s) => s,
            other => panic!("{other:?}"),
        };
        assert!(refuse(phrases("en")).contains("could not be read: gone"));
        assert!(refuse(phrases("ja")).contains("読み込めませんでした: gone"));
        assert_eq!(refuse(phrases("fr")), refuse(phrases("en")));

        let mut held = task();
        reclaim(&mut held, None, 2, "ja");
        assert!(held.hold_reason.unwrap().contains("保留にしました"));
        let mut held = task();
        reclaim(&mut held, None, 2, "xx");
        assert!(held.hold_reason.unwrap().contains("held for a human"));
    }

    fn run_state(status: RunStatus) -> RunState {
        let mut state = RunState::new(
            PathBuf::from("/repo"),
            "main".to_owned(),
            "abc1234def".to_owned(),
            "add retries".to_owned(),
            Config::default(),
        );
        state.status = status;
        state
    }

    fn candidate(label: char, summary: &str, empty: bool, failed: Option<&str>) -> Candidate {
        Candidate {
            index: 0,
            label,
            agent: "claude".to_owned(),
            branch: format!("magi/x/{label}"),
            worktree: PathBuf::from("/repo"),
            summary: summary.to_owned(),
            stat: String::new(),
            files: 0,
            commits: usize::from(!empty),
            empty,
            failed: failed.map(str::to_owned),
            verified_noop: None,
            duration_ms: 0,
            folded: false,
        }
    }

    #[test]
    fn diagnostic_names_the_failing_gate_checks_and_their_output() {
        let mut state = run_state(RunStatus::Blocked);
        state.gate = vec![
            CommandOutcome {
                command: "cargo make check".to_owned(),
                code: Some(0),
                output_tail: "ok".to_owned(),
                duration_ms: 0,
                resource_blocked: false,
            },
            CommandOutcome {
                command: "cargo test".to_owned(),
                code: Some(101),
                output_tail: "thread 'x' panicked: assertion failed".to_owned(),
                duration_ms: 0,
                resource_blocked: false,
            },
        ];
        let d = diagnostic(&state).expect("a failing gate must produce a diagnostic");
        assert!(d.contains("cargo test"), "{d}");
        assert!(
            !d.contains("cargo make check"),
            "a passing check is not a diagnostic: {d}"
        );
        assert!(d.contains("assertion failed"), "{d}");
    }

    #[test]
    fn diagnostic_names_the_checks_the_fixer_gave_up_in_front_of() {
        let mut state = run_state(RunStatus::Blocked);
        state.event(
            "land",
            "stopped: the fixer produced no commit while 2 check(s) were failing \
             (build, lint); stopping instead of looping on an unchanged tree",
        );
        let d = diagnostic(&state).expect("a stalled land loop must produce a diagnostic");
        assert!(d.contains("build"), "{d}");
        assert!(d.contains("lint"), "{d}");
        assert!(d.contains("fixer produced no commit"), "{d}");
    }

    #[test]
    fn describe_never_leaves_a_verified_noop_reading_as_a_bare_status_code() {
        // `describe`'s output becomes `Task::last_error` verbatim, and the
        // phone renders that in the same alarm-styled box an ordinary
        // failure gets. A bare `verified_noop` there would read exactly like
        // the failure this status exists to be told apart from.
        let state = run_state(RunStatus::VerifiedNoop);
        let d = describe(&state);
        assert!(
            d.contains("agent-verified no-op"),
            "expected the display label, not the wire spelling: {d}"
        );
        assert!(!d.contains("verified_noop"), "{d}");
    }

    #[test]
    fn diagnostic_carries_a_candidates_own_final_word_when_none_was_viable() {
        // The whole point of the feature: a run held as "no candidate produced
        // a change" can mean the implementer actually finished the task and
        // only left a clean local tree behind - see AGENTS.md on this exact
        // failure mode. The diagnostic has to carry what the agent actually
        // said, not just the fact that nothing was there to judge.
        let mut state = run_state(RunStatus::Failed);
        state.candidates = vec![candidate(
            'A',
            "opened pull request #42, merged it, tagged v1.2.3 and published the release",
            true,
            None,
        )];
        let d = diagnostic(&state).expect("an empty candidate with a summary must be surfaced");
        assert!(d.contains("candidate A"), "{d}");
        assert!(d.contains("tagged v1.2.3"), "{d}");
    }

    #[test]
    fn diagnostic_falls_back_to_a_candidates_failure_reason_when_it_has_no_summary() {
        let mut state = run_state(RunStatus::Failed);
        state.candidates = vec![candidate('A', "", true, Some("agent timed out"))];
        let d = diagnostic(&state).expect("a candidate's own failure reason must be surfaced");
        assert!(d.contains("candidate A"), "{d}");
        assert!(d.contains("agent timed out"), "{d}");
    }

    #[test]
    fn diagnostic_is_none_when_nothing_recognisable_explains_the_hold() {
        // A viable candidate existed, the gate never ran, and nothing land
        // said matches - `Task::last_error` is left to explain this one alone.
        let mut state = run_state(RunStatus::Failed);
        state.candidates = vec![candidate('A', "did the work", false, None)];
        assert!(diagnostic(&state).is_none());
    }

    #[test]
    fn diagnostic_is_bounded_however_much_a_run_printed() {
        let mut state = run_state(RunStatus::Blocked);
        state.gate = vec![
            CommandOutcome {
                command: "cargo test".to_owned(),
                code: Some(101),
                output_tail: "x".repeat(50_000),
                duration_ms: 0,
                resource_blocked: false,
            },
            CommandOutcome {
                command: "cargo clippy".to_owned(),
                code: Some(1),
                output_tail: "y".repeat(50_000),
                duration_ms: 0,
                resource_blocked: false,
            },
        ];
        state.candidates = vec![
            candidate('A', &"z".repeat(50_000), true, None),
            candidate('B', &"w".repeat(50_000), true, None),
        ];
        let d = diagnostic(&state).expect("plenty here to diagnose");
        assert!(
            d.len() <= DIAGNOSTIC_MAX,
            "diagnostic grew to {} bytes, unbounded",
            d.len()
        );
    }

    #[test]
    fn selected_delivery_guards_survive_recovery_failure_accounting() {
        for status in [RunStatus::Ready, RunStatus::Blocked, RunStatus::Failed] {
            let mut t = task();
            let mut state = run_state(status);
            t.pr_recovery = Some(crate::pr_recovery::Selection {
                url: "url".into(),
                branch: format!("magi/task-{}", t.id),
                head: "a".repeat(40),
                source_head: None,
                source_run: None,
                source_proof: None,
                disposition: Some(crate::pr_recovery::Disposition::Land),
                instruction: t.instruction.clone(),
                approved_at: Timestamp::now(),
            });
            state.pr_recovery = t.pr_recovery.clone();
            t.start(state.id.clone());
            settle_and_diagnose(
                &mut t,
                Verdict {
                    status,
                    left_pr: false,
                    quota_hit: false,
                    parked: false,
                    no_viable_candidates: false,
                },
                "delivery stopped",
                5,
                &state,
            );
            assert_eq!(t.status, TaskStatus::Held);
            let reason = t.hold_reason.as_deref().unwrap();
            if status == RunStatus::Ready {
                assert!(reason.contains("Selected PR delivery is incomplete"));
                assert!(t.recovery_budget.is_none());
            } else {
                assert!(reason.contains("Selected recovery stopped"));
                assert_eq!(t.recovery_budget.as_ref().unwrap().failures, 1);
            }
            assert!(t.pr_recovery.is_some());
        }
    }

    #[test]
    fn settle_and_diagnose_attaches_a_diagnostic_only_once_the_task_is_held() {
        let mut state = run_state(RunStatus::Blocked);
        state.gate = vec![CommandOutcome {
            command: "cargo test".to_owned(),
            code: Some(101),
            output_tail: "assertion failed".to_owned(),
            duration_ms: 0,
            resource_blocked: false,
        }];
        let verdict = Verdict {
            status: RunStatus::Blocked,
            left_pr: false,
            quota_hit: false,
            parked: false,
            no_viable_candidates: false,
        };

        // Attempt one of two still has a retry coming: no diagnostic yet, the
        // task is going to run again and this run's evidence would go stale.
        let mut t = task();
        t.start("run-1".to_owned());
        settle_and_diagnose(&mut t, verdict, "gate failed", 2, &state);
        assert_eq!(t.status, TaskStatus::Failed);
        assert!(t.diagnostic.is_none());

        // Attempt two exhausts the budget: now it is held, and the
        // diagnostic is what `magi task show` has to say more than one line.
        t.start("run-2".to_owned());
        settle_and_diagnose(&mut t, verdict, "gate failed", 2, &state);
        assert_eq!(t.status, TaskStatus::Held);
        let d = t.diagnostic.expect("a held task must carry its diagnostic");
        assert!(d.contains("cargo test"), "{d}");
    }

    #[test]
    fn a_held_task_names_the_open_question_it_is_waiting_on() {
        // Task 20260928-191407-05fd's own bug: a verified no-op that filed a
        // `magi ask` question settled Held with `hold_reason: null`, so the
        // notification said nothing actionable. `note_open_question` should
        // append the question id to whatever `handed_off` already wrote.
        crate::run::pin_test_home();
        let home = crate::run::home();
        let state = run_state(RunStatus::VerifiedNoop);
        let mut q = ask::Question::new(
            state.id.clone(),
            "implement".to_owned(),
            "impl-A".to_owned(),
            "is this really a no-op?".to_owned(),
            String::new(),
            Vec::new(),
        );
        Questions::at(home.join("questions")).put(&mut q).unwrap();

        let verdict = Verdict {
            status: RunStatus::VerifiedNoop,
            left_pr: false,
            quota_hit: false,
            parked: false,
            no_viable_candidates: false,
        };
        let mut t = task();
        t.start(state.id.clone());
        settle_and_diagnose(&mut t, verdict, "run ended agent-verified no-op", 5, &state);

        assert_eq!(t.status, TaskStatus::Held);
        let reason = t.hold_reason.expect("a held task must record why");
        assert!(
            reason.starts_with("run ended agent-verified no-op"),
            "the original settle reason must survive unchanged: {reason}"
        );
        assert!(
            reason.contains(q.short()),
            "the open question's id must be named so the notice is actionable: {reason}"
        );
    }

    #[test]
    fn a_held_task_with_no_open_question_keeps_its_plain_reason() {
        crate::run::pin_test_home();
        let state = run_state(RunStatus::VerifiedNoop);

        let verdict = Verdict {
            status: RunStatus::VerifiedNoop,
            left_pr: false,
            quota_hit: false,
            parked: false,
            no_viable_candidates: false,
        };
        let mut t = task();
        t.start(state.id.clone());
        settle_and_diagnose(&mut t, verdict, "run ended agent-verified no-op", 5, &state);

        assert_eq!(t.status, TaskStatus::Held);
        assert_eq!(
            t.hold_reason.as_deref(),
            Some("run ended agent-verified no-op"),
            "nothing to append when the question was already answered or never asked"
        );
    }

    #[test]
    fn supersede_prior_runs_rewrites_an_earlier_blocked_attempt_once_a_later_one_lands() {
        crate::run::pin_test_home();
        let mut first = run_state(RunStatus::Blocked);
        first.id = "20260101-000000-sup1".to_owned();
        first.save().unwrap();
        let mut second = run_state(RunStatus::Merged);
        second.id = "20260101-000000-sup2".to_owned();
        second.save().unwrap();

        let mut t = task();
        t.runs = vec![first.id.clone(), second.id.clone()];
        t.status = TaskStatus::Done;

        supersede_prior_runs(&t, &crate::run::home());

        assert_eq!(
            RunState::load(&first.id).unwrap().status,
            RunStatus::Superseded,
            "the first attempt's Blocked no longer needs anyone's attention"
        );
        assert_eq!(
            RunState::load(&second.id).unwrap().status,
            RunStatus::Merged,
            "the run that actually succeeded is left exactly as it was"
        );
    }

    #[test]
    fn supersede_prior_runs_leaves_a_manually_resumed_attempt_alone() {
        // `is_working_on` alone only proves a *daemon* claim; a `magi run
        // --resume` invoked by hand outside the daemon never touches
        // `daemon.json` at all, so it would look identical to a genuinely
        // idle run without also consulting `RunState::liveness`, which reads
        // this run's own recorded `driver_pid` instead.
        crate::run::pin_test_home();
        let mut first = run_state(RunStatus::Blocked);
        first.id = "20260101-000000-sup9".to_owned();
        // This test process's own pid: guaranteed alive without needing a
        // real second process or daemon.
        first.driver_pid = Some(std::process::id());
        first.driver_started_at = Some(
            crate::proc::process_started_at(std::process::id())
                .expect("this test process's own start time must be queryable"),
        );
        first.save().unwrap();
        let mut second = run_state(RunStatus::Merged);
        second.id = "20260101-000000-supa".to_owned();
        second.save().unwrap();

        let mut t = task();
        t.runs = vec![first.id.clone(), second.id.clone()];
        t.status = TaskStatus::Done;

        supersede_prior_runs(&t, &crate::run::home());

        assert_eq!(
            RunState::load(&first.id).unwrap().status,
            RunStatus::Blocked,
            "a live driver_pid means something is still actually working this run, \
             even though no daemon claims it - rewriting under it would just be \
             undone the next time that process saves"
        );
    }

    #[test]
    fn resweep_catches_up_a_run_left_live_once_its_manual_process_is_no_longer_driving_it() {
        // The first resweep must skip a still-live attempt exactly like
        // `supersede_prior_runs` itself does; a later resweep, once that
        // process is no longer actually driving it, is what closes the gap
        // `supersede_prior_runs` alone leaves - a task only ever reaches
        // `Done` once, so nothing else would ever look at this run again.
        let dir = tempfile::tempdir().unwrap();
        let home = dir.path().to_path_buf();
        let queue = Queue::at(dir.path().join("queue"));

        let mut first = run_state(RunStatus::Blocked);
        first.id = "20260101-000000-supd".to_owned();
        first.driver_pid = Some(std::process::id());
        first.driver_started_at = Some(
            crate::proc::process_started_at(std::process::id())
                .expect("this test process's own start time must be queryable"),
        );
        first.save_under(&home).unwrap();
        let mut second = run_state(RunStatus::Merged);
        second.id = "20260101-000000-supe".to_owned();
        second.save_under(&home).unwrap();

        let mut t = task();
        t.runs = vec![first.id.clone(), second.id.clone()];
        t.status = TaskStatus::Done;
        queue.put(&mut t).unwrap();

        resweep_superseded_attempts(&queue, &home);
        assert_eq!(
            RunState::load_under(&first.id, &home).unwrap().status,
            RunStatus::Blocked,
            "still live on the first pass, so still untouched"
        );

        // Stand in for the manual process no longer being the one driving
        // this run: same pid (this test process really is still alive), but
        // an identity marker that no longer matches it - see
        // `RunState::liveness`'s own doc for why a mismatched
        // `driver_started_at` reads as `Dead`, not merely `Unknown`.
        let mut stale = RunState::load_under(&first.id, &home).unwrap();
        stale.driver_started_at = Some("1".to_owned());
        stale.save_under(&home).unwrap();

        resweep_superseded_attempts(&queue, &home);
        assert_eq!(
            RunState::load_under(&first.id, &home).unwrap().status,
            RunStatus::Superseded,
            "the second pass catches up what the first one correctly skipped"
        );
    }

    #[test]
    fn supersede_prior_runs_leaves_concurrent_blocked_attempts_alone_while_the_task_is_not_done() {
        crate::run::pin_test_home();
        let mut first = run_state(RunStatus::Blocked);
        first.id = "20260101-000000-sup3".to_owned();
        first.save().unwrap();
        let mut second = run_state(RunStatus::Blocked);
        second.id = "20260101-000000-sup4".to_owned();
        second.save().unwrap();

        let mut t = task();
        t.runs = vec![first.id.clone(), second.id.clone()];
        // Still retrying: nothing about this task's story is settled yet, so
        // neither Blocked run may be relabelled, even though a later attempt
        // already exists.
        t.status = TaskStatus::Failed;

        supersede_prior_runs(&t, &crate::run::home());

        assert_eq!(
            RunState::load(&first.id).unwrap().status,
            RunStatus::Blocked
        );
        assert_eq!(
            RunState::load(&second.id).unwrap().status,
            RunStatus::Blocked
        );
    }

    #[test]
    fn supersede_prior_runs_does_nothing_when_the_task_was_closed_by_hand() {
        // `magi task done` (or the API's equivalent) can close a task with no
        // run of its own ever having succeeded - there is nothing here that
        // counts as "the attempt that finished it", so nothing is rewritten.
        crate::run::pin_test_home();
        let mut first = run_state(RunStatus::Blocked);
        first.id = "20260101-000000-sup5".to_owned();
        first.save().unwrap();

        let mut t = task();
        t.runs = vec![first.id.clone()];
        t.status = TaskStatus::Done;

        supersede_prior_runs(&t, &crate::run::home());

        assert_eq!(
            RunState::load(&first.id).unwrap().status,
            RunStatus::Blocked,
            "a single-attempt task has no earlier run to supersede"
        );
    }

    #[test]
    fn supersede_prior_runs_does_nothing_when_the_last_recorded_attempt_never_landed() {
        // `magi task done` (or the web/conductor equivalents) can close a
        // task in any status, including one whose *last* recorded attempt is
        // itself still `Blocked`/`Failed` - a manual merge magi's own loop
        // never watched, say. `runs.last()` being `Done`-adjacent is not
        // proof it actually succeeded, so nothing earlier may be relabelled
        // on its say-so alone.
        crate::run::pin_test_home();
        let mut first = run_state(RunStatus::Blocked);
        first.id = "20260101-000000-supb".to_owned();
        first.save().unwrap();
        let mut second = run_state(RunStatus::Failed);
        second.id = "20260101-000000-supc".to_owned();
        second.save().unwrap();

        let mut t = task();
        t.runs = vec![first.id.clone(), second.id.clone()];
        t.status = TaskStatus::Done;

        supersede_prior_runs(&t, &crate::run::home());

        assert_eq!(
            RunState::load(&first.id).unwrap().status,
            RunStatus::Blocked,
            "the task's last attempt never landed, so there is nothing here \
             actually superseding it"
        );
    }

    #[test]
    fn supersede_prior_runs_leaves_a_failed_or_verified_noop_attempt_as_is() {
        // Only `Blocked`/`Stalled` mean "sitting there waiting for a human
        // to look" - `Failed` and `VerifiedNoop` are already their own
        // terminal answers and must not be relabelled into a third one.
        crate::run::pin_test_home();
        let mut failed = run_state(RunStatus::Failed);
        failed.id = "20260101-000000-sup6".to_owned();
        failed.save().unwrap();
        let mut noop = run_state(RunStatus::VerifiedNoop);
        noop.id = "20260101-000000-sup7".to_owned();
        noop.save().unwrap();
        let mut winner = run_state(RunStatus::Ready);
        winner.id = "20260101-000000-sup8".to_owned();
        winner.save().unwrap();

        let mut t = task();
        t.runs = vec![failed.id.clone(), noop.id.clone(), winner.id.clone()];
        t.status = TaskStatus::Done;

        supersede_prior_runs(&t, &crate::run::home());

        assert_eq!(
            RunState::load(&failed.id).unwrap().status,
            RunStatus::Failed
        );
        assert_eq!(
            RunState::load(&noop.id).unwrap().status,
            RunStatus::VerifiedNoop
        );
    }

    fn approval_question(run: &str) -> ask::Question {
        ask::Question::new(
            run.to_owned(),
            land::APPROVAL_NODE.to_owned(),
            "land".to_owned(),
            "merge?".to_owned(),
            String::new(),
            vec!["merge".to_owned(), "hold".to_owned()],
        )
    }

    #[test]
    fn land_resume_state_leaves_a_fresh_open_question_waiting() {
        crate::run::pin_test_home();
        let mut state = run_state(RunStatus::Landing);
        state.id = "20260101-000000-fre1".to_owned();
        state.parked = true;
        state.save().unwrap();
        ask::Questions::open()
            .put(&mut approval_question(&state.id))
            .unwrap();

        let mut t = task();
        t.runs.push(state.id.clone());
        assert_eq!(
            land_resume_state(&t),
            LandResume::StillWaiting,
            "nobody has answered and the timeout has not passed"
        );
    }

    #[test]
    fn land_resume_state_waits_on_a_withheld_text_question_then_resumes() {
        crate::run::pin_test_home();
        let mut state = run_state(RunStatus::Gating);
        state.id = "20260101-000000-gt01".to_owned();
        state.parked = true;
        state.config.graph.answer_timeout = 60;
        state.github_text = Some(crate::run::GithubTextAsk {
            rewrite: None,
            fingerprint: "f".into(),
            title: true,
            body: false,
            categories: vec!["title-language".into()],
            question: None,
            asks: 1,
            resolved: false,
            chosen_title: None,
            choice: None,
        });
        state.save().unwrap();
        let store = ask::Questions::open();
        let mut q = ask::Question::new(
            state.id.clone(),
            crate::github_text::ASK_NODE.to_owned(),
            crate::github_text::ASK_SEAT.to_owned(),
            "s".into(),
            String::new(),
            vec!["use fallback".into()],
        );
        store.put(&mut q).unwrap();
        let mut t = task();
        t.runs.push(state.id.clone());
        assert_eq!(land_resume_state(&t), LandResume::StillWaiting);
        q.asked_at = Timestamp::now() - jiff::SignedDuration::from_secs(120);
        store.put(&mut q).unwrap();
        assert_eq!(land_resume_state(&t), LandResume::Ready);
        assert!(!store.get(&q.id).unwrap().status.open());
        // Once decided, a parked run is an ordinary candidate again.
        state.github_text.as_mut().unwrap().resolved = true;
        state.save().unwrap();
        assert_eq!(land_resume_state(&t), LandResume::NotLanding);
    }

    #[test]
    fn land_resume_state_abandons_a_question_that_outlived_answer_timeout() {
        // `ask::ask_and_wait`'s own deadline used to retire a question
        // nobody answered; land's approval bypasses that wait (see
        // `land::approval_gate`), so this is now the only place
        // `graph.answer_timeout` is enforced for a land approval at all.
        crate::run::pin_test_home();
        let mut state = run_state(RunStatus::Landing);
        state.id = "20260101-000000-exp1".to_owned();
        state.parked = true;
        state.config.graph.answer_timeout = 60;
        state.save().unwrap();

        let store = ask::Questions::open();
        let mut q = approval_question(&state.id);
        q.asked_at = Timestamp::now() - jiff::SignedDuration::from_secs(120);
        store.put(&mut q).unwrap();

        let mut t = task();
        t.runs.push(state.id.clone());
        assert_eq!(
            land_resume_state(&t),
            LandResume::Ready,
            "an expired question must not be waited on forever"
        );

        let after = store.get(&q.id).unwrap();
        assert!(
            !after.status.open(),
            "the question is abandoned, not silently ignored"
        );
        assert!(
            after.resolution().is_none(),
            "an abandoned question is not read as a decision"
        );
    }

    #[test]
    fn reclaim_settles_a_running_task_against_its_last_run() {
        let mut t = task();
        t.start("20260904-000000-4043".to_owned());
        reclaim(&mut t, Some(run_state(RunStatus::Ready)), 2, "en");
        assert_eq!(
            t.status,
            TaskStatus::Done,
            "a run that actually finished must not stay `running` forever"
        );
    }

    #[test]
    fn reclaim_maps_a_parked_run_to_parked_without_touching_last_error() {
        let mut t = task();
        t.start("20260904-000000-4043".to_owned());
        t.last_error = Some("earlier trouble".to_owned());
        let mut state = run_state(RunStatus::Judging);
        state.parked = true;
        reclaim(&mut t, Some(state), 1, "en");
        assert_eq!(t.status, TaskStatus::Parked);
        assert_eq!(t.attempts, 0, "the park is refunded, even at max_attempts");
        assert_eq!(t.last_error.as_deref(), Some("earlier trouble"));
        assert!(t.park_reason.is_some());
        assert_eq!(t.runs, ["20260904-000000-4043"], "the same run is kept");
        assert!(!t.fresh_start);
        assert!(t.status.runnable());
    }

    #[test]
    fn settle_parks_a_task_without_a_failure_and_a_new_start_clears_the_reason() {
        let mut t = task();
        t.start("20260904-000000-4043".to_owned());
        t.last_error = Some("earlier trouble".to_owned());
        settle(
            &mut t,
            Verdict {
                status: RunStatus::Judging,
                left_pr: false,
                quota_hit: false,
                parked: true,
                no_viable_candidates: false,
            },
            "parked after `judging`",
            1,
        );
        assert_eq!(t.status, TaskStatus::Parked);
        assert_eq!(t.attempts, 0);
        assert_eq!(t.last_error.as_deref(), Some("earlier trouble"));
        assert_eq!(t.park_reason.as_deref(), Some("parked after `judging`"));
        assert_eq!(t.schema, crate::queue::SCHEMA);
        assert!(
            crate::notices::task_held(&t).is_none(),
            "a park is not news"
        );
        t.start("20260904-000000-4043".to_owned());
        assert_eq!(t.park_reason, None);
    }

    #[test]
    fn reclaim_reuses_the_same_retry_policy_as_a_live_settle() {
        // A blocked run with attempts left goes back to `Failed`, exactly as
        // it would from `attempt` itself - `reclaim` must not invent a second
        // policy for a task a daemon merely stopped without reporting.
        let mut t = task();
        t.start("20260904-000000-4043".to_owned());
        reclaim(&mut t, Some(run_state(RunStatus::Blocked)), 2, "en");
        assert_eq!(t.status, TaskStatus::Failed);
        assert!(t.status.runnable());
    }

    #[test]
    fn a_settled_parked_pass_records_its_cause_and_the_refund() {
        let mut t = task();
        t.start("20260904-000000-4043".to_owned());
        assert_eq!(t.attempts, 1);
        let mut run = run_state(RunStatus::Implementing);
        run.id = "20260904-000000-4043".to_owned();
        run.begin_pass();
        let cause = crate::run::ParkCause::Upgrade {
            from: "0.121.0".to_owned(),
            to: Some("0.121.1".to_owned()),
        };
        run.end_pass_parked(cause.clone());
        run.parked = true;
        let verdict = Verdict {
            status: run.status,
            left_pr: false,
            quota_hit: false,
            parked: true,
            no_viable_candidates: false,
        };
        // A crash after the checkpoint but before queue settlement must
        // recover exactly the same scheduling evidence and refund.
        let mut orphan = t.clone();
        reclaim(&mut orphan, Some(run.clone()), 2, "en");
        assert_eq!(orphan.status, TaskStatus::Parked);
        assert_eq!(orphan.attempts, 0);
        assert_eq!(
            orphan.upgrade_resume_key(),
            Some((run.passes[0].started_at, orphan.id.as_str()))
        );
        settle_and_diagnose(&mut t, verdict, "parked", 2, &run);
        assert_eq!(t.attempts, 0);
        assert_eq!(t.passes.len(), 1);
        assert_eq!(t.passes[0].cost, crate::queue::PassCost::Refunded);
        assert_eq!(t.passes[0].parked, Some(cause));
        assert_eq!(t.passes[0].pass_index, 0);
        assert_eq!(t.passes[0].started_at, Some(run.passes[0].started_at));
        assert!(t.upgrade_resume_key().is_some());

        // A resumed pass that then fails spends its attempt, and the earlier
        // pass's entry is untouched.
        t.start("20260904-000000-4043".to_owned());
        run.begin_pass();
        run.status = RunStatus::Failed;
        let verdict = Verdict {
            status: RunStatus::Failed,
            left_pr: false,
            quota_hit: false,
            parked: false,
            no_viable_candidates: false,
        };
        settle_and_diagnose(&mut t, verdict, "failed", 2, &run);
        assert_eq!(t.passes.len(), 2);
        assert_eq!(t.passes[0].cost, crate::queue::PassCost::Refunded);
        assert_eq!(t.passes[1].cost, crate::queue::PassCost::Spent);
        assert_eq!(t.passes[1].pass_index, 1);
        assert_eq!(t.attempts, 1);
    }

    #[test]
    fn reclaim_holds_a_running_task_whose_run_cannot_be_found() {
        let mut t = task();
        t.start("20260904-000000-4043".to_owned());
        reclaim(&mut t, None, 2, "en");
        assert_eq!(t.status, TaskStatus::Held);
        assert!(
            t.last_error
                .as_deref()
                .is_some_and(|e| e.contains("running")),
            "the operator needs to know why this task was held"
        );
    }

    #[test]
    fn orphaned_running_tasks_are_reclaimed_but_live_ones_are_left_alone() {
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().to_path_buf());

        // No run recorded, so this never has to touch `RunState::load`.
        let mut orphaned = task();
        orphaned.id = "20260904-000000-orph".to_owned();
        orphaned.status = TaskStatus::Running;
        orphaned.attempts = 1;
        queue.put(&mut orphaned).unwrap();

        let mut alive = task();
        alive.id = "20260904-000000-live".to_owned();
        alive.status = TaskStatus::Running;
        alive.attempts = 1;
        queue.put(&mut alive).unwrap();
        let _held_by_a_live_daemon = queue.claim(&alive.id).unwrap();

        let mut queued = task();
        queued.id = "20260904-000000-wait".to_owned();
        queue.put(&mut queued).unwrap();

        let reclaimed = reclaim_orphaned_running(&queue, 2, &Default::default());
        assert_eq!(reclaimed, vec![orphaned.id.clone()]);

        assert_eq!(
            queue.get(&orphaned.id).unwrap().status,
            TaskStatus::Held,
            "nothing was driving it and there was no run to recover"
        );
        assert_eq!(
            queue.get(&alive.id).unwrap().status,
            TaskStatus::Running,
            "a live claim must protect the task it belongs to"
        );
        assert_eq!(queue.get(&queued.id).unwrap().status, TaskStatus::Queued);
    }

    /// Read a run.json back from an explicit `home`, the same way
    /// `reclaim_abandoned_runs` itself does - never through the
    /// process-global `RunState::load`, which this test's own `home` (an
    /// isolated tempdir, never pinned into the shared `OnceLock`) does not
    /// use at all.
    fn read_run_under(home: &Path, id: &str) -> RunState {
        let body = std::fs::read_to_string(home.join("runs").join(id).join("run.json")).unwrap();
        serde_json::from_str(&body).unwrap()
    }

    #[test]
    fn reclaim_abandoned_runs_fails_a_run_whose_active_seats_are_all_provably_dead() {
        let dir = tempfile::tempdir().unwrap();
        let home = dir.path().to_path_buf();
        let now = Timestamp::now();
        let overrun_seat = || crate::run::ActiveSeat {
            node: "implement".to_owned(),
            started_at: now - jiff::SignedDuration::new(21_000, 0),
            timeout_secs: 3_600,
            attempt: 0,
            task: None,
            command: None,
            index: None,
            total: None,
        };

        let mut dead = run_state(RunStatus::Implementing);
        dead.id = "20260101-000000-dead".to_owned();
        dead.active.insert("impl-A".to_owned(), overrun_seat());
        // A `driver_pid` the injected query below confirms gone outright —
        // `liveness` reads this as `Dead`, not merely "no daemon claims it".
        dead.driver_pid = Some(4242);
        dead.save_under(&home).unwrap();

        // Same shape, but a live daemon's heartbeat names it: must be left
        // exactly alone, however far past its own timeout the seat sits.
        let mut alive = run_state(RunStatus::Implementing);
        alive.id = "20260101-000000-aliv".to_owned();
        alive.active.insert("impl-A".to_owned(), overrun_seat());
        alive.save_under(&home).unwrap();
        let mut status = Status::new();
        status.current = vec![Current {
            worker: None,
            task: "20260101-000000-task".to_owned(),
            run: alive.id.clone(),
        }];
        write_status_to(&home.join("daemon.json"), &status).unwrap();

        // The abandoned seat left an open question behind: nobody is left to
        // read an answer once the run is failed, and this must not wait for
        // some later daemon startup's own sweep to notice that.
        let questions = Questions::at(home.join("questions"));
        let mut q = ask::Question::new(
            dead.id.clone(),
            "implement".to_owned(),
            "impl-A".to_owned(),
            "Which storage backend?".to_owned(),
            String::new(),
            vec!["SQLite".to_owned(), "Redis".to_owned()],
        );
        questions.put(&mut q).unwrap();

        let abandoned = reclaim_abandoned_runs_with(
            &home,
            now,
            |pid| if pid == 4242 { Some(false) } else { None },
            |_| panic!("a query answering Dead outright needs no identity corroboration"),
        );
        assert_eq!(abandoned, vec![dead.id.clone()]);

        let reloaded = read_run_under(&home, &dead.id);
        assert_eq!(reloaded.status, RunStatus::Failed);
        assert!(reloaded.active.is_empty());
        assert!(
            !questions.get(&q.id).unwrap().status.open(),
            "the failed run's own open question must be settled in the same pass"
        );

        let still_alive = read_run_under(&home, &alive.id);
        assert_eq!(
            still_alive.status,
            RunStatus::Implementing,
            "a live daemon's claim protects it"
        );
        assert!(!still_alive.active.is_empty());
    }

    /// The exact shape a review round flagged as broken: `magi serve` running
    /// in this same `home` scans *every* run on disk, including a manual
    /// `magi review` / `magi run` this daemon never started and that
    /// therefore claims no heartbeat of its own. Before this scan asked
    /// `liveness` rather than just `is_working_on`, a manual run whose active
    /// seat merely ran a little past its own timeout — the CLI finishing up,
    /// its result still being collected — got wiped and failed by a daemon
    /// that had nothing to do with it, out from under a process that was
    /// still very much running.
    #[test]
    fn reclaim_abandoned_runs_leaves_a_live_manual_run_alone_even_though_no_daemon_claims_it() {
        let dir = tempfile::tempdir().unwrap();
        let home = dir.path().to_path_buf();
        let now = Timestamp::now();

        let mut manual = run_state(RunStatus::Reviewing);
        manual.id = "20260101-000000-manl".to_owned();
        manual.active.insert(
            "review-1".to_owned(),
            crate::run::ActiveSeat {
                node: "review".to_owned(),
                started_at: now - jiff::SignedDuration::new(21_000, 0),
                timeout_secs: 3_600,
                attempt: 0,
                task: None,
                command: None,
                index: None,
                total: None,
            },
        );
        // Not claimed by any daemon (no `daemon.json` at all in this `home`),
        // but a real, still-running process: `liveness` must corroborate this
        // as `Live`, not read the missing daemon claim as death.
        manual.driver_pid = Some(4242);
        manual.driver_started_at = Some("1790000000".to_owned());
        manual.save_under(&home).unwrap();

        let abandoned = reclaim_abandoned_runs_with(
            &home,
            now,
            |pid| if pid == 4242 { Some(true) } else { None },
            |pid| {
                if pid == 4242 {
                    Some("1790000000".to_owned())
                } else {
                    None
                }
            },
        );
        assert!(
            abandoned.is_empty(),
            "a manual run a real process is still driving must never be reclaimed: {abandoned:?}"
        );

        let reloaded = read_run_under(&home, &manual.id);
        assert_eq!(reloaded.status, RunStatus::Reviewing);
        assert!(!reloaded.active.is_empty());
    }

    #[test]
    fn an_already_claimed_task_is_skipped_rather_than_failed() {
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().to_path_buf());
        let mut only = task();
        queue.put(&mut only).unwrap();

        let _elsewhere = queue.claim(&only.id).unwrap();
        let candidates = runnable(&queue);
        assert_eq!(candidates.len(), 1, "the task is still runnable");
        assert!(
            queue.claim(&candidates[0].id).is_err(),
            "the loop cannot take a claim somebody else holds"
        );

        let after = queue.get(&only.id).unwrap();
        assert_eq!(after.status, TaskStatus::Queued);
        assert_eq!(
            after.attempts, 0,
            "losing the race is not an attempt at the task"
        );
        assert_eq!(after.last_error, None);
    }

    #[test]
    fn the_status_file_round_trips_and_its_heartbeat_advances() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("daemon.json");

        let mut status = Status::new();
        status.idle = false;
        status.completed = 7;
        status.current = vec![Current {
            worker: None,
            task: "20260902-000000-t111".to_owned(),
            run: "20260902-000001-r111".to_owned(),
        }];
        write_status_to(&path, &status).unwrap();
        let first: Status = serde_json::from_str(&std::fs::read_to_string(&path).unwrap()).unwrap();
        assert_eq!(first.schema, SCHEMA);
        assert_eq!(first.pid, std::process::id());
        assert!(!first.idle);
        assert_eq!(first.completed, 7);
        assert_eq!(first.current, status.current);
        assert!(
            !path.with_extension("json.tmp").exists(),
            "the temp file is renamed, not left behind"
        );

        std::thread::sleep(Duration::from_millis(5));
        status.updated_at = Timestamp::now();
        status.polls = 3;
        write_status_to(&path, &status).unwrap();
        let second: Status =
            serde_json::from_str(&std::fs::read_to_string(&path).unwrap()).unwrap();
        assert!(
            second.updated_at > first.updated_at,
            "a reader can only detect staleness if the heartbeat moves"
        );
        assert_eq!(
            second.started_at, first.started_at,
            "the start time is not a heartbeat"
        );
        assert_eq!(second.polls, 3);
    }

    #[test]
    fn reading_counts_as_running_only_while_its_heartbeat_is_fresh() {
        let dir = tempfile::tempdir().unwrap();

        assert!(read_status(dir.path()).is_none(), "no file, no daemon");

        let mut status = Status::new();
        status.updated_at = Timestamp::now() - jiff::SignedDuration::from_secs(60);
        write_status_to(&dir.path().join("daemon.json"), &status).unwrap();
        let stale = read_status(dir.path()).unwrap();
        assert!(
            !stale.running(Timestamp::now()),
            "a minute without a heartbeat is a dead daemon, not a busy one"
        );
        assert!(stale.age_secs(Timestamp::now()).is_some_and(|s| s >= 55));

        status.updated_at = Timestamp::now();
        write_status_to(&dir.path().join("daemon.json"), &status).unwrap();
        let fresh = read_status(dir.path()).unwrap();
        assert!(fresh.running(Timestamp::now()));
    }

    #[test]
    fn only_a_live_daemon_on_this_very_run_counts_as_working_on_it() {
        let dir = tempfile::tempdir().unwrap();
        let now = Timestamp::now();
        let mine = "20260903-080619-01c2";

        assert!(
            !is_working_on(dir.path(), mine, now),
            "no status file means nobody is working on anything"
        );

        let mut status = Status::new();
        status.current = vec![Current {
            worker: None,
            task: "20260903-080340-0167".to_owned(),
            run: mine.to_owned(),
        }];
        status.updated_at = now;
        write_status_to(&dir.path().join("daemon.json"), &status).unwrap();
        assert!(is_working_on(dir.path(), mine, now));
        assert!(
            !is_working_on(dir.path(), "20260903-105039-3cbf", now),
            "a daemon busy with one run is not working on another"
        );

        // A killed daemon stops writing heartbeats but leaves the file behind
        // naming the run it died in. That run must not be undeletable forever.
        status.updated_at = now - jiff::SignedDuration::from_secs(600);
        write_status_to(&dir.path().join("daemon.json"), &status).unwrap();
        assert!(
            !is_working_on(dir.path(), mine, now),
            "a stale heartbeat is a dead daemon, so its run is a leftover"
        );
    }

    #[test]
    fn is_working_on_short_matches_by_the_worktree_bays_own_name() {
        let dir = tempfile::tempdir().unwrap();
        let now = Timestamp::now();

        assert!(
            !is_working_on_short(dir.path(), "01c2", now),
            "no status file means nobody is working on anything"
        );

        let mut status = Status::new();
        status.current = vec![Current {
            worker: None,
            task: "20260903-080340-0167".to_owned(),
            run: "20260903-080619-01c2".to_owned(),
        }];
        status.updated_at = now;
        write_status_to(&dir.path().join("daemon.json"), &status).unwrap();
        assert!(
            is_working_on_short(dir.path(), "01c2", now),
            "the run's short id is the last block of its full id"
        );
        assert!(
            !is_working_on_short(dir.path(), "3cbf", now),
            "a daemon busy with one worktree bay is not working on another"
        );
    }

    #[test]
    fn a_newer_status_file_still_yields_a_reading() {
        let dir = tempfile::tempdir().unwrap();
        // A field this build has never heard of must not turn the reading into
        // nothing at all; that is the whole reason the reader is permissive.
        std::fs::write(
            dir.path().join("daemon.json"),
            serde_json::json!({
                "schema": 2,
                "updated_at": Timestamp::now().to_string(),
                "idle": true,
                "surprise": { "nested": [1, 2, 3] },
            })
            .to_string(),
        )
        .unwrap();

        let reading = read_status(dir.path()).expect("a forward-compatible read");
        assert!(reading.running(Timestamp::now()));
        assert!(reading.idle);
        assert!(reading.current.is_empty());
    }

    #[test]
    fn an_older_daemons_single_object_current_still_reads_as_a_one_item_list() {
        // A daemon started before `current` became a list keeps writing this
        // shape on every heartbeat until it is restarted. A rolling upgrade
        // - a newer `magi web` or `magi doctor` reading an older `magi
        // serve`'s heartbeat - must still see the run it is on, not "no
        // daemon" from a type mismatch failing the whole struct.
        let dir = tempfile::tempdir().unwrap();
        std::fs::write(
            dir.path().join("daemon.json"),
            serde_json::json!({
                "schema": 1,
                "pid": 4242,
                "updated_at": Timestamp::now().to_string(),
                "idle": false,
                "current": {"task": "20260902-140501-aaaa", "run": "20260902-140502-bbbb"},
                "completed": 3,
                "polls": 9,
            })
            .to_string(),
        )
        .unwrap();

        let reading = read_status(dir.path()).expect("an older shape must still parse");
        assert!(reading.running(Timestamp::now()));
        assert_eq!(
            reading.current,
            vec![Current {
                worker: None,
                task: "20260902-140501-aaaa".to_owned(),
                run: "20260902-140502-bbbb".to_owned(),
            }]
        );
    }

    #[test]
    fn an_absent_or_null_current_reads_as_idle_not_a_parse_failure() {
        let dir = tempfile::tempdir().unwrap();
        std::fs::write(
            dir.path().join("daemon.json"),
            serde_json::json!({
                "schema": 1,
                "updated_at": Timestamp::now().to_string(),
                "idle": true,
                "current": null,
            })
            .to_string(),
        )
        .unwrap();
        let with_null = read_status(dir.path()).expect("null must still parse");
        assert!(with_null.current.is_empty());

        std::fs::write(
            dir.path().join("daemon.json"),
            serde_json::json!({
                "schema": 1,
                "updated_at": Timestamp::now().to_string(),
                "idle": true,
            })
            .to_string(),
        )
        .unwrap();
        let absent = read_status(dir.path()).expect("a missing field must still parse");
        assert!(absent.current.is_empty());
    }

    #[test]
    fn a_task_without_a_repository_runs_in_the_daemons_default() {
        let fallback = Path::new("/default");
        let mut blank = task();
        blank.repo = PathBuf::new();
        assert_eq!(repo_for(&blank, fallback), PathBuf::from("/default"));
        let mut dot = task();
        dot.repo = PathBuf::from(".");
        assert_eq!(repo_for(&dot, fallback), PathBuf::from("/default"));
        assert_eq!(
            repo_for(&task(), fallback),
            PathBuf::from("/repo"),
            "a task that names a repository keeps it"
        );
    }

    #[test]
    fn task_implementers_edit_inherits_daemon_config_and_merge() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("explicit.toml");
        std::fs::write(&path, "[graph]\nimplementers = 3\njudges = 1\n").unwrap();
        let opts = Opts {
            config: Some(path),
            merge: Some("none".into()),
            ..Default::default()
        };
        let mut t = task();
        t.set_implementers(
            2,
            &toml::from_str("[[agents]]\nid = 'mock'\nkind = 'command'\ncommand = ['true']\n")
                .unwrap(),
        )
        .unwrap();
        let cfg = prepare_for(dir.path(), &opts, &t).unwrap();
        assert_eq!(cfg.graph.implementers, 2);
        assert_eq!(cfg.graph.judges, 1);
        assert_eq!(cfg.merge.mode, MergeMode::None);
        t.set_implementers(1, &cfg).unwrap();
        let mut cfg = prepare_for(dir.path(), &opts, &t).unwrap();
        apply_task_implementers(&mut cfg, &t);
        assert_eq!(cfg.graph.implementers, 1);
        assert_eq!(cfg.graph.judges, 1);
        assert_eq!(cfg.merge.mode, MergeMode::None);
    }

    #[test]
    fn task_implementers_direct_overrides_stay_isolated_after_edits() {
        let dir = tempfile::tempdir().unwrap();
        let repo = dir.path().join("repo");
        std::fs::create_dir(&repo).unwrap();
        std::fs::write(
            repo.join("magi.toml"),
            "[graph]\njudges = 2\n[merge]\nmode = 'none'\n",
        )
        .unwrap();
        let daemon_config = dir.path().join("daemon.toml");
        std::fs::write(
            &daemon_config,
            "[graph]\njudges = 1\n[merge]\nmode = 'pr'\n",
        )
        .unwrap();
        let opts = Opts {
            config: Some(daemon_config),
            merge: Some("pr".into()),
            ..Default::default()
        };
        let q = Queue::at(dir.path().join("queue"));
        let validation: Config =
            toml::from_str("[[agents]]\nid = 'mock'\nkind = 'command'\ncommand = ['true']\n")
                .unwrap();
        // No provenance field on legacy direct tasks: both shapes stay isolated.
        for record in ["{}", r#"{"candidates":2}"#] {
            let overrides = serde_json::from_str(record).unwrap();
            let filing = crate::direct::Filing {
                instruction: "work".into(),
                title: "direct".into(),
                repo: repo.clone(),
                source: crate::queue::Source::Human,
                solo: false,
                overrides,
                review_of: None,
                sources: Default::default(),
            };
            let filed =
                crate::direct::file(&q, dir.path(), Timestamp::now(), 1, filing, true).unwrap();
            let crate::direct::Filed::Standalone {
                mut task,
                claim: _claim,
            } = filed
            else {
                panic!("local filing")
            };
            let before = prepare_for(&repo, &opts, &task).unwrap();
            assert_eq!(before.graph.judges, 2, "daemon --config must not leak");
            assert_eq!(
                before.merge.mode,
                MergeMode::None,
                "daemon --merge must not leak"
            );
            for n in [2, 1, 2] {
                task.set_implementers(n, &validation).unwrap();
                q.put(&mut task).unwrap();
                task = q.get(&task.id).unwrap();
                assert!(!task.overrides.as_ref().unwrap().inherit_daemon_options);
                let mut cfg = prepare_for(&repo, &opts, &task).unwrap();
                apply_task_implementers(&mut cfg, &task);
                assert_eq!(cfg.graph.implementers, usize::from(n));
                assert_eq!(cfg.graph.judges, 2);
                assert_eq!(cfg.merge.mode, MergeMode::None);
            }
        }
    }

    #[test]
    fn task_implementers_mismatch_keeps_explicit_reviews_review_only() {
        let cfg: Config =
            toml::from_str("[[agents]]\nid = 'mock'\nkind = 'command'\ncommand = ['true']\n")
                .unwrap();
        let mut t = task();
        t.review_of = Some("review-target".into());
        t.hold_manual(Some("retry".into()));
        let mut previous = RunState::new(
            PathBuf::from("/repo"),
            "main".into(),
            "abc1234".into(),
            "review".into(),
            cfg.clone(),
        );
        previous.config.graph.implementers = 2;
        for count in [1, 3] {
            t.set_implementers(count, &cfg).unwrap();
            t.release();
            assert_eq!(t.review_of.as_deref(), Some("review-target"));
            for proposed in [
                Starter::Resume(previous.id.clone()),
                Starter::Review("recovery-target".into()),
            ] {
                assert_eq!(
                    starter_with_implementers(&t, Some(&previous), proposed),
                    Starter::Review("review-target".into())
                );
            }
            let mut configured = cfg.clone();
            apply_task_implementers(&mut configured, &t);
            assert_eq!(configured.graph.implementers, usize::from(count));
            assert_eq!(previous.config.graph.implementers, 2);
        }
    }

    #[test]
    fn task_implementers_dispatch_and_resume_agree() {
        let mut t = task();
        let cfg: crate::config::Config =
            toml::from_str("[[agents]]\nid = 'mock'\nkind = 'command'\ncommand = ['true']\n")
                .unwrap();
        let mut run = RunState::new(
            PathBuf::from("/repo"),
            "main".into(),
            "abc1234".into(),
            "work".into(),
            cfg.clone(),
        );
        run.config.graph.implementers = 2;
        for n in [2, 1, 3, 2] {
            t.set_implementers(n, &cfg).unwrap();
            let mut dispatched = cfg.clone();
            apply_task_implementers(&mut dispatched, &t);
            assert_eq!(dispatched.graph.implementers, usize::from(n));
            assert_eq!(implementers_match(&t, &run), n == 2);
            for proposed in [
                Starter::Resume(run.id.clone()),
                Starter::Review("old-branch".into()),
            ] {
                let expected = if n == 2 {
                    proposed.clone()
                } else {
                    Starter::Start
                };
                assert_eq!(
                    starter_with_implementers(&t, Some(&run), proposed),
                    expected
                );
            }
            assert_eq!(
                run.config.graph.implementers, 2,
                "history must not be rewritten"
            );
        }
        t.solo = false;
        t.overrides = None;
        assert!(implementers_match(&t, &run));
    }

    #[test]
    fn a_solo_task_runs_with_one_candidate_and_a_plain_task_keeps_the_configs() {
        // Three seats said out loud. What `solo` promises is one candidate
        // *whatever the config asks for*, so the contrast has to be a number
        // this test owns - it used to be `Config::default()`'s, which became
        // 1 when one implementation became the default and left the two
        // halves of this test asserting the same thing.
        let mut solo_cfg = Config::default();
        solo_cfg.graph.implementers = 3;
        let mut solo_task = task();
        solo_task.solo = true;
        apply_task_implementers(&mut solo_cfg, &solo_task);
        assert_eq!(solo_cfg.graph.implementers, 1);

        let mut plain_cfg = Config::default();
        plain_cfg.graph.implementers = 3;
        let plain_task = task();
        assert!(!plain_task.solo);
        apply_task_implementers(&mut plain_cfg, &plain_task);
        assert_eq!(
            plain_cfg.graph.implementers, 3,
            "a task that did not ask to run alone keeps the config's candidates"
        );
    }

    fn loss(seat: &str, at: &str, reset: Option<&str>) -> QuotaLoss {
        QuotaLoss {
            seat: seat.into(),
            node: "judge".into(),
            at: at.parse().unwrap(),
            reset: reset.map(str::to_string),
        }
    }

    #[test]
    fn a_resumed_run_with_only_old_quota_losses_arms_no_cooldown() {
        let old: Vec<QuotaLoss> = (1..=4)
            .map(|i| {
                loss(
                    &format!("judge-{i}"),
                    "2026-09-23T05:23:00Z",
                    Some("2:40pm (Asia/Tokyo)"),
                )
            })
            .collect();
        let fresh = losses_this_attempt(&old, &old);
        assert!(fresh.is_empty());
        assert_eq!(cooldown_until(&fresh, Timestamp::now()), None);
        // And it is not a `quota_hit` either: that is `!fresh.is_empty()`.
    }

    #[test]
    fn a_new_quota_loss_during_the_attempt_still_arms_the_cooldown() {
        let old = vec![loss("judge-1", "2026-09-23T05:23:00Z", None)];
        let now = Timestamp::now();
        let mut after = old.clone();
        after.push(loss("judge-2", &now.to_string(), None));
        let fresh = losses_this_attempt(&old, &after);
        assert_eq!(fresh, vec![after[1].clone()]);
        let until = cooldown_until(&fresh, now).expect("a fresh loss arms the cooldown");
        assert_eq!(
            until,
            now + jiff::SignedDuration::from_secs(QUOTA_WAIT_FALLBACK.as_secs() as i64)
        );
    }

    #[test]
    fn a_recovered_seat_dropping_out_of_the_history_does_not_hide_a_new_loss() {
        // `recover_stall` removes judge-1's loss and the retry then hits quota
        // again: the vector is the same length, so an index diff sees nothing.
        let before = vec![
            loss("judge-1", "2026-09-23T05:23:00Z", None),
            loss("judge-2", "2026-09-23T05:24:00Z", None),
        ];
        let after = vec![
            loss("judge-2", "2026-09-23T05:24:00Z", None),
            loss("judge-1", "2026-09-24T01:00:00Z", None),
        ];
        assert_eq!(losses_this_attempt(&before, &after), vec![after[1].clone()]);
    }

    #[test]
    fn merge_overrides_are_parsed_or_refused() {
        assert_eq!(merge_mode("none").unwrap(), MergeMode::None);
        assert_eq!(merge_mode("local").unwrap(), MergeMode::Local);
        assert_eq!(merge_mode("pr").unwrap(), MergeMode::Pr);
        assert!(merge_mode("squash").is_err());
    }

    #[test]
    fn quota_wait_uses_a_future_reset_time_capped_and_falls_back_otherwise() {
        let now = Timestamp::now();
        let fallback = Duration::from_secs(300);
        let cap = Duration::from_secs(1800);

        // No reset hint at all: the fallback.
        assert_eq!(quota_wait(None, now, fallback, cap), fallback);

        // A reset ten minutes out, well inside the cap: waited for exactly.
        let soon = now + jiff::SignedDuration::from_secs(600);
        assert_eq!(
            quota_wait(Some(soon), now, fallback, cap),
            Duration::from_secs(600)
        );

        // A reset already in the past is not trusted: the fallback, not a
        // zero or negative wait that would spin the loop right back around.
        let past = now - jiff::SignedDuration::from_secs(60);
        assert_eq!(quota_wait(Some(past), now, fallback, cap), fallback);

        // A reset further out than the cap is trusted for direction but not
        // for magnitude: a parsing slip must not sleep the loop for a day.
        let far = now + jiff::SignedDuration::from_secs(3 * 3600);
        assert_eq!(quota_wait(Some(far), now, fallback, cap), cap);
    }

    #[test]
    fn parse_reset_hint_reads_the_claude_cli_shape_and_rolls_a_past_clock_to_tomorrow() {
        let now = "2026-09-07T02:50:00Z".parse::<Timestamp>().unwrap();

        let at = parse_reset_hint("4:50am (UTC)", now, now).expect("a recognised shape parses");
        assert_eq!(at.to_string(), "2026-09-07T04:50:00Z");

        // Same clock reading, but it has already gone by today: read as
        // tomorrow's, since the CLI would not still be reporting a limit past
        // its own stated reset.
        let already_past =
            parse_reset_hint("1:00am (UTC)", now, now).expect("a recognised shape parses");
        assert_eq!(already_past.to_string(), "2026-09-08T01:00:00Z");

        assert!(
            parse_reset_hint("session limit reached", now, now).is_none(),
            "free text with no recognised shape is not guessed at"
        );
        assert!(
            parse_reset_hint("4:50am (Nowhere/Fake)", now, now).is_none(),
            "an unresolvable zone name is not guessed at either"
        );
    }

    #[test]
    fn parse_reset_hint_reads_the_codex_cli_shape_with_no_year_rollover_needed() {
        let now = "2026-09-07T02:50:00Z".parse::<Timestamp>().unwrap();

        let at = parse_reset_hint(
            "You've hit your usage limit. Visit \
             https://chatgpt.com/codex/settings/usage to purchase more \
             credits or try again at Sep 19th, 2026 5:10 PM.",
            now,
            now,
        )
        .expect("the codex reset wording is a recognised shape");
        assert_eq!(at.to_string(), "2026-09-19T17:10:00Z");

        // The month is explicit, so a date already earlier in the same
        // sentence-implied year than `now` is trusted as written rather than
        // rolled forward a year the way the bracketed shape rolls a
        // same-day clock reading to tomorrow.
        let earlier = parse_reset_hint("try again at Jan 2nd, 2026 1:00 AM.", now, now)
            .expect("an explicit year needs no rollover");
        assert_eq!(earlier.to_string(), "2026-01-02T01:00:00Z");

        assert!(
            parse_reset_hint("try again at Sep 19th, 26 5:10 PM.", now, now).is_none(),
            "a two-digit year is not the documented shape and is not guessed at"
        );
        assert!(
            parse_reset_hint("try again at Sept 19th, 2026 5:10 PM.", now, now).is_none(),
            "a four-letter month name is not the documented three-letter abbreviation"
        );
        assert!(
            parse_reset_hint("try again at Sep 19th, 2026 5:10 PM (UTC).", now, now).is_none(),
            "an explicit zone on the dated shape is a format nobody has \
             documented, and is refused rather than guessed at as UTC"
        );
    }

    #[test]
    fn parse_reset_hint_reads_agys_relative_shape_from_when_the_loss_was_recorded() {
        let now = "2026-09-24T12:00:00Z".parse::<Timestamp>().unwrap();
        let recorded = "2026-09-24T08:00:00Z".parse::<Timestamp>().unwrap();

        let at = parse_reset_hint("in 1h2m49s", now, recorded).expect("agy's shape parses");
        assert_eq!(at.as_second() - recorded.as_second(), 3769);

        let partial = parse_reset_hint("in 45m", now, recorded).expect("units are optional");
        assert_eq!(partial.as_second() - recorded.as_second(), 45 * 60);

        for bad in ["in ", "in 45", "in 3x", "in m", "in 1h junk", "1h2m"] {
            assert!(
                parse_reset_hint(bad, now, recorded).is_none(),
                "{bad:?} must not be guessed at"
            );
        }
    }

    /// A loop whose queue lives in a temp tree and whose poll interval is far
    /// longer than the test's patience, so anything that waits out a poll
    /// instead of noticing the stop fails rather than merely being slow.
    fn idle_loop(dir: &Path) -> (Opts, Queue, PathBuf, PathBuf, PathBuf) {
        let config = dir.join("magi.toml");
        std::fs::write(
            &config,
            "[disk]\nmin_free_bytes = 0\nauto_fold = false\ncache_limit_bytes = 0\n",
        )
        .unwrap();
        let opts = Opts {
            poll: Duration::from_secs(30),
            config: Some(config),
            // The explicit fixture config keeps startup cleanup from reading
            // machine configuration. This fictional repository likewise
            // keeps any best-effort git cleanup away from this checkout.
            repo: dir.join("repo"),
            ..Opts::default()
        };
        // The status file goes in a directory that does not exist yet, so its
        // creation is itself evidence the loop published one. `worktrees`
        // must be just as fictional: the janitor reclaims worktrees under it
        // for real, and a test that let it fall through to
        // `crate::run::default_worktree_root()` would have it reclaim
        // worktrees out of the operator's real `~/wt/<repo>`, not a fixture -
        // which is exactly what happened before this function took the
        // parameter at all.
        let home = dir.join("home");
        // These control-only fixtures do not launch native workers. Give the
        // independently tested maintenance services a fresh cadence receipt.
        let stamps = home.join("service-ticks");
        std::fs::create_dir_all(&stamps).unwrap();
        for service in ["waiter", "deputies", "release-watch"] {
            std::fs::write(
                stamps.join(service),
                Timestamp::now().as_second().to_string(),
            )
            .unwrap();
        }
        for operation in [
            "conductor",
            "maintenance",
            "housekeeping",
            "disk-pressure",
            "cache",
            "fetch",
        ] {
            std::fs::write(
                stamps.join(format!("daemon-{operation}")),
                serde_json::to_vec(&Timestamp::now()).unwrap(),
            )
            .unwrap();
        }
        let worktrees = dir.join("wt");
        (
            opts,
            Queue::at(dir.join("queue")),
            home.join("daemon.json"),
            home,
            worktrees,
        )
    }

    #[test]
    fn a_stop_is_idempotent_and_once_set_stays_set() {
        let stop = Stop::new();
        assert!(!stop.stopped());

        stop.stop();
        assert!(stop.stopped());
        stop.stop();
        assert!(stop.stopped(), "a second stop is not a toggle");

        let shared = stop.clone();
        assert!(
            shared.stopped(),
            "a clone is the same stop; that is how the loop and its caller share one"
        );
    }

    #[test]
    fn only_a_stop_with_a_run_in_flight_reads_as_finishing() {
        let stop = Stop::new();
        stop.busy.store(1, Ordering::SeqCst);
        assert!(
            !stop.finishing(),
            "a busy loop nobody has asked to stop is just running"
        );

        stop.stop();
        assert!(
            stop.finishing(),
            "a stop asked for mid-run has not landed until the run is settled"
        );

        stop.busy.store(0, Ordering::SeqCst);
        assert!(
            !stop.finishing(),
            "once the run is settled the stop has landed and there is nothing to finish"
        );
    }

    #[test]
    fn finishing_stays_true_until_the_last_of_several_runs_exits() {
        let stop = Stop::new();
        stop.busy.store(2, Ordering::SeqCst);
        stop.stop();
        assert!(stop.finishing(), "two runs still in flight");

        stop.busy.store(1, Ordering::SeqCst);
        assert!(
            stop.finishing(),
            "one run finished, but a sibling is still working"
        );

        stop.busy.store(0, Ordering::SeqCst);
        assert!(
            !stop.finishing(),
            "the last run out is what actually lands the stop"
        );
    }

    #[tokio::test]
    async fn a_loop_already_asked_to_stop_returns_without_waiting_out_a_poll() {
        let dir = tempfile::tempdir().unwrap();
        let (opts, queue, status_file, home, worktrees) = idle_loop(dir.path());
        let stop = Stop::new();
        stop.stop();

        let began = std::time::Instant::now();
        tokio::time::timeout(
            Duration::from_secs(2),
            drive(&opts, &queue, &status_file, &home, &worktrees, &stop),
        )
        .await
        .expect("a stopped loop must return, not sit out its poll interval")
        .expect("the loop's own setup and teardown must not fail");
        assert!(
            began.elapsed() < opts.poll,
            "returned only after {:?}, which is a poll interval, not a stop",
            began.elapsed()
        );
    }

    #[tokio::test]
    async fn a_stop_while_idle_wakes_the_wait_instead_of_sleeping_it_out() {
        let dir = tempfile::tempdir().unwrap();
        let (opts, queue, status_file, home, worktrees) = idle_loop(dir.path());
        let stop = Stop::new();

        // Asked for after the loop is already parked on its empty queue, which
        // is the case an operator tapping stop on a phone actually hits.
        let asker = {
            let stop = stop.clone();
            tokio::spawn(async move {
                tokio::time::sleep(Duration::from_millis(20)).await;
                stop.stop();
            })
        };

        let began = std::time::Instant::now();
        tokio::time::timeout(
            Duration::from_secs(2),
            drive(&opts, &queue, &status_file, &home, &worktrees, &stop),
        )
        .await
        .expect("a stop asked for while idle must wake the wait")
        .expect("the loop's own setup and teardown must not fail");
        asker.await.unwrap();
        assert!(
            began.elapsed() < opts.poll,
            "returned only after {:?}, so the stop waited on the sleep",
            began.elapsed()
        );
    }

    #[tokio::test]
    async fn a_stopped_loop_leaves_no_status_file_claiming_it_is_running() {
        let dir = tempfile::tempdir().unwrap();
        let (opts, queue, status_file, home, worktrees) = idle_loop(dir.path());
        let stop = Stop::new();
        stop.stop();

        tokio::time::timeout(
            Duration::from_secs(2),
            drive(&opts, &queue, &status_file, &home, &worktrees, &stop),
        )
        .await
        .expect("a stopped loop must return")
        .expect("the loop's own setup and teardown must not fail");

        assert!(
            home.is_dir(),
            "the loop did publish a status file, so its removal is the teardown and not an absence"
        );
        assert!(
            !status_file.exists(),
            "a stopped loop clears its status file"
        );
        assert!(
            read_status(&home).is_none(),
            "a reader must see no daemon at all, not a heartbeat that merely stopped"
        );
    }

    #[tokio::test]
    async fn housekeeping_worker_settles_questions_without_a_scheduler() {
        let dir = tempfile::tempdir().unwrap();
        let (opts, queue, _, home, worktrees) = idle_loop(dir.path());

        let mut settled = RunState::new(
            dir.path().join("repo"),
            "main".to_owned(),
            "abc1234".to_owned(),
            "fixture".to_owned(),
            Config::default(),
        );
        settled.status = RunStatus::Ready;
        let run_dir = home.join("runs").join(&settled.id);
        std::fs::create_dir_all(&run_dir).unwrap();
        std::fs::write(
            run_dir.join("run.json"),
            serde_json::to_string_pretty(&settled).unwrap(),
        )
        .unwrap();
        let questions = Questions::at(home.join("questions"));
        let mut question = ask::Question::new(
            settled.id.clone(),
            "review".to_owned(),
            "reviewer-1".to_owned(),
            "Continue?".to_owned(),
            String::new(),
            Vec::new(),
        );
        questions.put(&mut question).unwrap();

        run_service_worker(
            &home,
            serde_json::to_value(ServiceWorker {
                opts,
                queue: queue.root().to_path_buf(),
                worktrees_root: worktrees,
                operation: "housekeeping".to_owned(),
            })
            .unwrap(),
        )
        .await
        .unwrap();

        assert_eq!(
            questions.get(&question.id).unwrap().status,
            ask::QuestionStatus::Abandoned,
            "the independent housekeeping worker settles ended-run questions"
        );
    }

    #[test]
    fn cache_check_due_fires_immediately_then_waits_out_its_own_interval() {
        let t0 = "2026-09-15T00:00:00Z".parse::<Timestamp>().unwrap();

        assert!(
            cache_check_due(None, t0, CACHE_CHECK_INTERVAL_SECS),
            "never checked before: due at once"
        );

        let one_sec_later = t0 + jiff::SignedDuration::from_secs(1);
        assert!(
            !cache_check_due(Some(t0), one_sec_later, CACHE_CHECK_INTERVAL_SECS),
            "well inside the interval: not due yet"
        );

        let at_the_edge = t0 + jiff::SignedDuration::from_secs(CACHE_CHECK_INTERVAL_SECS as i64);
        assert!(
            !cache_check_due(Some(t0), at_the_edge, CACHE_CHECK_INTERVAL_SECS),
            "exactly at the edge: not yet due, same convention as `clean::due`"
        );

        let past_it = t0 + jiff::SignedDuration::from_secs(CACHE_CHECK_INTERVAL_SECS as i64 + 1);
        assert!(
            cache_check_due(Some(t0), past_it, CACHE_CHECK_INTERVAL_SECS),
            "past the interval: due again"
        );
    }

    /// A `magi.toml` whose `[verify] gate` names `cache_dir` as its shared
    /// `CARGO_TARGET_DIR`, capped at `limit_bytes`, plus a repository path
    /// that is never created - the fixtures [`maybe_prune_cache_between_runs`]
    /// and the congestion test below both need, and must not drift apart.
    fn cache_check_opts(dir: &Path, cache_dir: &Path, limit_bytes: u64) -> Opts {
        let config = dir.join("magi.toml");
        // A literal (single-quoted) TOML string, not a basic one: the cache
        // path is a Windows path full of backslashes, and a basic string
        // would have TOML try to interpret `\U` (from `\Users\...`) as a
        // Unicode escape and fail to parse - the same trap `magi.toml`'s own
        // `{{ vars.cache }}` rendering documents.
        std::fs::write(
            &config,
            format!(
                "[disk]\nmin_free_bytes = 0\nauto_fold = false\ncache_limit_bytes = {limit_bytes}\n\n\
                 [verify]\ngate = ['CARGO_TARGET_DIR={} cargo make check']\n",
                cache_dir.display()
            ),
        )
        .unwrap();
        Opts {
            config: Some(config),
            repo: dir.join("repo"),
            ..Opts::default()
        }
    }

    #[tokio::test]
    async fn maybe_prune_cache_between_runs_reprunes_only_once_its_own_interval_elapses() {
        let dir = tempfile::tempdir().unwrap();
        let home = dir.path().join("home");
        let cache_dir = dir.path().join("cache");
        std::fs::create_dir_all(&cache_dir).unwrap();
        std::fs::write(cache_dir.join("a"), vec![0u8; 10]).unwrap();
        let opts = cache_check_opts(dir.path(), &cache_dir, 1);

        // Nobody has asked this daemon to stop, which is the ordinary case;
        // the skip that a stop buys is asserted by its own test below.
        let running = Stop::new();
        let mut last_checked = None;
        let t0 = "2026-09-15T00:00:00Z".parse::<Timestamp>().unwrap();
        maybe_prune_cache_between_runs(&opts.repo, &opts, &home, &running, &mut last_checked, t0)
            .await;
        assert_eq!(
            crate::disk::dir_size(&cache_dir),
            0,
            "over the cap on the first check ever: pruned at once, no idle queue required"
        );
        assert_eq!(last_checked, Some(t0));

        // A fresh oversized file lands, but the next check is not due yet.
        std::fs::write(cache_dir.join("b"), vec![0u8; 10]).unwrap();
        let too_soon = t0 + jiff::SignedDuration::from_secs(1);
        maybe_prune_cache_between_runs(
            &opts.repo,
            &opts,
            &home,
            &running,
            &mut last_checked,
            too_soon,
        )
        .await;
        assert_eq!(
            crate::disk::dir_size(&cache_dir),
            10,
            "too soon since the last check: left alone rather than rescanned every call"
        );
        assert_eq!(
            last_checked,
            Some(t0),
            "an idle check does not reset the clock"
        );

        // Once the interval elapses, the same oversized cache is caught again.
        let due_again = t0 + jiff::SignedDuration::from_secs(CACHE_CHECK_INTERVAL_SECS as i64 + 1);
        maybe_prune_cache_between_runs(
            &opts.repo,
            &opts,
            &home,
            &running,
            &mut last_checked,
            due_again,
        )
        .await;
        assert_eq!(
            crate::disk::dir_size(&cache_dir),
            0,
            "due again: pruned back under the cap"
        );
    }

    /// A stop must not queue behind housekeeping. The prune below is a
    /// synchronous walk of the whole cache with no await point in it, so a
    /// loop that entered it could not get back to its own `stopped()` test
    /// until the walk finished - and because no run is in flight at this
    /// boundary, `Stop::finishing` would meanwhile tell the operator's screen
    /// the stop had already landed. The idle branch has always made this same
    /// check before reaching `janitor`; the between-runs path makes it too.
    #[tokio::test]
    async fn a_stop_already_asked_for_skips_the_between_runs_cache_walk() {
        let dir = tempfile::tempdir().unwrap();
        let home = dir.path().join("home");
        let cache_dir = dir.path().join("cache");
        std::fs::create_dir_all(&cache_dir).unwrap();
        std::fs::write(cache_dir.join("a"), vec![0u8; 10]).unwrap();
        let opts = cache_check_opts(dir.path(), &cache_dir, 1);

        let stop = Stop::new();
        stop.stop();
        assert!(
            !stop.finishing(),
            "no run is in flight at a between-runs boundary, so nothing else \
             would tell the operator this stop had not taken effect yet"
        );

        let mut last_checked = None;
        let t0 = "2026-09-15T00:00:00Z".parse::<Timestamp>().unwrap();
        maybe_prune_cache_between_runs(&opts.repo, &opts, &home, &stop, &mut last_checked, t0)
            .await;
        assert_eq!(
            crate::disk::dir_size(&cache_dir),
            10,
            "over its cap, and due for the first check ever, but a stop outranks \
             it: the cap is a standing policy the next start measures again"
        );
        assert_eq!(
            last_checked, None,
            "a check that never happened must not claim the interval"
        );
    }

    /// A backlog must not starve cache pruning. The finite cache worker runs
    /// independently of queue drain and must not consume any task attempts.
    #[tokio::test]
    async fn cache_prune_reaches_a_queue_that_never_goes_idle() {
        let dir = tempfile::tempdir().unwrap();
        let cache_dir = dir.path().join("cache");
        std::fs::create_dir_all(&cache_dir).unwrap();
        std::fs::write(cache_dir.join("stale"), vec![0u8; 4096]).unwrap();

        let mut opts = cache_check_opts(dir.path(), &cache_dir, 1);
        opts.poll = Duration::from_millis(20);
        opts.max_attempts = 1_000;

        let queue = Queue::at(dir.path().join("queue"));
        for i in 0..128 {
            let mut task = Task::new(
                format!("queued work {i}"),
                format!("queued work {i}"),
                opts.repo.clone(),
                Source::Human,
            );
            queue.put(&mut task).unwrap();
        }

        let home = dir.path().join("home");
        let worktrees = dir.path().join("wt");
        run_service_worker(
            &home,
            serde_json::to_value(ServiceWorker {
                opts,
                queue: queue.root().to_path_buf(),
                worktrees_root: worktrees,
                operation: "cache".to_owned(),
            })
            .unwrap(),
        )
        .await
        .unwrap();
        let after = queue.list();
        assert_eq!(after.len(), 128);
        assert!(
            after
                .iter()
                .all(|task| task.status.runnable() && task.attempts == 0)
        );

        assert_eq!(
            crate::disk::dir_size(&cache_dir),
            0,
            "an oversized cache must not be left to grow unboundedly just because the \
             queue kept the loop busy the whole time"
        );
    }

    #[test]
    fn task_question_reconciliation_keeps_references_and_retires_manual_releases() {
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().join("queue"));
        let questions = Questions::at(dir.path().join("questions"));
        let mut task = task();
        queue.put(&mut task).unwrap();

        let mut task_question = ask::Question::new(
            task.id.clone(),
            crate::conduct::NODE.to_owned(),
            "conduct".to_owned(),
            "Which backend?".to_owned(),
            String::new(),
            Vec::new(),
        );
        questions.put(&mut task_question).unwrap();
        task.block(vec![task_question.id.clone()], None);
        queue.put(&mut task).unwrap();

        let mut run_question = ask::Question::new(
            "20260101-000000-run1".to_owned(),
            "review".to_owned(),
            "reviewer-1".to_owned(),
            "Run question".to_owned(),
            String::new(),
            Vec::new(),
        );
        questions.put(&mut run_question).unwrap();

        // A question from another node whose `run` happens to equal this
        // task's id — the same field, filled in for an unrelated reason. Only
        // `crate::conduct::NODE` questions use `run` as a task id; this one
        // must never be touched by this reconciliation, even after release.
        let mut coincidental = ask::Question::new(
            task.id.clone(),
            "review".to_owned(),
            "reviewer-1".to_owned(),
            "Unrelated review question".to_owned(),
            String::new(),
            Vec::new(),
        );
        questions.put(&mut coincidental).unwrap();

        reconcile_task_questions(&queue, &questions);
        assert!(questions.get(&task_question.id).unwrap().status.open());
        assert!(questions.get(&run_question.id).unwrap().status.open());
        assert!(questions.get(&coincidental.id).unwrap().status.open());

        task.release();
        queue.put(&mut task).unwrap();
        reconcile_task_questions(&queue, &questions);
        assert_eq!(
            questions.get(&task_question.id).unwrap().status,
            ask::QuestionStatus::Abandoned
        );
        assert!(
            questions.get(&run_question.id).unwrap().status.open(),
            "run questions remain the run janitor's responsibility"
        );
        assert!(
            questions.get(&coincidental.id).unwrap().status.open(),
            "a non-conductor question must not be abandoned just because its \
             run id coincides with a task id"
        );
    }

    #[test]
    fn a_freshly_started_running_task_is_never_stalled() {
        let dir = tempfile::tempdir().unwrap();
        let mut t = task();
        t.start("run-1".to_owned());
        // `updated_at` is `Timestamp::now()`, left alone: no live daemon
        // named in `dir`, but nowhere near `STALLED_RUNNING` yet.
        assert!(!is_stalled(&t, dir.path(), Timestamp::now()));
    }

    #[test]
    fn a_long_running_task_with_no_live_daemon_is_stalled() {
        let dir = tempfile::tempdir().unwrap();
        let mut t = task();
        t.start("run-1".to_owned());
        t.updated_at = Timestamp::now()
            - jiff::SignedDuration::from_secs(STALLED_RUNNING.as_secs() as i64 + 60);
        assert!(is_stalled(&t, dir.path(), Timestamp::now()));
        assert_eq!(
            stalled_tasks(
                &Queue::at(dir.path().join("q")),
                dir.path(),
                Timestamp::now()
            )
            .len(),
            0,
            "the task was never written to this queue"
        );
    }

    #[test]
    fn a_long_running_task_a_live_daemon_still_names_is_not_stalled() {
        let dir = tempfile::tempdir().unwrap();
        let mut t = task();
        t.id = "20260903-080340-0167".to_owned();
        t.start("20260903-080619-01c2".to_owned());
        t.updated_at = Timestamp::now()
            - jiff::SignedDuration::from_secs(STALLED_RUNNING.as_secs() as i64 + 60);

        let mut status = Status::new();
        status.current = vec![Current {
            worker: None,
            task: t.id.clone(),
            run: "20260903-080619-01c2".to_owned(),
        }];
        write_status_to(&dir.path().join("daemon.json"), &status).unwrap();

        assert!(
            !is_stalled(&t, dir.path(), Timestamp::now()),
            "a live daemon's own heartbeat rules out stalled, however long the task has run"
        );
    }

    /// Rewrite a task's `updated_at` on disk directly, bypassing
    /// `Queue::put`'s own `Timestamp::now()` stamping - the only way to make
    /// a fixture look like it has genuinely been `running` for a while.
    fn backdate_task(queue: &Queue, id: &str, seconds_ago: i64) {
        let path = queue.path_of(id);
        let body = std::fs::read_to_string(&path).unwrap();
        let mut v: serde_json::Value = serde_json::from_str(&body).unwrap();
        let old = Timestamp::now() - jiff::SignedDuration::from_secs(seconds_ago);
        v["updated_at"] = serde_json::Value::String(old.to_string());
        std::fs::write(&path, serde_json::to_string_pretty(&v).unwrap()).unwrap();
    }

    #[test]
    fn stalled_tasks_still_reaches_a_task_reclaim_could_not_claim_yet() {
        // The realistic `poll()` ordering, not `is_stalled` in isolation:
        // `reclaim_orphaned_running` runs first, on every poll, and settles
        // any `running` task whose claim it can actually take. For most
        // crashes that is immediate - a dead pid is proof enough for
        // `sweep_stale_claims` to drop the lock the same tick, and the very
        // next claim attempt succeeds. But a lock whose pid cannot be parsed
        // at all falls back to `STALE_CLAIM`'s six-hour age instead (see
        // `sweep_stale_claims`'s own doc), so the lock - and the claim
        // failure behind it - can legitimately outlive many polls. This is
        // exactly the gap `stalled_tasks` exists to surface well before that
        // six-hour sweep would: reclaim leaves the task `running`, and it
        // must still reach the conductor as stalled.
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().join("queue"));
        let home = dir.path().join("home");

        let mut t = task();
        t.id = "20260101-000001-lock".to_owned();
        t.start("run-1".to_owned());
        queue.put(&mut t).unwrap();
        backdate_task(&queue, &t.id, STALLED_RUNNING.as_secs() as i64 + 60);
        std::fs::write(
            dir.path().join("queue").join(format!("{}.lock", t.id)),
            "not a pid",
        )
        .unwrap();

        let now = Timestamp::now();
        assert!(
            reclaim_orphaned_running(&queue, 2, &Default::default()).is_empty(),
            "the unparseable lock is still well within STALE_CLAIM, so the claim fails \
             and reclaim must leave the task alone"
        );
        assert_eq!(queue.get(&t.id).unwrap().status, TaskStatus::Running);

        let stalled = stalled_tasks(&queue, &home, now);
        assert_eq!(
            stalled.len(),
            1,
            "reclaim's inability to claim it yet must not hide it from the conductor"
        );
        assert_eq!(stalled[0].id, t.id);
    }

    #[test]
    fn ordinary_dead_daemon_task_is_shown_stalled_before_reclaim_and_can_be_requeued() {
        let dir = tempfile::tempdir().unwrap();
        crate::run::set_home(dir.path().join("run-home"));
        let queue = Queue::at(dir.path().join("queue"));
        let home = dir.path().join("home");
        let questions = Questions::at(dir.path().join("questions"));

        let mut t = task();
        t.id = "20260101-000003-dead".to_owned();
        t.start("missing-run".to_owned());
        queue.put(&mut t).unwrap();
        backdate_task(&queue, &t.id, STALLED_RUNNING.as_secs() as i64 + 60);

        // This is the real poll ordering: retain the deterministic stalled
        // input before a claim proves the owner is gone and reclaims it.
        let stalled = stalled_tasks(&queue, &home, Timestamp::now());
        assert_eq!(
            stalled.iter().map(|task| &task.id).collect::<Vec<_>>(),
            [&t.id]
        );
        assert_eq!(
            reclaim_orphaned_running(&queue, 2, &Default::default()),
            [t.id.clone()]
        );
        assert_eq!(queue.get(&t.id).unwrap().status, TaskStatus::Held);

        // Reclaim drops its guard before conductor decisions are applied, so
        // the decision for the captured stalled input has a real write path.
        crate::conduct::apply(
            &queue,
            &questions,
            &crate::conduct::Verdict {
                decisions: vec![crate::conduct::Decision {
                    id: t.id.clone(),
                    recovery: Some(crate::conduct::Recovery::Requeue),
                    ..crate::conduct::Decision::default()
                }],
            },
        )
        .unwrap();
        assert_eq!(queue.get(&t.id).unwrap().status, TaskStatus::Queued);
    }

    #[test]
    fn stalled_tasks_reports_exactly_the_tasks_is_stalled_agrees_on() {
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().join("queue"));
        let home = dir.path().join("home");

        let mut fresh = task();
        fresh.id = "20260101-000001-aaaa".to_owned();
        fresh.start("run-1".to_owned());
        queue.put(&mut fresh).unwrap();

        let mut old = task();
        old.id = "20260101-000002-bbbb".to_owned();
        old.start("run-2".to_owned());
        queue.put(&mut old).unwrap();
        backdate_task(&queue, &old.id, STALLED_RUNNING.as_secs() as i64 + 60);

        let stalled = stalled_tasks(&queue, &home, Timestamp::now());
        assert_eq!(stalled.len(), 1);
        assert_eq!(stalled[0].id, old.id);
    }

    #[test]
    fn queued_and_finished_task_views_partition_by_status() {
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().join("queue"));

        let mut queued = task();
        queued.id = "20260101-000001-aaaa".to_owned();
        queue.put(&mut queued).unwrap();

        let mut failed = task();
        failed.id = "20260101-000002-bbbb".to_owned();
        failed.start("run-1".to_owned());
        failed.fail("gate red", 5);
        queue.put(&mut failed).unwrap();

        let mut held = task();
        held.id = "20260101-000003-cccc".to_owned();
        held.hold_machine(None);
        queue.put(&mut held).unwrap();

        let mut running = task();
        running.id = "20260101-000004-dddd".to_owned();
        running.start("run-2".to_owned());
        queue.put(&mut running).unwrap();

        let queued_ids: Vec<String> = queued_tasks(&queue).into_iter().map(|t| t.id).collect();
        assert_eq!(queued_ids, [queued.id.clone()]);

        let mut finished_ids: Vec<String> =
            finished_tasks(&queue).into_iter().map(|t| t.id).collect();
        finished_ids.sort_unstable();
        let mut want = vec![failed.id.clone(), held.id.clone()];
        want.sort_unstable();
        assert_eq!(finished_ids, want);
    }

    #[test]
    fn dependency_resolution_preserves_existing_short_and_full_running_chains() {
        for short in [false, true] {
            let dir = tempfile::tempdir().unwrap();
            let queue = Queue::at(dir.path().join("queue"));
            let questions = ask::Questions::at(dir.path().join("questions"));
            let mut running = task();
            running.id = "20261013-192213-feb2".into();
            running.start("existing-run".into());
            queue.put(&mut running).unwrap();
            let mut middle = task();
            middle.id = "20261013-193611-ca5b".into();
            middle.block(
                vec![if short {
                    "feb2".into()
                } else {
                    running.id.clone()
                }],
                None,
            );
            queue.put(&mut middle).unwrap();
            let mut waiting = task();
            waiting.id = "20261013-202849-ee37".into();
            waiting.block(
                vec![if short {
                    "ca5b".into()
                } else {
                    middle.id.clone()
                }],
                Some("wait for implementation".into()),
            );
            queue.put(&mut waiting).unwrap();
            assert_eq!(queue.get("ca5b").unwrap().id, middle.id);
            let inv = crate::blockers::Inventory::load(&queue, &questions);
            assert_eq!(inv.waits_on(&waiting), ["ca5b (blocked → feb2 running)"]);
            assert!(inv.stuck().is_empty());
            let report = crate::triage::run_once(&queue, &questions, None, Timestamp::now());
            assert!(report.quarantined.is_empty());
            assert!(report.asked.is_empty());
            resolve_blockers(&queue, &questions);
            assert_eq!(queue.get(&waiting.id).unwrap().status, TaskStatus::Blocked);
            assert!(questions.list().is_empty());
            // Finishing the transitive prerequisite alone does not satisfy
            // the task's direct dependency.
            running.succeed();
            queue.put(&mut running).unwrap();
            resolve_blockers(&queue, &questions);
            assert_eq!(queue.get(&middle.id).unwrap().status, TaskStatus::Queued);
            assert_eq!(queue.get(&waiting.id).unwrap().status, TaskStatus::Blocked);
            middle = queue.get(&middle.id).unwrap();
            middle.succeed();
            queue.put(&mut middle).unwrap();
            resolve_blockers(&queue, &questions);
            let after = queue.get(&waiting.id).unwrap();
            assert_eq!(after.status, TaskStatus::Queued);
            assert!(after.blocked_by.is_empty());
            assert_eq!(after.instruction, waiting.instruction);
        }
    }

    #[test]
    fn dependency_resolution_unknown_records_never_hold_ask_or_release() {
        for future_schema in [false, true] {
            let name = "20261013-193611-ca5b";
            let mut future = task();
            future.id = name.into();
            future.schema = crate::queue::SCHEMA + 1;
            let contents = if future_schema {
                serde_json::to_string(&future).unwrap()
            } else {
                "corrupt".into()
            };
            let dir = tempfile::tempdir().unwrap();
            let queue = Queue::at(dir.path().join("queue"));
            let questions = ask::Questions::at(dir.path().join("questions"));
            let mut waiting = task();
            waiting.id = "20261013-202849-ee37".into();
            waiting.block(vec!["ca5b".into()], None);
            queue.put(&mut waiting).unwrap();
            std::fs::write(queue.path_of(name), contents).unwrap();
            assert_eq!(queue.resolve_id("ca5b").unwrap(), name);
            assert!(
                crate::queue::missing_blockers(&queue, &questions, &waiting.blocked_by).is_empty()
            );
            let report = crate::triage::run_once(&queue, &questions, None, Timestamp::now());
            assert!(report.asked.is_empty());
            resolve_blockers(&queue, &questions);
            assert_eq!(queue.get(&waiting.id).unwrap().status, TaskStatus::Blocked);
            assert!(questions.list().is_empty());
        }
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().join("queue"));
        let questions = ask::Questions::at(dir.path().join("questions"));
        let mut waiting = task();
        waiting.id = "20261013-202849-ee37".into();
        waiting.block(vec!["ca5b".into()], None);
        queue.put(&mut waiting).unwrap();
        let mut done = task();
        done.id = "20261013-193611-ca5b".into();
        done.succeed();
        queue.put(&mut done).unwrap();
        // An unreadable second match must not disappear from uniqueness
        // checks just because Queue::list skips it.
        std::fs::write(queue.path_of("20261014-193611-ca5b"), "bad").unwrap();
        assert!(queue.get("ca5b").is_err());
        assert_eq!(
            crate::queue::dependency(&queue, &questions, "ca5b"),
            crate::queue::Dependency::Ambiguous
        );
        resolve_blockers(&queue, &questions);
        let report = crate::triage::run_once(&queue, &questions, None, Timestamp::now());
        assert!(report.asked.is_empty());
        assert_eq!(queue.get(&waiting.id).unwrap().status, TaskStatus::Blocked);
        assert_eq!(queue.get(&done.id).unwrap().status, TaskStatus::Done);
    }

    #[test]
    fn dependency_resolution_preserves_independent_consent_and_holds_after_completion() {
        for held in [false, true] {
            for question in [false, true] {
                for reference in ["ca5b", "20261013-193611-ca5b"] {
                    let dir = tempfile::tempdir().unwrap();
                    let queue = Queue::at(dir.path().join("queue"));
                    let questions = ask::Questions::at(dir.path().join("questions"));
                    let mut prerequisite = task();
                    prerequisite.id = "20261013-193611-ca5b".into();
                    prerequisite.start("existing-run".into());
                    queue.put(&mut prerequisite).unwrap();
                    let mut waiting = task();
                    waiting.id = "20261013-202849-ee37".into();
                    if held {
                        waiting.hold_machine(Some("waiting for separate consent".into()));
                    }
                    queue.put(&mut waiting).unwrap();
                    let reason = "Deleting saved data requires separate owner consent";
                    crate::conduct::apply(
                        &queue,
                        &questions,
                        &crate::conduct::Verdict {
                            decisions: vec![crate::conduct::Decision {
                                id: waiting.id.clone(),
                                blocked_by: vec![reference.into()],
                                question: question.then(|| "May the saved data be deleted?".into()),
                                recovery: (!question).then_some(crate::conduct::Recovery::Hold),
                                reason: Some(reason.into()),
                                ..crate::conduct::Decision::default()
                            }],
                        },
                    )
                    .unwrap();
                    let before = queue.get(&waiting.id).unwrap();
                    if question {
                        assert_eq!(before.status, TaskStatus::Blocked);
                        let q = questions.get(&before.blocked_by[0]).unwrap();
                        assert_eq!(q.summary, "May the saved data be deleted?");
                        assert!(q.status.open());
                    } else {
                        assert_eq!(before.status, TaskStatus::Held);
                        let recorded_reason = before.hold_reason.as_deref().unwrap();
                        assert!(recorded_reason.starts_with(reason));
                        if held {
                            assert!(recorded_reason.contains("waiting for separate consent"));
                        }
                    }
                    prerequisite.succeed();
                    queue.put(&mut prerequisite).unwrap();
                    resolve_blockers(&queue, &questions);
                    let after = queue.get(&waiting.id).unwrap();
                    assert_eq!(after.status, before.status);
                    assert_eq!(after.blocked_by, before.blocked_by);
                    assert_eq!(after.hold_reason, before.hold_reason);
                    assert_eq!(after.instruction, waiting.instruction);
                    if question {
                        assert!(questions.get(&after.blocked_by[0]).unwrap().status.open());
                    }
                    assert!(
                        queue.next_runnable().is_none(),
                        "dependency completion is not consent"
                    );
                }
            }
        }
    }

    #[test]
    fn resolve_blockers_clears_a_done_dependency_and_keeps_an_unresolved_one() {
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().join("queue"));
        let questions = ask::Questions::at(dir.path().join("questions"));

        let mut dep = task();
        dep.id = "20260101-000001-dep0".to_owned();
        dep.succeed();
        queue.put(&mut dep).unwrap();

        let mut still_going = task();
        still_going.id = "20260101-000002-dep1".to_owned();
        queue.put(&mut still_going).unwrap();

        let mut blocked = task();
        blocked.id = "20260101-000003-main".to_owned();
        blocked.block(
            vec![dep.id.clone(), still_going.id.clone()],
            Some("waits on both".to_owned()),
        );
        queue.put(&mut blocked).unwrap();

        resolve_blockers(&queue, &questions);

        let after = queue.get(&blocked.id).unwrap();
        assert_eq!(
            after.status,
            TaskStatus::Blocked,
            "one dependency is still outstanding"
        );
        assert_eq!(after.blocked_by, [still_going.id.clone()]);
    }

    #[test]
    fn resolve_blockers_carries_an_answers_content_onto_the_task_and_unblocks_it() {
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().join("queue"));
        let questions = ask::Questions::at(dir.path().join("questions"));

        let mut q = crate::ask::Question::new(
            "20260101-000001-main".to_owned(),
            crate::conduct::NODE.to_owned(),
            "conduct".to_owned(),
            "Which backend?".to_owned(),
            String::new(),
            Vec::new(),
        );
        questions.put(&mut q).unwrap();
        q.answer(crate::ask::Answer::Text("SQLite".to_owned()))
            .unwrap();
        questions.put(&mut q).unwrap();

        let mut blocked = task();
        blocked.id = "20260101-000001-main".to_owned();
        blocked.block(vec![q.id.clone()], Some("which backend?".to_owned()));
        queue.put(&mut blocked).unwrap();

        resolve_blockers(&queue, &questions);

        let after = queue.get(&blocked.id).unwrap();
        assert_eq!(
            after.status,
            TaskStatus::Queued,
            "the only blocker resolved"
        );
        assert_eq!(after.answers.len(), 1);
        assert_eq!(after.answers[0].question, "Which backend?");
        assert_eq!(after.answers[0].answer, "SQLite");

        // And the run this task starts next is told about it.
        let instruction = instruction_for(&after);
        assert!(instruction.contains("Which backend?"));
        assert!(instruction.contains("SQLite"));
    }

    #[test]
    fn resolve_blockers_holds_a_task_whose_conductor_question_was_abandoned() {
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().join("queue"));
        let questions = ask::Questions::at(dir.path().join("questions"));

        let mut q = crate::ask::Question::new(
            "20260101-000001-main".to_owned(),
            crate::conduct::NODE.to_owned(),
            "conduct".to_owned(),
            "Is the setup done?".to_owned(),
            String::new(),
            Vec::new(),
        );
        q.abandon("no answer within 60s of asking");
        questions.put(&mut q).unwrap();

        let mut blocked = task();
        blocked.id = "20260101-000001-main".to_owned();
        blocked.block(vec![q.id.clone()], Some("setup?".to_owned()));
        queue.put(&mut blocked).unwrap();

        resolve_blockers(&queue, &questions);

        let after = queue.get(&blocked.id).unwrap();
        assert_eq!(
            after.status,
            TaskStatus::Held,
            "never left blocked on nothing"
        );
        assert!(!after.operator_held(), "a machine hold, for triage");
        assert!(
            after
                .hold_reason
                .as_deref()
                .unwrap_or_default()
                .contains("went unanswered")
        );
    }

    #[test]
    fn resolve_blockers_restores_a_held_task_to_held_instead_of_queuing_it() {
        // Reproduces the reported bug (task 3958): a task held out of
        // attempts, blocked on a `crate::conduct` follow-up question, must
        // come back `held` once that question is answered - never `queued`,
        // whatever the answer said - or it silently re-enters the
        // competition queue with its attempts already exhausted.
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().join("queue"));
        let questions = ask::Questions::at(dir.path().join("questions"));

        let mut q = crate::ask::Question::new(
            "20260101-000001-main".to_owned(),
            crate::conduct::NODE.to_owned(),
            "conduct".to_owned(),
            "How should this be handled?".to_owned(),
            String::new(),
            Vec::new(),
        );
        questions.put(&mut q).unwrap();
        q.answer(crate::ask::Answer::Text(
            "leave it held, a human will look at it later".to_owned(),
        ))
        .unwrap();
        questions.put(&mut q).unwrap();

        let mut held = task();
        held.id = "20260101-000001-main".to_owned();
        held.hold_machine(Some("out of attempts".to_owned()));
        held.block(vec![q.id.clone()], Some("what now?".to_owned()));
        queue.put(&mut held).unwrap();

        resolve_blockers(&queue, &questions);

        let after = queue.get(&held.id).unwrap();
        assert_eq!(after.status, TaskStatus::Held);
        assert_eq!(after.hold_reason.as_deref(), Some("out of attempts"));
        assert_eq!(
            after.answers[0].answer,
            "leave it held, a human will look at it later"
        );
    }

    #[test]
    fn resolve_blockers_releases_a_task_whose_dependency_was_deleted_on_purpose() {
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().join("queue"));
        let questions = ask::Questions::at(dir.path().join("questions"));
        let mut dep = task();
        dep.id = "20260101-000001-gone".to_owned();
        queue.put(&mut dep).unwrap();
        let mut blocked = task();
        blocked.id = "20260101-000003-main".to_owned();
        blocked.block(vec![dep.id.clone()], None);
        queue.put(&mut blocked).unwrap();

        // Claimed, so `remove` cannot rewrite it and the resolver must.
        let claim = queue.claim(&blocked.id).unwrap();
        queue.remove(&dep.id, false, &questions).unwrap();
        drop(claim);
        resolve_blockers(&queue, &questions);

        let after = queue.get(&blocked.id).unwrap();
        assert_eq!(after.status, TaskStatus::Queued);
        assert!(after.blocked_by.is_empty());
    }

    #[test]
    fn resolve_blockers_holds_a_task_whose_dependency_was_deleted() {
        // Reproduces the reported bug: a task blocked on a task id that was
        // removed (`magi task rm`, or deleted by hand) can never see that id
        // reach `Done`, so the ordinary per-id loop has nothing to notice and
        // would otherwise leave the task `blocked` forever with no way for an
        // operator to find out why.
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().join("queue"));
        let questions = ask::Questions::at(dir.path().join("questions"));

        let mut still_going = task();
        still_going.id = "20260101-000002-dep1".to_owned();
        queue.put(&mut still_going).unwrap();

        let mut blocked = task();
        blocked.id = "20260101-000003-main".to_owned();
        blocked.block(
            vec!["20260101-000001-gone".to_owned(), still_going.id.clone()],
            Some("waits on both".to_owned()),
        );
        queue.put(&mut blocked).unwrap();

        resolve_blockers(&queue, &questions);

        let after = queue.get(&blocked.id).unwrap();
        assert_eq!(
            after.status,
            TaskStatus::Held,
            "a missing dependency must not leave the task blocked forever"
        );
        assert_eq!(after.hold_source, Some(crate::queue::HoldSource::Machine));
        assert!(after.blocked_by.is_empty());
        let reason = after.hold_reason.as_deref().unwrap_or_default();
        assert!(
            reason.contains("20260101-000001-gone"),
            "the missing id must be named so an operator can tell what happened: {reason}"
        );
        assert!(
            reason.contains(&still_going.id),
            "the still-valid dependency must not silently vanish from the record: {reason}"
        );
    }

    #[test]
    fn instruction_for_is_unchanged_without_any_answers() {
        let t = task();
        assert_eq!(instruction_for(&t), t.instruction);
    }

    #[test]
    fn task_attachments_are_absolute_and_a_missing_file_is_an_error() {
        let dir = tempfile::tempdir().unwrap();
        let q = Queue::at(dir.path().join("queue"));
        let src = dir.path().join("shot.png");
        std::fs::write(&src, "x").unwrap();
        let mut t = task();
        q.attach(&mut t, &[src]).unwrap();
        let paths = task_attachments(&q, &t).unwrap();
        assert_eq!(paths.len(), 1);
        assert!(paths[0].is_absolute() && paths[0].is_file());
        std::fs::remove_file(&paths[0]).unwrap();
        let err = task_attachments(&q, &t).unwrap_err().to_string();
        assert!(err.contains("shot.png"), "{err}");
    }

    #[tokio::test]
    async fn config_failure_notices_distinguish_boundaries_and_targets_after_restart() {
        let dir = tempfile::tempdir().unwrap();
        let queue_path = dir.path().join("queue");
        let queue = Queue::at(queue_path.clone());
        let mut t = task();
        t.source = Source::Agent {
            run: "originating-chat".into(),
            node: crate::queue::CHAT_NODE.into(),
        };
        let fetch = anyhow::anyhow!("network unavailable").context(crate::config::ConfigFailure {
            stage: "config-fetch",
            target: "origin/main".into(),
        });
        record_config_failure(&mut t, &fetch);
        t.hold_machine(Some(format!("{fetch:#}")));
        let fetch_key = t.chat_notice_due().unwrap();
        t.chat_notices.push(fetch_key.clone());
        queue.put(&mut t).unwrap();

        let queue = Queue::at(queue_path);
        let mut t = queue.get(&t.id).unwrap();
        let a = dir.path().join("a.toml");
        let b = dir.path().join("b.toml");
        for (path, text, new_cause) in [
            (&a, "[graph", true),
            (&a, "[verify", false),
            (&a, "[graph]\nimplementers = 'invalid-type'", true),
            (&b, "[graph]\nimplementers = 'invalid-type'", true),
        ] {
            t.release_operator("test", None);
            std::fs::write(path, text).unwrap();
            let error = Config::discover_fetched(dir.path(), Some(path))
                .await
                .unwrap_err();
            record_config_failure(&mut t, &error);
            t.hold_machine(Some(format!("{error:#}")));
            let due = t.chat_notice_due();
            assert_eq!(due.is_some(), new_cause, "{error:#}");
            if let Some(key) = due {
                assert_ne!(key, fetch_key);
                t.chat_notices.push(key);
            }
        }
        t.succeed();
        assert_eq!(t.chat_notice_due().as_deref(), Some("done"));
    }

    #[test]
    fn different_missing_attachments_have_distinct_persisted_notice_causes() {
        let dir = tempfile::tempdir().unwrap();
        let queue_path = dir.path().join("queue");
        let queue = Queue::at(queue_path.clone());
        let mut t = task();
        t.source = crate::queue::Source::Agent {
            run: "originating-chat".into(),
            node: crate::queue::CHAT_NODE.into(),
        };
        let a = dir.path().join("a.png");
        let b = dir.path().join("b.png");
        std::fs::write(&a, "a").unwrap();
        std::fs::write(&b, "b").unwrap();
        queue.attach(&mut t, &[a, b]).unwrap();
        let paths = task_attachments(&queue, &t).unwrap();
        for path in &paths {
            std::fs::remove_file(path).unwrap();
        }
        let missing = task_attachments(&queue, &t).unwrap_err();
        t.attempts += 1;
        let reason = missing.to_string();
        t.fail_startup_target("startup-attachments", missing.name, reason, 1);
        let first = t.chat_notice_due().expect("first attachment notice");
        t.chat_notices.push(first.clone());
        queue.put(&mut t).unwrap();

        let queue = Queue::at(queue_path.clone());
        let mut t = queue.get(&t.id).unwrap();
        assert!(t.chat_notice_due().is_none(), "restart does not replay");
        t.release_operator("test", None);
        t.attempts += 1;
        let missing = task_attachments(&queue, &t).unwrap_err();
        t.fail_startup_target(
            "startup-attachments",
            missing.name,
            "same missing attachment with regenerated wording",
            1,
        );
        assert!(t.chat_notice_due().is_none(), "same object stays quiet");

        std::fs::write(&paths[0], "restored").unwrap();
        t.release_operator("test", None);
        t.attempts += 1;
        let missing = task_attachments(&queue, &t).unwrap_err();
        let reason = missing.to_string();
        t.fail_startup_target("startup-attachments", missing.name, reason, 1);
        let second = t
            .chat_notice_due()
            .expect("different attachment must notify");
        assert_ne!(first, second);
        assert!(t.hold_reason.as_ref().unwrap().contains("b.png"));
    }

    #[test]
    fn resumed_instruction_is_unchanged_without_any_answers() {
        let t = task();
        assert_eq!(resumed_instruction(&t.instruction, &t), t.instruction);
    }

    #[test]
    fn resumed_instruction_carries_a_new_answer_onto_the_old_run() {
        let mut t = task();
        t.record_answer("Which backend?".to_owned(), "SQLite".to_owned());
        // The run's own instruction on disk predates the answer: it is the
        // plain original text `Runner::start` saved before the operator was
        // ever asked anything.
        let old = t.instruction.clone();

        let refreshed = resumed_instruction(&old, &t);
        assert!(refreshed.starts_with(&old), "the original text is kept");
        assert!(refreshed.contains("Which backend?"));
        assert!(refreshed.contains("SQLite"));
    }

    #[test]
    fn resumed_instruction_keeps_an_original_answers_heading() {
        let mut t = task();
        t.instruction = "Context\n\n# Operator answers\n\nThis is part of the task.".to_owned();
        t.record_answer("Which backend?".to_owned(), "SQLite".to_owned());

        let refreshed = resumed_instruction(&t.instruction, &t);

        assert!(
            refreshed.starts_with(&t.instruction),
            "an answers heading in the original instruction is not the appended block"
        );
        assert_eq!(refreshed.matches(ANSWERS_HEADER).count(), 2);
        assert!(refreshed.contains("Which backend?"));
        assert!(refreshed.contains("SQLite"));

        let repeated = resumed_instruction(&refreshed, &t);
        assert_eq!(
            repeated, refreshed,
            "only the final appended block is refreshed"
        );
    }

    #[test]
    fn resumed_instruction_does_not_duplicate_across_repeated_resumes() {
        let mut t = task();
        t.record_answer("Which backend?".to_owned(), "SQLite".to_owned());

        // A first resume appends the block; a second resume of the same run,
        // with no new answer in between, must reproduce exactly the same
        // text rather than appending the block a second time.
        let once = resumed_instruction(&t.instruction, &t);
        let twice = resumed_instruction(&once, &t);
        assert_eq!(once, twice);
        assert_eq!(once.matches("Which backend?").count(), 1);

        // A later answer replaces the block wholesale rather than growing it.
        t.record_answer("Which cache?".to_owned(), "Redis".to_owned());
        let refreshed = resumed_instruction(&once, &t);
        assert_eq!(refreshed.matches(ANSWERS_HEADER).count(), 1);
        assert!(refreshed.contains("Which backend?"));
        assert!(refreshed.contains("Which cache?"));
    }

    #[test]
    fn prepare_instruction_covers_all_three_starters() {
        let mut t = task();
        t.record_answer("Which backend?".to_owned(), "SQLite".to_owned());

        // Start: a fresh run gets the task text plus every answer so far —
        // exactly `instruction_for`.
        assert_eq!(
            prepare_instruction(&Starter::Start, None, &t),
            Some(instruction_for(&t))
        );

        // Resume: the run's prior instruction is refreshed with the answer,
        // not discarded and not left stale.
        let old = t.instruction.clone();
        assert_eq!(
            prepare_instruction(&Starter::Resume("some-run".to_owned()), Some(&old), &t),
            Some(resumed_instruction(&old, &t))
        );

        // Review: a review-only pass builds its own instruction from the
        // branch's history in `crate::graph`, with no task statement at all -
        // this boundary must leave it alone.
        assert_eq!(
            prepare_instruction(&Starter::Review("magi/eba2/A".to_owned()), Some(&old), &t),
            None
        );
    }

    #[test]
    fn choose_starter_prefers_review_over_resume_when_the_branch_survived() {
        assert_eq!(
            choose_starter(Some("magi/eba2/A"), true, Some("some-run")),
            Starter::Review("magi/eba2/A".to_owned())
        );
    }

    #[test]
    fn choose_starter_falls_back_to_start_when_the_review_branch_is_gone() {
        assert_eq!(
            choose_starter(Some("magi/eba2/A"), false, Some("some-run")),
            Starter::Start,
            "a vanished review branch must not fall back to resuming the old run either"
        );
    }

    #[test]
    fn a_refused_handover_retries_as_a_review_of_the_same_branch() {
        let mut t = task();
        t.start("old-run".to_owned());
        t.hold_for_handover(Some("magi/eba2/A".to_owned()), "checked out".to_owned());
        t.release();
        let branch = t.review_branch.take();
        assert_eq!(
            choose_starter(branch.as_deref(), true, Some("old-run")),
            Starter::Review("magi/eba2/A".to_owned()),
            "a review wins over resuming the old run"
        );
    }

    #[test]
    fn choose_starter_resumes_or_starts_when_there_is_no_review_choice_at_all() {
        assert_eq!(
            choose_starter(None, false, Some("some-run")),
            Starter::Resume("some-run".to_owned())
        );
        assert_eq!(choose_starter(None, false, None), Starter::Start);
    }

    #[test]
    fn an_explicit_release_forces_a_fresh_competition_even_with_a_resumable_run() {
        let mut released = task();
        released.start("stalled-run".to_owned());
        released.requeue();
        let unfinished = (!released.fresh_start)
            .then(|| Some("stalled-run".to_owned()))
            .flatten();
        assert_eq!(
            choose_starter(None, false, unfinished.as_deref()),
            Starter::Start,
            "release keeps run history but must not resume it"
        );
        assert_eq!(released.runs, ["stalled-run"]);
    }

    fn stopped_public_run(status: RunStatus) -> RunState {
        let mut state = run_state(status);
        state.driver_exited = true;
        state.config.graph.land = true;
        state.config.graph.review_rounds = 1;
        state.reviews = vec![review_round(1)];
        state.merge = Some(crate::run::MergeOutcome {
            mode: MergeMode::Pr,
            ok: false,
            detail: "landing stopped".into(),
            empty: false,
        });
        state.pr = Some(crate::run::PrRecord {
            url: "https://example.test/pull/1".into(),
            number: 1,
            state: "open".into(),
            checks: "red".into(),
            round: 1,
            rounds: 1,
            red_at_merge: Vec::new(),
        });
        state
    }

    #[test]
    fn stopped_public_owner_resumes_on_release_choice_and_control_after_review_exhaustion() {
        for status in [RunStatus::Blocked, RunStatus::Gating] {
            let home = tempfile::tempdir().unwrap();
            let mut state = stopped_public_run(status);
            state.save_under(home.path()).unwrap();
            assert!(crate::handover::has_resume_checkpoint(&state, home.path()));
            assert!(!exhausted_review_budget(&state));
            let mut task = held_task_with(&state.id);
            task.release();
            let unfinished = unfinished_run_with(&task.runs, task.short(), |_| Ok(state.clone()));
            assert_eq!(
                choose_starter(None, false, unfinished.as_deref()),
                Starter::Resume(state.id.clone())
            );
            let question = action_question(&state.id, resume_action(&state.id));
            assert_eq!(
                decide_action(&task, &question, &PHRASES_EN, |_| Ok(state.clone())),
                ActionDecision::Resume(state.id.clone())
            );
            // The control-plane command uses this same preflight before pinning.
            assert_eq!(
                crate::resume::validate(home.path(), &state.id).unwrap().id,
                state.id
            );
            let queue = Queue::at(home.path().join("queue"));
            let mut controlled = Task::new(
                "resume land".into(),
                state.instruction.clone(),
                state.repo.clone(),
                Source::Agent {
                    run: "talk".into(),
                    node: crate::queue::CHAT_NODE.into(),
                },
            );
            controlled.runs.push(state.id.clone());
            controlled.hold_machine(Some("land stopped".into()));
            queue.put(&mut controlled).unwrap();
            let resumed =
                crate::chat_control::resume(&queue, home.path(), "talk", &state.id).unwrap();
            assert_eq!(resumed.status, TaskStatus::Queued);
            assert_eq!(
                resumed.resume_override.unwrap().pinned_run,
                Some(state.id.clone())
            );
            assert_eq!(resumed.attempts, 0);
        }
    }

    #[test]
    fn exhausted_gate_failure_with_clean_or_disabled_reviews_is_not_resumable() {
        for review_rounds in [0, 1] {
            let home = tempfile::tempdir().unwrap();
            let mut state = run_state(RunStatus::Blocked);
            state.config.graph.review_rounds = review_rounds;
            if review_rounds > 0 {
                let mut review = review_round(1);
                review.clean = true;
                state.reviews = vec![review];
            }
            state.gate_ran = true;
            state.gate = vec![crate::run::CommandOutcome {
                command: "verify".into(),
                code: Some(1),
                output_tail: "gate failed after repair budget exhausted".into(),
                duration_ms: 0,
                resource_blocked: false,
            }];
            state.save_under(home.path()).unwrap();
            assert!(!crate::handover::has_resume_checkpoint(&state, home.path()));
            assert!(exhausted_review_budget(&state));
            let mut task = held_task_with(&state.id);
            task.release();
            assert!(unfinished_run_with(&task.runs, task.short(), |_| Ok(state.clone())).is_none());
            let question = action_question(&state.id, resume_action(&state.id));
            assert_ne!(
                decide_action(&task, &question, &PHRASES_EN, |_| Ok(state.clone())),
                ActionDecision::Resume(state.id.clone())
            );
            assert!(crate::resume::validate(home.path(), &state.id).is_err());

            // An unexecuted gate still has work to do with or without reviews.
            state.gate_ran = false;
            state.gate.clear();
            assert!(!exhausted_review_budget(&state));
            assert_eq!(
                unfinished_run_with(&task.runs, task.short(), |_| Ok(state.clone())),
                Some(state.id)
            );
        }
    }

    #[test]
    fn resource_blocked_verification_resumes_the_same_run() {
        for (kind, stage) in [
            ("cache", "clean"),
            ("coordination", "clean"),
            ("cache", "review-e2e"),
            ("coordination", "no-reviews"),
            ("coordination", "handoff"),
        ] {
            let home = tempfile::tempdir().unwrap();
            let mut state = run_state(RunStatus::Blocked);
            state.config.graph.review_rounds = 1;
            let mut review = review_round(1);
            review.clean = true;
            state.reviews = vec![review];
            if stage == "review-e2e" {
                let review = &mut state.reviews[0];
                review.clean = false;
                review.blocking = 1;
                review.e2e = vec![crate::run::CommandOutcome {
                    command: "verify".into(),
                    code: None,
                    output_tail: "resource wait expired".into(),
                    duration_ms: 0,
                    resource_blocked: true,
                }];
            } else if stage == "no-reviews" {
                state.config.graph.review_rounds = 0;
                state.reviews.clear();
            } else if stage == "handoff" {
                // A completed final verification can hand off to the gate
                // even when the review still carries contested findings.
                let review = &mut state.reviews[0];
                review.clean = false;
                review.blocking = 1;
                review.e2e = vec![crate::run::CommandOutcome {
                    command: "verify".into(),
                    code: Some(0),
                    output_tail: String::new(),
                    duration_ms: 0,
                    resource_blocked: false,
                }];
            }
            state.gate_ran = false;
            state.resource_block = Some(crate::run::ResourceBlock {
                cause: crate::run::ResourceBlockCause::Other,
                node: if stage == "review-e2e" {
                    "review"
                } else {
                    "gate"
                }
                .into(),
                kind: kind.into(),
                detail: "resource wait expired".into(),
                at: jiff::Timestamp::now(),
            });
            state.save_under(home.path()).unwrap();
            assert!(!crate::handover::has_resume_checkpoint(&state, home.path()));
            assert!(!exhausted_review_budget(&state));
            let mut task = held_task_with(&state.id);
            task.release();
            let unfinished = unfinished_run_with(&task.runs, task.short(), |_| Ok(state.clone()));
            assert_eq!(
                choose_starter(None, false, unfinished.as_deref()),
                Starter::Resume(state.id.clone())
            );
            let question = action_question(&state.id, resume_action(&state.id));
            assert_eq!(
                decide_action(&task, &question, &PHRASES_EN, |_| Ok(state.clone())),
                ActionDecision::Resume(state.id.clone())
            );
            assert_eq!(
                crate::resume::validate(home.path(), &state.id).unwrap().id,
                state.id
            );
            let queue = Queue::at(home.path().join("queue"));
            let mut controlled = Task::new(
                "resume verification".into(),
                state.instruction.clone(),
                state.repo.clone(),
                Source::Agent {
                    run: "talk".into(),
                    node: crate::queue::CHAT_NODE.into(),
                },
            );
            controlled.runs.push(state.id.clone());
            controlled.hold_machine(Some("verification resource unavailable".into()));
            queue.put(&mut controlled).unwrap();
            let resumed =
                crate::chat_control::resume(&queue, home.path(), "talk", &state.id).unwrap();
            assert_eq!(resumed.status, TaskStatus::Queued);
            assert_eq!(
                resumed.resume_override.unwrap().pinned_run,
                Some(state.id.clone())
            );
            assert_eq!(resumed.attempts, 0);

            // A genuinely unresolved final review still exhausts the budget.
            state.config.graph.review_rounds = 1;
            let mut unresolved = review_round(1);
            unresolved.blocking = 1;
            state.reviews = vec![unresolved];
            state.resource_block = None;
            state.save_under(home.path()).unwrap();
            assert!(exhausted_review_budget(&state));
            assert!(crate::resume::validate(home.path(), &state.id).is_err());
        }
    }

    #[tokio::test]
    async fn ownership_contention_waits_and_reads_the_settled_record_before_resuming() {
        if !crate::standalone_test(
            "daemon::tests::ownership_contention_waits_and_reads_the_settled_record_before_resuming",
        ) {
            return;
        }
        let home = tempfile::tempdir().unwrap();
        let mut owner = stopped_public_run(RunStatus::Blocked);
        owner.save_under(home.path()).unwrap();
        let history = vec![owner.id.clone()];
        let repo = owner.repo.clone();
        let lock = crate::pr_head::owner_lock(home.path(), &owner.id).unwrap();
        let mut lookup = Box::pin(public_resume_owner(home.path(), &history, &repo));
        let initial =
            std::future::poll_fn(|cx| std::task::Poll::Ready(lookup.as_mut().poll(cx))).await;
        assert!(
            initial.is_pending(),
            "a busy record must not hold or resume the task"
        );
        owner.retired_to = Some("20260101-000001-bbbb".into());
        owner.save_under(home.path()).unwrap();
        drop(lock);
        let result = tokio::time::timeout(Duration::from_secs(10), lookup)
            .await
            .expect("ownership lock released")
            .expect("read settled owner");
        assert!(
            result.is_none(),
            "the retired owner must not be resumed from a stale read"
        );
    }

    #[tokio::test]
    async fn retained_public_owner_wins_over_an_existing_successor_and_unknown_history_holds() {
        if !crate::standalone_test(
            "daemon::tests::retained_public_owner_wins_over_an_existing_successor_and_unknown_history_holds",
        ) {
            return;
        }
        let home = tempfile::tempdir().unwrap();
        let mut owner = stopped_public_run(RunStatus::Blocked);
        let repo = tempfile::tempdir().unwrap();
        crate::git::git(repo.path(), &["init"]).await.unwrap();
        owner.repo = crate::git::toplevel(repo.path()).await.unwrap();
        owner.id = "20260101-000000-aaaa".into();
        owner.save_under(home.path()).unwrap();
        let mut successor = run_state(RunStatus::Blocked);
        successor.id = "20260101-000001-bbbb".into();
        successor.save_under(home.path()).unwrap();
        let runs = vec![owner.id.clone(), successor.id.clone()];
        assert_eq!(
            public_resume_owner(home.path(), &runs, &owner.repo)
                .await
                .unwrap()
                .unwrap()
                .id,
            owner.id
        );
        let subdir = owner.repo.join("nested");
        std::fs::create_dir(&subdir).unwrap();
        assert_eq!(
            public_resume_owner(home.path(), &runs, &subdir)
                .await
                .unwrap()
                .unwrap()
                .id,
            owner.id
        );
        #[cfg(unix)]
        {
            let alias = home.path().join("repo-alias");
            std::os::unix::fs::symlink(&owner.repo, &alias).unwrap();
            assert_eq!(
                public_resume_owner(home.path(), &runs, &alias.join("nested"))
                    .await
                    .unwrap()
                    .unwrap()
                    .id,
                owner.id
            );
        }
        let different = tempfile::tempdir().unwrap();
        crate::git::git(different.path(), &["init"]).await.unwrap();
        assert!(
            public_resume_owner(home.path(), &runs, different.path())
                .await
                .is_err()
        );
        std::fs::remove_file(
            home.path()
                .join("runs")
                .join(&successor.id)
                .join("run.json"),
        )
        .unwrap();
        assert!(
            public_resume_owner(home.path(), &runs, &owner.repo)
                .await
                .is_err()
        );
    }

    #[test]
    fn an_ordinary_release_keeps_a_resumable_run_available() {
        let mut released = task();
        released.start("stalled-run".to_owned());
        released.release();
        let unfinished = (!released.fresh_start)
            .then(|| Some("stalled-run".to_owned()))
            .flatten();
        assert_eq!(
            choose_starter(None, false, unfinished.as_deref()),
            Starter::Resume("stalled-run".to_owned()),
            "manual release must preserve the normal resume path"
        );
    }

    #[test]
    fn a_blocked_run_that_spent_every_review_round_has_exhausted_its_budget() {
        let mut state = run_state(RunStatus::Blocked);
        state.config.graph.review_rounds = 3;
        state.reviews = vec![review_round(1), review_round(2), review_round(3)];
        assert!(exhausted_review_budget(&state));

        // One round still unused: resuming can still ask a reviewer something.
        state.reviews.pop();
        assert!(!exhausted_review_budget(&state));

        // Exhausted rounds on a non-`Blocked` status (a stall, say) do not
        // count: only a `Blocked` run re-enters the review loop on resume.
        let mut stalled = run_state(RunStatus::Stalled);
        stalled.config.graph.review_rounds = 1;
        stalled.reviews = vec![review_round(1)];
        assert!(!exhausted_review_budget(&stalled));
    }

    fn review_round(round: usize) -> crate::run::ReviewRound {
        crate::run::ReviewRound {
            round,
            head: "deadbeef".to_owned(),
            verified_head: None,
            verified_at: None,
            reviews: Vec::new(),
            e2e: Vec::new(),
            verify_retried: false,
            e2e_deferred: false,
            e2e_defer_reason: None,
            fix: None,
            blocking: 0,
            answered: 1,
            expected: 1,
            clean: false,
            progressed: true,
            vote_split: false,
            reconsideration: Vec::new(),
            verdict: None,
        }
    }

    #[test]
    fn awaiting_resume_is_a_failed_task_whose_last_run_parked_and_can_be_resumed() {
        let mut run = RunState::new(
            PathBuf::from("/repo"),
            "main".to_owned(),
            "abc1234def".to_owned(),
            "add retries".to_owned(),
            Config::default(),
        );
        run.status = RunStatus::Judging;
        run.parked = true;
        let mut task = Task::new(
            "add retries".to_owned(),
            "add retries".to_owned(),
            PathBuf::from("/repo"),
            crate::queue::Source::Human,
        );
        task.status = TaskStatus::Failed;
        task.runs = vec![run.id.clone()];
        let with = |t: &Task, r: &RunState| awaiting_resume_with(t, |_| Ok(r.clone()));
        assert!(with(&task, &run), "parked after judging is the case");
        let mut parked_task = task.clone();
        parked_task.status = TaskStatus::Parked;
        assert!(with(&parked_task, &run), "the Parked status is the case");

        let mut not_parked = run.clone();
        not_parked.parked = false;
        not_parked.status = RunStatus::Stalled;
        assert!(!with(&task, &not_parked), "a stall is the conductor's");

        let mut fresh = task.clone();
        fresh.fresh_start = true;
        assert!(!with(&fresh, &run), "a requeue asked for a new competition");

        let mut review = task.clone();
        review.review_branch = Some("magi/x/A".to_owned());
        assert!(!with(&review, &run), "review is ranked before resume");

        let mut held = task.clone();
        held.status = TaskStatus::Held;
        assert!(!with(&held, &run), "a hold stays visible to the conductor");

        let mut released = run.clone();
        released.released_to = Some("20260901-000000-new1".to_owned());
        assert!(!with(&task, &released), "nothing left to resume into");

        assert!(!awaiting_resume_with(&task, |_| anyhow::bail!(
            "unreadable"
        )));
    }

    #[test]
    fn unfinished_run_never_offers_a_run_whose_worktree_was_released() {
        let mut released = RunState::new(
            PathBuf::from("/repo"),
            "main".to_owned(),
            "abc1234def".to_owned(),
            "add retries".to_owned(),
            Config::default(),
        );
        released.status = RunStatus::Blocked;
        assert_eq!(
            unfinished_run_with(&[released.id.clone()], "t", |_| Ok(released.clone())),
            Some(released.id.clone())
        );
        released.released_to = Some("20260901-000000-new1".to_owned());
        assert_eq!(
            unfinished_run_with(&[released.id.clone()], "t", |_| Ok(released.clone())),
            None,
            "there is nothing left to resume it into"
        );
    }

    #[test]
    fn unfinished_run_skips_a_round_exhausted_blocked_run_so_requeue_means_a_fresh_competition() {
        // Mirrors the failure this exists to close: a task's last run ended
        // `Blocked` with the review budget spent, `crate::conduct` chose
        // `Recovery::Requeue` (`Task::release`, which keeps `runs` as
        // evidence), and without this check `attempt` would go on treating
        // that exhausted run as "unfinished" and resume it - `graph::Runner`'s
        // review loop iterates zero times over an already-spent budget, so
        // the resumed run settles right back to `Blocked` having asked nobody
        // anything, and `Requeue`'s promised fresh competition never happens.
        let mut exhausted = RunState::new(
            PathBuf::from("/repo"),
            "main".to_owned(),
            "abc1234def".to_owned(),
            "add retries".to_owned(),
            Config::default(),
        );
        exhausted.status = RunStatus::Blocked;
        exhausted.config.graph.review_rounds = 1;
        exhausted.reviews = vec![review_round(1)];

        assert_eq!(
            unfinished_run_with(&[exhausted.id.clone()], "t", |_| Ok(exhausted.clone())),
            None,
            "an exhausted `Blocked` run must not be offered as resumable"
        );

        // A `Blocked` run with rounds still unused is genuinely worth
        // resuming, and must still be found.
        let mut has_budget_left = RunState::new(
            PathBuf::from("/repo"),
            "main".to_owned(),
            "abc1234def".to_owned(),
            "add retries".to_owned(),
            Config::default(),
        );
        has_budget_left.status = RunStatus::Blocked;
        has_budget_left.config.graph.review_rounds = 3;
        has_budget_left.reviews = vec![review_round(1)];

        assert_eq!(
            unfinished_run_with(&[has_budget_left.id.clone()], "t", |_| {
                Ok(has_budget_left.clone())
            }),
            Some(has_budget_left.id.clone())
        );
    }

    #[test]
    fn unfinished_run_resumes_a_run_whose_task_head_publication_is_pending() {
        let mut run = RunState::new(
            PathBuf::from("/repo"),
            "main".to_owned(),
            "abc1234def".to_owned(),
            "add retries".to_owned(),
            Config::default(),
        );
        run.status = RunStatus::Blocked;
        run.config.graph.review_rounds = 1;
        run.reviews = vec![review_round(1)];
        run.pr_publication_pending = true;
        assert_eq!(
            unfinished_run_with(&[run.id.clone()], "t", |_| Ok(run.clone())),
            Some(run.id.clone()),
            "a spent review budget must not turn a failed publication into a re-competition"
        );
    }

    #[test]
    fn retained_attempt_bound_survives_changed_bases_releases_and_duplicate_history() {
        let mut task = Task::new(
            "recover work".into(),
            "recover work".into(),
            PathBuf::from("/repo"),
            crate::queue::Source::Human,
        );
        let mut history = std::collections::BTreeMap::new();
        for index in 0..8 {
            let mut run = run_state(RunStatus::Blocked);
            run.id = format!("20260101-000000-{index:04}");
            run.base_commit = format!("upstream-{index}");
            // Seven empty newer attempts must not erase the old recovery owner.
            if index > 0 {
                run.candidates.clear();
            }
            task.runs.extend([run.id.clone(), run.id.clone()]);
            history.insert(run.id.clone(), run);
            task.requeue();
        }
        let check = |task: &Task, starter: &Starter, limit| {
            retained_attempt_hold(task, starter, limit, |id| Ok(history[id].clone()))
        };
        assert!(
            check(&task, &Starter::Start, 8)
                .unwrap()
                .contains("8 unretired")
        );
        assert!(check(&task, &Starter::Start, 9).is_none());
        assert!(check(&task, &Starter::Review("existing".into()), 8).is_some());
        task.release_operator("owner", None);
        assert_eq!(task.attempts, 0);
        let restored: Task = serde_json::from_slice(&serde_json::to_vec(&task).unwrap()).unwrap();
        assert!(check(&restored, &Starter::Start, 8).is_some());
        assert!(check(&restored, &Starter::Resume(task.runs[0].clone()), 8).is_none());
        assert!(check(&restored, &Starter::Start, 0).is_none());
    }

    #[test]
    fn retained_attempt_bound_requires_verified_retirement_not_completion_labels() {
        let mut task = Task::new(
            "recover work".into(),
            "recover work".into(),
            PathBuf::from("/repo"),
            crate::queue::Source::Human,
        );
        let mut run = run_state(RunStatus::Superseded);
        run.candidates.clear();
        task.runs.push(run.id.clone());
        assert!(retained_attempt_hold(&task, &Starter::Start, 1, |_| Ok(run.clone())).is_some());
        run.retired_to = Some("authority".into());
        assert!(retained_attempt_hold(&task, &Starter::Start, 1, |_| Ok(run.clone())).is_none());
        run.retired_to = None;
        run.released_to = Some("authority".into());
        assert!(retained_attempt_hold(&task, &Starter::Start, 1, |_| Ok(run.clone())).is_none());
        assert!(
            retained_attempt_hold(&task, &Starter::Start, 8, |_| anyhow::bail!("unreadable"))
                .unwrap()
                .contains("Cannot verify")
        );
        // Resuming an existing owner needs no new inventory or worktree budget.
        assert!(
            retained_attempt_hold(&task, &Starter::Resume(run.id), 1, |_| {
                panic!("resume must not load historical attempts")
            })
            .is_none()
        );
    }

    #[test]
    fn retired_resume_requires_a_valid_same_repository_authority() {
        let mut source = run_state(RunStatus::Blocked);
        let mut empty = run_state(RunStatus::Blocked);
        empty.retired_to = Some(source.id.clone());
        let runs = vec![source.id.clone(), empty.id.clone()];
        let resolve = |source: &RunState, empty: &RunState| {
            unfinished_run_with(&runs, "fixture", |id| {
                if id == source.id {
                    Ok(source.clone())
                } else if id == empty.id {
                    Ok(empty.clone())
                } else {
                    bail!("unreadable authority")
                }
            })
        };
        assert_eq!(resolve(&source, &empty), Some(source.id.clone()));
        assert_eq!(
            choose_starter(None, false, resolve(&source, &empty).as_deref()),
            Starter::Resume(source.id.clone())
        );
        source.retired_to = Some(empty.id.clone());
        assert!(
            resolve(&source, &empty).is_none(),
            "cycles do not revive obsolete runs"
        );
        source.retired_to = None;
        source.repo = PathBuf::from("/another-repository");
        assert!(resolve(&source, &empty).is_none());
        source.repo = empty.repo.clone();
        source.released_to = Some("later".into());
        assert!(resolve(&source, &empty).is_none());
        empty.retired_to = Some("unlisted-run".into());
        assert!(resolve(&source, &empty).is_none());
    }

    #[test]
    fn unfinished_run_never_falls_back_to_an_older_resumable_run() {
        // A task whose history holds an *older* run that still looks
        // resumable (say, a competition `Runner::review` was started
        // alongside after that older run went `Stalled`) and a *newest* run
        // that is `Blocked` with its review budget spent. `Recovery::Requeue`
        // on this task must mean a fresh competition — falling back to the
        // stale, superseded `Stalled` run instead would resurrect history
        // nothing asked to revisit and silently defeat the requeue.
        let mut older_stalled = RunState::new(
            PathBuf::from("/repo"),
            "main".to_owned(),
            "abc1234def".to_owned(),
            "add retries".to_owned(),
            Config::default(),
        );
        older_stalled.status = RunStatus::Stalled;

        let mut newest_exhausted = RunState::new(
            PathBuf::from("/repo"),
            "main".to_owned(),
            "abc1234def".to_owned(),
            "add retries".to_owned(),
            Config::default(),
        );
        newest_exhausted.status = RunStatus::Blocked;
        newest_exhausted.config.graph.review_rounds = 1;
        newest_exhausted.reviews = vec![review_round(1)];

        assert_eq!(
            unfinished_run_with(
                &[older_stalled.id.clone(), newest_exhausted.id.clone()],
                "t",
                |_| Ok(newest_exhausted.clone())
            ),
            None,
            "the newest run is exhausted, so nothing here is worth resuming - \
             least of all the older, already-superseded run"
        );
    }

    #[test]
    fn unfinished_run_warns_and_skips_a_run_it_cannot_read() {
        assert_eq!(
            unfinished_run_with(&["20260101-000000-gone".to_owned()], "t", |_| {
                Err(anyhow::anyhow!("fixture is absent"))
            }),
            None
        );
    }

    fn action_question(run: &str, action: ask::ChoiceAction) -> ask::Question {
        let mut q = ask::Question::new(
            run.to_owned(),
            "implement".to_owned(),
            "impl-A".to_owned(),
            "continue?".to_owned(),
            String::new(),
            vec!["resume で続行する".to_owned(), "other".to_owned()],
        );
        q.actions.insert("resume で続行する".to_owned(), action);
        q.answer(ask::Answer::Choice("resume で続行する".to_owned()))
            .unwrap();
        q
    }

    fn held_task_with(run: &str) -> Task {
        let mut t = task();
        t.runs = vec![run.to_owned()];
        t.hold_machine(Some("waiting for magi resume to be executed".to_owned()));
        t
    }

    fn resume_action(run: &str) -> ask::ChoiceAction {
        ask::ChoiceAction::Resume { run: run.into() }
    }

    #[test]
    fn explicitly_resumed_older_run_remains_the_release_and_question_target() {
        for parked in [false, true] {
            let mut t = task();
            t.start("A".into());
            t.start("B".into());
            assert_eq!(t.runs, vec!["A", "B"]);
            t.start("A".into());
            let mut resumed = run_state(RunStatus::Blocked);
            resumed.id = "A".into();
            resumed.parked = parked;
            resumed.driver_exited = true;
            t.hold_machine(Some("resumed run stopped".into()));
            let q = action_question("A", resume_action("A"));
            assert_eq!(action_standing(&t, &q), ActionStanding::Pending);
            assert_eq!(
                decide_action(&t, &q, &PHRASES_EN, |id| {
                    assert_eq!(id, "A");
                    Ok(resumed.clone())
                }),
                ActionDecision::Resume("A".into())
            );
            assert_eq!(
                action_standing(&t, &action_question("B", resume_action("B"))),
                ActionStanding::Stale
            );
            t.release_operator("cli", None);
            let unfinished = unfinished_run_with(&t.runs, t.short(), |id| {
                assert_eq!(id, "A");
                Ok(resumed.clone())
            });
            assert_eq!(
                choose_starter(None, false, unfinished.as_deref()),
                Starter::Resume("A".into())
            );
            assert_eq!(t.runs, vec!["B", "A"]);
        }
    }

    #[test]
    fn merge_repair_dispatch_refuses_obsolete_bindings_and_unsupported_owners() {
        let mut state = crate::land::tests::repair_state(true, true);
        state.status = RunStatus::Landing;
        state.parked = true;
        state.driver_exited = true;
        let mut q = ask::Question::new(
            state.id.clone(),
            land::APPROVAL_NODE.into(),
            "land".into(),
            "Merge?".into(),
            String::new(),
            vec![land::APPROVE.into(), land::HOLD.into()],
        );
        q.id = state.id.clone();
        state.land_approval = Some(crate::run::LandApproval {
            question: q.id.clone(),
            head: "current-head".into(),
        });
        assert!(land::upgrade_repair_choice(&mut q, &state));
        q.answer(ask::Answer::Choice(land::REPAIR.into())).unwrap();
        let mut task = held_task_with(&state.id);
        task.status = TaskStatus::Parked;
        assert_eq!(
            decide_action(&task, &q, &PHRASES_EN, |_| Ok(state.clone())),
            ActionDecision::Resume(state.id.clone())
        );
        q.asked_at = "2026-01-01T00:00:00Z".parse().unwrap();
        q.answered_at = Some("2026-01-01T00:00:20Z".parse().unwrap());
        task.operator_decided_at = Some("2026-01-01T00:00:10Z".parse().unwrap());
        assert_eq!(
            decide_action(&task, &q, &PHRASES_EN, |_| Ok(state.clone())),
            ActionDecision::Resume(state.id.clone()),
            "a repair answer newer than the manual hold resumes the existing owner"
        );
        task.operator_decided_at = Some("2026-01-01T00:00:30Z".parse().unwrap());
        for answered_at in [q.answered_at, None] {
            let mut older = q.clone();
            older.answered_at = answered_at;
            let refused = decide_action(&task, &older, &PHRASES_EN, |_| {
                panic!("a later manual hold must prevent dispatch")
            });
            let ActionDecision::Refuse(reason) = refused else {
                panic!("expected an actionable refusal, got {refused:?}");
            };
            assert!(reason.contains("later operator decision"));
            assert!(reason.contains(&format!("magi task release {}", task.id)));
        }
        task.operator_decided_at = None;
        let mut superseded = state.clone();
        superseded.land_approval.as_mut().unwrap().question = "fresh-decision".into();
        assert_eq!(
            decide_action(&task, &q, &PHRASES_EN, |_| Ok(superseded)),
            ActionDecision::Stale
        );
        for case in 1..4 {
            let mut changed = state.clone();
            match case {
                1 => changed.status = RunStatus::Blocked,
                2 => changed.released_to = Some("new-owner".into()),
                _ => changed.land_approval.as_mut().unwrap().head.clear(),
            }
            assert!(matches!(
                decide_action(&task, &q, &PHRASES_EN, |_| Ok(changed)),
                ActionDecision::Refuse(_)
            ));
        }
        assert!(matches!(
            decide_action(&task, &q, &PHRASES_EN, |_| anyhow::bail!("missing owner")),
            ActionDecision::Refuse(_)
        ));
        task.runs.push("replacement".into());
        task.operator_decided_at = Some("2026-01-01T00:00:30Z".parse().unwrap());
        assert_eq!(
            decide_action(&task, &q, &PHRASES_EN, |_| panic!(
                "old owner must not load"
            )),
            ActionDecision::Stale
        );
    }

    #[test]
    fn merge_repair_dispatch_obeys_capacity_and_quota_while_hold_stays_decision_only() {
        let mut state = crate::land::tests::repair_state(true, true);
        state.status = RunStatus::Landing;
        state.parked = true;
        state.driver_exited = true;
        let mut q = ask::Question::new(
            state.id.clone(),
            land::APPROVAL_NODE.into(),
            "land".into(),
            "Merge?".into(),
            String::new(),
            vec![land::APPROVE.into(), land::HOLD.into()],
        );
        q.id = state.id.clone();
        state.land_approval = Some(crate::run::LandApproval {
            question: q.id.clone(),
            head: "current-head".into(),
        });
        state.save().unwrap();
        land::upgrade_repair_choice(&mut q, &state);
        q.answer(ask::Answer::Choice(land::REPAIR.into())).unwrap();
        Questions::open().put(&mut q).unwrap();
        let tmp = tempfile::tempdir().unwrap();
        let queue = Queue::at(tmp.path().join("queue"));
        let mut task = held_task_with(&state.id);
        task.status = TaskStatus::Parked;
        queue.put(&mut task).unwrap();
        let empty = Arc::new(tokio::sync::Semaphore::new(0));
        let free = Arc::new(tokio::sync::Semaphore::new(1));
        assert!(claim_dispatch(&queue, &task, false, &empty, &free).is_none());
        assert!(claim_dispatch(&queue, &task, true, &free, &free).is_none());
        let claim = claim_dispatch(&queue, &task, false, &free, &free).unwrap();
        assert!(claim.permit.is_some());
        assert!(claim_dispatch(&queue, &task, false, &free, &free).is_none());
        drop(claim);
        Questions::open()
            .update(&q.id, |q| {
                q.answer = Some(ask::Answer::Choice(land::HOLD.into()));
                Ok(())
            })
            .unwrap();
        let claim = claim_dispatch(&queue, &task, true, &empty, &empty).unwrap();
        assert!(claim.permit.is_none());
        assert!(RunState::load(&state.id).unwrap().merge_repairs.is_empty());
    }

    #[test]
    fn decide_action_resumes_only_the_latest_resumable_run() {
        let t = held_task_with("r1");
        let q = action_question("r1", resume_action("r1"));
        let load = |s: RunState| move |_: &str| Ok(s);
        assert_eq!(
            decide_action(&t, &q, &PHRASES_EN, load(run_state(RunStatus::Blocked))),
            ActionDecision::Resume("r1".into())
        );
        // Not the latest run of the task.
        let q_other = action_question("r1", resume_action("r0"));
        assert!(matches!(
            decide_action(
                &t,
                &q_other,
                &PHRASES_EN,
                load(run_state(RunStatus::Blocked))
            ),
            ActionDecision::Refuse(_)
        ));
        // A finished run cannot make progress.
        assert!(matches!(
            decide_action(&t, &q, &PHRASES_EN, load(run_state(RunStatus::Ready))),
            ActionDecision::Refuse(_)
        ));
        // A released one either.
        let mut released = run_state(RunStatus::Blocked);
        released.released_to = Some("elsewhere".into());
        assert!(matches!(
            decide_action(&t, &q, &PHRASES_EN, load(released)),
            ActionDecision::Refuse(_)
        ));
        // Unreadable state is a refusal, never a fresh competition.
        assert!(matches!(
            decide_action(&t, &q, &PHRASES_EN, |_: &str| bail!("gone")),
            ActionDecision::Refuse(_)
        ));
    }

    #[test]
    fn decide_action_ignores_a_question_about_an_earlier_run() {
        let mut t = held_task_with("r1");
        t.runs.push("r2".to_owned());
        let never = |_: &str| -> Result<RunState> { bail!("not read") };
        assert_eq!(
            decide_action(
                &t,
                &action_question("r1", ask::ChoiceAction::Done),
                &PHRASES_EN,
                never
            ),
            ActionDecision::Stale
        );
    }

    #[test]
    fn decide_action_maps_requeue_and_done_and_never_acts_twice() {
        let mut t = held_task_with("r1");
        let never = |_: &str| -> Result<RunState> { bail!("not read") };
        assert_eq!(
            decide_action(
                &t,
                &action_question("r1", ask::ChoiceAction::Requeue),
                &PHRASES_EN,
                never
            ),
            ActionDecision::Requeue
        );
        let done_q = action_question("r1", ask::ChoiceAction::Done);
        assert_eq!(
            decide_action(&t, &done_q, &PHRASES_EN, never),
            ActionDecision::Done
        );
        t.mark_action_applied(&done_q.id);
        assert_eq!(
            decide_action(&t, &done_q, &PHRASES_EN, never),
            ActionDecision::Skip
        );

        // A plain answer (no action for that label) does nothing.
        let mut plain = action_question("r1", ask::ChoiceAction::Done);
        plain.actions.clear();
        assert_eq!(
            decide_action(&held_task_with("r1"), &plain, &PHRASES_EN, never),
            ActionDecision::Skip
        );
        // A running task is left alone.
        let mut running = held_task_with("r1");
        running.status = TaskStatus::Running;
        assert_eq!(
            decide_action(
                &running,
                &action_question("r1", ask::ChoiceAction::Done),
                &PHRASES_EN,
                never
            ),
            ActionDecision::Skip
        );
    }

    #[test]
    fn merge_repair_rejected_after_manual_hold_keeps_the_conductor_guard() {
        crate::run::pin_test_home();
        for legacy in [false, true] {
            let dir = tempfile::tempdir().unwrap();
            let queue = Queue::at(dir.path().join("queue"));
            let questions = Questions::at(dir.path().join("questions"));
            let run = "20260101-000000-hold";
            let mut task = held_task_with(run);
            task.status = TaskStatus::Parked;
            let mut q = ask::Question::new(
                run.into(),
                land::APPROVAL_NODE.into(),
                "land".into(),
                "Repair?".into(),
                String::new(),
                vec![land::REPAIR.into()],
            );
            q.actions.insert(land::REPAIR.into(), resume_action(run));
            q.answer(ask::Answer::Choice(land::REPAIR.into())).unwrap();
            // Deterministically order the answer before the actual manual hold.
            q.asked_at = "2026-01-01T00:00:00Z".parse().unwrap();
            q.answered_at = Some("2026-01-01T00:00:01Z".parse().unwrap());
            questions.put(&mut q).unwrap();
            task.hold_manual(Some("Keep this PR paused".into()));
            if legacy {
                task.hold_source = None;
            }
            queue.put(&mut task).unwrap();

            apply_task_choice_actions(&queue, &questions, dir.path());
            let after = queue.get(&task.id).unwrap();
            assert!(after.operator_held());
            assert_eq!(after.hold_source, task.hold_source);
            assert_eq!(after.operator_decided_at, task.operator_decided_at);
            assert_eq!(after.runs, task.runs);
            assert_eq!(after.instruction, task.instruction);
            assert!(after.resume_override.is_none());
            assert!(after.action_applied(&q.id));
            let reason = after.hold_reason.as_deref().unwrap();
            assert!(reason.starts_with("Keep this PR paused"));
            assert!(reason.contains("later operator decision"));
            assert!(reason.contains(&format!("magi task release {}", task.id)));

            for recovery in [
                crate::conduct::Recovery::Review,
                crate::conduct::Recovery::Requeue,
            ] {
                crate::conduct::apply(
                    &queue,
                    &questions,
                    &crate::conduct::Verdict {
                        decisions: vec![crate::conduct::Decision {
                            id: task.id.clone(),
                            recovery: Some(recovery),
                            ..Default::default()
                        }],
                    },
                )
                .unwrap();
            }
            // Reconciliation is idempotent, and automatic recovery cannot
            // reopen this owner after it observes the rejected repair answer.
            apply_task_choice_actions(&queue, &questions, dir.path());
            let still_held = queue.get(&task.id).unwrap();
            assert!(still_held.operator_held());
            assert_eq!(still_held.hold_reason, after.hold_reason);
            assert_eq!(still_held.runs, task.runs);
            assert!(still_held.review_branch.is_none());
            assert!(!still_held.fresh_start);
            assert!(queue.next_runnable().is_none());
        }
    }

    #[test]
    fn conductor_driver_choices_apply_from_both_queued_and_held_tasks() {
        for held in [false, true] {
            for retry in [false, true] {
                let dir = tempfile::tempdir().unwrap();
                let queue = Queue::at(dir.path().join("queue"));
                let questions = Questions::at(dir.path().join("questions"));
                let home = dir.path().join("home");
                let mut t = task();
                if held {
                    t.hold_machine(Some("driver state unknown".into()));
                }
                queue.put(&mut t).unwrap();
                let verdict = serde_json::from_value(serde_json::json!({
                    "decisions": [{
                        "id": t.id,
                        "question": "Driver state unknown; retry the checks or hold?",
                        "choices": ["daemon: recheck and retry", "daemon: hold the task"],
                        "actions": {
                            "daemon: recheck and retry": {"do": "requeue"},
                            "daemon: hold the task": {"do": "hold"}
                        }
                    }]
                }))
                .unwrap();
                crate::conduct::apply(&queue, &questions, &verdict).unwrap();
                assert_eq!(queue.get(&t.id).unwrap().status, TaskStatus::Blocked);
                let mut q = questions.list().pop().unwrap();
                let choice = if retry {
                    "daemon: recheck and retry"
                } else {
                    "daemon: hold the task"
                };
                assert_eq!(q.actions.len(), 2);
                q.answer(ask::Answer::Choice(choice.into())).unwrap();
                questions.put(&mut q).unwrap();

                // A Web answer does not remove the deputy's fresh lease.
                questions.beat(&q.id, ask::WaiterKind::Deputy);
                for _ in 0..2 {
                    resolve_blockers(&queue, &questions);
                    apply_task_choice_actions(&queue, &questions, &home);
                    let waiting = queue.get(&t.id).unwrap();
                    assert_eq!(waiting.status, TaskStatus::Blocked);
                    assert_eq!(waiting.blocked_by, [q.id.clone()]);
                    assert!(waiting.answers.is_empty());
                    assert!(!waiting.action_applied(&q.id));
                    assert!(runnable(&queue).is_empty());
                    let free = Arc::new(tokio::sync::Semaphore::new(1));
                    assert!(claim_dispatch(&queue, &t, false, &free, &free).is_none());
                }
                std::fs::remove_file(questions.root().join(format!("{}.lease", q.id))).unwrap();

                // Releasing the blocker and applying the operation share one save.
                resolve_blockers(&queue, &questions);
                assert_eq!(queue.get(&t.id).unwrap().status, TaskStatus::Blocked);
                apply_task_choice_actions(&queue, &questions, &home);
                let after = queue.get(&t.id).unwrap();
                assert_eq!(
                    after.status,
                    if retry {
                        TaskStatus::Queued
                    } else {
                        TaskStatus::Held
                    }
                );
                assert!(after.action_applied(&q.id));
                assert_eq!(after.operator_held(), !retry);
                assert_eq!(after.answers.len(), 1);

                // A later operator decision must not replay this answer.
                let mut changed = after;
                if retry {
                    changed.hold_manual(Some("later hold".into()));
                } else {
                    changed.release_operator("test", None);
                }
                let expected = changed.status;
                queue.put(&mut changed).unwrap();
                apply_task_choice_actions(&queue, &questions, &home);
                assert_eq!(queue.get(&t.id).unwrap().status, expected);
            }
        }
    }

    #[test]
    fn apply_choice_actions_releases_the_task_pinned_to_its_run_and_only_once() {
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().join("queue"));
        let questions = Questions::at(dir.path().join("questions"));
        let home = dir.path().join("home");
        let mut state = run_state(RunStatus::Blocked);
        state.id = "20260101-000000-act1".to_owned();
        state.save_under(&home).unwrap();

        let mut t = held_task_with(&state.id);
        queue.put(&mut t).unwrap();
        let mut q = action_question(&state.id, resume_action(&state.id));
        questions.put(&mut q).unwrap();

        apply_task_choice_actions(&queue, &questions, &home);
        let after = queue.get(&t.id).unwrap();
        assert_eq!(after.status, TaskStatus::Queued);
        assert!(!after.fresh_start);
        assert!(after.action_applied(&q.id));
        let pin = after.resume_override.clone().unwrap();
        assert_eq!(pin.pinned_run.as_deref(), Some(state.id.as_str()));
        assert!(pin.forced);

        // Held again later: the same answer does not release it a second time.
        let mut again = queue.get(&t.id).unwrap();
        again.hold_machine(Some("later".into()));
        queue.put(&mut again).unwrap();
        apply_task_choice_actions(&queue, &questions, &home);
        assert_eq!(queue.get(&t.id).unwrap().status, TaskStatus::Held);
    }

    #[test]
    fn a_delivered_answer_is_still_acted_on_exactly_once() {
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().join("queue"));
        let questions = Questions::at(dir.path().join("questions"));
        let home = dir.path().join("home");
        let mut state = run_state(RunStatus::Blocked);
        state.id = "20260101-000000-act2".to_owned();
        state.save_under(&home).unwrap();

        let mut t = held_task_with(&state.id);
        queue.put(&mut t).unwrap();
        let mut q = action_question(&state.id, resume_action(&state.id));
        q.answer_delivered = true;
        questions.put(&mut q).unwrap();

        // Delivered, and the agent then died: the task is still held, so the
        // chosen action applies.
        apply_task_choice_actions(&queue, &questions, &home);
        assert_eq!(queue.get(&t.id).unwrap().status, TaskStatus::Queued);
        assert!(queue.get(&t.id).unwrap().action_applied(&q.id));

        // Held again: the same answer does nothing a second time.
        let mut again = queue.get(&t.id).unwrap();
        again.hold_machine(Some("later".into()));
        queue.put(&mut again).unwrap();
        apply_task_choice_actions(&queue, &questions, &home);
        assert_eq!(queue.get(&t.id).unwrap().status, TaskStatus::Held);
    }

    #[test]
    fn a_fresh_asker_defers_the_action_until_it_goes_quiet() {
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().join("queue"));
        let questions = Questions::at(dir.path().join("questions"));
        let home = dir.path().join("home");
        let mut state = run_state(RunStatus::Blocked);
        state.id = "20260101-000000-act3".to_owned();
        state.save_under(&home).unwrap();
        let mut t = held_task_with(&state.id);
        queue.put(&mut t).unwrap();
        let mut q = action_question(&state.id, ask::ChoiceAction::Requeue);
        questions.put(&mut q).unwrap();

        questions.beat(&q.id, crate::ask::WaiterKind::Asker);
        apply_task_choice_actions(&queue, &questions, &home);
        assert_eq!(queue.get(&t.id).unwrap().status, TaskStatus::Held);

        std::fs::remove_file(questions.root().join(format!("{}.lease", q.id))).unwrap();
        apply_task_choice_actions(&queue, &questions, &home);
        assert_eq!(queue.get(&t.id).unwrap().status, TaskStatus::Queued);
    }

    #[test]
    fn action_standing_tells_the_reasons_apart() {
        let mut t = held_task_with("r1");
        let q = action_question("r1", ask::ChoiceAction::Requeue);
        assert_eq!(action_standing(&t, &q), ActionStanding::Pending);
        let mut plain = q.clone();
        plain.actions.clear();
        assert_eq!(action_standing(&t, &plain), ActionStanding::NoAction);

        // Applied wins over everything, even a running task.
        t.mark_action_applied(&q.id);
        assert_eq!(action_standing(&t, &q), ActionStanding::Applied);

        // A newer attempt running: the old question is Stale, not Busy.
        let mut t = held_task_with("r1");
        t.start("r2".to_owned());
        assert_eq!(action_standing(&t, &q), ActionStanding::Stale);
        // The same question about the latest run just waits.
        let q2 = action_question("r2", ask::ChoiceAction::Requeue);
        assert_eq!(action_standing(&t, &q2), ActionStanding::Busy);
        t.status = TaskStatus::Blocked;
        assert_eq!(action_standing(&t, &q2), ActionStanding::Busy);

        // A conductor question is keyed by the task, never stale.
        let mut c = action_question("r0", ask::ChoiceAction::Requeue);
        c.node = crate::conduct::NODE.to_owned();
        assert_eq!(action_standing(&t, &c), ActionStanding::Busy);
        assert!(!ActionStanding::Busy.daemon_owns());
    }

    #[test]
    fn a_running_task_waits_and_a_dead_asker_with_a_cwd_is_still_actioned() {
        let dir = tempfile::tempdir().unwrap();
        let queue = Queue::at(dir.path().join("queue"));
        let questions = Questions::at(dir.path().join("questions"));
        let home = dir.path().join("home");
        let mut state = run_state(RunStatus::Blocked);
        state.id = "20260101-000000-act4".to_owned();
        state.save_under(&home).unwrap();
        let mut t = held_task_with(&state.id);
        t.status = TaskStatus::Running;
        queue.put(&mut t).unwrap();
        let mut q = action_question(&state.id, ask::ChoiceAction::Done);
        q.cwd = Some(dir.path().display().to_string());
        questions.put(&mut q).unwrap();

        // While the task runs the daemon will not act, so the waiter still
        // delivers the word to the dead asker's seat ...
        let running = queue.get(&t.id).unwrap();
        assert_eq!(action_standing(&running, &q), ActionStanding::Busy);
        assert!(matches!(
            crate::waiter::decide_owned(&q, None, false, 86_400, Timestamp::now(), false),
            crate::waiter::Action::Deliver(_)
        ));
        // ... and the daemon waits while the task runs, then applies once.
        apply_task_choice_actions(&queue, &questions, &home);
        assert_eq!(queue.get(&t.id).unwrap().status, TaskStatus::Running);
        let mut back = queue.get(&t.id).unwrap();
        back.hold_machine(Some("later".into()));
        queue.put(&mut back).unwrap();
        apply_task_choice_actions(&queue, &questions, &home);
        assert_eq!(queue.get(&t.id).unwrap().status, TaskStatus::Done);
        let mut again = queue.get(&t.id).unwrap();
        again.hold_machine(Some("again".into()));
        queue.put(&mut again).unwrap();
        apply_task_choice_actions(&queue, &questions, &home);
        assert_eq!(queue.get(&t.id).unwrap().status, TaskStatus::Held);
    }
}