From d90f67579e1598a2c17b135d8cf6554adabee769 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 08:22:32 +0000
Subject: [PATCH 01/23] feat(studio): blocked tasks tell their story and offer
 a next step

A blocked card rendered only task.error, the last line of a longer story.
The expanded card now shows the attempts timeline (attempt_log), the
review verdict, the structured criteria checklist, and a next-step row:
Send back to Ready, Retry (POST /api/tasks/{id}/retry, falling back to
the Ready move on a server without the endpoint), Reassign team (opens
the edit form on the team control) and Steer (prefills LiveFeedback with
@task:ID, parking the request across navigation when the composer is not
mounted).

LiveTaskPanel's Blocked/Failed counters are now filters over the list,
every attention row carries Retry, and a focusTaskId prop expands,
scrolls to and flashes one task.

Also: additive Task/QuerySession/PendingChange fields, a shared
window-event contract (ui/events.ts), an ErrorState primitive, a roving
tabindex helper, a confetti layer, and Modal's focus trap extracted into
useFocusTrap so other dialogs can reuse it.
---
 web/src/api/client.ts                         |   7 +
 web/src/components/Board/TaskCard.test.tsx    | 133 +++++++++
 web/src/components/Board/TaskCard.tsx         |  75 ++++-
 web/src/components/Board/TaskStory.tsx        | 263 ++++++++++++++++++
 web/src/components/Live/LiveFeedback.tsx      |  28 +-
 .../components/Live/LiveTaskPanel.test.tsx    | 118 ++++++++
 web/src/components/Live/LiveTaskPanel.tsx     | 146 +++++++++-
 web/src/components/ui/Confetti.tsx            |  73 +++++
 web/src/components/ui/ErrorState.tsx          |  50 ++++
 web/src/components/ui/Modal.tsx               |  88 ++++--
 web/src/components/ui/events.ts               |  92 ++++++
 web/src/components/ui/useRovingTabs.ts        |  83 ++++++
 web/src/styles/globals.css                    |  25 ++
 web/src/types/index.ts                        |  35 +++
 14 files changed, 1166 insertions(+), 50 deletions(-)
 create mode 100644 web/src/components/Board/TaskCard.test.tsx
 create mode 100644 web/src/components/Board/TaskStory.tsx
 create mode 100644 web/src/components/Live/LiveTaskPanel.test.tsx
 create mode 100644 web/src/components/ui/Confetti.tsx
 create mode 100644 web/src/components/ui/ErrorState.tsx
 create mode 100644 web/src/components/ui/events.ts
 create mode 100644 web/src/components/ui/useRovingTabs.ts

diff --git a/web/src/api/client.ts b/web/src/api/client.ts
index d97d1b3..1fddee0 100644
--- a/web/src/api/client.ts
+++ b/web/src/api/client.ts
@@ -864,3 +864,10 @@ export async function createTeamManager(
     body: JSON.stringify(opts ?? {}),
   });
 }
+
+// ── Task retry ──
+// POST /api/tasks/{id}/retry → the task goes back to the queue with its
+// attempt log intact. 409 when no board is loaded, 404 for an unknown id.
+export async function retryTask(id: string): Promise<Task> {
+  return request<Task>(`/tasks/${encodeURIComponent(id)}/retry`, { method: 'POST' });
+}
diff --git a/web/src/components/Board/TaskCard.test.tsx b/web/src/components/Board/TaskCard.test.tsx
new file mode 100644
index 0000000..911ccec
--- /dev/null
+++ b/web/src/components/Board/TaskCard.test.tsx
@@ -0,0 +1,133 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { MemoryRouter } from 'react-router-dom';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import TaskCard from './TaskCard';
+import type { Task } from '@/types';
+
+const retryTask = vi.fn(async (id: string) => ({ id }) as unknown as Task);
+const patchTask = vi.fn(async (id: string, patch: Partial<Task>) => ({ id, ...patch }) as Task);
+
+vi.mock('@/api/client', () => {
+  class ApiError extends Error {
+    status: number;
+    constructor(status: number, body: string) {
+      super(body);
+      this.status = status;
+    }
+    get isConflict() {
+      return this.status === 409;
+    }
+  }
+  return {
+    ApiError,
+    errorText: (e: unknown) => (e instanceof Error ? e.message : String(e)),
+    retryTask: (...a: unknown[]) => retryTask(...(a as [string])),
+    patchTask: (...a: unknown[]) => patchTask(...(a as [string, Partial<Task>])),
+    deleteTask: vi.fn(async () => ({ ok: 'true' })),
+  };
+});
+
+const stuck: Task = {
+  id: 'T3',
+  title: 'Wire the retry endpoint',
+  description: '',
+  role: 'worker',
+  assignee: '',
+  column: 'blocked',
+  status: 'blocked',
+  priority: 0,
+  depends_on: [],
+  files: ['pkg/server/tasks.go'],
+  acceptance: '',
+  checklist: [],
+  output: '',
+  review: 'Reviewer: the handler returns 200 on an unknown id.',
+  retries: 2,
+  error: 'attempt 2 failed because go test ./pkg/server timed out',
+  updated_at: '',
+  notes: '',
+  attempt_log: [
+    'attempt 1 failed because handler not registered on the mux',
+    'attempt 2 failed because go test ./pkg/server timed out',
+  ],
+  gate_retries: 1,
+  criteria: [
+    { id: 'AC1', text: 'POST /api/tasks/{id}/retry returns 404 for an unknown id', met: false },
+    { id: 'AC2', text: 'Attempt log survives the retry', priority: 'should' },
+  ],
+};
+
+function renderCard(task: Task, onUpdate = vi.fn()) {
+  render(
+    <MemoryRouter>
+      <TaskCard task={task} columns={['ready_to_dev', 'blocked', 'done']} columnLabels={{ blocked: 'Blocked' }} teams={['api', 'web']} onUpdate={onUpdate} />
+    </MemoryRouter>,
+  );
+  return onUpdate;
+}
+
+describe('TaskCard — the story of a stuck task', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('shows the attempts timeline, the verdict and the criteria once expanded', async () => {
+    renderCard(stuck);
+    await userEvent.click(screen.getByTitle('Show full task details'));
+
+    const timeline = screen.getByTestId('attempts-timeline');
+    expect(timeline).toHaveTextContent('Attempts');
+    expect(timeline).toHaveTextContent('2 failed');
+    expect(timeline).toHaveTextContent('1 gate retry');
+    // Each attempt is numbered and its reason is shown without the boilerplate.
+    expect(screen.getByText('#1')).toBeInTheDocument();
+    expect(screen.getByText('handler not registered on the mux')).toBeInTheDocument();
+    expect(screen.getByText('go test ./pkg/server timed out')).toBeInTheDocument();
+
+    expect(screen.getByText('Review verdict')).toBeInTheDocument();
+    expect(screen.getByText(/returns 200 on an unknown id/)).toBeInTheDocument();
+
+    expect(screen.getByText('Criteria')).toBeInTheDocument();
+    expect(screen.getByText(/returns 404 for an unknown id/)).toBeInTheDocument();
+    expect(screen.getByText('not met:')).toBeInTheDocument();
+    expect(screen.getByText('not yet checked:')).toBeInTheDocument();
+  });
+
+  it('offers the next step: Retry calls the endpoint and refreshes the board', async () => {
+    const onUpdate = renderCard(stuck);
+    await userEvent.click(screen.getByTitle('Show full task details'));
+
+    const group = screen.getByRole('group', { name: 'Next steps for T3' });
+    expect(group).toBeInTheDocument();
+    await userEvent.click(screen.getByRole('button', { name: /^Retry$/ }));
+
+    await waitFor(() => expect(retryTask).toHaveBeenCalledWith('T3'));
+    expect(onUpdate).toHaveBeenCalled();
+  });
+
+  it('sends the task back to Ready through the board patch', async () => {
+    const onUpdate = renderCard(stuck);
+    await userEvent.click(screen.getByTitle('Show full task details'));
+    await userEvent.click(screen.getByRole('button', { name: /Send back to Ready/ }));
+    await waitFor(() =>
+      expect(patchTask).toHaveBeenCalledWith('T3', expect.objectContaining({ column: 'ready_to_dev' })),
+    );
+    expect(onUpdate).toHaveBeenCalled();
+  });
+
+  it('opens the edit form on the team control for Reassign', async () => {
+    renderCard(stuck);
+    await userEvent.click(screen.getByTitle('Show full task details'));
+    await userEvent.click(screen.getByRole('button', { name: /Reassign team/ }));
+    const select = await screen.findByLabelText('Team of T3');
+    await waitFor(() => expect(select).toHaveFocus());
+  });
+
+  it('keeps the action row off a healthy task', async () => {
+    renderCard({ ...stuck, column: 'done', status: 'done', attempt_log: [], error: '' });
+    await userEvent.click(screen.getByTitle('Show full task details'));
+    expect(screen.queryByRole('group', { name: /Next steps/ })).not.toBeInTheDocument();
+    expect(screen.queryByTestId('attempts-timeline')).not.toBeInTheDocument();
+  });
+});
diff --git a/web/src/components/Board/TaskCard.tsx b/web/src/components/Board/TaskCard.tsx
index 82ec3d7..fdd9592 100644
--- a/web/src/components/Board/TaskCard.tsx
+++ b/web/src/components/Board/TaskCard.tsx
@@ -20,6 +20,7 @@ import {
 } from 'lucide-react';
 import { patchTask, deleteTask } from '@/api/client';
 import { teamColor } from './teamColor';
+import { AttemptsTimeline, CriteriaChecklist, ReviewVerdict, TaskActionRow, isStuck } from './TaskStory';
 import type { Task } from '@/types';
 import clsx from 'clsx';
 import { useConfirm } from '@/components/ui/Modal';
@@ -49,9 +50,28 @@ interface TaskDraft {
   notes: string;
 }
 
+// Colour plus a word: the ring around a failed card and a lone red triangle
+// read as decoration to anyone who cannot see red, so each state also says
+// its name.
 const STATUS_ICON: Record<string, ReactNode> = {
-  done: <CheckCircle size={12} className="text-emerald-500" />,
-  failed: <AlertTriangle size={12} className="text-red-500" />,
+  done: (
+    <span className="badge-success flex items-center gap-1 text-[9px]" title="Status: done">
+      <CheckCircle size={10} aria-hidden="true" />
+      done
+    </span>
+  ),
+  failed: (
+    <span className="badge-error flex items-center gap-1 text-[9px]" title="Status: failed">
+      <AlertTriangle size={10} aria-hidden="true" />
+      failed
+    </span>
+  ),
+  blocked: (
+    <span className="badge-error flex items-center gap-1 text-[9px]" title="Status: blocked">
+      <AlertTriangle size={10} aria-hidden="true" />
+      blocked
+    </span>
+  ),
 };
 
 const STATUS_OPTIONS = ['todo', 'scoped', 'ready', 'running', 'review', 'correcting', 'blocked', 'failed', 'done'];
@@ -64,6 +84,10 @@ export default function TaskCard({ task, columns, columnLabels, teams = [], onUp
   const [saving, setSaving] = useState(false);
   const [draft, setDraft] = useState<TaskDraft>(() => taskToDraft(task));
   const titleFieldRef = useRef<HTMLTextAreaElement>(null);
+  const teamFieldRef = useRef<HTMLSelectElement>(null);
+  // "Reassign team" opens the edit form on the team control rather than the
+  // title. A ref, not state: the flag must not re-run the focus effect.
+  const focusTeamRef = useRef(false);
   const ticket = ticketInfo(task);
 
   useEffect(() => {
@@ -71,11 +95,22 @@ export default function TaskCard({ task, columns, columnLabels, teams = [], onUp
   }, [task]);
 
   useEffect(() => {
-    if (editing) {
-      titleFieldRef.current?.focus();
+    if (!editing) return;
+    const wantTeam = focusTeamRef.current;
+    focusTeamRef.current = false;
+    if (wantTeam && teamFieldRef.current) {
+      teamFieldRef.current.focus();
+      return;
     }
+    titleFieldRef.current?.focus();
   }, [editing]);
 
+  const handleReassign = () => {
+    focusTeamRef.current = true;
+    setEditing(true);
+    setExpanded(true);
+  };
+
   const {
     attributes,
     listeners,
@@ -354,6 +389,7 @@ export default function TaskCard({ task, columns, columnLabels, teams = [], onUp
                   <label>
                     <span className="label">Team</span>
                     <select
+                      ref={teamFieldRef}
                       value={draft.squad}
                       onChange={(e) => setDraft((d) => ({ ...d, squad: e.target.value }))}
                       className="input text-xs"
@@ -451,16 +487,41 @@ export default function TaskCard({ task, columns, columnLabels, teams = [], onUp
                   <ul className="space-y-1">
                     {task.checklist.map((item, i) => (
                       <li key={item.id || i} className="flex items-start gap-1 text-xs text-gray-600 dark:text-gray-400">
-                        <span className={item.done ? 'text-green-500' : 'text-gray-300'}>-</span>
+                        {item.done ? (
+                          <CheckCircle size={12} className="mt-0.5 shrink-0 text-emerald-500" aria-hidden="true" />
+                        ) : (
+                          <span aria-hidden="true" className="mt-1 h-2.5 w-2.5 shrink-0 rounded-sm border border-gray-300 dark:border-gray-600" />
+                        )}
+                        <span className="sr-only">{item.done ? 'done:' : 'open:'}</span>
                         <span className="break-words">{typeof item === 'string' ? item : item.text}</span>
                       </li>
                     ))}
                   </ul>
                 </div>
               )}
+              <CriteriaChecklist criteria={task.criteria} />
               {task.error && (
-                <div className="whitespace-pre-wrap break-words rounded-lg bg-red-50 p-2 text-xs text-red-600 dark:bg-red-900/20 dark:text-red-400">
-                  {task.error}
+                <div
+                  role="note"
+                  className="flex items-start gap-1.5 whitespace-pre-wrap break-words rounded-lg bg-red-50 p-2 text-xs text-red-700 dark:bg-red-900/20 dark:text-red-300"
+                >
+                  <AlertTriangle size={12} className="mt-0.5 shrink-0" aria-hidden="true" />
+                  <span>
+                    <span className="font-semibold">Last error: </span>
+                    {task.error}
+                  </span>
+                </div>
+              )}
+              <AttemptsTimeline task={task} />
+              <ReviewVerdict review={task.review} />
+              {isStuck(task) && (
+                <div className="rounded-lg border border-dashed border-gray-200 p-2 dark:border-gray-700">
+                  <div className="mb-1.5 text-[10px] font-semibold uppercase text-gray-400">Next step</div>
+                  <TaskActionRow
+                    task={task}
+                    onUpdate={onUpdate}
+                    onReassign={teams.length > 0 || task.squad ? handleReassign : undefined}
+                  />
                 </div>
               )}
               {task.output && (
diff --git a/web/src/components/Board/TaskStory.tsx b/web/src/components/Board/TaskStory.tsx
new file mode 100644
index 0000000..3a91f12
--- /dev/null
+++ b/web/src/components/Board/TaskStory.tsx
@@ -0,0 +1,263 @@
+import { useCallback, useState } from 'react';
+import { useNavigate } from 'react-router-dom';
+import {
+  ArrowLeftCircle,
+  Check,
+  CheckCircle2,
+  Circle,
+  History,
+  Loader2,
+  MessageSquareText,
+  RotateCcw,
+  ShieldCheck,
+  Users,
+  XCircle,
+} from 'lucide-react';
+import clsx from 'clsx';
+import { ApiError, patchTask, retryTask } from '@/api/client';
+import type { Task, TaskCriterion } from '@/types';
+import { useToast } from '@/components/ui/Toast';
+import { steerTask } from '@/components/ui/events';
+
+// ── The story of a stuck task, and what to do about it ──
+//
+// A blocked card used to render `task.error` — the last line — and stop. The
+// attempt log is the actual story ("attempt 1 failed because the test file
+// was not found; attempt 2 failed because …"), the review verdict is what the
+// gate said, and the criteria are what it was judged against. Shown together,
+// with the four things a person can do next, on the board card AND in the
+// live rail so the fix is one click from wherever the failure was noticed.
+
+/** Blocked or failed by status or by column. */
+export function isStuck(task: Task): boolean {
+  return (
+    task.status === 'blocked' ||
+    task.status === 'failed' ||
+    task.column === 'blocked' ||
+    task.column === 'failed'
+  );
+}
+
+// ── Attempts timeline ──
+
+/** "attempt 2 failed because X" → { n: 2, reason: "X" }; anything else keeps the whole line. */
+export function parseAttempt(line: string, index: number): { n: number; reason: string } {
+  const m = /^attempt\s+(\d+)\s+failed(?:\s+because\s*:?\s*|\s*[:—-]\s*)?(.*)$/i.exec(line.trim());
+  if (m) return { n: Number.parseInt(m[1], 10), reason: m[2] || 'no reason recorded' };
+  return { n: index + 1, reason: line };
+}
+
+export function AttemptsTimeline({ task, compact = false }: { task: Task; compact?: boolean }) {
+  const log = task.attempt_log ?? [];
+  if (log.length === 0) return null;
+  return (
+    <div data-testid="attempts-timeline">
+      <div className={clsx('mb-1 flex items-center gap-1 font-semibold uppercase text-gray-400', compact ? 'text-[9px]' : 'text-[10px]')}>
+        <History size={compact ? 9 : 10} aria-hidden="true" />
+        Attempts
+        <span className="font-mono normal-case">
+          · {log.length} failed{task.gate_retries ? ` · ${task.gate_retries} gate ${task.gate_retries === 1 ? 'retry' : 'retries'}` : ''}
+        </span>
+      </div>
+      <ol className="relative ml-1.5 space-y-1.5 border-l border-red-200 pl-3 dark:border-red-900/60">
+        {log.map((line, i) => {
+          const a = parseAttempt(line, i);
+          return (
+            <li key={`${i}-${line.slice(0, 24)}`} className={clsx('relative', compact ? 'text-[10px]' : 'text-xs')}>
+              <span
+                aria-hidden="true"
+                className="absolute -left-[0.95rem] top-1 h-2 w-2 rounded-full border border-red-400 bg-white dark:bg-gray-900"
+              />
+              <span className="font-mono text-[10px] text-red-600 dark:text-red-400">#{a.n}</span>{' '}
+              <span className="break-words text-gray-700 dark:text-gray-300">{a.reason}</span>
+            </li>
+          );
+        })}
+      </ol>
+    </div>
+  );
+}
+
+// ── Review verdict ──
+
+export function ReviewVerdict({ review, compact = false }: { review?: string; compact?: boolean }) {
+  if (!review) return null;
+  return (
+    <div>
+      <div className={clsx('mb-1 flex items-center gap-1 font-semibold uppercase text-gray-400', compact ? 'text-[9px]' : 'text-[10px]')}>
+        <ShieldCheck size={compact ? 9 : 10} aria-hidden="true" />
+        Review verdict
+      </div>
+      <div
+        className={clsx(
+          'whitespace-pre-wrap break-words rounded-md border border-amber-200 bg-amber-50 px-2 py-1.5 text-amber-900',
+          'dark:border-amber-900/60 dark:bg-amber-950/30 dark:text-amber-100',
+          compact ? 'max-h-24 overflow-y-auto text-[10px]' : 'text-xs',
+        )}
+      >
+        {review}
+      </div>
+    </div>
+  );
+}
+
+// ── Criteria checklist ──
+
+export function CriteriaChecklist({ criteria, compact = false }: { criteria?: TaskCriterion[]; compact?: boolean }) {
+  if (!criteria || criteria.length === 0) return null;
+  return (
+    <div>
+      <div className={clsx('mb-1 flex items-center gap-1 font-semibold uppercase text-gray-400', compact ? 'text-[9px]' : 'text-[10px]')}>
+        <Check size={compact ? 9 : 10} aria-hidden="true" />
+        Criteria
+      </div>
+      <ul className="space-y-1">
+        {criteria.map((c, i) => {
+          const state = c.met === true ? 'met' : c.met === false ? 'unmet' : 'open';
+          return (
+            <li
+              key={c.id || i}
+              className={clsx('flex items-start gap-1.5 text-gray-700 dark:text-gray-300', compact ? 'text-[10px]' : 'text-xs')}
+            >
+              {state === 'met' && <CheckCircle2 size={12} className="mt-0.5 shrink-0 text-emerald-500" aria-hidden="true" />}
+              {state === 'unmet' && <XCircle size={12} className="mt-0.5 shrink-0 text-red-500" aria-hidden="true" />}
+              {state === 'open' && <Circle size={12} className="mt-0.5 shrink-0 text-gray-300 dark:text-gray-600" aria-hidden="true" />}
+              <span className="sr-only">{state === 'met' ? 'met:' : state === 'unmet' ? 'not met:' : 'not yet checked:'}</span>
+              <span className="min-w-0 break-words">
+                {c.id && <span className="mr-1 font-mono text-[10px] text-gray-400">{c.id}</span>}
+                {c.text}
+                {c.priority && c.priority !== 'must' && (
+                  <span className="ml-1 rounded bg-gray-100 px-1 text-[9px] uppercase text-gray-500 dark:bg-gray-800">
+                    {c.priority}
+                  </span>
+                )}
+              </span>
+            </li>
+          );
+        })}
+      </ul>
+    </div>
+  );
+}
+
+// ── Actions ──
+
+/**
+ * useTaskRecovery wires the four next steps and reports each outcome through
+ * the toast. Retry degrades gracefully when the server does not have the
+ * endpoint yet: a 404/405 from POST /tasks/{id}/retry falls back to moving the
+ * task to Ready, which the orchestrator has always honoured.
+ */
+export function useTaskRecovery(onUpdate?: () => void) {
+  const toast = useToast();
+  const [busy, setBusy] = useState<'ready' | 'retry' | null>(null);
+
+  const sendBackToReady = useCallback(
+    async (task: Task) => {
+      setBusy('ready');
+      try {
+        await patchTask(task.id, { column: 'ready_to_dev', status: 'ready', error: '' });
+        toast.success(`${task.id} is back in Ready`, 'The next wave picks it up.');
+        onUpdate?.();
+      } catch (err) {
+        toast.reportError(err, `Could not send ${task.id} back to Ready`);
+      } finally {
+        setBusy(null);
+      }
+    },
+    [onUpdate, toast],
+  );
+
+  const retry = useCallback(
+    async (task: Task) => {
+      setBusy('retry');
+      try {
+        await retryTask(task.id);
+        toast.success(`Retrying ${task.id}`, 'Its attempt log is kept, so the next try knows what failed.');
+        onUpdate?.();
+      } catch (err) {
+        if (err instanceof ApiError && (err.status === 404 || err.status === 405)) {
+          // The endpoint is newer than this server; fall back to the move.
+          try {
+            await patchTask(task.id, { column: 'ready_to_dev', status: 'ready' });
+            toast.success(`${task.id} queued for another attempt`);
+            onUpdate?.();
+          } catch (inner) {
+            toast.reportError(inner, `Could not retry ${task.id}`);
+          }
+        } else if (err instanceof ApiError && err.isConflict) {
+          toast.push({ tone: 'warning', title: 'Nothing to retry', detail: 'No board is loaded — start a run first.' });
+        } else {
+          toast.reportError(err, `Could not retry ${task.id}`);
+        }
+      } finally {
+        setBusy(null);
+      }
+    },
+    [onUpdate, toast],
+  );
+
+  return { busy, sendBackToReady, retry };
+}
+
+interface TaskActionRowProps {
+  task: Task;
+  onUpdate?: () => void;
+  /** Surfaces the team control of the edit form; hidden when absent. */
+  onReassign?: () => void;
+  compact?: boolean;
+  /** Which actions to show. Defaults to all four. */
+  actions?: Array<'ready' | 'retry' | 'reassign' | 'steer'>;
+}
+
+export function TaskActionRow({
+  task,
+  onUpdate,
+  onReassign,
+  compact = false,
+  actions = ['ready', 'retry', 'reassign', 'steer'],
+}: TaskActionRowProps) {
+  const navigate = useNavigate();
+  const { busy, sendBackToReady, retry } = useTaskRecovery(onUpdate);
+  const btn = clsx(
+    'focus-ring inline-flex items-center gap-1 rounded-md border border-gray-200 bg-white font-medium text-gray-700',
+    'hover:border-brand-300 hover:text-brand-700 disabled:opacity-50 dark:border-gray-700 dark:bg-gray-900 dark:text-gray-200 dark:hover:border-brand-600',
+    compact ? 'h-6 px-1.5 text-[10px]' : 'h-7 px-2 text-[11px]',
+  );
+  const icon = compact ? 10 : 12;
+
+  const handleSteer = () => {
+    // LiveFeedback listens on the Live page. Anywhere else, go there first;
+    // steerTask() parks the prefill for the composer to pick up on mount.
+    if (!steerTask(task.id)) navigate('/');
+  };
+
+  return (
+    <div className="flex flex-wrap items-center gap-1.5" role="group" aria-label={`Next steps for ${task.id}`}>
+      {actions.includes('ready') && (
+        <button type="button" className={btn} onClick={() => sendBackToReady(task)} disabled={busy !== null} title="Move the task back to Ready so the next wave picks it up">
+          {busy === 'ready' ? <Loader2 size={icon} className="animate-spin" aria-hidden="true" /> : <ArrowLeftCircle size={icon} aria-hidden="true" />}
+          Send back to Ready
+        </button>
+      )}
+      {actions.includes('retry') && (
+        <button type="button" className={btn} onClick={() => retry(task)} disabled={busy !== null} title="Run the task again, keeping its attempt log">
+          {busy === 'retry' ? <Loader2 size={icon} className="animate-spin" aria-hidden="true" /> : <RotateCcw size={icon} aria-hidden="true" />}
+          Retry
+        </button>
+      )}
+      {actions.includes('reassign') && onReassign && (
+        <button type="button" className={btn} onClick={onReassign} title="Give the task to a different team">
+          <Users size={icon} aria-hidden="true" />
+          Reassign team
+        </button>
+      )}
+      {actions.includes('steer') && (
+        <button type="button" className={btn} onClick={handleSteer} title="Tell the agents how to approach this task">
+          <MessageSquareText size={icon} aria-hidden="true" />
+          Steer
+        </button>
+      )}
+    </div>
+  );
+}
diff --git a/web/src/components/Live/LiveFeedback.tsx b/web/src/components/Live/LiveFeedback.tsx
index 47744a2..11e5d69 100644
--- a/web/src/components/Live/LiveFeedback.tsx
+++ b/web/src/components/Live/LiveFeedback.tsx
@@ -1,9 +1,10 @@
-import { useState, useEffect } from 'react';
+import { useState, useEffect, useRef } from 'react';
 import { MessageSquareText, Send, Trash2, Loader2 } from 'lucide-react';
 import { getFeedback, postFeedback, clearFeedback } from '@/api/client';
 import type { FeedbackState } from '@/types';
 import clsx from 'clsx';
 import { useConfirm } from '@/components/ui/Modal';
+import { STEER_TASK_EVENT, on, steerPrefix, takePendingSteer, type SteerTaskDetail } from '@/components/ui/events';
 
 interface LiveFeedbackProps {
   /** Called with the newly active feedback text (or '') after set/clear. */
@@ -33,6 +34,7 @@ export default function LiveFeedback({ onChanged, compact = false }: LiveFeedbac
   const [sending, setSending] = useState(false);
   const [clearing, setClearing] = useState(false);
   const [notice, setNotice] = useState<Notice | null>(null);
+  const textareaRef = useRef<HTMLTextAreaElement>(null);
 
   // Show any existing active feedback so it survives page navigation.
   useEffect(() => {
@@ -44,6 +46,29 @@ export default function LiveFeedback({ onChanged, compact = false }: LiveFeedbac
       .catch(() => { /* backend may not expose feedback yet — treat as none */ });
   }, []);
 
+  // "Steer" on a stuck task prefills `@task:ID ` here and focuses the box —
+  // live when this composer is mounted, or parked in sessionStorage by a card
+  // on the board and picked up when the Live page mounts.
+  useEffect(() => {
+    const prefill = (taskId: string) => {
+      const prefix = steerPrefix(taskId);
+      setText((t) => (t.startsWith(prefix) ? t : prefix + t.replace(/^@task:\S+\s*/, '')));
+      window.setTimeout(() => {
+        const el = textareaRef.current;
+        if (!el) return;
+        el.focus();
+        el.setSelectionRange(el.value.length, el.value.length);
+      }, 0);
+    };
+    const parked = takePendingSteer();
+    if (parked) prefill(parked);
+    return on<SteerTaskDetail>(STEER_TASK_EVENT, (detail, ev) => {
+      if (!detail?.taskId) return;
+      ev.preventDefault();
+      prefill(detail.taskId);
+    });
+  }, []);
+
   const refreshFromServer = async () => {
     const f = await getFeedback();
     setCurrent(f.text || '');
@@ -128,6 +153,7 @@ export default function LiveFeedback({ onChanged, compact = false }: LiveFeedbac
       {/* Composer */}
       <div className="flex items-end gap-2">
         <textarea
+          ref={textareaRef}
           value={text}
           onChange={(e) => setText(e.target.value)}
           onKeyDown={(e) => {
diff --git a/web/src/components/Live/LiveTaskPanel.test.tsx b/web/src/components/Live/LiveTaskPanel.test.tsx
new file mode 100644
index 0000000..2c2bafd
--- /dev/null
+++ b/web/src/components/Live/LiveTaskPanel.test.tsx
@@ -0,0 +1,118 @@
+import { render, screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { MemoryRouter } from 'react-router-dom';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import LiveTaskPanel from './LiveTaskPanel';
+import type { Board, Task } from '@/types';
+
+const retryTask = vi.fn(async (id: string) => ({ id }) as unknown as Task);
+
+const task = (over: Partial<Task>): Task => ({
+  id: 'T1',
+  title: 'task',
+  description: '',
+  role: 'worker',
+  assignee: '',
+  column: 'in_progress',
+  status: 'in_progress',
+  priority: 0,
+  depends_on: [],
+  files: [],
+  acceptance: '',
+  checklist: [],
+  output: '',
+  review: '',
+  retries: 0,
+  error: '',
+  updated_at: '',
+  notes: '',
+  ...over,
+});
+
+const tasks: Task[] = [
+  task({ id: 'T1', title: 'Healthy task', column: 'in_progress', status: 'in_progress' }),
+  task({
+    id: 'T2',
+    title: 'Stuck task',
+    column: 'blocked',
+    status: 'blocked',
+    error: 'attempt 1 failed because tests did not compile',
+    attempt_log: ['attempt 1 failed because tests did not compile'],
+  }),
+];
+
+const board: Board = {
+  plan: { summary: '', goals: [], assumptions: [], risks: [], steps: [], raw: '' },
+  tasks,
+  columns: ['in_progress', 'blocked'],
+  by_column: { in_progress: [tasks[0]], blocked: [tasks[1]] },
+};
+
+vi.mock('@/api/client', () => {
+  class ApiError extends Error {
+    status = 500;
+    get isConflict() {
+      return false;
+    }
+  }
+  return {
+    ApiError,
+    errorText: (e: unknown) => (e instanceof Error ? e.message : String(e)),
+    getTasks: vi.fn(async () => board),
+    getAgents: vi.fn(async () => []),
+    getDoc: vi.fn(async () => ({ name: 'CONTEXT.md', content: '' })),
+    updateDoc: vi.fn(async () => ({ ok: 'true' })),
+    addTask: vi.fn(),
+    patchTask: vi.fn(async () => tasks[1]),
+    deleteTask: vi.fn(),
+    retryTask: (...a: unknown[]) => retryTask(...(a as [string])),
+  };
+});
+
+function renderPanel(props?: { focusTaskId?: string }) {
+  return render(
+    <MemoryRouter>
+      <LiveTaskPanel {...props} />
+    </MemoryRouter>,
+  );
+}
+
+describe('LiveTaskPanel — blocked tasks have a next step', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('turns the Blocked counter into a filter over the list', async () => {
+    renderPanel();
+    await screen.findByText('Healthy task');
+    const blocked = screen.getByRole('button', { name: /Blocked/ });
+    expect(blocked).toHaveAttribute('aria-pressed', 'false');
+
+    await userEvent.click(blocked);
+    expect(blocked).toHaveAttribute('aria-pressed', 'true');
+    expect(screen.queryByText('Healthy task')).not.toBeInTheDocument();
+    // The attention row and the list both name the stuck task.
+    expect(screen.getAllByText('Stuck task').length).toBeGreaterThan(0);
+
+    await userEvent.click(screen.getByRole('button', { name: 'Show all' }));
+    expect(await screen.findByText('Healthy task')).toBeInTheDocument();
+  });
+
+  it('retries a blocked task from its attention row', async () => {
+    renderPanel();
+    const row = (await screen.findByText('Stuck task', { selector: 'span' })).closest('div')!;
+    await userEvent.click(within(row).getByRole('button', { name: /^Retry$/ }));
+    await waitFor(() => expect(retryTask).toHaveBeenCalledWith('T2'));
+  });
+
+  it('expands, scrolls to and flashes the focused task', async () => {
+    const scrollIntoView = vi.spyOn(Element.prototype, 'scrollIntoView');
+    renderPanel({ focusTaskId: 'T2' });
+    await screen.findByText('Healthy task');
+    await waitFor(() => expect(scrollIntoView).toHaveBeenCalled());
+    const row = document.querySelector('[data-task-id="T2"]');
+    expect(row).toHaveClass('flash-focus');
+    // Expanded: the attempts timeline is visible for the focused task.
+    expect(await screen.findByTestId('attempts-timeline')).toHaveTextContent('tests did not compile');
+  });
+});
diff --git a/web/src/components/Live/LiveTaskPanel.tsx b/web/src/components/Live/LiveTaskPanel.tsx
index ee3e938..42ced62 100644
--- a/web/src/components/Live/LiveTaskPanel.tsx
+++ b/web/src/components/Live/LiveTaskPanel.tsx
@@ -14,6 +14,7 @@ import {
 } from '@/api/client';
 import type { Task, AgentSpec, Board } from '@/types';
 import clsx from 'clsx';
+import { AttemptsTimeline, ReviewVerdict, TaskActionRow, isStuck } from '@/components/Board/TaskStory';
 import {
   Plus,
   Trash2,
@@ -111,14 +112,29 @@ function timeAgo(iso: string): string {
   return `${d}d ago`;
 }
 
+type AttentionFilter = 'blocked' | 'failed' | null;
+
+interface LiveTaskPanelProps {
+  /**
+   * A task to bring into view: the panel expands it, scrolls it into view and
+   * flashes it once. The Live view passes the id of a ticket clicked on the
+   * floor or a `?task=` parameter; a new value re-triggers the scroll.
+   */
+  focusTaskId?: string;
+}
+
 // ── Component ──
-export default function LiveTaskPanel() {
+export default function LiveTaskPanel({ focusTaskId }: LiveTaskPanelProps = {}) {
   // ── App context ──
   const ctx = useContext(AppContext);
   const config = ctx?.config;
 
   // ── State: tasks ──
   const [board, setBoard] = useState<Board | null>(null);
+  // Blocked/Failed counters double as filters over the list below.
+  const [attentionFilter, setAttentionFilter] = useState<AttentionFilter>(null);
+  const [flashId, setFlashId] = useState<string | null>(null);
+  const listRef = useRef<HTMLDivElement>(null);
   const [tasksLoading, setTasksLoading] = useState(true);
   const [locallyAddedIds, setLocallyAddedIds] = useState<Set<string>>(new Set());
   const [optimisticTasks, setOptimisticTasks] = useState<Task[]>([]);
@@ -428,6 +444,41 @@ export default function LiveTaskPanel() {
   const allTasks = useMemo(() => board?.tasks || [], [board?.tasks]);
   const taskCount = allTasks.length;
   const taskHealth = useMemo(() => summarizeTaskHealth(allTasks), [allTasks]);
+  const matchesFilter = useCallback(
+    (task: Task) =>
+      attentionFilter === null ||
+      (attentionFilter === 'blocked' ? isBlockedTask(task) : isFailedTask(task)),
+    [attentionFilter],
+  );
+  const toggleFilter = (f: Exclude<AttentionFilter, null>) =>
+    setAttentionFilter((cur) => (cur === f ? null : f));
+
+  // Bring one task into view: expand it, scroll to it, flash it once.
+  const revealTask = useCallback((id: string) => {
+    setAttentionFilter(null);
+    setExpandedTasks((prev) => (prev.has(id) ? prev : new Set(prev).add(id)));
+    setFlashId(id);
+    window.setTimeout(() => {
+      const rows = listRef.current?.querySelectorAll<HTMLElement>('[data-task-id]') ?? [];
+      for (const row of rows) {
+        if (row.dataset.taskId === id) {
+          row.scrollIntoView({ block: 'center', behavior: 'smooth' });
+          break;
+        }
+      }
+    }, 0);
+  }, []);
+
+  useEffect(() => {
+    if (!focusTaskId || tasksLoading) return;
+    revealTask(focusTaskId);
+  }, [focusTaskId, tasksLoading, revealTask]);
+
+  useEffect(() => {
+    if (!flashId) return undefined;
+    const t = window.setTimeout(() => setFlashId(null), 1700);
+    return () => window.clearTimeout(t);
+  }, [flashId]);
 
   // ── Render ──
   return (
@@ -642,22 +693,52 @@ export default function LiveTaskPanel() {
 
           <div className="grid grid-cols-4 gap-1.5">
             <TaskMetric label="Active" value={taskHealth.active} tone={taskHealth.active > 0 ? 'info' : 'neutral'} />
-            <TaskMetric label="Blocked" value={taskHealth.blocked} tone={taskHealth.blocked > 0 ? 'error' : 'neutral'} />
-            <TaskMetric label="Failed" value={taskHealth.failed} tone={taskHealth.failed > 0 ? 'error' : 'neutral'} />
+            <TaskMetric
+              label="Blocked"
+              value={taskHealth.blocked}
+              tone={taskHealth.blocked > 0 ? 'error' : 'neutral'}
+              pressed={attentionFilter === 'blocked'}
+              onToggle={() => toggleFilter('blocked')}
+            />
+            <TaskMetric
+              label="Failed"
+              value={taskHealth.failed}
+              tone={taskHealth.failed > 0 ? 'error' : 'neutral'}
+              pressed={attentionFilter === 'failed'}
+              onToggle={() => toggleFilter('failed')}
+            />
             <TaskMetric label="Retries" value={taskHealth.retries} tone={taskHealth.retries > 0 ? 'warning' : 'neutral'} />
           </div>
 
+          {attentionFilter && (
+            <div className="mt-2 flex items-center gap-2 text-[10px] text-gray-500">
+              <span>Showing only {attentionFilter} tasks.</span>
+              <button type="button" onClick={() => setAttentionFilter(null)} className="text-brand-600 hover:underline dark:text-brand-400">
+                Show all
+              </button>
+            </div>
+          )}
+
           {taskHealth.attention.length > 0 ? (
             <div className="mt-2 space-y-1">
               {taskHealth.attention.map((task) => (
                 <div
                   key={task.id}
-                  className="flex items-center gap-2 rounded-md border border-amber-200 bg-amber-50 px-2 py-1.5 text-[10px] text-amber-800 dark:border-amber-900/70 dark:bg-amber-950/30 dark:text-amber-300"
-                  title={task.title}
+                  className="flex flex-wrap items-center gap-x-2 gap-y-1 rounded-md border border-amber-200 bg-amber-50 px-2 py-1.5 text-[10px] text-amber-800 dark:border-amber-900/70 dark:bg-amber-950/30 dark:text-amber-300"
                 >
-                  <AlertCircle size={11} className="shrink-0" />
-                  <span className="truncate font-medium">{task.title}</span>
-                  <span className="ml-auto shrink-0 font-mono opacity-70">{taskStateLabel(task)}</span>
+                  <button
+                    type="button"
+                    onClick={() => revealTask(task.id)}
+                    className="flex min-w-0 flex-1 items-center gap-2 text-left hover:underline"
+                    title={`${task.title} — show details`}
+                  >
+                    <AlertCircle size={11} className="shrink-0" aria-hidden="true" />
+                    <span className="truncate font-medium">{task.title}</span>
+                    <span className="ml-auto shrink-0 font-mono opacity-70">{taskStateLabel(task)}</span>
+                  </button>
+                  {isStuck(task) && (
+                    <TaskActionRow task={task} onUpdate={fetchTasks} compact actions={['retry']} />
+                  )}
                 </div>
               ))}
             </div>
@@ -770,7 +851,7 @@ export default function LiveTaskPanel() {
       {/* ═══════════════════════════════════════════════════ */}
       {/* ── SECTION 1: Task List ── */}
       {/* ═══════════════════════════════════════════════════ */}
-      <div className="min-h-0 flex-1 overflow-y-auto">
+      <div ref={listRef} className="min-h-0 flex-1 overflow-y-auto">
         {tasksLoading && taskCount === 0 && optimisticTasks.length === 0 ? (
           <div className="flex items-center justify-center py-8 text-[10px] text-gray-400">
             <Loader2 size={12} className="animate-spin mr-2" />
@@ -790,7 +871,7 @@ export default function LiveTaskPanel() {
         ) : (
           <div className="divide-y divide-gray-100 dark:divide-gray-800/50">
             {(columns || []).map((col) => {
-              const tasks = byColumn[col] || [];
+              const tasks = (byColumn[col] || []).filter(matchesFilter);
               if (tasks.length === 0) return null;
 
               const colColors = COLUMN_COLORS[col] || COLUMN_COLORS.scoped;
@@ -822,9 +903,11 @@ export default function LiveTaskPanel() {
                     return (
                       <div
                         key={task.id}
+                        data-task-id={task.id}
                         className={clsx(
                           'px-3 py-2 hover:bg-gray-50 dark:hover:bg-gray-800/40 transition-colors border-b border-gray-50 dark:border-gray-800/30',
                           isPending && 'bg-amber-50/50 dark:bg-amber-900/10',
+                          flashId === task.id && 'flash-focus',
                         )}
                       >
                         {/* Compact row */}
@@ -1056,6 +1139,19 @@ export default function LiveTaskPanel() {
                               </div>
                             )}
 
+                            {/* Why it is stuck, and what to do about it */}
+                            {task.error && (
+                              <div className="rounded bg-red-50 px-1.5 py-1 text-[10px] text-red-700 dark:bg-red-900/20 dark:text-red-300">
+                                <span className="font-semibold">Last error: </span>
+                                {task.error}
+                              </div>
+                            )}
+                            <AttemptsTimeline task={task} compact />
+                            <ReviewVerdict review={task.review} compact />
+                            {isStuck(task) && (
+                              <TaskActionRow task={task} onUpdate={fetchTasks} compact actions={['ready', 'retry', 'steer']} />
+                            )}
+
                             {/* Output */}
                             {task.output && (
                               <div>
@@ -1132,13 +1228,18 @@ function TaskMetric({
   label,
   value,
   tone,
+  pressed,
+  onToggle,
 }: {
   label: string;
   value: number;
   tone: 'neutral' | 'info' | 'warning' | 'error';
+  /** When given, the counter is a filter toggle over the task list. */
+  pressed?: boolean;
+  onToggle?: () => void;
 }) {
-  return (
-    <div className="rounded-md bg-white/70 px-2 py-1.5 dark:bg-gray-900/50">
+  const body = (
+    <>
       <div className="text-[9px] uppercase text-gray-400">{label}</div>
       <div
         className={clsx(
@@ -1151,7 +1252,26 @@ function TaskMetric({
       >
         {value}
       </div>
-    </div>
+    </>
+  );
+  if (!onToggle) {
+    return <div className="rounded-md bg-white/70 px-2 py-1.5 dark:bg-gray-900/50">{body}</div>;
+  }
+  return (
+    <button
+      type="button"
+      onClick={onToggle}
+      aria-pressed={pressed}
+      title={pressed ? `Stop filtering by ${label.toLowerCase()}` : `Show only ${label.toLowerCase()} tasks`}
+      className={clsx(
+        'focus-ring rounded-md px-2 py-1.5 text-left transition-colors',
+        pressed
+          ? 'bg-white ring-2 ring-brand-500 dark:bg-gray-900'
+          : 'bg-white/70 hover:bg-white dark:bg-gray-900/50 dark:hover:bg-gray-900',
+      )}
+    >
+      {body}
+    </button>
   );
 }
 
diff --git a/web/src/components/ui/Confetti.tsx b/web/src/components/ui/Confetti.tsx
new file mode 100644
index 0000000..b5081e8
--- /dev/null
+++ b/web/src/components/ui/Confetti.tsx
@@ -0,0 +1,73 @@
+import { useEffect, useMemo } from 'react';
+
+// ── A short burst for a green run ──
+//
+// Pure DOM and CSS: forty coloured rectangles falling for about two seconds,
+// then gone. It renders nothing when the user asked for reduced motion, and it
+// is `aria-hidden` and pointer-transparent so it cannot get in the way of the
+// result the user is about to read.
+
+const COLORS = ['#10b981', '#3b82f6', '#f59e0b', '#ec4899', '#8b5cf6', '#14b8a6'];
+const PIECES = 40;
+export const CONFETTI_MS = 2000;
+
+interface ConfettiProps {
+  /** Bumps to trigger a new burst; 0 renders nothing. */
+  burst: number;
+  onDone?: () => void;
+}
+
+export function prefersReducedMotion(): boolean {
+  try {
+    return window.matchMedia('(prefers-reduced-motion: reduce)').matches;
+  } catch {
+    return false;
+  }
+}
+
+export default function Confetti({ burst, onDone }: ConfettiProps) {
+  const reduced = prefersReducedMotion();
+  const pieces = useMemo(
+    () =>
+      Array.from({ length: PIECES }, (_, i) => ({
+        left: `${(i * 37 + burst * 11) % 100}%`,
+        delay: `${((i * 53) % 40) * 10}ms`,
+        duration: `${1400 + ((i * 29) % 6) * 100}ms`,
+        color: COLORS[i % COLORS.length],
+        rotate: `${(i * 97) % 360}deg`,
+        size: 6 + ((i * 13) % 5),
+      })),
+    [burst],
+  );
+
+  useEffect(() => {
+    if (!burst || reduced) return undefined;
+    const t = window.setTimeout(() => onDone?.(), CONFETTI_MS);
+    return () => window.clearTimeout(t);
+  }, [burst, reduced, onDone]);
+
+  if (!burst || reduced) return null;
+  return (
+    <div
+      aria-hidden="true"
+      data-testid="confetti"
+      className="pointer-events-none fixed inset-0 z-[55] overflow-hidden"
+    >
+      {pieces.map((p, i) => (
+        <span
+          key={`${burst}-${i}`}
+          className="confetti-piece absolute -top-3 block rounded-sm"
+          style={{
+            left: p.left,
+            width: p.size,
+            height: p.size * 1.6,
+            background: p.color,
+            animationDelay: p.delay,
+            animationDuration: p.duration,
+            transform: `rotate(${p.rotate})`,
+          }}
+        />
+      ))}
+    </div>
+  );
+}
diff --git a/web/src/components/ui/ErrorState.tsx b/web/src/components/ui/ErrorState.tsx
new file mode 100644
index 0000000..688220e
--- /dev/null
+++ b/web/src/components/ui/ErrorState.tsx
@@ -0,0 +1,50 @@
+import { AlertTriangle, RefreshCw } from 'lucide-react';
+import clsx from 'clsx';
+import { errorText } from '@/api/client';
+
+// ── Inline error with a way out ──
+//
+// A list page whose load failed used to log to the console and render its
+// empty state — "No agents defined yet" over a dead backend. This says what
+// went wrong where the list would have been, and offers the retry the user
+// was about to attempt with a reload anyway.
+
+interface ErrorStateProps {
+  /** Anything thrown; normalised through errorText(). */
+  error: unknown;
+  /** What was being loaded, e.g. "agents". */
+  what?: string;
+  onRetry?: () => void;
+  retrying?: boolean;
+  className?: string;
+}
+
+export default function ErrorState({ error, what, onRetry, retrying, className }: ErrorStateProps) {
+  return (
+    <div
+      role="alert"
+      className={clsx(
+        'flex flex-col items-center gap-2 rounded-lg border border-red-200 bg-red-50 px-4 py-6 text-center',
+        'dark:border-red-900/60 dark:bg-red-950/30',
+        className,
+      )}
+    >
+      <AlertTriangle size={20} className="text-red-500" aria-hidden="true" />
+      <div className="text-sm font-semibold text-red-800 dark:text-red-200">
+        {what ? `Could not load ${what}` : 'Something went wrong'}
+      </div>
+      <div className="max-w-md break-words text-xs text-red-700/80 dark:text-red-300/80">{errorText(error)}</div>
+      {onRetry && (
+        <button
+          type="button"
+          onClick={onRetry}
+          disabled={retrying}
+          className="btn-secondary focus-ring mt-1 h-8 gap-1.5 px-3 text-xs"
+        >
+          <RefreshCw size={12} className={clsx(retrying && 'animate-spin')} aria-hidden="true" />
+          {retrying ? 'Retrying…' : 'Retry'}
+        </button>
+      )}
+    </div>
+  );
+}
diff --git a/web/src/components/ui/Modal.tsx b/web/src/components/ui/Modal.tsx
index 65222f6..a89fc62 100644
--- a/web/src/components/ui/Modal.tsx
+++ b/web/src/components/ui/Modal.tsx
@@ -27,44 +27,52 @@ export interface ModalProps {
 const FOCUSABLE =
   'a[href], button:not([disabled]), textarea:not([disabled]), input:not([disabled]), select:not([disabled]), [tabindex]:not([tabindex="-1"])';
 
-export function Modal({
-  open,
-  title,
-  description,
-  onClose,
-  children,
-  footer,
-  className,
-  initialFocusRef,
-}: ModalProps) {
-  const panelRef = useRef<HTMLDivElement>(null);
-  const titleId = useId();
-  const descId = useId();
+interface FocusTrapOptions {
+  /** The trap is inert while false. */
+  active: boolean;
+  /** Called on Escape. Omit for a dialog that cannot be dismissed (a HITL gate). */
+  onEscape?: () => void;
+  /** Element focused when the trap activates. Falls back to the first control. */
+  initialFocusRef?: React.RefObject<HTMLElement | null>;
+  /** Skip moving focus in on activation (the caller does it). */
+  manageInitialFocus?: boolean;
+}
 
-  // Focus management: move focus in on open, restore it on close.
+/**
+ * useFocusTrap keeps Tab inside `panelRef` while active, moves focus in on
+ * activation and restores it on release, and routes Escape to `onEscape`.
+ * Modal uses it; so does the HITL gate, which has a dialog role but used to
+ * let Tab wander into the page underneath.
+ */
+export function useFocusTrap(
+  panelRef: React.RefObject<HTMLElement | null>,
+  { active, onEscape, initialFocusRef, manageInitialFocus = true }: FocusTrapOptions,
+) {
   useEffect(() => {
-    if (!open) return undefined;
+    if (!active) return undefined;
     const previous = document.activeElement instanceof HTMLElement ? document.activeElement : null;
-    const timer = window.setTimeout(() => {
-      const target =
-        initialFocusRef?.current ??
-        panelRef.current?.querySelector<HTMLElement>(FOCUSABLE) ??
-        panelRef.current;
-      target?.focus();
-    }, 0);
+    const timer = manageInitialFocus
+      ? window.setTimeout(() => {
+          const target =
+            initialFocusRef?.current ??
+            panelRef.current?.querySelector<HTMLElement>(FOCUSABLE) ??
+            panelRef.current;
+          target?.focus();
+        }, 0)
+      : null;
     return () => {
-      window.clearTimeout(timer);
+      if (timer !== null) window.clearTimeout(timer);
       previous?.focus();
     };
-  }, [open, initialFocusRef]);
+  }, [active, initialFocusRef, manageInitialFocus, panelRef]);
 
-  // Esc closes; Tab is trapped inside the dialog.
   useEffect(() => {
-    if (!open) return undefined;
+    if (!active) return undefined;
     const onKeyDown = (e: KeyboardEvent) => {
       if (e.key === 'Escape') {
+        if (!onEscape) return;
         e.stopPropagation();
-        onClose();
+        onEscape();
         return;
       }
       if (e.key !== 'Tab') return;
@@ -76,7 +84,11 @@ export function Modal({
       if (items.length === 0) return;
       const first = items[0];
       const last = items[items.length - 1];
-      if (e.shiftKey && document.activeElement === first) {
+      const inside = panel.contains(document.activeElement);
+      if (!inside) {
+        e.preventDefault();
+        (e.shiftKey ? last : first).focus();
+      } else if (e.shiftKey && document.activeElement === first) {
         e.preventDefault();
         last.focus();
       } else if (!e.shiftKey && document.activeElement === last) {
@@ -86,7 +98,25 @@ export function Modal({
     };
     document.addEventListener('keydown', onKeyDown, true);
     return () => document.removeEventListener('keydown', onKeyDown, true);
-  }, [open, onClose]);
+  }, [active, onEscape, panelRef]);
+}
+
+export function Modal({
+  open,
+  title,
+  description,
+  onClose,
+  children,
+  footer,
+  className,
+  initialFocusRef,
+}: ModalProps) {
+  const panelRef = useRef<HTMLDivElement>(null);
+  const titleId = useId();
+  const descId = useId();
+
+  // Focus in on open, restore on close; Esc closes; Tab stays inside.
+  useFocusTrap(panelRef, { active: open, onEscape: onClose, initialFocusRef });
 
   if (!open) return null;
 
diff --git a/web/src/components/ui/events.ts b/web/src/components/ui/events.ts
new file mode 100644
index 0000000..ce897a6
--- /dev/null
+++ b/web/src/components/ui/events.ts
@@ -0,0 +1,92 @@
+// ── App-wide window events ──
+//
+// A few interactions cross component boundaries that do not share a parent:
+// a keyboard shortcut in the layout wants to run the prompt that lives in the
+// Live view; a task card on the board wants to prefill the feedback box at the
+// bottom of the rail. A CustomEvent on `window` is the smallest thing that
+// works, and every event name lives here so the contract is in one place.
+//
+// Events are dispatched `cancelable`. A listener that handles one calls
+// `preventDefault()`, and `dispatchEvent` then returns false — which lets the
+// dispatcher fall back to doing the work itself when nobody is listening.
+
+/** Fired on `/`: the Live view focuses its prompt. No detail. */
+export const FOCUS_PROMPT_EVENT = 'slmcode:focus-prompt';
+
+/**
+ * Fired on Cmd/Ctrl+Enter while the prompt is focused, and by "Run again"
+ * on the result panel. `detail.query` is set when the dispatcher wants a
+ * specific prompt run; absent means "run whatever is in the prompt box".
+ * The Live view should call preventDefault() once it has taken the request.
+ */
+export const RUN_PROMPT_EVENT = 'slmcode:run-prompt';
+
+/** Fired on Cmd/Ctrl+. while the prompt is focused: stop the active run. */
+export const STOP_RUN_EVENT = 'slmcode:stop-run';
+
+/**
+ * Fired by a task's "Steer" action: LiveFeedback prefills its composer with
+ * `@task:<id> ` and focuses it. `detail.taskId` is the task id.
+ */
+export const STEER_TASK_EVENT = 'slmcode:steer-task';
+
+/** Fired on Cmd/Ctrl+K: toggle the command palette. */
+export const COMMAND_PALETTE_EVENT = 'slmcode:command-palette';
+
+export interface RunPromptDetail {
+  query?: string;
+}
+
+export interface SteerTaskDetail {
+  taskId: string;
+}
+
+/** Dispatch and report whether a listener claimed the event. */
+export function emit<T>(name: string, detail?: T): boolean {
+  const ev = new CustomEvent<T | undefined>(name, { detail, cancelable: true });
+  return !window.dispatchEvent(ev);
+}
+
+/** Subscribe with a typed detail; returns the unsubscribe function. */
+export function on<T>(name: string, handler: (detail: T, ev: CustomEvent<T>) => void): () => void {
+  const listener = (ev: Event) => {
+    const custom = ev as CustomEvent<T>;
+    handler(custom.detail, custom);
+  };
+  window.addEventListener(name, listener);
+  return () => window.removeEventListener(name, listener);
+}
+
+const STEER_KEY = 'slmcode:steer';
+
+/**
+ * Ask LiveFeedback to prefill a steer for one task. When no composer is
+ * mounted (the board page, say) the request is parked in sessionStorage and
+ * the caller navigates to Live, where the composer picks it up on mount.
+ * Returns whether a mounted composer took it.
+ */
+export function steerTask(taskId: string): boolean {
+  if (emit<SteerTaskDetail>(STEER_TASK_EVENT, { taskId })) return true;
+  try {
+    sessionStorage.setItem(STEER_KEY, taskId);
+  } catch {
+    /* private mode — the user can still type the tag by hand */
+  }
+  return false;
+}
+
+/** Consume a parked steer request, if any. */
+export function takePendingSteer(): string | null {
+  try {
+    const id = sessionStorage.getItem(STEER_KEY);
+    if (id) sessionStorage.removeItem(STEER_KEY);
+    return id;
+  } catch {
+    return null;
+  }
+}
+
+/** The prefix LiveFeedback prefills for a steer. */
+export function steerPrefix(taskId: string): string {
+  return `@task:${taskId} `;
+}
diff --git a/web/src/components/ui/useRovingTabs.ts b/web/src/components/ui/useRovingTabs.ts
new file mode 100644
index 0000000..2772153
--- /dev/null
+++ b/web/src/components/ui/useRovingTabs.ts
@@ -0,0 +1,83 @@
+import { useCallback, useId } from 'react';
+import type { KeyboardEvent } from 'react';
+
+// ── Roving tabindex for a tablist ──
+//
+// The WAI-ARIA tabs pattern: one Tab stop for the whole strip (the active
+// tab), arrows move between tabs, Home/End jump to the ends, and each tab
+// names the panel it controls. Every tab strip in Studio hand-rolled a row
+// of buttons instead, which put eight tab stops between the header and the
+// content on every page.
+
+export interface RovingTab<ID extends string> {
+  id: ID;
+}
+
+export function useRovingTabs<ID extends string>(
+  tabs: ReadonlyArray<RovingTab<ID>>,
+  active: ID,
+  onChange: (id: ID) => void,
+) {
+  const base = useId();
+  const tabId = useCallback((id: ID) => `${base}-tab-${id}`, [base]);
+  const panelId = useCallback((id: ID) => `${base}-panel-${id}`, [base]);
+
+  const onKeyDown = useCallback(
+    (e: KeyboardEvent<HTMLElement>) => {
+      const idx = tabs.findIndex((t) => t.id === active);
+      if (idx < 0) return;
+      let next = idx;
+      switch (e.key) {
+        case 'ArrowRight':
+        case 'ArrowDown':
+          next = (idx + 1) % tabs.length;
+          break;
+        case 'ArrowLeft':
+        case 'ArrowUp':
+          next = (idx - 1 + tabs.length) % tabs.length;
+          break;
+        case 'Home':
+          next = 0;
+          break;
+        case 'End':
+          next = tabs.length - 1;
+          break;
+        default:
+          return;
+      }
+      e.preventDefault();
+      const id = tabs[next].id;
+      onChange(id);
+      document.getElementById(tabId(id))?.focus();
+    },
+    [tabs, active, onChange, tabId],
+  );
+
+  /** Props for one tab button. */
+  const tabProps = useCallback(
+    (id: ID) => ({
+      id: tabId(id),
+      role: 'tab' as const,
+      type: 'button' as const,
+      'aria-selected': id === active,
+      'aria-controls': panelId(id),
+      tabIndex: id === active ? 0 : -1,
+      onClick: () => onChange(id),
+      onKeyDown,
+    }),
+    [active, onChange, onKeyDown, tabId, panelId],
+  );
+
+  /** Props for the panel the active tab controls. */
+  const panelProps = useCallback(
+    (id: ID) => ({
+      id: panelId(id),
+      role: 'tabpanel' as const,
+      'aria-labelledby': tabId(id),
+      tabIndex: 0,
+    }),
+    [panelId, tabId],
+  );
+
+  return { tabProps, panelProps, listProps: { role: 'tablist' as const } };
+}
diff --git a/web/src/styles/globals.css b/web/src/styles/globals.css
index 914b77d..86bdd79 100644
--- a/web/src/styles/globals.css
+++ b/web/src/styles/globals.css
@@ -177,6 +177,31 @@
   }
 }
 
+/* A green run's two-second burst (ui/Confetti.tsx). Not rendered at all under
+   prefers-reduced-motion; the keyframes are here so the pieces need no JS. */
+.confetti-piece {
+  animation-name: confettiFall;
+  animation-timing-function: cubic-bezier(0.2, 0.6, 0.4, 1);
+  animation-fill-mode: forwards;
+}
+@keyframes confettiFall {
+  0%   { opacity: 1; transform: translate3d(0, -12px, 0) rotate(0deg); }
+  80%  { opacity: 1; }
+  100% { opacity: 0; transform: translate3d(var(--confetti-drift, 24px), 100vh, 0) rotate(540deg); }
+}
+
+/* A card scrolled into view from elsewhere (LiveTaskPanel focusTaskId). */
+.flash-focus {
+  animation: flashFocus 1.6s ease-out 1;
+}
+@keyframes flashFocus {
+  0%   { box-shadow: 0 0 0 0 rgb(99 102 241 / 0.7); background-color: rgb(99 102 241 / 0.12); }
+  100% { box-shadow: 0 0 0 8px rgb(99 102 241 / 0); background-color: transparent; }
+}
+@media (prefers-reduced-motion: reduce) {
+  .flash-focus { animation: none; outline: 2px solid rgb(99 102 241 / 0.7); }
+}
+
 /* Column colors */
 .col-to_scope { @apply text-sky-500; }
 .col-scoped { @apply text-indigo-500; }
diff --git a/web/src/types/index.ts b/web/src/types/index.ts
index 28931a2..531de66 100644
--- a/web/src/types/index.ts
+++ b/web/src/types/index.ts
@@ -37,6 +37,28 @@ export interface Task {
   error: string;
   updated_at: string;
   notes: string;
+  /**
+   * One line per failed attempt ("attempt 2 failed because …"), oldest first.
+   * The story of a blocked task lives here, not in `error`, which only keeps
+   * the last line.
+   */
+  attempt_log?: string[];
+  /** Escalate-gate retries used so far. */
+  gate_retries?: number;
+  /** Structured acceptance criteria — the checklist a reviewer judges. */
+  criteria?: TaskCriterion[];
+}
+
+/** One acceptance criterion; mirrors plan.Criterion. */
+export interface TaskCriterion {
+  id: string;
+  text: string;
+  /** Shell command that proves the condition, or empty. */
+  verify?: string;
+  /** must | should | nice */
+  priority?: string;
+  /** Set when the server has judged it; absent means not yet checked. */
+  met?: boolean;
 }
 
 export interface ChecklistItem {
@@ -677,6 +699,15 @@ export interface QuerySession {
   interrupted?: boolean;
   phase?: string;
   resume_from?: string;
+  /** Wall time of the run, when the archive recorded it. */
+  duration_ms?: number;
+  tokens?: number;
+  cost_usd?: number;
+  tasks_total?: number;
+  tasks_done?: number;
+  failed_tasks?: number;
+  /** Teams the run was sent to. */
+  teams?: string[];
 }
 
 export interface QueryView {
@@ -1130,6 +1161,10 @@ export interface PendingChange {
   hunks?: DiffHunk[];
   truncated?: boolean;
   error?: string;
+  /** Provenance: which task and agent proposed the change, and in which run. */
+  task_id?: string;
+  agent?: string;
+  query_id?: string;
 }
 
 export interface ReviewQueue {

From b674ed4d1a326614a7e2fc1273f041b257dd84ce Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 08:27:12 +0000
Subject: [PATCH 02/23] feat(studio): a run's end is not a dead end, and the
 keyboard reaches everything

ResultPanel grows a What-next row: Resume interrupted run, Open blocked
on Board (/board?column=blocked), Review N pending, Run again with this
prompt. All data can be passed as props by the Live view; without props
the panel fetches the resumable list and newest prompt itself and runs
the prompt through RUN_PROMPT_EVENT, starting it directly when no
listener claims the event.

Layout reacts to run_end: a success or error toast, a flashing tab
title while the tab is hidden, a browser Notification when permission
was already granted and the tab is hidden, and a two-second confetti
layer on a green run (skipped under prefers-reduced-motion). A run_end
replayed from the server snapshot on page load is ignored.

Keyboard: g t goes to Teams; Cmd/Ctrl+Enter and Cmd/Ctrl+. dispatch
RUN_PROMPT_EVENT / STOP_RUN_EVENT while the run prompt is focused;
Cmd/Ctrl+K opens a self-contained command palette over pages, tasks,
agents, teams, recent runs and the theme. ShortcutSheet picks the new
rows up from the shortcut table.
---
 web/src/components/Layout.test.tsx           | 121 +++++++++
 web/src/components/Layout.tsx                | 115 ++++++++-
 web/src/components/Live/ResultPanel.test.tsx |  89 ++++++-
 web/src/components/Live/ResultPanel.tsx      | 175 ++++++++++++-
 web/src/components/ui/CommandPalette.tsx     | 258 +++++++++++++++++++
 web/src/hooks/useKeyboard.ts                 |  82 +++++-
 6 files changed, 820 insertions(+), 20 deletions(-)
 create mode 100644 web/src/components/Layout.test.tsx
 create mode 100644 web/src/components/ui/CommandPalette.tsx

diff --git a/web/src/components/Layout.test.tsx b/web/src/components/Layout.test.tsx
new file mode 100644
index 0000000..6a27260
--- /dev/null
+++ b/web/src/components/Layout.test.tsx
@@ -0,0 +1,121 @@
+import { render, screen } from '@testing-library/react';
+import { MemoryRouter, Route, Routes } from 'react-router-dom';
+import { describe, expect, it, vi } from 'vitest';
+import Layout, { runEndVerdict } from './Layout';
+import { ToastProvider } from './ui/Toast';
+import { AppContext, type AppContextValue } from '@/App';
+import type { RunEvent } from '@/types';
+
+vi.mock('./TopBar', () => ({ default: () => <div data-testid="topbar" /> }));
+vi.mock('./Sidebar', () => ({ default: () => <div data-testid="sidebar" /> }));
+vi.mock('./Live/HITLPopup', () => ({ default: () => null }));
+vi.mock('./ui/CommandPalette', () => ({ default: () => null }));
+vi.mock('@/api/client', () => ({ errorText: (e: unknown) => String(e) }));
+
+const ev = (over: Partial<RunEvent>): RunEvent => ({
+  phase: 'execute',
+  kind: 'log',
+  message: '',
+  time: new Date().toISOString(),
+  ...over,
+});
+
+function ctx(over: Partial<AppContextValue>): AppContextValue {
+  return {
+    health: null,
+    config: null,
+    dark: false,
+    toggleDark: () => {},
+    refresh: () => {},
+    refreshError: null,
+    liveEvents: [],
+    liveRunning: false,
+    setLiveRunning: () => {},
+    liveResult: null,
+    setLiveResult: () => {},
+    resetLiveEvents: () => {},
+    connection: 'live',
+    reconnect: () => {},
+    streamGap: null,
+    clearStreamGap: () => {},
+    askSignal: 0,
+    tokenStream: '',
+    ...over,
+  };
+}
+
+function renderLayout(value: AppContextValue) {
+  return render(
+    <ToastProvider>
+      <AppContext.Provider value={value}>
+        <MemoryRouter>
+          <Routes>
+            <Route element={<Layout />}>
+              <Route index element={<div>page</div>} />
+            </Route>
+          </Routes>
+        </MemoryRouter>
+      </AppContext.Provider>
+    </ToastProvider>,
+  );
+}
+
+describe('runEndVerdict', () => {
+  it('reads failed-task counts out of the summary line', () => {
+    expect(runEndVerdict(ev({ kind: 'run_end', phase: 'done', message: '3/3 tasks done, 0 failed' }))).toEqual({ ok: true, failedTasks: 0 });
+    expect(runEndVerdict(ev({ kind: 'run_end', phase: 'done', message: '1/3 tasks done, 2 failed' }))).toEqual({ ok: false, failedTasks: 2 });
+    expect(runEndVerdict(ev({ kind: 'run_end', phase: 'error', message: 'context deadline exceeded' }))).toEqual({ ok: false, failedTasks: 0 });
+  });
+});
+
+describe('Layout — the run’s end reaches the user', () => {
+  it('celebrates a green run with a toast and a short burst', () => {
+    const running = ctx({ liveRunning: true, liveEvents: [ev({ kind: 'run_start' })] });
+    const { rerender } = renderLayout(running);
+    const ended = ctx({
+      liveRunning: false,
+      liveEvents: [ev({ kind: 'run_start' }), ev({ kind: 'run_end', phase: 'done', message: '2/2 tasks done, 0 failed' })],
+    });
+    rerender(
+      <ToastProvider>
+        <AppContext.Provider value={ended}>
+          <MemoryRouter>
+            <Routes>
+              <Route element={<Layout />}>
+                <Route index element={<div>page</div>} />
+              </Route>
+            </Routes>
+          </MemoryRouter>
+        </AppContext.Provider>
+      </ToastProvider>,
+    );
+    expect(screen.getByText('Run finished')).toBeInTheDocument();
+    expect(screen.getByTestId('confetti')).toBeInTheDocument();
+  });
+
+  it('reports a failed run as an error toast, without confetti', () => {
+    const { rerender } = renderLayout(ctx({ liveRunning: true }));
+    rerender(
+      <ToastProvider>
+        <AppContext.Provider value={ctx({ liveRunning: false, liveEvents: [ev({ kind: 'run_end', phase: 'done', message: '1/3 tasks done, 2 failed' })] })}>
+          <MemoryRouter>
+            <Routes>
+              <Route element={<Layout />}>
+                <Route index element={<div>page</div>} />
+              </Route>
+            </Routes>
+          </MemoryRouter>
+        </AppContext.Provider>
+      </ToastProvider>,
+    );
+    expect(screen.getByRole('alert')).toHaveTextContent('Run finished with 2 failed tasks');
+    expect(screen.queryByTestId('confetti')).not.toBeInTheDocument();
+  });
+
+  // The server replays the last run_end on page load. That is history.
+  it('stays quiet about a run_end it never saw running', () => {
+    renderLayout(ctx({ liveRunning: false, liveEvents: [ev({ kind: 'run_end', phase: 'done', message: '2/2 tasks done, 0 failed' })] }));
+    expect(screen.queryByText('Run finished')).not.toBeInTheDocument();
+    expect(screen.queryByTestId('confetti')).not.toBeInTheDocument();
+  });
+});
diff --git a/web/src/components/Layout.tsx b/web/src/components/Layout.tsx
index 298e2c5..ee6dcee 100644
--- a/web/src/components/Layout.tsx
+++ b/web/src/components/Layout.tsx
@@ -1,4 +1,4 @@
-import { useContext } from 'react';
+import { useCallback, useContext, useEffect, useRef, useState } from 'react';
 import { Outlet, useLocation } from 'react-router-dom';
 import { AlertTriangle, X } from 'lucide-react';
 import TopBar from './TopBar';
@@ -6,13 +6,122 @@ import Sidebar from './Sidebar';
 import HITLPopup from './Live/HITLPopup';
 import ErrorBoundary from './ui/ErrorBoundary';
 import ShortcutSheet from './ui/ShortcutSheet';
+import CommandPalette from './ui/CommandPalette';
+import Confetti from './ui/Confetti';
+import { useToast } from './ui/Toast';
 import { AppContext } from '@/App';
 import { useKeyboardShortcuts } from '@/hooks/useKeyboard';
+import type { RunEvent } from '@/types';
+
+/** How long the tab title alternates after a run ends in a hidden tab. */
+const TITLE_FLASH_MS = 12_000;
+
+/** run_end with phase "done" whose message does not report failed tasks. */
+export function runEndVerdict(ev: RunEvent): { ok: boolean; failedTasks: number } {
+  const m = /(\d+)\s+failed/i.exec(ev.message || '');
+  const failedTasks = m ? Number.parseInt(m[1], 10) : 0;
+  return { ok: ev.phase !== 'error' && failedTasks === 0, failedTasks };
+}
 
 export default function Layout() {
   const ctx = useContext(AppContext);
   const location = useLocation();
-  const { sheetOpen, setSheetOpen } = useKeyboardShortcuts();
+  const toast = useToast();
+  const { sheetOpen, setSheetOpen, paletteOpen, setPaletteOpen } = useKeyboardShortcuts();
+  const [burst, setBurst] = useState(0);
+  const endBurstDone = useCallback(() => setBurst(0), []);
+
+  // ── Run end: a toast, a flashing tab title, a notification, a burst ──
+  //
+  // Studio is usually one tab among many while a local model grinds for ten
+  // minutes. The run finishing has to reach the user wherever they are:
+  // in the tab (toast + confetti), on the tab strip (title), or in another
+  // window entirely (Notification, only when the tab is hidden and only when
+  // permission was already granted — this never asks on its own).
+  const events = ctx?.liveEvents ?? [];
+  const last = events.length > 0 ? events[events.length - 1] : null;
+  const sawRunning = useRef(false);
+  const handledEnd = useRef<RunEvent | null>(null);
+  const titleTimer = useRef<number | null>(null);
+  const originalTitle = useRef<string>(typeof document !== 'undefined' ? document.title : 'Studio');
+
+  useEffect(() => {
+    if (ctx?.liveRunning) sawRunning.current = true;
+  }, [ctx?.liveRunning]);
+
+  const stopTitleFlash = useCallback(() => {
+    if (titleTimer.current !== null) {
+      window.clearInterval(titleTimer.current);
+      titleTimer.current = null;
+    }
+    document.title = originalTitle.current;
+  }, []);
+
+  const flashTitle = useCallback(
+    (text: string) => {
+      stopTitleFlash();
+      originalTitle.current = document.title;
+      let on = false;
+      titleTimer.current = window.setInterval(() => {
+        on = !on;
+        document.title = on ? text : originalTitle.current;
+      }, 1000);
+      window.setTimeout(stopTitleFlash, TITLE_FLASH_MS);
+    },
+    [stopTitleFlash],
+  );
+
+  // Coming back to the tab ends the title flash.
+  useEffect(() => {
+    const onVisible = () => {
+      if (!document.hidden) stopTitleFlash();
+    };
+    document.addEventListener('visibilitychange', onVisible);
+    return () => {
+      document.removeEventListener('visibilitychange', onVisible);
+      stopTitleFlash();
+    };
+  }, [stopTitleFlash]);
+
+  useEffect(() => {
+    if (!last || last.kind !== 'run_end') return;
+    if (handledEnd.current === last) return;
+    handledEnd.current = last;
+    // A run_end replayed from the server snapshot on page load is history, not news.
+    if (!sawRunning.current) return;
+    sawRunning.current = false;
+
+    const { ok, failedTasks } = runEndVerdict(last);
+    const summary = (last.message || '').slice(0, 200);
+    if (ok) {
+      toast.success('Run finished', summary);
+      setBurst((n) => n + 1);
+    } else {
+      toast.push({
+        tone: 'error',
+        title: failedTasks > 0 ? `Run finished with ${failedTasks} failed task${failedTasks === 1 ? '' : 's'}` : 'Run failed',
+        detail: summary,
+      });
+    }
+
+    if (document.hidden) {
+      flashTitle(ok ? '✓ Run finished' : '✗ Run needs you');
+      try {
+        if ('Notification' in window && Notification.permission === 'granted') {
+          const n = new Notification(ok ? 'Studio: run finished' : 'Studio: run needs you', {
+            body: summary || undefined,
+            tag: 'slmcode-run-end',
+          });
+          n.onclick = () => {
+            window.focus();
+            n.close();
+          };
+        }
+      } catch {
+        /* notifications unavailable — the title flash still happened */
+      }
+    }
+  }, [last, toast, flashTitle]);
 
   return (
     <div className="h-screen flex flex-col overflow-hidden">
@@ -64,6 +173,8 @@ export default function Layout() {
       <HITLPopup running={Boolean(ctx?.liveRunning)} askSignal={ctx?.askSignal ?? 0} />
 
       <ShortcutSheet open={sheetOpen} onClose={() => setSheetOpen(false)} />
+      <CommandPalette open={paletteOpen} onClose={() => setPaletteOpen(false)} />
+      <Confetti burst={burst} onDone={endBurstDone} />
     </div>
   );
 }
diff --git a/web/src/components/Live/ResultPanel.test.tsx b/web/src/components/Live/ResultPanel.test.tsx
index 41d0fb8..bc1423b 100644
--- a/web/src/components/Live/ResultPanel.test.tsx
+++ b/web/src/components/Live/ResultPanel.test.tsx
@@ -1,9 +1,25 @@
-import { render, screen } from '@testing-library/react';
-import { describe, expect, it } from 'vitest';
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { MemoryRouter } from 'react-router-dom';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
 import ResultPanel from './ResultPanel';
-import type { LatestRunResponse, RunRepairs } from '@/types';
+import { RUN_PROMPT_EVENT } from '@/components/ui/events';
+import type { InterruptedRun, LatestRunResponse, QuerySession, RunRepairs } from '@/types';
 
-const run = (repairs?: RunRepairs | null): LatestRunResponse => ({
+const getInterruptedRuns = vi.fn(async (): Promise<InterruptedRun[]> => []);
+const getQueries = vi.fn(async (): Promise<QuerySession[]> => []);
+const resumeRun = vi.fn(async () => ({ status: 'started' }));
+const startRun = vi.fn(async () => ({ status: 'started' }));
+
+vi.mock('@/api/client', () => ({
+  errorText: (e: unknown) => (e instanceof Error ? e.message : String(e)),
+  getInterruptedRuns: () => getInterruptedRuns(),
+  getQueries: () => getQueries(),
+  resumeRun: (...a: unknown[]) => resumeRun(...(a as [])),
+  startRun: (...a: unknown[]) => startRun(...(a as [])),
+}));
+
+const run = (repairs?: RunRepairs | null, over?: Partial<LatestRunResponse['result']>): LatestRunResponse => ({
   running: false,
   events: [],
   result: {
@@ -12,10 +28,17 @@ const run = (repairs?: RunRepairs | null): LatestRunResponse => ({
     duration: 21_000_000_000,
     failed_tasks: 0,
     repairs,
+    ...over,
   },
 });
 
 describe('ResultPanel', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    getInterruptedRuns.mockResolvedValue([]);
+    getQueries.mockResolvedValue([]);
+  });
+
   it('says there is nothing to show before a run finishes', () => {
     render(<ResultPanel result={null} />);
     expect(screen.getByText('No result yet')).toBeInTheDocument();
@@ -55,4 +78,62 @@ describe('ResultPanel', () => {
     expect(screen.getByText('Failed')).toBeInTheDocument();
     expect(screen.getByText('21.0s')).toBeInTheDocument();
   });
+
+  // ── The run's end is not a dead end ──
+
+  it('links the failed count to the blocked column and the queue to Review', () => {
+    render(
+      <MemoryRouter>
+        <ResultPanel result={run(null, { success: false, failed_tasks: 2 })} pending={3} />
+      </MemoryRouter>,
+    );
+    expect(screen.getByRole('link', { name: /Open blocked on Board/ })).toHaveAttribute('href', '/board?column=blocked');
+    expect(screen.getByRole('link', { name: /Review 3 pending/ })).toHaveAttribute('href', '/review');
+  });
+
+  it('hides the board and review links when there is nothing behind them', () => {
+    render(<ResultPanel result={run(null)} pending={0} />);
+    expect(screen.queryByText(/Open blocked/)).not.toBeInTheDocument();
+    expect(screen.queryByText(/Review .* pending/)).not.toBeInTheDocument();
+  });
+
+  it('offers Resume when an interrupted run exists and calls the handler it was given', async () => {
+    const onResume = vi.fn();
+    render(
+      <ResultPanel
+        result={run(null)}
+        interrupted={[{ id: 'q-9', query: 'ship it', updated_at: '', tasks: 4, done: 2, blocked: 1, react_resume: false }]}
+        onResume={onResume}
+      />,
+    );
+    await userEvent.click(screen.getByRole('button', { name: /Resume interrupted run/ }));
+    expect(onResume).toHaveBeenCalledWith('q-9');
+  });
+
+  it('finds the resumable run itself when nobody passed one', async () => {
+    getInterruptedRuns.mockResolvedValue([
+      { id: 'q-1', query: 'x', updated_at: '', tasks: 1, done: 0, blocked: 0, react_resume: false },
+    ]);
+    render(<ResultPanel result={run(null)} />);
+    expect(await screen.findByRole('button', { name: /Resume interrupted run/ })).toBeInTheDocument();
+  });
+
+  it('runs the prompt again through the shared event, and starts it itself when nobody listens', async () => {
+    getQueries.mockResolvedValue([
+      { id: 'q-2', query: 'add a health endpoint', success: true, summary: '', updated_at: '' },
+    ]);
+    render(<ResultPanel result={run(null)} />);
+    const again = await screen.findByRole('button', { name: /Run again with this prompt/ });
+
+    // A listener (the Live view) claims the event: no direct request.
+    const claim = (ev: Event) => ev.preventDefault();
+    window.addEventListener(RUN_PROMPT_EVENT, claim);
+    await userEvent.click(again);
+    expect(startRun).not.toHaveBeenCalled();
+    window.removeEventListener(RUN_PROMPT_EVENT, claim);
+
+    // Nobody listening: the panel starts the run directly.
+    await userEvent.click(again);
+    await waitFor(() => expect(startRun).toHaveBeenCalledWith(expect.objectContaining({ query: 'add a health endpoint' })));
+  });
 });
diff --git a/web/src/components/Live/ResultPanel.tsx b/web/src/components/Live/ResultPanel.tsx
index 2c8ab07..c8fa66f 100644
--- a/web/src/components/Live/ResultPanel.tsx
+++ b/web/src/components/Live/ResultPanel.tsx
@@ -1,6 +1,12 @@
+import { useCallback, useContext, useEffect, useState } from 'react';
+import { Link, useInRouterContext } from 'react-router-dom';
 import clsx from 'clsx';
-import { CheckCircle2, Wrench } from 'lucide-react';
-import type { LatestRunResponse } from '@/types';
+import { CheckCircle2, FileDiff, Loader2, OctagonAlert, Play, RotateCw, Wrench } from 'lucide-react';
+import type { InterruptedRun, LatestRunResponse } from '@/types';
+import { AppContext } from '@/App';
+import { getInterruptedRuns, getQueries, resumeRun, startRun } from '@/api/client';
+import { useToast } from '@/components/ui/Toast';
+import { RUN_PROMPT_EVENT, emit, type RunPromptDetail } from '@/components/ui/events';
 
 // ── The screen people read last ──────────────────────────────────────────
 //
@@ -10,8 +16,111 @@ import type { LatestRunResponse } from '@/types';
 // concludes the failures were swallowed, or that the panel is not to be
 // trusted, and the repair line is where the run's own resilience becomes
 // visible instead.
+//
+// And it was a dead end. Every run ends with one of four next moves — resume
+// what was interrupted, deal with what is blocked, review what is queued, or
+// go again — so they are buttons here, not things to remember.
+
+interface ResultPanelProps {
+  result: LatestRunResponse | null;
+  /**
+   * Everything below is optional. The Live view owns the resumable-run list
+   * and the prompt; when it passes them the panel uses them, and when it does
+   * not the panel fetches the list itself and runs the prompt through the
+   * shared RUN_PROMPT_EVENT (falling back to POST /api/runs directly).
+   */
+  interrupted?: InterruptedRun[];
+  onResume?: (id?: string) => void;
+  /** The prompt of the run that just finished. Defaults to the newest archive. */
+  query?: string;
+  onRunAgain?: (query: string) => void;
+  /** Review-queue size. Defaults to health.pending from the app context. */
+  pending?: number;
+  running?: boolean;
+}
+
+export default function ResultPanel({
+  result,
+  interrupted: interruptedProp,
+  onResume,
+  query: queryProp,
+  onRunAgain,
+  pending: pendingProp,
+  running: runningProp,
+}: ResultPanelProps) {
+  const ctx = useContext(AppContext);
+  const toast = useToast();
+  const inRouter = useInRouterContext();
+  const running = runningProp ?? ctx?.liveRunning ?? false;
+  const pending = pendingProp ?? ctx?.health?.pending ?? 0;
+  const hasResult = Boolean(result?.result);
+
+  const [interruptedOwn, setInterruptedOwn] = useState<InterruptedRun[]>([]);
+  const [queryOwn, setQueryOwn] = useState('');
+  const [busy, setBusy] = useState<'resume' | 'again' | null>(null);
+  const interrupted = interruptedProp ?? interruptedOwn;
+  const query = queryProp ?? queryOwn;
+
+  // Own the data only when nobody passed it, and only once there is a result
+  // to act on. Both are one request each and are re-read when a run ends.
+  useEffect(() => {
+    if (!hasResult || running) return;
+    if (interruptedProp === undefined) {
+      getInterruptedRuns().then(setInterruptedOwn).catch(() => setInterruptedOwn([]));
+    }
+    if (queryProp === undefined) {
+      getQueries()
+        .then((list) => setQueryOwn(list[0]?.query ?? ''))
+        .catch(() => setQueryOwn(''));
+    }
+  }, [hasResult, running, interruptedProp, queryProp]);
+
+  const beginRun = useCallback(() => {
+    ctx?.resetLiveEvents();
+    ctx?.setLiveResult(null);
+    ctx?.setLiveRunning(true);
+  }, [ctx]);
+
+  const handleResume = useCallback(async () => {
+    const id = interrupted[0]?.id;
+    if (onResume) {
+      onResume(id);
+      return;
+    }
+    setBusy('resume');
+    try {
+      beginRun();
+      await resumeRun(id);
+      setInterruptedOwn([]);
+    } catch (err) {
+      ctx?.setLiveRunning(false);
+      toast.reportError(err, 'Could not resume the run');
+    } finally {
+      setBusy(null);
+    }
+  }, [interrupted, onResume, beginRun, ctx, toast]);
+
+  const handleRunAgain = useCallback(async () => {
+    if (!query) return;
+    if (onRunAgain) {
+      onRunAgain(query);
+      return;
+    }
+    // The Live view, when mounted, takes the prompt and starts it with the
+    // teams and specialist the user picked. Otherwise start it plainly.
+    if (emit<RunPromptDetail>(RUN_PROMPT_EVENT, { query })) return;
+    setBusy('again');
+    try {
+      beginRun();
+      await startRun({ query, skills: ctx?.config?.pinned_skills });
+    } catch (err) {
+      ctx?.setLiveRunning(false);
+      toast.reportError(err, 'Could not start the run');
+    } finally {
+      setBusy(null);
+    }
+  }, [query, onRunAgain, beginRun, ctx, toast]);
 
-export default function ResultPanel({ result }: { result: LatestRunResponse | null }) {
   if (!result?.result) {
     return (
       <div className="flex h-full flex-col items-center justify-center gap-2 px-6 text-center text-gray-400">
@@ -23,6 +132,11 @@ export default function ResultPanel({ result }: { result: LatestRunResponse | nu
   }
   const r = result.result;
   const seconds = r.duration > 1e9 ? `${(r.duration / 1e9).toFixed(1)}s` : `${(r.duration / 1e6).toFixed(0)}ms`;
+  const actionClass =
+    'focus-ring inline-flex h-8 items-center gap-1.5 rounded-md border border-gray-200 bg-white px-2.5 text-xs font-medium text-gray-700 hover:border-brand-300 hover:text-brand-700 disabled:opacity-50 dark:border-gray-700 dark:bg-gray-900 dark:text-gray-200 dark:hover:border-brand-600';
+  const blockedHref = '/board?column=blocked';
+  const reviewHref = '/review';
+
   return (
     <div className="h-full space-y-3 overflow-auto p-4">
       <div className="flex items-center justify-between">
@@ -55,6 +169,61 @@ export default function ResultPanel({ result }: { result: LatestRunResponse | nu
         <Stat label="Duration" value={seconds} />
         <Stat label="Events" value={String(result.events?.length ?? 0)} />
       </div>
+
+      {/* ── What next ── */}
+      <div>
+        <div className="mb-1.5 text-[10px] font-semibold uppercase tracking-wide text-gray-400">What next</div>
+        <div className="flex flex-wrap gap-1.5" role="group" aria-label="Next steps">
+          {interrupted.length > 0 && (
+            <button
+              type="button"
+              className={clsx(actionClass, 'border-brand-300 text-brand-700 dark:border-brand-700 dark:text-brand-300')}
+              onClick={handleResume}
+              disabled={running || busy !== null}
+              title={`Resume ${interrupted[0].id}: ${interrupted[0].done}/${interrupted[0].tasks} done, ${interrupted[0].blocked} blocked`}
+            >
+              {busy === 'resume' ? <Loader2 size={13} className="animate-spin" aria-hidden="true" /> : <Play size={13} fill="currentColor" aria-hidden="true" />}
+              Resume interrupted run
+            </button>
+          )}
+          {r.failed_tasks > 0 &&
+            (inRouter ? (
+              <Link to={blockedHref} className={actionClass}>
+                <OctagonAlert size={13} aria-hidden="true" />
+                Open blocked on Board
+              </Link>
+            ) : (
+              <a href={blockedHref} className={actionClass}>
+                <OctagonAlert size={13} aria-hidden="true" />
+                Open blocked on Board
+              </a>
+            ))}
+          {pending > 0 &&
+            (inRouter ? (
+              <Link to={reviewHref} className={actionClass}>
+                <FileDiff size={13} aria-hidden="true" />
+                Review {pending} pending
+              </Link>
+            ) : (
+              <a href={reviewHref} className={actionClass}>
+                <FileDiff size={13} aria-hidden="true" />
+                Review {pending} pending
+              </a>
+            ))}
+          {query && (
+            <button
+              type="button"
+              className={actionClass}
+              onClick={handleRunAgain}
+              disabled={running || busy !== null}
+              title={query}
+            >
+              {busy === 'again' ? <Loader2 size={13} className="animate-spin" aria-hidden="true" /> : <RotateCw size={13} aria-hidden="true" />}
+              Run again with this prompt
+            </button>
+          )}
+        </div>
+      </div>
     </div>
   );
 }
diff --git a/web/src/components/ui/CommandPalette.tsx b/web/src/components/ui/CommandPalette.tsx
new file mode 100644
index 0000000..440137f
--- /dev/null
+++ b/web/src/components/ui/CommandPalette.tsx
@@ -0,0 +1,258 @@
+import { useContext, useEffect, useMemo, useRef, useState } from 'react';
+import { useNavigate } from 'react-router-dom';
+import { Archive, Bot, Compass, ListChecks, Moon, Search, Sun, Users } from 'lucide-react';
+import type { ReactNode } from 'react';
+import clsx from 'clsx';
+import { AppContext } from '@/App';
+import { getAgents, getQueries, getTasks, getTeams } from '@/api/client';
+import { GO_TARGETS } from '@/hooks/useKeyboard';
+import { useFocusTrap } from './Modal';
+
+// ── ⌘K ──
+//
+// One box that reaches everything with a name: pages, tasks by id or title,
+// agents, teams, recent runs, and the theme. Self-contained: it loads its
+// catalogue when it opens (four best-effort requests) and navigates with the
+// router; nothing else in the app has to know it exists.
+
+interface Command {
+  id: string;
+  group: 'Pages' | 'Tasks' | 'Agents' | 'Teams' | 'Recent runs' | 'Theme';
+  label: string;
+  hint?: string;
+  keywords: string;
+  icon: ReactNode;
+  run: () => void;
+}
+
+interface CommandPaletteProps {
+  open: boolean;
+  onClose: () => void;
+}
+
+const MAX_RESULTS = 24;
+
+export default function CommandPalette({ open, onClose }: CommandPaletteProps) {
+  const ctx = useContext(AppContext);
+  const navigate = useNavigate();
+  const panelRef = useRef<HTMLDivElement>(null);
+  const inputRef = useRef<HTMLInputElement>(null);
+  const [query, setQuery] = useState('');
+  const [active, setActive] = useState(0);
+  const [loaded, setLoaded] = useState<Command[]>([]);
+
+  useFocusTrap(panelRef, { active: open, onEscape: onClose, initialFocusRef: inputRef });
+
+  // Reset and load on open. Each request fails on its own; a page with no
+  // board still gets pages, agents and the theme.
+  useEffect(() => {
+    if (!open) return undefined;
+    setQuery('');
+    setActive(0);
+    let alive = true;
+    const go = (path: string) => () => {
+      onClose();
+      navigate(path);
+    };
+    Promise.allSettled([getTasks(), getAgents(), getTeams(), getQueries()]).then(([tasks, agents, teams, runs]) => {
+      if (!alive) return;
+      const out: Command[] = [];
+      if (tasks.status === 'fulfilled') {
+        for (const t of tasks.value?.tasks ?? []) {
+          out.push({
+            id: `task:${t.id}`,
+            group: 'Tasks',
+            label: `${t.id} · ${t.title}`,
+            hint: [t.column, t.squad].filter(Boolean).join(' · '),
+            keywords: `${t.id} ${t.title} ${t.role} ${t.squad ?? ''} ${t.column}`,
+            icon: <ListChecks size={14} aria-hidden="true" />,
+            run: go(`/?task=${encodeURIComponent(t.id)}`),
+          });
+        }
+      }
+      if (agents.status === 'fulfilled') {
+        for (const a of agents.value ?? []) {
+          out.push({
+            id: `agent:${a.id}`,
+            group: 'Agents',
+            label: a.title || a.id,
+            hint: a.id,
+            keywords: `${a.id} ${a.title ?? ''} ${a.description ?? ''}`,
+            icon: <Bot size={14} aria-hidden="true" />,
+            run: go(`/agents?agent=${encodeURIComponent(a.id)}`),
+          });
+        }
+      }
+      if (teams.status === 'fulfilled') {
+        for (const t of teams.value?.teams ?? []) {
+          out.push({
+            id: `team:${t.id}`,
+            group: 'Teams',
+            label: t.name || t.id,
+            hint: t.id,
+            keywords: `${t.id} ${t.name ?? ''} ${t.charter ?? ''}`,
+            icon: <Users size={14} aria-hidden="true" />,
+            run: go(`/teams?team=${encodeURIComponent(t.id)}`),
+          });
+        }
+      }
+      if (runs.status === 'fulfilled') {
+        for (const r of (runs.value ?? []).slice(0, 15)) {
+          out.push({
+            id: `run:${r.id}`,
+            group: 'Recent runs',
+            label: r.query || r.id,
+            hint: r.id,
+            keywords: `${r.id} ${r.query} ${r.summary}`,
+            icon: <Archive size={14} aria-hidden="true" />,
+            run: go(`/runs?run=${encodeURIComponent(r.id)}`),
+          });
+        }
+      }
+      setLoaded(out);
+    });
+    return () => {
+      alive = false;
+    };
+  }, [open, navigate, onClose]);
+
+  const commands = useMemo<Command[]>(() => {
+    const go = (path: string) => () => {
+      onClose();
+      navigate(path);
+    };
+    const pages: Command[] = GO_TARGETS.map((t) => ({
+      id: `page:${t.path}`,
+      group: 'Pages',
+      label: t.label,
+      hint: `g ${t.key}`,
+      keywords: `${t.label} ${t.path} go page`,
+      icon: <Compass size={14} aria-hidden="true" />,
+      run: go(t.path),
+    }));
+    const theme: Command = {
+      id: 'theme:toggle',
+      group: 'Theme',
+      label: ctx?.dark ? 'Switch to light theme' : 'Switch to dark theme',
+      keywords: 'theme dark light mode appearance toggle',
+      icon: ctx?.dark ? <Sun size={14} aria-hidden="true" /> : <Moon size={14} aria-hidden="true" />,
+      run: () => {
+        ctx?.toggleDark();
+        onClose();
+      },
+    };
+    return [...pages, theme, ...loaded];
+  }, [loaded, ctx, navigate, onClose]);
+
+  const results = useMemo(() => {
+    const needle = query.trim().toLowerCase();
+    if (!needle) return commands.filter((c) => c.group === 'Pages' || c.group === 'Theme').slice(0, MAX_RESULTS);
+    const terms = needle.split(/\s+/);
+    return commands
+      .map((c) => {
+        const hay = `${c.label} ${c.keywords}`.toLowerCase();
+        if (!terms.every((t) => hay.includes(t))) return null;
+        const first = c.label.toLowerCase().indexOf(terms[0]);
+        return { c, score: first < 0 ? 100 : first };
+      })
+      .filter((x): x is { c: Command; score: number } => x !== null)
+      .sort((a, b) => a.score - b.score)
+      .slice(0, MAX_RESULTS)
+      .map((x) => x.c);
+  }, [commands, query]);
+
+  useEffect(() => {
+    setActive(0);
+  }, [query]);
+
+  useEffect(() => {
+    document.getElementById(`palette-item-${active}`)?.scrollIntoView({ block: 'nearest' });
+  }, [active]);
+
+  if (!open) return null;
+
+  const onKeyDown = (e: React.KeyboardEvent) => {
+    if (e.key === 'ArrowDown') {
+      e.preventDefault();
+      setActive((i) => Math.min(i + 1, results.length - 1));
+    } else if (e.key === 'ArrowUp') {
+      e.preventDefault();
+      setActive((i) => Math.max(i - 1, 0));
+    } else if (e.key === 'Enter') {
+      e.preventDefault();
+      results[active]?.run();
+    }
+  };
+
+  let lastGroup = '';
+  return (
+    <div className="fixed inset-0 z-50 flex items-start justify-center px-4 pt-[12vh]">
+      <div className="absolute inset-0 bg-black/40 backdrop-blur-sm" onClick={onClose} aria-hidden="true" />
+      <div
+        ref={panelRef}
+        role="dialog"
+        aria-modal="true"
+        aria-label="Command palette"
+        className="relative z-10 w-full max-w-xl overflow-hidden rounded-xl border border-gray-200 bg-white shadow-2xl dark:border-gray-800 dark:bg-gray-900"
+      >
+        <div className="flex items-center gap-2 border-b border-gray-100 px-3 dark:border-gray-800">
+          <Search size={15} className="shrink-0 text-gray-400" aria-hidden="true" />
+          <input
+            ref={inputRef}
+            value={query}
+            onChange={(e) => setQuery(e.target.value)}
+            onKeyDown={onKeyDown}
+            role="combobox"
+            aria-expanded="true"
+            aria-controls="palette-listbox"
+            aria-activedescendant={results.length > 0 ? `palette-item-${active}` : undefined}
+            aria-autocomplete="list"
+            placeholder="Go to a page, a task, an agent, a team, a run…"
+            className="h-11 w-full bg-transparent text-sm outline-none placeholder:text-gray-400"
+          />
+          <kbd className="hidden rounded border border-gray-200 px-1.5 py-0.5 font-mono text-[10px] text-gray-400 sm:inline dark:border-gray-700">
+            esc
+          </kbd>
+        </div>
+        <ul id="palette-listbox" role="listbox" aria-label="Commands" className="max-h-[50vh] overflow-y-auto py-1">
+          {results.length === 0 && (
+            <li className="px-4 py-6 text-center text-xs text-gray-400">Nothing matches “{query}”.</li>
+          )}
+          {results.map((c, i) => {
+            const header = c.group !== lastGroup ? c.group : null;
+            lastGroup = c.group;
+            return (
+              <li key={c.id} role="presentation">
+                {header && (
+                  <div className="px-3 pb-0.5 pt-2 text-[10px] font-semibold uppercase tracking-wider text-gray-400">{header}</div>
+                )}
+                <div
+                  id={`palette-item-${i}`}
+                  role="option"
+                  aria-selected={i === active}
+                  tabIndex={-1}
+                  onMouseEnter={() => setActive(i)}
+                  onClick={c.run}
+                  onKeyDown={(e) => {
+                    if (e.key === 'Enter' || e.key === ' ') {
+                      e.preventDefault();
+                      c.run();
+                    }
+                  }}
+                  className={clsx(
+                    'mx-1 flex cursor-pointer items-center gap-2.5 rounded-md px-2.5 py-1.5 text-sm',
+                    i === active ? 'bg-brand-50 text-brand-800 dark:bg-brand-900/30 dark:text-brand-100' : 'text-gray-700 dark:text-gray-200',
+                  )}
+                >
+                  <span className="shrink-0 text-gray-400">{c.icon}</span>
+                  <span className="min-w-0 flex-1 truncate">{c.label}</span>
+                  {c.hint && <span className="shrink-0 font-mono text-[10px] text-gray-400">{c.hint}</span>}
+                </div>
+              </li>
+            );
+          })}
+        </ul>
+      </div>
+    </div>
+  );
+}
diff --git a/web/src/hooks/useKeyboard.ts b/web/src/hooks/useKeyboard.ts
index c37e4ce..7c855f9 100644
--- a/web/src/hooks/useKeyboard.ts
+++ b/web/src/hooks/useKeyboard.ts
@@ -1,15 +1,29 @@
 import { useEffect, useRef, useState } from 'react';
 import { useNavigate } from 'react-router-dom';
+import {
+  COMMAND_PALETTE_EVENT,
+  FOCUS_PROMPT_EVENT,
+  RUN_PROMPT_EVENT,
+  STOP_RUN_EVENT,
+  emit,
+} from '@/components/ui/events';
 
 // ── Keyboard-first navigation ──
 //
-//   ?        open the shortcut sheet
-//   g <key>  go to a page (vim/gmail style two-stroke chord)
-//   /        focus the run prompt
-//   Esc      close whatever is open
+//   ?          open the shortcut sheet
+//   g <key>    go to a page (vim/gmail style two-stroke chord)
+//   /          focus the run prompt
+//   ⌘K         command palette
+//   ⌘↵ / ⌘.    run / stop, while the run prompt is focused
+//   Esc        close whatever is open
 //
-// Shortcuts never fire while the user is typing into a field or a
-// contenteditable region, and never while a modal has focus.
+// Plain-key shortcuts never fire while the user is typing into a field or a
+// contenteditable region, and never while a modal has focus. The modifier
+// shortcuts are the exception: ⌘↵ and ⌘. exist precisely for the prompt box.
+//
+// The run and stop shortcuts do not know how to start a run: they dispatch
+// RUN_PROMPT_EVENT / STOP_RUN_EVENT on `window` and the Live view, which owns
+// the prompt and the run request, listens (see components/ui/events.ts).
 
 export interface Shortcut {
   keys: string;
@@ -24,6 +38,7 @@ export const GO_TARGETS: Array<{ key: string; path: string; label: string }> = [
   { key: 'r', path: '/review', label: 'Review queue' },
   { key: 'p', path: '/pipeline', label: 'Pipeline' },
   { key: 'a', path: '/agents', label: 'Agents' },
+  { key: 't', path: '/teams', label: 'Teams' },
   { key: 'k', path: '/blocks', label: 'Blocks' },
   { key: 'f', path: '/files', label: 'Files' },
   { key: 's', path: '/skills', label: 'Skills' },
@@ -31,10 +46,17 @@ export const GO_TARGETS: Array<{ key: string; path: string; label: string }> = [
   { key: ',', path: '/settings', label: 'Settings' },
 ];
 
+/** Rendered as ⌘ on Apple platforms and Ctrl elsewhere. */
+export const MOD_LABEL =
+  typeof navigator !== 'undefined' && /Mac|iPhone|iPad/.test(navigator.platform) ? '⌘' : 'Ctrl';
+
 export const SHORTCUTS: Shortcut[] = [
   { keys: '?', label: 'Show this shortcut sheet', group: 'General' },
+  { keys: `${MOD_LABEL} K`, label: 'Command palette — pages, tasks, agents, teams, runs, theme', group: 'General' },
   { keys: 'Esc', label: 'Close dialog / shortcut sheet', group: 'General' },
-  { keys: '/', label: 'Focus the run prompt', group: 'General' },
+  { keys: '/', label: 'Focus the run prompt', group: 'Run' },
+  { keys: `${MOD_LABEL} ↵`, label: 'Run the prompt (while it is focused)', group: 'Run' },
+  { keys: `${MOD_LABEL} .`, label: 'Stop the active run (while the prompt is focused)', group: 'Run' },
   ...GO_TARGETS.map((t) => ({ keys: `g ${t.key}`, label: `Go to ${t.label}`, group: 'Navigation' })),
 ];
 
@@ -46,17 +68,35 @@ export function isTypingTarget(target: EventTarget | null): boolean {
   return target.isContentEditable;
 }
 
-/** Fired on `/` so the Live view can focus its prompt from anywhere. */
-export const FOCUS_PROMPT_EVENT = 'slmcode:focus-prompt';
+/**
+ * The run prompt is recognised by its accessible name ("Run prompt") or an
+ * explicit data-run-prompt attribute, so the shortcut needs no ref plumbing.
+ */
+export function isRunPrompt(target: EventTarget | null): boolean {
+  if (!(target instanceof HTMLElement)) return false;
+  return target.getAttribute('aria-label') === 'Run prompt' || target.hasAttribute('data-run-prompt');
+}
+
+// Re-exported so existing imports keep working; the name now lives with the
+// other window events.
+export { FOCUS_PROMPT_EVENT, RUN_PROMPT_EVENT, STOP_RUN_EVENT };
 
 export function useKeyboardShortcuts() {
   const navigate = useNavigate();
   const [sheetOpen, setSheetOpen] = useState(false);
+  const [paletteOpen, setPaletteOpen] = useState(false);
   const [chord, setChord] = useState<string | null>(null);
   const chordTimer = useRef<number | null>(null);
   const navigateRef = useRef(navigate);
   navigateRef.current = navigate;
 
+  // Anything can ask for the palette (a button, another shortcut).
+  useEffect(() => {
+    const toggle = () => setPaletteOpen((v) => !v);
+    window.addEventListener(COMMAND_PALETTE_EVENT, toggle);
+    return () => window.removeEventListener(COMMAND_PALETTE_EVENT, toggle);
+  }, []);
+
   useEffect(() => {
     const clearChord = () => {
       if (chordTimer.current !== null) {
@@ -67,10 +107,30 @@ export function useKeyboardShortcuts() {
     };
 
     const onKeyDown = (e: KeyboardEvent) => {
-      if (e.metaKey || e.ctrlKey || e.altKey) return;
+      const mod = e.metaKey || e.ctrlKey;
+
+      if (mod && !e.altKey && !e.shiftKey && e.key.toLowerCase() === 'k') {
+        e.preventDefault();
+        setPaletteOpen((v) => !v);
+        return;
+      }
+      if (mod && isRunPrompt(e.target)) {
+        if (e.key === 'Enter') {
+          e.preventDefault();
+          emit(RUN_PROMPT_EVENT);
+          return;
+        }
+        if (e.key === '.') {
+          e.preventDefault();
+          emit(STOP_RUN_EVENT);
+          return;
+        }
+      }
+      if (mod || e.altKey) return;
 
       if (e.key === 'Escape') {
         setSheetOpen(false);
+        setPaletteOpen(false);
         clearChord();
         return;
       }
@@ -111,5 +171,5 @@ export function useKeyboardShortcuts() {
     };
   }, [chord]);
 
-  return { sheetOpen, setSheetOpen, chord };
+  return { sheetOpen, setSheetOpen, paletteOpen, setPaletteOpen, chord };
 }

From 676f19948a7d0518cef687f880991d563506b9b0 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 08:31:04 +0000
Subject: [PATCH 03/23] fix(studio): no more silent failures on the editor
 pages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

SettingsPanel and MarkdownEditor swallowed save errors — a 409 during a
run left Save looking like a no-op. Both now report through the shared
toast, naming the active run as the reason and saying the edits are
kept. AgentManager, SkillManager and PipelineEditor render an inline
ErrorState with Retry when their list fails to load instead of an empty
state over a dead backend, and their secondary loads and reset report
through the toast. FileInspector drops its private toast for the shared
one and accepts /files?path= to open a file directly.

ReviewView refreshes on the review_pending SSE event and on a 15 s poll
while a run is writing, not only when it stops; each change shows its
provenance (task, agent, run) with links, plus Open in Files. Empty
states on Review, Agents and Skills say what the page is for and offer
the first action.
---
 web/src/components/Agents/AgentManager.tsx    | 35 ++++++--
 web/src/components/Docs/MarkdownEditor.tsx    | 35 +++++++-
 web/src/components/Files/FileInspector.tsx    | 51 +++++++----
 .../components/Pipeline/PipelineEditor.tsx    | 15 +++-
 web/src/components/Review/ReviewView.tsx      | 85 ++++++++++++++++++-
 web/src/components/Settings/SettingsPanel.tsx | 18 +++-
 web/src/components/Skills/SkillManager.tsx    | 32 +++++--
 7 files changed, 229 insertions(+), 42 deletions(-)

diff --git a/web/src/components/Agents/AgentManager.tsx b/web/src/components/Agents/AgentManager.tsx
index 7d8d835..371e9f4 100644
--- a/web/src/components/Agents/AgentManager.tsx
+++ b/web/src/components/Agents/AgentManager.tsx
@@ -15,6 +15,7 @@ import {
 import clsx from 'clsx';
 import { useConfirm } from '@/components/ui/Modal';
 import { useToast } from '@/components/ui/Toast';
+import ErrorState from '@/components/ui/ErrorState';
 
 const EMPTY_AGENT: AgentSpec = {
   id: '',
@@ -36,6 +37,7 @@ export default function AgentManager() {
   const toast = useToast();
   const [agents, setAgents] = useState<AgentSpec[]>([]);
   const [loading, setLoading] = useState(true);
+  const [loadError, setLoadError] = useState<unknown>(null);
   const [detailLoading, setDetailLoading] = useState(false);
   const [editing, setEditing] = useState<AgentSpec | null>(null);
   const [creating, setCreating] = useState(false);
@@ -48,8 +50,11 @@ export default function AgentManager() {
     try {
       const list = await getAgents();
       setAgents(list);
+      setLoadError(null);
     } catch (e) {
-      console.error('Failed to load agents:', e);
+      // Shown in place of the list with a Retry; an empty list over a dead
+      // backend used to read as "no custom agents defined yet".
+      setLoadError(e);
     } finally {
       setLoading(false);
     }
@@ -64,11 +69,11 @@ export default function AgentManager() {
     getSkills()
       .then((list) => setAllSkills(list || []))
       .catch((e) => {
-        console.error('Failed to load skills:', e);
+        toast.reportError(e, 'Could not load the skill list for the picker');
         setAllSkills([]);
       })
       .finally(() => setSkillsLoaded(true));
-  }, []);
+  }, [toast]);
 
   const toggleSkill = useCallback((name: string) => {
     setForm((f) => {
@@ -104,8 +109,13 @@ export default function AgentManager() {
       const detail = await getAgent(agent.id);
       setForm({ ...detail });
     } catch (e) {
-      console.error('Failed to load agent detail:', e);
-      // Fall back to list data (prompts may be missing)
+      // Fall back to list data (prompts may be missing) — and say so, or a
+      // save from this form silently blanks the system prompt.
+      toast.push({
+        tone: 'warning',
+        title: `Editing ${agent.title || agent.id} from the summary only`,
+        detail: `The full spec could not be loaded (${e instanceof Error ? e.message : String(e)}); prompts may be missing.`,
+      });
       setForm({ ...agent });
     } finally {
       setDetailLoading(false);
@@ -520,11 +530,20 @@ export default function AgentManager() {
           ))}
         </div>
 
-        {agents.length === 0 && !showForm && (
+        {loadError !== null && !showForm && <ErrorState error={loadError} what="agents" onRetry={fetch} />}
+
+        {!loadError && agents.length === 0 && !showForm && (
           <div className="text-center py-12 text-gray-400">
             <Bot size={48} className="mx-auto mb-3 opacity-50" />
-            <p className="text-sm">No custom agents defined yet.</p>
-            <p className="text-xs mt-1">Built-in specialists are always available.</p>
+            <p className="text-sm">No agents yet.</p>
+            <p className="text-xs mt-1">
+              An agent is a role with its own prompt, model and skills — the pipeline seats one per phase. Built-in
+              specialists are always available; add one here to override a builtin or introduce a new role.
+            </p>
+            <button type="button" onClick={handleCreate} className="btn-primary mx-auto mt-4 gap-2 text-sm">
+              <Plus size={14} />
+              Create your first agent
+            </button>
           </div>
         )}
       </div>
diff --git a/web/src/components/Docs/MarkdownEditor.tsx b/web/src/components/Docs/MarkdownEditor.tsx
index b03b021..63770fb 100644
--- a/web/src/components/Docs/MarkdownEditor.tsx
+++ b/web/src/components/Docs/MarkdownEditor.tsx
@@ -1,23 +1,34 @@
 import { useState, useEffect, useCallback } from 'react';
 import { useParams } from 'react-router-dom';
-import { getDoc, updateDoc } from '@/api/client';
+import { ApiError, getDoc, updateDoc } from '@/api/client';
 import { Save, FileText, Loader } from 'lucide-react';
+import { useToast } from '@/components/ui/Toast';
+import ErrorState from '@/components/ui/ErrorState';
 
 export default function MarkdownEditor() {
   const { docId } = useParams<{ docId: string }>();
+  const toast = useToast();
   const [content, setContent] = useState('');
   const [loading, setLoading] = useState(true);
+  const [loadError, setLoadError] = useState<unknown>(null);
   const [saving, setSaving] = useState(false);
   const [saved, setSaved] = useState(false);
 
   const fetchDoc = useCallback(async () => {
     if (!docId) return;
     setLoading(true);
+    setLoadError(null);
     try {
       const d = await getDoc(docId);
       setContent(d.content || '');
     } catch (e) {
-      console.error('Failed to load doc:', e);
+      // A 404 is a document that does not exist yet: start it empty. Anything
+      // else is a real failure the editor must not paper over with a blank page.
+      if (e instanceof ApiError && e.status === 404) {
+        setContent('');
+      } else {
+        setLoadError(e);
+      }
     } finally {
       setLoading(false);
     }
@@ -36,11 +47,19 @@ export default function MarkdownEditor() {
       setSaved(true);
       setTimeout(() => setSaved(false), 2000);
     } catch (e) {
-      console.error('Save failed:', e);
+      if (e instanceof ApiError && e.isConflict) {
+        toast.push({
+          tone: 'warning',
+          title: `${docId} not saved`,
+          detail: 'A run is active and owns this document — stop it before editing. Your text is kept in the editor.',
+        });
+      } else {
+        toast.reportError(e, `Could not save ${docId}`);
+      }
     } finally {
       setSaving(false);
     }
-  }, [docId, content]);
+  }, [docId, content, toast]);
 
   // Keyboard shortcut: Cmd/Ctrl + S
   useEffect(() => {
@@ -63,6 +82,14 @@ export default function MarkdownEditor() {
     );
   }
 
+  if (loadError) {
+    return (
+      <div className="flex h-full items-center justify-center p-6">
+        <ErrorState error={loadError} what={docId} onRetry={fetchDoc} className="w-full max-w-md" />
+      </div>
+    );
+  }
+
   return (
     <div className="h-full flex flex-col">
       {/* Toolbar */}
diff --git a/web/src/components/Files/FileInspector.tsx b/web/src/components/Files/FileInspector.tsx
index 8ec978a..da724e5 100644
--- a/web/src/components/Files/FileInspector.tsx
+++ b/web/src/components/Files/FileInspector.tsx
@@ -19,9 +19,11 @@ import {
   Eye,
   EyeOff,
 } from 'lucide-react';
+import { useSearchParams } from 'react-router-dom';
 import { addTask, getWorkspaceFile, getWorkspaceTree } from '@/api/client';
 import type { RunEvent } from '@/types';
 import clsx from 'clsx';
+import { useToast } from '@/components/ui/Toast';
 
 // ── Types ──
 
@@ -178,9 +180,22 @@ function genId(): string { return `${Date.now()}-${Math.random().toString(36).sl
 // ── Component ──
 
 export default function FileInspector({ events, running }: Props) {
+  const toast = useToast();
+  // `/files?path=a/b/c.go` opens that file with its ancestors expanded — the
+  // review queue's "Open in Files" link lands here.
+  const [searchParams] = useSearchParams();
+  const initialPath = searchParams.get('path') || null;
+
   // ── State ──
-  const [selectedFile, setSelectedFile] = useState<string | null>(null);
-  const [expandedDirs, setExpandedDirs] = useState<Set<string>>(new Set(['']));
+  const [selectedFile, setSelectedFile] = useState<string | null>(initialPath);
+  const [expandedDirs, setExpandedDirs] = useState<Set<string>>(() => {
+    const dirs = new Set(['']);
+    if (initialPath) {
+      const parts = initialPath.split('/');
+      for (let i = 1; i < parts.length; i++) dirs.add(parts.slice(0, i).join('/'));
+    }
+    return dirs;
+  });
   const [tree, setTree] = useState<Record<string, TreeEntry[]>>({});
   const [treeLoading, setTreeLoading] = useState(true);
   const [content, setContent] = useState<string | null>(null);
@@ -188,7 +203,6 @@ export default function FileInspector({ events, running }: Props) {
   const [lineComments, setLineComments] = useState<Record<string, Record<number, LineComment[]>>>({});
   const [activeLine, setActiveLine] = useState<{ file: string; line: number } | null>(null);
   const [draftComment, setDraftComment] = useState('');
-  const [toast, setToast] = useState<{ ok: boolean; msg: string } | null>(null);
   const [showOnlyModified, setShowOnlyModified] = useState(false);
   // Dot-entries are shown by default: `.slmcode/pending/` is the review queue
   // and `.github/` is real project content. `.git` stays hidden server-side.
@@ -213,6 +227,13 @@ export default function FileInspector({ events, running }: Props) {
 
   useEffect(() => { setTree({}); loadDir(''); }, [loadDir]);
 
+  // A deep link's ancestors are expanded but not yet loaded.
+  useEffect(() => {
+    if (!initialPath) return;
+    const parts = initialPath.split('/');
+    for (let i = 1; i < parts.length; i++) loadDir(parts.slice(0, i).join('/'));
+  }, [initialPath, loadDir]);
+
   // ── Load file content ──
   useEffect(() => {
     if (!selectedFile) { setContent(null); return; }
@@ -231,11 +252,15 @@ export default function FileInspector({ events, running }: Props) {
     if (activeLine) setTimeout(() => draftInputRef.current?.focus(), 50);
   }, [activeLine]);
 
-  // ── Toast ──
-  const flash = useCallback((ok: boolean, msg: string) => {
-    setToast({ ok, msg });
-    setTimeout(() => setToast(null), 4000);
-  }, []);
+  // ── Notices go through the shared toast, like every other page ──
+  const flash = useCallback(
+    (ok: boolean, msg: string, err?: unknown) => {
+      if (ok) toast.success(msg);
+      else if (err !== undefined) toast.reportError(err, msg);
+      else toast.push({ tone: 'error', title: msg });
+    },
+    [toast],
+  );
 
   // ── Tree helpers ──
   const toggleDir = useCallback(async (dirPath: string) => {
@@ -344,7 +369,7 @@ export default function FileInspector({ events, running }: Props) {
     try {
       await addTask({ title: `Review: ${filePath}:L${comment.line}`, description: comment.text, role: 'worker', files: [filePath] });
       flash(true, `Task created for ${filePath}:L${comment.line}`);
-    } catch { flash(false, 'Failed to create task'); }
+    } catch (err) { flash(false, 'Could not create the task', err); }
   }, [flash]);
 
   // ── Content lines ──
@@ -356,14 +381,6 @@ export default function FileInspector({ events, running }: Props) {
   // ── Render ──
   return (
     <div className="h-full flex flex-col overflow-hidden">
-      {/* Toast */}
-      {toast && (
-        <div className={clsx('mx-4 mt-3 px-4 py-2.5 rounded-lg text-xs font-medium animate-slide-up border shadow-sm',
-          toast.ok ? 'bg-emerald-50 dark:bg-emerald-900/30 text-emerald-700 dark:text-emerald-300 border-emerald-200' : 'bg-red-50 dark:bg-red-900/30 text-red-700 dark:text-red-300 border-red-200')}>
-          {toast.msg}
-        </div>
-      )}
-
       {/* Header */}
       <div className="shrink-0 px-5 py-3 border-b border-gray-200 dark:border-gray-800 flex items-center justify-between">
         <div className="flex items-center gap-3">
diff --git a/web/src/components/Pipeline/PipelineEditor.tsx b/web/src/components/Pipeline/PipelineEditor.tsx
index 8b70146..bd199f4 100644
--- a/web/src/components/Pipeline/PipelineEditor.tsx
+++ b/web/src/components/Pipeline/PipelineEditor.tsx
@@ -3,6 +3,8 @@ import { getPipeline, updatePipeline, resetPipeline, getBlocks, applyPipelinePre
 import { AppContext } from '@/App';
 import type { PipelineConfig, PipelineView, PhaseSpec, GroupMeta, Slot, ExecuteLoop, BlockCatalogEntry, TeamSpec } from '@/types';
 import BlockEditor from '@/components/Blocks/BlockEditor';
+import { useToast } from '@/components/ui/Toast';
+import ErrorState from '@/components/ui/ErrorState';
 import {
   RotateCcw,
   Save,
@@ -80,9 +82,11 @@ interface Notice {
 
 export default function PipelineEditor() {
   const confirm = useConfirm();
+  const toast = useToast();
   const ctx = useContext(AppContext);
   const [pipeline, setPipeline] = useState<PipelineView | null>(null);
   const [loading, setLoading] = useState(true);
+  const [loadError, setLoadError] = useState<unknown>(null);
   const [saving, setSaving] = useState(false);
   const [presets, setPresets] = useState<any[]>([]);
   const [applyingPreset, setApplyingPreset] = useState(false);
@@ -101,8 +105,9 @@ export default function PipelineEditor() {
     try {
       const p = await getPipeline();
       setPipeline(p);
+      setLoadError(null);
     } catch (e) {
-      console.error('Failed to load pipeline:', e);
+      setLoadError(e);
     } finally {
       setLoading(false);
     }
@@ -254,14 +259,20 @@ export default function PipelineEditor() {
       const p = await resetPipeline();
       setPipeline(p);
       setNotice(null);
+      toast.success('Pipeline reset to defaults');
     } catch (e) {
-      console.error(e);
+      toast.reportError(e, 'Could not reset the pipeline');
     }
   };
 
   if (loading) return (
     <div className="flex items-center justify-center h-full"><div className="flex items-center gap-3 text-gray-400"><div className="w-5 h-5 border-2 border-brand-500 border-t-transparent rounded-full animate-spin" />Loading pipeline…</div></div>
   );
+  if (loadError) return (
+    <div className="flex h-full items-center justify-center p-6">
+      <ErrorState error={loadError} what="the pipeline" onRetry={() => { setLoading(true); fetch(); }} className="w-full max-w-md" />
+    </div>
+  );
   if (!pipeline) return (
     <div className="flex items-center justify-center h-full text-gray-400">No pipeline data.</div>
   );
diff --git a/web/src/components/Review/ReviewView.tsx b/web/src/components/Review/ReviewView.tsx
index f0ba161..fe8a6ac 100644
--- a/web/src/components/Review/ReviewView.tsx
+++ b/web/src/components/Review/ReviewView.tsx
@@ -1,10 +1,14 @@
 import { useCallback, useContext, useEffect, useMemo, useState } from 'react';
+import { Link } from 'react-router-dom';
 import {
+  Bot,
   Check,
   CheckCheck,
   Columns2,
   FileDiff,
   FilePlus2,
+  FolderOpen,
+  ListChecks,
   Loader2,
   RefreshCw,
   Rows3,
@@ -25,6 +29,9 @@ import DiffView, { type DiffMode } from './DiffView';
 // to act on that queue was `slmcode apply`, which applies *everything* blind.
 // This is the per-file diff review that was missing.
 
+/** Poll interval while a run is writing, for servers without the SSE nudge. */
+const REVIEW_POLL_MS = 15_000;
+
 export default function ReviewView() {
   const ctx = useContext(AppContext);
   const toast = useToast();
@@ -58,12 +65,27 @@ export default function ReviewView() {
     load();
   }, [load]);
 
-  // A run that writes new pending changes should refresh the queue.
+  // A run that writes new pending changes should refresh the queue — as it
+  // writes them, not only when it stops. The server announces each new patch
+  // with a `review_pending` event; a slow poll covers a server without it.
   const runEnded = ctx?.liveRunning === false;
   useEffect(() => {
     if (runEnded) load({ quiet: true });
   }, [runEnded, load]);
 
+  const events = ctx?.liveEvents;
+  const lastEvent = events && events.length > 0 ? events[events.length - 1] : null;
+  useEffect(() => {
+    if (lastEvent?.kind === 'review_pending') load({ quiet: true });
+  }, [lastEvent, load]);
+
+  const running = ctx?.liveRunning === true;
+  useEffect(() => {
+    if (!running) return undefined;
+    const id = window.setInterval(() => load({ quiet: true }), REVIEW_POLL_MS);
+    return () => window.clearInterval(id);
+  }, [running, load]);
+
   const selected = useMemo(
     () => queue?.items.find((i) => i.id === selectedId) ?? null,
     [queue, selectedId],
@@ -201,7 +223,26 @@ export default function ReviewView() {
             </div>
           )}
           {!loading && queue?.count === 0 && (
-            <p className="px-4 py-6 text-xs text-gray-400">Nothing waiting for review.</p>
+            <div className="px-4 py-6 text-xs text-gray-400">
+              <p className="font-medium text-gray-500 dark:text-gray-300">Nothing waiting for review.</p>
+              {isReviewMode ? (
+                <p className="mt-1">
+                  Every file an agent writes during a run lands here first. Start a run from Live and the
+                  queue fills as they work.
+                </p>
+              ) : (
+                <p className="mt-1">
+                  Agents write directly in <code className="font-mono">{queue?.permission || 'auto'}</code> mode.
+                  Switch permission to <code className="font-mono">review</code> to approve each file here.
+                </p>
+              )}
+              <Link
+                to={isReviewMode ? '/' : '/settings'}
+                className="btn-secondary focus-ring mt-3 inline-flex h-7 items-center gap-1.5 px-2.5 text-[11px]"
+              >
+                {isReviewMode ? 'Start a run' : 'Open Settings'}
+              </Link>
+            </div>
           )}
           <ul>
             {queue?.items.map((item) => (
@@ -228,6 +269,11 @@ export default function ReviewView() {
                       {item.is_new && <span className="mr-1 text-emerald-600">new</span>}
                       <span className="text-emerald-600">+{item.stat.added}</span>{' '}
                       <span className="text-red-600">−{item.stat.removed}</span>
+                      {(item.task_id || item.agent) && (
+                        <span className="ml-1 text-gray-400">
+                          · {[item.task_id, item.agent].filter(Boolean).join(' @')}
+                        </span>
+                      )}
                       {item.error && <span className="ml-1 text-red-600">· {item.error}</span>}
                     </span>
                   </span>
@@ -248,6 +294,41 @@ export default function ReviewView() {
             <>
               <div className="sticky top-0 z-10 flex flex-wrap items-center gap-2 border-b border-gray-200 bg-surface px-4 py-2 dark:border-gray-800">
                 <code className="min-w-0 flex-1 truncate font-mono text-xs">{selected.path}</code>
+                {/* Where the change came from: the task that asked for it and
+                    the agent that wrote it. A diff without an author is a
+                    guess; with one it is a decision. */}
+                {selected.task_id && (
+                  <Link
+                    to={`/?task=${encodeURIComponent(selected.task_id)}`}
+                    className="focus-ring inline-flex items-center gap-1 rounded bg-gray-100 px-1.5 py-0.5 font-mono text-[10px] text-gray-600 hover:text-brand-700 dark:bg-gray-800 dark:text-gray-300"
+                    title="Open the task on the Live panel"
+                  >
+                    <ListChecks size={11} aria-hidden="true" />
+                    {selected.task_id}
+                  </Link>
+                )}
+                {selected.agent && (
+                  <span className="inline-flex items-center gap-1 rounded bg-gray-100 px-1.5 py-0.5 font-mono text-[10px] text-gray-600 dark:bg-gray-800 dark:text-gray-300" title="Agent that proposed the change">
+                    <Bot size={11} aria-hidden="true" />
+                    {selected.agent}
+                  </span>
+                )}
+                {selected.query_id && (
+                  <Link
+                    to={`/runs?run=${encodeURIComponent(selected.query_id)}`}
+                    className="focus-ring font-mono text-[10px] text-gray-400 hover:text-brand-700"
+                    title="Open the run this change belongs to"
+                  >
+                    {selected.query_id}
+                  </Link>
+                )}
+                <Link
+                  to={`/files?path=${encodeURIComponent(selected.path)}`}
+                  className="btn-secondary focus-ring inline-flex items-center gap-1 text-xs"
+                  title="Open the file as it is on disk"
+                >
+                  <FolderOpen size={12} aria-hidden="true" /> Open in Files
+                </Link>
                 <span className="font-mono text-[10px] text-gray-500">{selected.bytes} B</span>
                 <button
                   type="button"
diff --git a/web/src/components/Settings/SettingsPanel.tsx b/web/src/components/Settings/SettingsPanel.tsx
index 890f299..1a0ae68 100644
--- a/web/src/components/Settings/SettingsPanel.tsx
+++ b/web/src/components/Settings/SettingsPanel.tsx
@@ -1,7 +1,8 @@
 import { useState, useContext, useEffect } from 'react';
 import { AppContext } from '@/App';
-import { getAuthStatus, getMCPStatus, putAuthKey, updateConfig } from '@/api/client';
+import { ApiError, getAuthStatus, getMCPStatus, putAuthKey, updateConfig } from '@/api/client';
 import type { AuthStatus, ConfigPatch, MCPStatus } from '@/types';
+import { useToast } from '@/components/ui/Toast';
 import StackSelector from './StackSelector';
 import PackSelector from './PackSelector';
 import ReadinessPanel from './ReadinessPanel';
@@ -22,6 +23,7 @@ import clsx from 'clsx';
 
 export default function SettingsPanel() {
   const ctx = useContext(AppContext);
+  const toast = useToast();
   const [saving, setSaving] = useState(false);
   const [local, setLocal] = useState<ConfigPatch>({});
   const [auth, setAuth] = useState<AuthStatus | null>(null);
@@ -68,9 +70,21 @@ export default function SettingsPanel() {
       await updateConfig(local);
       setLocal({});
       ctx?.refresh();
+      toast.success('Settings saved');
       getAuthStatus().then(setAuth).catch(() => {});
     } catch (e) {
-      console.error('Save failed:', e);
+      // The server answers 409 while a run is active. This used to be a
+      // console.error, so Save appeared to do nothing and the edits stayed
+      // pending with no explanation.
+      if (e instanceof ApiError && e.isConflict) {
+        toast.push({
+          tone: 'warning',
+          title: 'Settings not saved',
+          detail: 'A run is active — stop it before changing the configuration. Your edits are kept.',
+        });
+      } else {
+        toast.reportError(e, 'Could not save settings');
+      }
     } finally {
       setSaving(false);
     }
diff --git a/web/src/components/Skills/SkillManager.tsx b/web/src/components/Skills/SkillManager.tsx
index 3376f0f..5e4d03d 100644
--- a/web/src/components/Skills/SkillManager.tsx
+++ b/web/src/components/Skills/SkillManager.tsx
@@ -15,11 +15,15 @@ import {
 } from 'lucide-react';
 import clsx from 'clsx';
 import { useConfirm } from '@/components/ui/Modal';
+import { useToast } from '@/components/ui/Toast';
+import ErrorState from '@/components/ui/ErrorState';
 
 export default function SkillManager() {
   const confirm = useConfirm();
+  const toast = useToast();
   const [skills, setSkills] = useState<Skill[]>([]);
   const [loading, setLoading] = useState(true);
+  const [loadError, setLoadError] = useState<unknown>(null);
   const [creating, setCreating] = useState(false);
   const [newName, setNewName] = useState('');
   const [newDesc, setNewDesc] = useState('');
@@ -42,8 +46,9 @@ export default function SkillManager() {
     try {
       const list = await getSkills();
       setSkills(list);
+      setLoadError(null);
     } catch (e) {
-      console.error('Failed to load skills:', e);
+      setLoadError(e);
     } finally {
       setLoading(false);
     }
@@ -74,11 +79,11 @@ export default function SkillManager() {
         setAllAgents(deduped);
       })
       .catch((e) => {
-        console.error('Failed to load agents:', e);
+        toast.reportError(e, 'Could not load the agent list for the picker');
         setAllAgents([]);
       })
       .finally(() => setAgentsLoaded(true));
-  }, []);
+  }, [toast]);
 
   const toggleAgent = (selected: string[], id: string): string[] =>
     selected.includes(id) ? selected.filter((a) => a !== id) : [...selected, id];
@@ -197,7 +202,11 @@ export default function SkillManager() {
         body: full.body || '',
       });
     } catch (e) {
-      console.error('Failed to load skill detail:', e);
+      toast.push({
+        tone: 'warning',
+        title: `Editing ${skill.name} from the summary only`,
+        detail: `The full skill could not be loaded (${e instanceof Error ? e.message : String(e)}); the body may be missing.`,
+      });
       setEditForm({
         name: skill.name,
         description: skill.description || '',
@@ -514,11 +523,20 @@ export default function SkillManager() {
           })}
         </div>
 
-        {skills.length === 0 && (
+        {loadError !== null && <ErrorState error={loadError} what="skills" onRetry={fetch} />}
+
+        {!loadError && skills.length === 0 && (
           <div className="text-center py-12 text-gray-400">
             <Puzzle size={48} className="mx-auto mb-3 opacity-50" />
-            <p className="text-sm">No skill packs defined.</p>
-            <p className="text-xs mt-1">Create custom skills that agents can load with @skill:name.</p>
+            <p className="text-sm">No skill packs yet.</p>
+            <p className="text-xs mt-1">
+              A skill is a SKILL.md an agent loads on demand — house rules, a library's quirks, a checklist.
+              Reference one in a prompt with @skill:name, or pin it to an agent.
+            </p>
+            <button type="button" onClick={() => setCreating(true)} className="btn-primary mx-auto mt-4 gap-2 text-sm">
+              <Plus size={14} />
+              Create your first skill
+            </button>
           </div>
         )}
       </div>

From d272d19a7e34620bd10eaf4ded80b9f6aa4ddf9b Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 08:34:05 +0000
Subject: [PATCH 04/23] loop: one reviewer per review, fast-reject on gates,
 resume timed-out workers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The review path was a speculative race: at the default max_parallel it
fanned out to a local "acceptance" probe, the reviewer and reviewer-strict
at once. The probe re-tested a subset of fastPath's conditions with none of
its guards (open criteria, scope, blocking gates, tester role), so a task
fastPath had just declined could be approved "acceptance race won" with no
reviewer; and reviewer-strict was dispatched on every review while its
answer was used only when the primary's was empty. The race is gone:
decideReview is fastPath, then a harness fast-reject (a fired hard gate, or
a worker that finalized blocked with no evidence — the reviewer could not
change either outcome), then ONE reviewer request; reviewer-strict runs
sequentially and only when the primary produced no readable verdict. Every
dispatch goes through execOne, so the runway clamp and the call budget
apply to reviews as they do everywhere else; the speculate primitive keeps
its tests but no longer sits on the review path.

A reviewer transport error no longer blocks the task and cascades to its
dependents: the gathered gate signals are judged first, the reviewer is
re-asked once when budget and runway allow, and otherwise the task goes to
the human backlog as "reviewer unavailable".

Worker failures: a timed-out worker is re-queued to resume from its ReAct
checkpoint while under the attempt ceiling and parked in to_scope only at
the ceiling; transient and rate-limited errors get one bounded retry that
honors Retry-After; the checkpoint is saved before any retry so the retry
resumes instead of cold-starting. The timeout message reports the clamped
per-call budget the request was actually dispatched with.
---
 docs/agents.md                    |   2 +-
 pkg/loop/budget.go                |   9 -
 pkg/loop/review_path_test.go      | 488 ++++++++++++++++++++++++++
 pkg/loop/runner.go                | 561 ++++++++++++++++++++----------
 pkg/loop/runner_test.go           |   4 +
 pkg/loop/speculate.go             |  23 +-
 pkg/loop/speculate_cancel_test.go |  34 +-
 pkg/loop/speculate_test.go        |  25 +-
 pkg/loop/wiring_test.go           |  69 +++-
 9 files changed, 955 insertions(+), 260 deletions(-)
 create mode 100644 pkg/loop/review_path_test.go

diff --git a/docs/agents.md b/docs/agents.md
index 46049ce..7476d02 100644
--- a/docs/agents.md
+++ b/docs/agents.md
@@ -34,7 +34,7 @@ see <a href="providers.md">Providers</a>. Budget diplomacy is a feature.
 | `escalate` | — | action JSON | HITL timeout arbitrator (retry/re-scope/…) ⚖️ |
 | `memory` | — | bullets | Learn 💾 |
 | `composer` | — | pipeline JSON | Assemble a task-specific pipeline (dynamic_pipeline) 🎯 |
-| `reviewer-strict` | — | approve JSON | Second opinion in the speculative review race (`max_parallel >= 3`), temperature 0 🔍🔍 |
+| `reviewer-strict` | — | approve JSON | Sequential second opinion, asked only when `reviewer` returns no readable verdict; temperature 0 🔍🔍 |
 | `describer` | — | prose | Architect half of the describer→editor pair (`architect_editor`) 🗣️ |
 | `editor` | ✅ + `find_models` / `mcp_call` | status | Editor half: applies a described change, minimal reasoning, strict format ✍️ |
 
diff --git a/pkg/loop/budget.go b/pkg/loop/budget.go
index 232ad85..2df3e0e 100644
--- a/pkg/loop/budget.go
+++ b/pkg/loop/budget.go
@@ -206,15 +206,6 @@ func (r *Runner) spend(taskID, what string) bool {
 	return false
 }
 
-// noteExtraRequests records LLM round-trips a task issued beyond the budget
-// units it spent — the extra speculative slots of a review race.
-func (r *Runner) noteExtraRequests(taskID string, n int) {
-	if r == nil {
-		return
-	}
-	r.budget().note(taskID, n)
-}
-
 // budgetExhausted reports whether a task has no calls left.
 func (r *Runner) budgetExhausted(taskID string) bool {
 	return r != nil && taskID != "" && r.budget().remaining(taskID) == 0
diff --git a/pkg/loop/review_path_test.go b/pkg/loop/review_path_test.go
new file mode 100644
index 0000000..74a9857
--- /dev/null
+++ b/pkg/loop/review_path_test.go
@@ -0,0 +1,488 @@
+package loop
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/UnicoLab/slmcode/pkg/backends"
+	"github.com/UnicoLab/slmcode/pkg/plan"
+	"github.com/UnicoLab/slmcode/pkg/session"
+	ggagent "github.com/piotrlaczkowski/GoLangGraph/pkg/agent"
+	"github.com/piotrlaczkowski/GoLangGraph/pkg/llm"
+)
+
+// ── the reviewer is not asked when its answer could not matter ─────────────
+
+// TestFastRejectSkipsTheReviewerOnAHardGateFailure: a FAILED deterministic
+// smoke is a rejection whatever the reviewer says — applyHardGates overturns
+// an approval in that state — so the reviewer request is pure cost. The verdict
+// must be the gate's own words.
+func TestFastRejectSkipsTheReviewerOnAHardGateFailure(t *testing.T) {
+	root := t.TempDir()
+	if err := os.WriteFile(filepath.Join(root, "a.go"), []byte("package p\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	exec := &scriptedExec{answer: func(ggagent.SubAgentRequest, int) string {
+		return `{"approved":true,"score":95,"summary":"looks fine"}`
+	}}
+	r := defaultRunner(t, root, exec)
+	task := plan.Task{
+		ID: "T1", Title: "Update a", Role: plan.RoleWorker, Column: plan.ColInReview,
+		Description: "update the greeting in a.go", Acceptance: "greeting updated",
+		Files: []string{"a.go"},
+		Output: `{"status":"done","summary":"updated","files_changed":["a.go"]}` +
+			failingSmokeSection("go test ./...", "--- FAIL: TestGreeting"),
+	}
+	g := r.gatherGateSignals(context.Background(), &task, r.snapshotTargets(task))
+	if !g.smokeFail || !g.blocking() {
+		t.Fatalf("fixture does not trip the smoke gate: %+v", g)
+	}
+	review, raw, err := r.decideReview(context.Background(), task, g)
+	if err != nil {
+		t.Fatalf("decideReview: %v", err)
+	}
+	if n := exec.total(); n != 0 {
+		t.Fatalf("%d LLM request(s) were made for a verdict the gate had already decided", n)
+	}
+	if review.Approved || raw != "" {
+		t.Fatalf("hard gate failure was not a rejection: approved=%v raw=%q", review.Approved, raw)
+	}
+	summary, issue := g.rejectReason()
+	if review.Summary != summary {
+		t.Fatalf("summary = %q, want the gate's own %q", review.Summary, summary)
+	}
+	if len(review.Issues) != 1 || review.Issues[0] != issue {
+		t.Fatalf("issues = %v, want [%q]", review.Issues, issue)
+	}
+}
+
+// TestFastRejectUsesTheWorkersOwnBlockedSummary: a worker that finalized with
+// status blocked and left nothing on disk has already said what a rejection
+// would say. Its summary is the verdict; no reviewer is consulted.
+func TestFastRejectUsesTheWorkersOwnBlockedSummary(t *testing.T) {
+	root := t.TempDir()
+	if err := os.WriteFile(filepath.Join(root, "a.go"), []byte("package p\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	exec := &scriptedExec{answer: func(ggagent.SubAgentRequest, int) string {
+		return `{"approved":true,"score":95,"summary":"looks fine"}`
+	}}
+	r := defaultRunner(t, root, exec)
+	task := plan.Task{
+		ID: "T1", Title: "Update a", Role: plan.RoleWorker, Column: plan.ColInReview,
+		Description: "update the greeting in a.go", Acceptance: "greeting updated",
+		Files:  []string{"a.go"},
+		Output: `{"status":"blocked","summary":"the greeting constant is defined in a file outside my scope","files_changed":[]}`,
+	}
+	g := r.gatherGateSignals(context.Background(), &task, r.snapshotTargets(task))
+	review, _, err := r.decideReview(context.Background(), task, g)
+	if err != nil {
+		t.Fatalf("decideReview: %v", err)
+	}
+	if n := exec.total(); n != 0 {
+		t.Fatalf("%d LLM request(s) were made to reject a worker that rejected itself", n)
+	}
+	if review.Approved {
+		t.Fatal("a blocked worker with no evidence was approved")
+	}
+	if !strings.Contains(review.Summary, "outside my scope") ||
+		len(review.Issues) != 1 || !strings.Contains(review.Issues[0], "outside my scope") {
+		t.Fatalf("verdict does not carry the worker's own words: summary=%q issues=%v",
+			review.Summary, review.Issues)
+	}
+	// A tester's failing command is its finding, not a defect: never fast-rejected.
+	tester := task
+	tester.Role = plan.RoleTester
+	if _, ok := g.fastReject(tester); ok {
+		t.Fatal("a tester was fast-rejected")
+	}
+}
+
+// ── a reviewer transport error is not a verdict on the work ────────────────
+
+// flakyReviewerExec fails the first N reviewer calls with a transport error and
+// answers every later one; workers answer prose with no status JSON and no
+// write, so nothing but the reviewer can approve the task.
+type flakyReviewerExec struct {
+	mu             sync.Mutex
+	reviewerErrors int
+	reviewerCalls  int
+	workerCalls    int
+}
+
+func (e *flakyReviewerExec) ExecuteSubAgents(_ context.Context, reqs []ggagent.SubAgentRequest,
+	_ *ggagent.SharedState) ([]ggagent.SubAgentResult, error) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	out := make([]ggagent.SubAgentResult, len(reqs))
+	for i, req := range reqs {
+		if strings.Contains(req.AgentID, "review") {
+			e.reviewerCalls++
+			if e.reviewerCalls <= e.reviewerErrors {
+				out[i] = ggagent.SubAgentResult{AgentID: req.AgentID, TaskID: req.TaskID,
+					Error: errors.New("chat failed: Post \"http://127.0.0.1:1/v1/chat/completions\": " +
+						"dial tcp 127.0.0.1:1: connect: connection refused")}
+				continue
+			}
+			out[i] = ggagent.SubAgentResult{AgentID: req.AgentID, TaskID: req.TaskID,
+				Output: `{"approved":true,"score":90,"summary":"findings are sound"}`}
+			continue
+		}
+		e.workerCalls++
+		out[i] = ggagent.SubAgentResult{AgentID: req.AgentID, TaskID: req.TaskID,
+			Output: "Findings: the parser already handles UTF-8 input correctly; no change is needed."}
+	}
+	return out, nil
+}
+
+func (e *flakyReviewerExec) counts() (int, int) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	return e.reviewerCalls, e.workerCalls
+}
+
+// investigationTask is a task the evidence gate does not require a write for,
+// so the reviewer's verdict is the only thing standing between it and done.
+func investigationTask(id string, deps ...string) plan.Task {
+	return plan.Task{
+		ID: id, Title: "Investigate the parser", Role: plan.RoleWorker, Column: plan.ColReadyToDev,
+		Description: "Report whether the parser handles UTF-8 input.", Acceptance: "findings reported",
+		Files: []string{"parser.go"}, DependsOn: deps,
+	}
+}
+
+func TestReviewerTransportErrorDoesNotBlockTheTask(t *testing.T) {
+	t.Run("one error: the reviewer is asked once more", func(t *testing.T) {
+		root := t.TempDir()
+		if err := os.WriteFile(filepath.Join(root, "parser.go"), []byte("package p\n"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		exec := &flakyReviewerExec{reviewerErrors: 1}
+		r := defaultRunner(t, root, exec)
+		r.MaxRetries = 0
+		board := &plan.Board{Tasks: []plan.Task{investigationTask("T1")}}
+		if err := r.RunBoard(context.Background(), board); err != nil {
+			t.Fatalf("RunBoard: %v", err)
+		}
+		got, _ := board.Get("T1")
+		if got.Column == plan.ColBlocked {
+			t.Fatalf("a reviewer transport error blocked the task: %+v", got)
+		}
+		if got.Column != plan.ColDone {
+			t.Fatalf("T1 column=%s error=%q, want done after the re-ask", got.Column, got.Error)
+		}
+		if reviews, _ := exec.counts(); reviews != 2 {
+			t.Fatalf("reviewer requests=%d, want exactly 2 (the failed one and one re-ask)", reviews)
+		}
+	})
+
+	t.Run("reviewer down for good: human backlog, dependents untouched", func(t *testing.T) {
+		root := t.TempDir()
+		if err := os.WriteFile(filepath.Join(root, "parser.go"), []byte("package p\n"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		exec := &flakyReviewerExec{reviewerErrors: 1 << 20}
+		r := defaultRunner(t, root, exec)
+		r.MaxRetries = 0
+		board := &plan.Board{Tasks: []plan.Task{investigationTask("T1"), investigationTask("T2", "T1")}}
+		_ = r.RunBoard(context.Background(), board)
+		t1, _ := board.Get("T1")
+		if t1.Column == plan.ColBlocked {
+			t.Fatalf("a reviewer outage blocked the task: %+v", t1)
+		}
+		if t1.Column != plan.ColToScope || !strings.Contains(t1.Error, "reviewer unavailable") {
+			t.Fatalf("T1 column=%s error=%q, want to_scope with a reviewer-unavailable reason",
+				t1.Column, t1.Error)
+		}
+		t2, _ := board.Get("T2")
+		if t2.Column != plan.ColReadyToDev {
+			t.Fatalf("dependent T2 column=%s error=%q, want ready_to_dev — nothing judged T1's work",
+				t2.Column, t2.Error)
+		}
+		if reviews, _ := exec.counts(); reviews != 2 {
+			t.Fatalf("reviewer requests=%d, want exactly 2 (one re-ask, then escalate)", reviews)
+		}
+	})
+}
+
+// ── a timed-out worker resumes; a transient error retries ───────────────────
+
+// timeoutThenResumeExec times the first worker call out mid-ReAct (with a
+// transcript, as the real executor returns one) and finishes the task on the
+// second — but only from the restored transcript, never from a cold start.
+type timeoutThenResumeExec struct {
+	mu          sync.Mutex
+	root        string
+	workerCalls int
+	sawResume   bool
+	coldRestart bool
+}
+
+func (e *timeoutThenResumeExec) ExecuteSubAgents(_ context.Context, reqs []ggagent.SubAgentRequest,
+	_ *ggagent.SharedState) ([]ggagent.SubAgentResult, error) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	out := make([]ggagent.SubAgentResult, len(reqs))
+	for i, req := range reqs {
+		if strings.Contains(req.AgentID, "review") {
+			out[i] = ggagent.SubAgentResult{AgentID: req.AgentID, TaskID: req.TaskID,
+				Output: `{"approved":true,"score":90,"summary":"ok"}`}
+			continue
+		}
+		e.workerCalls++
+		if e.workerCalls == 1 {
+			msgs := []llm.Message{
+				{Role: "user", Content: req.Input},
+				{Role: "assistant", Content: "editing a.go", ToolCalls: []llm.ToolCall{{
+					ID: "call_1", Type: "function",
+					Function: llm.FunctionCall{Name: "ws_edit", Arguments: `{"path":"a.go"}`},
+				}}},
+			}
+			out[i] = ggagent.SubAgentResult{
+				AgentID: req.AgentID, TaskID: req.TaskID,
+				Messages: msgs, Iteration: 3, PendingToolCalls: msgs[1].ToolCalls,
+				Error: context.DeadlineExceeded,
+			}
+			continue
+		}
+		if req.Resume && len(req.Messages) >= 2 {
+			e.sawResume = true
+		} else {
+			e.coldRestart = true
+		}
+		_ = os.WriteFile(filepath.Join(e.root, "a.go"), []byte("package main\n\nconst Greeting = \"hi\"\n"), 0o644)
+		out[i] = ggagent.SubAgentResult{AgentID: req.AgentID, TaskID: req.TaskID,
+			Output: `{"status":"done","summary":"resumed and finished","files_changed":["a.go"]}`}
+	}
+	return out, nil
+}
+
+func TestTimedOutWorkerIsResumedNotParked(t *testing.T) {
+	root := t.TempDir()
+	slm := filepath.Join(root, ".slmcode")
+	_ = os.MkdirAll(slm, 0o755)
+	if err := os.WriteFile(filepath.Join(root, "a.go"), []byte("package main\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	turn, err := session.BeginTurn(slm, "run-timeout-1", "update the greeting")
+	if err != nil {
+		t.Fatal(err)
+	}
+	exec := &timeoutThenResumeExec{root: root}
+	r := defaultRunner(t, root, exec)
+	r.SlmDir = slm
+	r.TurnID = turn.ID
+	r.MaxRetries = 0
+	r.Timeout = time.Second
+	var logs []string
+	r.Log = func(format string, args ...interface{}) { logs = append(logs, fmt.Sprintf(format, args...)) }
+	timeoutInterventions := 0
+	r.OnEvent = func(kind, _, _, _, scope, _ string) {
+		if kind == "intervention" && scope == "timeout" {
+			timeoutInterventions++
+		}
+	}
+	board := &plan.Board{QueryID: turn.ID, Query: turn.Query, Tasks: []plan.Task{{
+		ID: "T1", Title: "update the greeting", Role: plan.RoleWorker, Column: plan.ColReadyToDev,
+		Description: "update the greeting in a.go", Acceptance: "greeting updated",
+		Files: []string{"a.go"},
+	}}}
+	if err := r.RunBoard(context.Background(), board); err != nil {
+		t.Fatalf("RunBoard: %v\n%s", err, strings.Join(logs, "\n"))
+	}
+	got, _ := board.Get("T1")
+	if got.Column != plan.ColDone {
+		t.Fatalf("T1 column=%s error=%q — a first-attempt timeout must be retried, not parked\n%s",
+			got.Column, got.Error, strings.Join(logs, "\n"))
+	}
+	if exec.workerCalls != 2 {
+		t.Fatalf("worker calls=%d, want 2 (the timeout and the resumed retry)", exec.workerCalls)
+	}
+	if !exec.sawResume || exec.coldRestart {
+		t.Fatalf("the retry did not resume from the checkpoint: sawResume=%v cold=%v",
+			exec.sawResume, exec.coldRestart)
+	}
+	if timeoutInterventions != 0 {
+		t.Fatalf("%d timeout intervention(s) raised for a retry the harness handled itself", timeoutInterventions)
+	}
+	if !strings.Contains(got.Notes, "RETRY-AFTER-TIMEOUT") {
+		t.Fatalf("the retry left no note on the task: %q", got.Notes)
+	}
+}
+
+// TestTimedOutWorkerParksOnlyAtTheAttemptCeiling: with a ceiling of two, a
+// worker that times out every time is dispatched exactly twice and then parked.
+func TestTimedOutWorkerParksOnlyAtTheAttemptCeiling(t *testing.T) {
+	root := t.TempDir()
+	exec := &timeoutExec{}
+	r := defaultRunner(t, root, exec)
+	r.MaxRetries = 0
+	r.MaxTaskAttempts = 2
+	r.Timeout = time.Second
+	board := &plan.Board{Tasks: []plan.Task{{
+		ID: "T1", Title: "one", Role: plan.RoleWorker, Column: plan.ColReadyToDev, Files: []string{"a.go"},
+	}}}
+	if err := r.RunBoard(context.Background(), board); err != nil {
+		t.Fatalf("RunBoard: %v", err)
+	}
+	if got := exec.callCount(); got != 2 {
+		t.Fatalf("executor calls=%d, want 2 (ceiling)", got)
+	}
+	got, _ := board.Get("T1")
+	if got.Column != plan.ColToScope || !strings.Contains(got.Error, "timed out") {
+		t.Fatalf("T1 at the ceiling: column=%s error=%q, want to_scope with a timeout reason", got.Column, got.Error)
+	}
+}
+
+// transientThenOKExec fails the first worker call with a connection-level
+// error, then succeeds.
+type transientThenOKExec struct {
+	mu          sync.Mutex
+	root        string
+	first       error
+	workerCalls int
+}
+
+func (e *transientThenOKExec) ExecuteSubAgents(_ context.Context, reqs []ggagent.SubAgentRequest,
+	_ *ggagent.SharedState) ([]ggagent.SubAgentResult, error) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	out := make([]ggagent.SubAgentResult, len(reqs))
+	for i, req := range reqs {
+		if strings.Contains(req.AgentID, "review") {
+			out[i] = ggagent.SubAgentResult{AgentID: req.AgentID, TaskID: req.TaskID,
+				Output: `{"approved":true,"score":90,"summary":"ok"}`}
+			continue
+		}
+		e.workerCalls++
+		if e.workerCalls == 1 {
+			out[i] = ggagent.SubAgentResult{AgentID: req.AgentID, TaskID: req.TaskID, Error: e.first}
+			continue
+		}
+		_ = os.WriteFile(filepath.Join(e.root, "a.go"), []byte("package main\n\nconst Greeting = \"hi\"\n"), 0o644)
+		out[i] = ggagent.SubAgentResult{AgentID: req.AgentID, TaskID: req.TaskID,
+			Output: `{"status":"done","summary":"second try","files_changed":["a.go"]}`}
+	}
+	return out, nil
+}
+
+func TestTransientWorkerErrorIsRetriedOnceBeforeBlocking(t *testing.T) {
+	newBoard := func() *plan.Board {
+		return &plan.Board{Tasks: []plan.Task{{
+			ID: "T1", Title: "update the greeting", Role: plan.RoleWorker, Column: plan.ColReadyToDev,
+			Description: "update the greeting in a.go", Acceptance: "greeting updated",
+			Files: []string{"a.go"},
+		}}}
+	}
+	t.Run("connection refused is retried and the retry lands", func(t *testing.T) {
+		root := t.TempDir()
+		_ = os.WriteFile(filepath.Join(root, "a.go"), []byte("package main\n"), 0o644)
+		exec := &transientThenOKExec{root: root, first: errors.New(
+			"chat failed: Post \"http://127.0.0.1:1/v1/chat/completions\": dial tcp 127.0.0.1:1: connect: connection refused")}
+		if !backends.Classify(exec.first).Retryable() {
+			t.Fatal("fixture error is not classified as retryable")
+		}
+		r := defaultRunner(t, root, exec)
+		r.MaxRetries = 0
+		board := newBoard()
+		if err := r.RunBoard(context.Background(), board); err != nil {
+			t.Fatalf("RunBoard: %v", err)
+		}
+		got, _ := board.Get("T1")
+		if got.Column != plan.ColDone {
+			t.Fatalf("T1 column=%s error=%q, want done after one transient retry", got.Column, got.Error)
+		}
+		if exec.workerCalls != 2 {
+			t.Fatalf("worker calls=%d, want 2", exec.workerCalls)
+		}
+	})
+	t.Run("an unclassifiable error still blocks without a retry", func(t *testing.T) {
+		root := t.TempDir()
+		_ = os.WriteFile(filepath.Join(root, "a.go"), []byte("package main\n"), 0o644)
+		exec := &transientThenOKExec{root: root, first: errors.New("the model exploded")}
+		if backends.Classify(exec.first).Retryable() {
+			t.Fatal("fixture error is unexpectedly retryable")
+		}
+		r := defaultRunner(t, root, exec)
+		r.MaxRetries = 0
+		board := newBoard()
+		_ = r.RunBoard(context.Background(), board)
+		got, _ := board.Get("T1")
+		if got.Column != plan.ColBlocked {
+			t.Fatalf("T1 column=%s, want blocked", got.Column)
+		}
+		if exec.workerCalls != 1 {
+			t.Fatalf("worker calls=%d, want 1 (no retry for a permanent failure)", exec.workerCalls)
+		}
+	})
+}
+
+func TestTransientRetryDelayHonorsRetryAfterWithinACap(t *testing.T) {
+	cases := []struct {
+		name string
+		c    backends.Classification
+		want time.Duration
+	}{
+		{"plain transient waits nothing", backends.Classification{Class: backends.ClassTransient}, 0},
+		{"429 without a hint pauses briefly", backends.Classification{Class: backends.ClassRateLimited}, time.Second},
+		{"Retry-After is honored", backends.Classification{Class: backends.ClassRateLimited, RetryAfter: 4 * time.Second}, 4 * time.Second},
+		{"a long hint is capped", backends.Classification{Class: backends.ClassTransient, RetryAfter: 5 * time.Minute}, maxTransientRetryDelay},
+	}
+	for _, tc := range cases {
+		if got := transientRetryDelay(tc.c); got != tc.want {
+			t.Errorf("%s: delay=%s want %s", tc.name, got, tc.want)
+		}
+	}
+}
+
+// ── every dispatch is clamped to the runway ─────────────────────────────────
+
+// TestEveryDispatchTimeoutFitsTheRunway drives worker, reviewer and corrector
+// under a 30-second run deadline with a 12-minute task timeout, and checks the
+// timeout handed to the executor for EVERY request against what the runway
+// allows once the finish reserve is held back.
+func TestEveryDispatchTimeoutFitsTheRunway(t *testing.T) {
+	root := t.TempDir()
+	if err := os.WriteFile(filepath.Join(root, "a.go"), []byte("package main\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	exec := &scriptedExec{answer: func(req ggagent.SubAgentRequest, _ int) string {
+		if strings.Contains(req.AgentID, "review") {
+			return `{"approved":false,"score":30,"summary":"no test was added"}`
+		}
+		return `{"status":"done","summary":"claims only","files_changed":["a.go"]}`
+	}}
+	r := defaultRunner(t, root, exec)
+	r.Timeout = 12 * time.Minute
+	r.MaxRetries = 1
+	const runway = 30 * time.Second
+	ctx, cancel := context.WithTimeout(context.Background(), runway)
+	defer cancel()
+	board := &plan.Board{Tasks: []plan.Task{{
+		ID: "T1", Title: "update the greeting", Role: plan.RoleWorker, Column: plan.ColReadyToDev,
+		Description: "update the greeting in a.go", Acceptance: "greeting updated",
+		Files: []string{"a.go"},
+	}}}
+	_ = r.RunBoard(ctx, board)
+
+	usable := runway - runway/loopFinishReserveDivisor
+	if exec.countFor(plan.RoleReviewer) == 0 || exec.countFor(plan.RoleCorrector) == 0 {
+		t.Fatalf("the fixture did not exercise review and correction: %d reviewer, %d corrector requests",
+			exec.countFor(plan.RoleReviewer), exec.countFor(plan.RoleCorrector))
+	}
+	exec.mu.Lock()
+	defer exec.mu.Unlock()
+	for _, req := range exec.reqs {
+		if req.Timeout <= 0 || req.Timeout > usable {
+			t.Errorf("%s request timeout %s exceeds the %s the runway allows (task_timeout=%s)",
+				req.AgentID, req.Timeout, usable, r.Timeout)
+		}
+	}
+}
diff --git a/pkg/loop/runner.go b/pkg/loop/runner.go
index 48c7589..61a15e4 100644
--- a/pkg/loop/runner.go
+++ b/pkg/loop/runner.go
@@ -1307,7 +1307,11 @@ func (r *Runner) collectWaveResults(ctx context.Context, board *plan.Board, ws *
 		t.Output = outputString(res)
 
 		if isTimeoutResult(execErr, res) {
-			r.handleTaskTimeout(board, *t, role, res, timeoutErr(execErr, res))
+			var budget time.Duration
+			if j < len(reqs) {
+				budget = reqs[j].Timeout
+			}
+			r.handleTaskTimeout(ctx, board, *t, role, res, timeoutErr(execErr, res), budget)
 			continue
 		}
 		// Per-RESULT, not per-wave: execErr is the first error across the whole
@@ -1394,41 +1398,38 @@ func (r *Runner) handleTaskCancel(board *plan.Board, t *plan.Task, role string,
 		strings.Join(t.Files, ", "), t.Error, stream.LevelWarn)
 }
 
-// recoverWaveError handles a failed worker result. A context overflow shrinks
-// the pack and retries once; anything else blocks the task. The overflow test
-// is backends.IsContextOverflow, which classifies the provider's error rather
-// than pattern-matching a generic HTTP 400.
+// recoverWaveError handles a failed worker result.
+//
+// The conversation is checkpointed FIRST, so every retry below resumes it via
+// applyResumeRequest instead of cold-starting the task: the overflow retry used
+// to save the checkpoint only after it had already re-dispatched, so the one
+// attempt that most needed the transcript never had it.
+//
+// Then, by what backends.Classify says the error is: a context overflow shrinks
+// the pack and retries once; a transient or rate-limited failure — the classes
+// Classify marks Retryable — retries once after the server's Retry-After;
+// anything else blocks the task. Classify reads the provider's own error
+// rather than pattern-matching a generic HTTP 400.
 func (r *Runner) recoverWaveError(ctx context.Context, board *plan.Board, t *plan.Task,
 	role string, res ggagent.SubAgentResult, execErr error) (ggagent.SubAgentResult, bool) {
+	if len(res.Messages) > 0 {
+		r.saveReactFromResult(t.ID, role, res)
+	}
 	class := backends.Classify(res.Error)
-	overflow := backends.IsContextOverflow(res.Error)
-	if overflow && r.OnOverflowCompact != nil {
-		r.logf("%s context overflow (%s) — compacting and retrying once", t.ID, class.Class)
-		adv := r.noteFailure(evolve.Signal{
-			Message: res.Error.Error(), Phase: "execute", Role: role,
-			Language: detectSignalLanguage(r.Root),
-		}, "")
-		if cerr := r.OnOverflowCompact(ctx); cerr != nil {
-			r.logf("%s overflow compact: %v", t.ID, cerr)
-		} else {
-			retryReq := ggagent.SubAgentRequest{
-				AgentID: role, Input: r.taskInputFor(board, *t), Timeout: r.callTimeout(ctx),
-				ShareState: true, TaskID: t.ID,
-			}
-			if r.applyResumeRequest(&retryReq, t.ID) {
-				r.ResumedReact = true
-			}
-			retryRes, ok := r.execOne(ctx, t.ID, "overflow retry", retryReq)
-			if ok && retryRes.Error == nil && strings.TrimSpace(outputString(retryRes)) != "" {
-				r.noteResolved(adv, "context compacted, retried once")
-				return retryRes, true
-			}
-			if ok && retryRes.Error != nil {
-				r.logf("%s overflow retry still failed: %v", t.ID, retryRes.Error)
-				res = retryRes
-			}
+	switch {
+	case backends.IsContextOverflow(res.Error) && r.OnOverflowCompact != nil:
+		if retried, ok := r.retryAfterOverflow(ctx, board, t, role, res, class); ok {
+			return retried, true
+		} else if retried.Error != nil {
+			res = retried
+		}
+	case res.Error != nil && class.Retryable() && !r.runwaySpent(ctx):
+		if retried, ok := r.retryAfterTransient(ctx, board, t, role, res, class); ok {
+			return retried, true
+		} else if retried.Error != nil {
+			res = retried
 		}
-	} else if res.Error != nil {
+	case res.Error != nil:
 		r.noteFailure(evolve.Signal{
 			Message: res.Error.Error(), Phase: "execute", Role: role,
 			Language: detectSignalLanguage(r.Root),
@@ -1453,6 +1454,100 @@ func (r *Runner) recoverWaveError(ctx context.Context, board *plan.Board, t *pla
 	return res, false
 }
 
+// retryAfterOverflow compacts the task's context and re-dispatches the worker
+// once. It returns the retry's result and whether it produced a usable answer;
+// a retry that failed again is returned with its own error so the caller
+// blocks the task on the fresher failure.
+func (r *Runner) retryAfterOverflow(ctx context.Context, board *plan.Board, t *plan.Task,
+	role string, res ggagent.SubAgentResult, class backends.Classification) (ggagent.SubAgentResult, bool) {
+	r.logf("%s context overflow (%s) — compacting and retrying once", t.ID, class.Class)
+	adv := r.noteFailure(evolve.Signal{
+		Message: res.Error.Error(), Phase: "execute", Role: role,
+		Language: detectSignalLanguage(r.Root),
+	}, "")
+	if cerr := r.OnOverflowCompact(ctx); cerr != nil {
+		r.logf("%s overflow compact: %v", t.ID, cerr)
+		return res, false
+	}
+	retryRes, ok := r.redispatch(ctx, board, t, role, "overflow retry")
+	if ok && retryRes.Error == nil && strings.TrimSpace(outputString(retryRes)) != "" {
+		r.noteResolved(adv, "context compacted, retried once")
+		return retryRes, true
+	}
+	if ok && retryRes.Error != nil {
+		r.logf("%s overflow retry still failed: %v", t.ID, retryRes.Error)
+		return retryRes, false
+	}
+	return res, false
+}
+
+// maxTransientRetryDelay caps the wait a Retry-After hint can impose before the
+// one transient retry: a hint of minutes would spend the runway on waiting.
+const maxTransientRetryDelay = 30 * time.Second
+
+// transientRetryDelay is how long to wait before the transient retry: the
+// server's Retry-After when it sent one, a short pause for a 429 that sent
+// none, nothing for a plain connection failure.
+func transientRetryDelay(c backends.Classification) time.Duration {
+	wait := c.RetryAfter
+	if wait <= 0 && c.Class == backends.ClassRateLimited {
+		wait = time.Second
+	}
+	if wait > maxTransientRetryDelay {
+		wait = maxTransientRetryDelay
+	}
+	return wait
+}
+
+// retryAfterTransient re-dispatches a worker ONCE after a transport-level or
+// rate-limit failure, honoring the server's Retry-After.
+//
+// A local inference server that has just finished loading a model refuses
+// connections for a few seconds; a shared endpoint answers 429 under load. The
+// old path classified both and then blocked the task anyway, cascading the
+// block to every dependent, over a failure the classifier had already said was
+// worth one more attempt.
+func (r *Runner) retryAfterTransient(ctx context.Context, board *plan.Board, t *plan.Task,
+	role string, res ggagent.SubAgentResult, class backends.Classification) (ggagent.SubAgentResult, bool) {
+	r.logf("%s %s failure (%v) — retrying once", t.ID, class.Class, res.Error)
+	adv := r.noteFailure(evolve.Signal{
+		Message: res.Error.Error(), Phase: "execute", Role: role,
+		Language: detectSignalLanguage(r.Root),
+	}, "")
+	if wait := transientRetryDelay(class); wait > 0 {
+		r.logf("%s waiting %s before the retry (Retry-After)", t.ID, wait)
+		select {
+		case <-ctx.Done():
+			return res, false
+		case <-time.After(wait):
+		}
+	}
+	retryRes, ok := r.redispatch(ctx, board, t, role, "transient retry")
+	if ok && retryRes.Error == nil && strings.TrimSpace(outputString(retryRes)) != "" {
+		r.noteResolved(adv, "transient failure, retried once")
+		return retryRes, true
+	}
+	if ok && retryRes.Error != nil {
+		r.logf("%s transient retry still failed: %v", t.ID, retryRes.Error)
+		return retryRes, false
+	}
+	return res, false
+}
+
+// redispatch sends a task to its worker again, resuming from the ReAct
+// checkpoint when one exists, under the runway-clamped call budget.
+func (r *Runner) redispatch(ctx context.Context, board *plan.Board, t *plan.Task, role, what string) (
+	ggagent.SubAgentResult, bool) {
+	req := ggagent.SubAgentRequest{
+		AgentID: role, Input: r.taskInputFor(board, *t), Timeout: r.callTimeout(ctx),
+		ShareState: true, TaskID: t.ID,
+	}
+	if r.applyResumeRequest(&req, t.ID) {
+		r.ResumedReact = true
+	}
+	return r.execOne(ctx, t.ID, what, req)
+}
+
 // driveCritique refines every weak task, in parallel when there is more than one.
 func (r *Runner) driveCritique(ctx context.Context, board *plan.Board, ws *waveState) {
 	if len(ws.weak) == 0 {
@@ -1507,7 +1602,20 @@ func (r *Runner) driveReview(ctx context.Context, board *plan.Board, ws *waveSta
 	return canceled
 }
 
-func (r *Runner) handleTaskTimeout(board *plan.Board, t plan.Task, role string, res ggagent.SubAgentResult, err error) {
+// handleTaskTimeout handles a worker that ran out of its per-call budget.
+//
+// budget is the timeout the request was actually dispatched with — the
+// runway-clamped callTimeout, not r.Timeout — so the message says how long the
+// worker really had.
+//
+// A timed-out worker is not a failed one: measured, it is most often a worker
+// midway through a long tool loop whose checkpoint is already on disk. Under
+// the attempt ceiling and with runway left, the task goes back to ready_to_dev
+// and the next wave RESUMES it from that checkpoint (applyResumeRequest)
+// instead of parking it for a human on the first attempt. Only at the ceiling,
+// or with no runway left to spend on it, does it park in to_scope.
+func (r *Runner) handleTaskTimeout(ctx context.Context, board *plan.Board, t plan.Task, role string,
+	res ggagent.SubAgentResult, err error, budget time.Duration) {
 	if err == nil {
 		err = context.DeadlineExceeded
 	}
@@ -1516,11 +1624,33 @@ func (r *Runner) handleTaskTimeout(board *plan.Board, t plan.Task, role string,
 	}
 	scope := strings.Join(t.Files, ", ")
 	baseOut := strings.TrimSpace(outputString(res))
-	after := r.Timeout
-	if after <= 0 {
-		after = 12 * time.Minute
+	if budget <= 0 {
+		budget = r.callTimeout(ctx)
+	}
+	if budget <= 0 {
+		budget = 12 * time.Minute
+	}
+	timeoutMsg := fmt.Sprintf("task timed out after %s: %s", budget.Round(time.Second), err.Error())
+
+	attempt := r.waveAttempts.get(t.ID)
+	ceiling := r.maxTaskAttempts()
+	if attempt < ceiling && !r.runwaySpent(ctx) {
+		note := fmt.Sprintf("RETRY-AFTER-TIMEOUT: attempt %d timed out after %s; re-queued to resume "+
+			"from the ReAct checkpoint (attempt %d of %d).",
+			attempt, budget.Round(time.Second), attempt+1, ceiling)
+		t.Output = strings.TrimSpace(baseOut + "\n\n## Harness timeout\n" + note)
+		t.Error = ""
+		t.Notes = strings.TrimSpace(t.Notes + "\n" + note)
+		t.MoveTo(plan.ColReadyToDev)
+		board.UpdateTask(t)
+		r.persist(board)
+		r.logf("%s %s", t.ID, note)
+		r.fireLevel(stream.KindAgentEnd, role, t.ID,
+			fmt.Sprintf("timed out — re-queued to resume (attempt %d/%d)", attempt+1, ceiling),
+			scope, timeoutMsg, stream.LevelWarn)
+		return
 	}
-	timeoutMsg := fmt.Sprintf("task timed out after %s: %s", after.Round(time.Second), err.Error())
+
 	if baseOut == "" {
 		t.Output = fmt.Sprintf(`{"status":"blocked","summary":%q,"files_changed":[],"notes":"harness timeout; retry with smaller scope or lower concurrency"}`, timeoutMsg)
 	} else {
@@ -1795,10 +1925,9 @@ func (r *Runner) gatherGateSignals(ctx context.Context, current *plan.Task, base
 	return g
 }
 
-// decideReview produces the review verdict: the disk fast path, the speculative
-// race, or a single reviewer LLM call.
-func (r *Runner) decideReview(ctx context.Context, current plan.Task, g gateState,
-	baseline map[string]string) (plan.ReviewResult, string, error) {
+// decideReview produces the review verdict: the disk fast path, the harness
+// fast-reject, or the reviewer LLM.
+func (r *Runner) decideReview(ctx context.Context, current plan.Task, g gateState) (plan.ReviewResult, string, error) {
 	if g.fastPath(current.Role) {
 		review := plan.ReviewResult{Approved: true, Score: 85}
 		switch {
@@ -1812,168 +1941,173 @@ func (r *Runner) decideReview(ctx context.Context, current plan.Task, g gateStat
 		r.logf("%s review fast-path (skip reviewer LLM): %s", current.ID, review.Summary)
 		return review, "", nil
 	}
-	if r.MaxParallel >= 2 {
-		return r.speculativeReview(ctx, current, g, baseline)
-	}
-	return r.plainReview(ctx, current, g)
-}
-
-// reviewerStrictDelay gives the primary reviewer a head start before the
-// strict second reviewer is even dispatched. A real LLM essentially never
-// answers this fast, so production still fans out to both reviewers exactly
-// as before; the delay only matters against a fast/local answer (disk
-// evidence, a quick model, a test double), where it lets the race actually
-// skip the second slot instead of firing it and discarding the result.
-const reviewerStrictDelay = 20 * time.Millisecond
-
-// speculativeReview races a disk/acceptance probe against the reviewer LLM (and
-// a strict second reviewer when capacity allows).
-func (r *Runner) speculativeReview(ctx context.Context, current plan.Task, g gateState,
-	baseline map[string]string) (plan.ReviewResult, string, error) {
-	// One race is one review attempt against the task's budget, however many
-	// speculative paths it fans out to. Without this the DEFAULT configuration
-	// (MaxParallel=4, which always takes this branch) would never be budgeted
-	// at all — reviews are exactly where the round-trip ladder lives.
-	if !r.spend(current.ID, "review") {
-		return r.slmApprovalFallback(plan.ReviewResult{
-			Approved: false, Summary: "review skipped: per-task call budget exhausted",
-		}, current, g, ""), "", nil
+	if review, ok := g.fastReject(current); ok {
+		r.logf("%s review fast-reject (skip reviewer LLM): %s", current.ID, review.Summary)
+		return review, "", nil
 	}
-	reviewIn := r.formatReviewPrompt(current)
-	revRole := r.resolveRole(r.reviewerID())
-	slots := r.reviewSlots(current, g, baseline, reviewIn, revRole)
-	r.fire(stream.KindAgentStart, revRole, current.ID, "speculative review race",
-		strings.Join(current.Files, ", "), "")
-	// Budget honesty: the race costs ONE unit but issues one real LLM request
-	// per non-local slot — reviewer plus reviewer-strict at the default
-	// max_parallel=4. Against a server that runs inference serially a 10-unit
-	// budget is therefore up to ~13 round-trips, and the operator waits on the
-	// round-trips. spend() already counted one; record the rest so the budget
-	// event reports both numbers instead of understating the wait.
-	llmSlots := 0
-	for _, sl := range slots {
-		if sl.Local == nil {
-			llmSlots++
-		}
-	}
-	if llmSlots > 1 {
-		r.noteExtraRequests(current.ID, llmSlots-1)
-	}
-	r.logf("%s speculative review (%d paths, %d LLM requests, 1 budget unit, max_parallel=%d)",
-		current.ID, len(slots), llmSlots, r.MaxParallel)
-	res := r.speculate(r.taskCtx(ctx, current.ID), slots)
-
-	// Only a slot that RAN TO COMPLETION carries a verdict. A racer the winner
-	// canceled comes back Skipped (see speculate), and a streaming one can
-	// come back with a partial body: reading `{"approved":true,"score":92,` off
-	// a cut-short stream and calling it a verdict is how the winner's complete
-	// approval was rendered and acted on as `approved=false score=0`, costing a
-	// correction round the model never needed.
-	var acceptOut, revOut, strictOut string
-	var revErr error
-	for _, sr := range res {
-		done := !sr.Skipped && sr.Err == nil && strings.TrimSpace(sr.Output) != ""
-		switch sr.Role {
-		case "acceptance":
-			if done {
-				acceptOut = sr.Output
-			}
-		case revRole:
-			revErr = sr.Err
-			if done {
-				revOut = sr.Output
-			}
-		default:
-			if done {
-				strictOut = sr.Output
-			}
-		}
+	return r.llmReview(ctx, current, g)
+}
+
+// fastReject reports a rejection the harness can already state without asking
+// a reviewer, so no LLM round-trip is spent on a verdict that could only come
+// out one way.
+//
+// Two cases. A hard gate fired: applyHardGates overturns any approval the
+// reviewer gives in that state (same role and rename exemptions), so the
+// reviewer's answer could not change the outcome — it could only cost a
+// request. Or the worker's own finalize says it is blocked and nothing on disk
+// contradicts it: the worker has already said, in its own words, what a
+// rejection would say.
+//
+// Testers are exempt for the reason applyHardGates exempts them: a tester's
+// failing command IS its finding, not a defect in its work.
+func (g gateState) fastReject(current plan.Task) (plan.ReviewResult, bool) {
+	if plan.IsTesterRole(current.Role) || g.renameDisk {
+		return plan.ReviewResult{}, false
 	}
-	if strings.TrimSpace(acceptOut) != "" {
-		r.logf("%s review acceptance won — canceled reviewer LLM", current.ID)
-		return plan.ParseReviewJSON(acceptOut), acceptOut, nil
+	if g.blocking() {
+		summary, issue := g.rejectReason()
+		return plan.ReviewResult{Approved: false, Score: 20, Summary: summary, Issues: []string{issue}}, true
 	}
-	reviewRaw := revOut
-	if strings.TrimSpace(reviewRaw) == "" {
-		reviewRaw = strictOut
+	if why, ok := workerReportedBlocked(current.Output); ok && !g.hasEvidence() && !g.satisfied {
+		return plan.ReviewResult{
+			Approved: false, Score: 10,
+			Summary: "rejected: worker reported blocked — " + why,
+			Issues:  []string{why},
+		}, true
 	}
-	if revErr != nil && strings.TrimSpace(reviewRaw) == "" {
-		return plan.ReviewResult{}, "", revErr
+	return plan.ReviewResult{}, false
+}
+
+// workerReportedBlocked reads a `{"status":"blocked", …}` finalize out of the
+// model's half of a task output and returns the worker's own summary.
+func workerReportedBlocked(output string) (string, bool) {
+	raw := strings.TrimSpace(stripPostSections(output))
+	if raw == "" {
+		return "", false
 	}
-	review := r.parseReviewOutput(ctx, current, reviewRaw, revRole, reviewIn)
-	return r.slmApprovalFallback(review, current, g, reviewRaw), reviewRaw, nil
+	fixed, _, err := repair.RepairRole(raw, plan.RoleWorker)
+	if err != nil {
+		return "", false
+	}
+	var st struct {
+		Status  string `json:"status"`
+		Summary string `json:"summary"`
+	}
+	if json.Unmarshal(fixed, &st) != nil || !strings.EqualFold(strings.TrimSpace(st.Status), "blocked") {
+		return "", false
+	}
+	why := strings.TrimSpace(st.Summary)
+	if why == "" {
+		why = "worker reported status blocked without a summary"
+	}
+	return why, true
 }
 
-// reviewSlots builds the speculative review race: a local disk/acceptance probe,
-// the reviewer LLM, and — when capacity allows — a strict second reviewer.
-func (r *Runner) reviewSlots(current plan.Task, g gateState, baseline map[string]string,
-	reviewIn, revRole string) []SpecSlot {
-	cur := current
-	base := baseline
-	// Use a shorter reviewer timeout when disk evidence already exists — the
-	// acceptance probe should win quickly; the full 12 min is excessive.
-	revTimeout := r.Timeout
-	if g.hasEvidence() {
-		revTimeout = 3 * time.Minute
-	}
-	slots := []SpecSlot{{
-		Role: "acceptance", Required: false,
-		Local: func(ctx context.Context) (string, error) {
-			return acceptanceProbe(ctx, func() bool {
-				return renameOK(r.Root, cur) || alreadySatisfied(r.Root, cur, base) ||
-					r.hasRealWriteEvidence(cur, base)
-			}, `{"approved":true,"score":85,"summary":"auto-approved: acceptance race won"}`)
-		},
-	}, {
-		Role: revRole, Prompt: reviewIn, Required: false, Timeout: revTimeout,
-	}}
-	// Second reviewer when capacity allows. reviewer-strict went unregistered
-	// for as long as this code referenced it, so the path never ran; assert the
-	// role is real instead of failing silently at runtime.
-	if r.MaxParallel >= 3 {
-		if strict, ok := r.resolveBuiltinSlot(roleReviewerStrict); ok {
-			slots = append(slots, SpecSlot{
-				Role: strict, Required: false,
-				Prompt:  reviewIn + "\n\nSTRICT: reject unless focus files + acceptance clearly met. Return JSON.",
-				Timeout: revTimeout,
-				// A genuine head start for the primary reviewer: a real LLM
-				// almost never answers inside this window, so production
-				// still races both reviewers as before. But it means the
-				// strict slot's dispatch — and its real budget/wall-clock
-				// cost — is actually skippable, not just cancelable after
-				// the fact, whenever the primary reviewer is fast enough to
-				// have already decided the race.
-				Delay: reviewerStrictDelay,
-			})
-		}
-	}
-	return slots
-}
-
-// plainReview runs one reviewer LLM call.
-func (r *Runner) plainReview(ctx context.Context, current plan.Task, g gateState) (
+// reviewEvidenceTimeout caps a reviewer call once disk evidence already exists:
+// the verdict is then mostly confirmation, and the full task timeout is
+// excessive for it.
+const reviewEvidenceTimeout = 3 * time.Minute
+
+// reviewTimeout is the per-call budget for a reviewer dispatch: the runway clamp
+// first — a review that outlives the run kills the finish path exactly as a
+// worker that does — then the evidence cap.
+func (r *Runner) reviewTimeout(ctx context.Context, g gateState) time.Duration {
+	t := r.callTimeout(ctx)
+	if g.hasEvidence() && t > reviewEvidenceTimeout {
+		return reviewEvidenceTimeout
+	}
+	return t
+}
+
+// llmReview asks the reviewer for a verdict: ONE request, and a strict second
+// opinion only when the first came back empty or unreadable.
+//
+// This used to be a speculative race. At the default max_parallel it fanned
+// out to a local "acceptance" probe, the reviewer and reviewer-strict all at
+// once, then read them in that order — two costs and one hole:
+//
+//   - reviewer-strict was dispatched on EVERY review and its answer used only
+//     when the primary's was empty, so at max_parallel>=3 each review cost two
+//     full reviewer prefills for one verdict;
+//   - the acceptance probe re-tested a subset of fastPath's conditions with
+//     none of its guards — no criteriaOpen, no scope check, no blocking gates,
+//     no tester exemption — so a task with an open must-criterion and a disk
+//     write could be approved "acceptance race won" with no reviewer at all,
+//     right after fastPath had declined to approve it for exactly that reason.
+//
+// Only decideReview's fastPath approves without a reviewer now, and the second
+// reviewer runs only in the one case its answer was ever used. Every dispatch
+// goes through execOne, so the runway and budget checks apply here as they do
+// to every other loop-side call.
+func (r *Runner) llmReview(ctx context.Context, current plan.Task, g gateState) (
 	plan.ReviewResult, string, error) {
 	revRole := r.resolveRole(r.reviewerID())
 	r.fire(stream.KindAgentStart, revRole, current.ID, "self-critic review",
 		strings.Join(current.Files, ", "), "")
 	reviewIn := r.formatReviewPrompt(current)
 	res, ok := r.execOne(ctx, current.ID, "review", ggagent.SubAgentRequest{
-		AgentID: revRole, Input: reviewIn, Timeout: r.callTimeout(ctx), ShareState: true, TaskID: current.ID,
+		AgentID: revRole, Input: reviewIn, Timeout: r.reviewTimeout(ctx, g),
+		ShareState: true, TaskID: current.ID,
 	})
 	if !ok {
-		// Budget exhausted: approve on evidence or reject — never loop.
+		// Out of budget or out of runway: approve on evidence or reject — never loop.
 		return r.slmApprovalFallback(plan.ReviewResult{
-			Approved: false, Summary: "review skipped: per-task call budget exhausted",
+			Approved: false, Summary: r.reviewSkippedSummary(ctx),
 		}, current, g, ""), "", nil
 	}
 	reviewRaw := outputString(res)
-	if res.Error != nil && reviewRaw == "" {
+	if res.Error != nil && strings.TrimSpace(reviewRaw) == "" {
 		return plan.ReviewResult{}, "", res.Error
 	}
 	review := r.parseReviewOutput(ctx, current, reviewRaw, revRole, reviewIn)
+	if review.NoVerdict {
+		if second, raw, ok := r.strictSecondOpinion(ctx, current, g, reviewIn); ok {
+			review, reviewRaw = second, raw
+		}
+	}
 	return r.slmApprovalFallback(review, current, g, reviewRaw), reviewRaw, nil
 }
 
+// reviewSkippedSummary names why a review was not dispatched at all.
+func (r *Runner) reviewSkippedSummary(ctx context.Context) string {
+	if r.runwaySpent(ctx) {
+		return "review skipped: out of runway"
+	}
+	return "review skipped: per-task call budget exhausted"
+}
+
+// strictSecondOpinion asks reviewer-strict when the primary reviewer produced
+// no readable verdict. Sequential, not raced: it is one more real request
+// against the task's budget, spent only in the case its answer is used.
+func (r *Runner) strictSecondOpinion(ctx context.Context, current plan.Task, g gateState,
+	reviewIn string) (plan.ReviewResult, string, bool) {
+	strict, ok := r.resolveBuiltinSlot(roleReviewerStrict)
+	if !ok {
+		return plan.ReviewResult{}, "", false
+	}
+	r.logf("%s primary reviewer produced no verdict — asking %s once", current.ID, strict)
+	r.fire(stream.KindAgentStart, strict, current.ID, "strict second opinion",
+		strings.Join(current.Files, ", "), "")
+	strictIn := reviewIn + "\n\nSTRICT: reject unless focus files + acceptance clearly met. Return JSON."
+	res, ok := r.execOne(ctx, current.ID, "review (strict second opinion)", ggagent.SubAgentRequest{
+		AgentID: strict, Input: strictIn, Timeout: r.reviewTimeout(ctx, g),
+		ShareState: true, TaskID: current.ID,
+	})
+	if !ok {
+		return plan.ReviewResult{}, "", false
+	}
+	raw := outputString(res)
+	if strings.TrimSpace(raw) == "" {
+		return plan.ReviewResult{}, "", false
+	}
+	review := r.parseReviewOutput(ctx, current, raw, strict, strictIn)
+	if review.NoVerdict {
+		return plan.ReviewResult{}, "", false
+	}
+	return review, raw, true
+}
+
 // parseReviewOutput repairs the reviewer's JSON against the reviewer schema.
 // A response cut off by max_tokens is re-asked with a bigger budget rather than
 // answered with a corrector round-trip at what is only a truncation.
@@ -2316,10 +2450,14 @@ func (r *Runner) reviewAndCorrectTask(ctx context.Context, t plan.Task, baseline
 		}
 
 		g := r.gatherGateSignals(ctx, &current, baseline)
-		review, reviewRaw, err := r.decideReview(ctx, current, g, baseline)
+		review, reviewRaw, err := r.decideReview(ctx, current, g)
+		if err != nil {
+			review, reviewRaw, err = r.recoverReviewError(ctx, current, g, err)
+		}
 		if err != nil {
-			// The reviewer never produced a verdict. That is still an attempt
-			// that happened, and the next one must be able to see it.
+			// The reviewer never produced a verdict, and neither the evidence
+			// nor a second ask could stand in for one. That is still an
+			// attempt that happened, and the next one must be able to see it.
 			//
 			// NoVerdict is set for the same reason parseReviewOutput sets it on
 			// an empty reply: without it this result is byte-identical to a
@@ -2327,12 +2465,8 @@ func (r *Runner) reviewAndCorrectTask(ctx context.Context, t plan.Task, baseline
 			// TIMED OUT would be read as a reviewer that judged the work
 			// worthless. The distinction has to survive as far as the ledger,
 			// because that is what the next attempt reads.
-			lin.record(current, g, plan.ReviewResult{
-				Summary: err.Error(), Issues: []string{err.Error()}, NoVerdict: true,
-			}, plan.AttemptError, startedAt)
-			current.MoveTo(plan.ColBlocked)
-			current.Error = err.Error()
-			return current, nil, err
+			lin.record(current, g, review, plan.AttemptError, startedAt)
+			return r.escalateReviewerUnavailable(current, err)
 		}
 		review = r.applyHardGates(&current, review, g, baseline)
 
@@ -2532,6 +2666,59 @@ func (r *Runner) escalateTask(current plan.Task, review plan.ReviewResult, attem
 	return current, &escalation{detail: detail, attempt: attempt, review: review}, nil
 }
 
+// recoverReviewError handles a reviewer that returned a transport error instead
+// of a verdict.
+//
+// It used to block the task outright — and PropagateBlocked then cascaded the
+// block to every dependent — over an error that says nothing about the work:
+// the reviewer's endpoint hiccupped after the worker had finished and every
+// gate had run, and the gathered gate signals were thrown away with it.
+//
+// The harness evidence is judged first, exactly as it is for a reviewer whose
+// reply could not be read: a task with disk write evidence and a clean gate
+// pass is approved on that evidence. When the evidence does not carry it and
+// the budget and runway allow, the reviewer is asked ONCE more. Only when that
+// fails too does the task leave the ladder — and it goes to the human backlog
+// as "reviewer unavailable", not to blocked as a failure of the work.
+func (r *Runner) recoverReviewError(ctx context.Context, current plan.Task, g gateState, err error) (
+	plan.ReviewResult, string, error) {
+	r.logf("%s reviewer unavailable (%v) — judging on harness evidence first", current.ID, err)
+	noVerdict := plan.ReviewResult{Summary: err.Error(), Issues: []string{err.Error()}, NoVerdict: true}
+	if review := r.slmApprovalFallback(noVerdict, current, g, ""); review.Approved {
+		return review, "", nil
+	}
+	if r.runwaySpent(ctx) || r.budgetExhausted(current.ID) {
+		return noVerdict, "", err
+	}
+	r.logf("%s re-asking the reviewer once after a transport error", current.ID)
+	again, raw, err2 := r.llmReview(ctx, current, g)
+	if err2 != nil {
+		return plan.ReviewResult{Summary: err2.Error(), Issues: []string{err2.Error()}, NoVerdict: true}, "", err2
+	}
+	return again, raw, nil
+}
+
+// escalateReviewerUnavailable parks a task whose reviewer could not be reached
+// in the human backlog.
+//
+// The work is not known to be wrong — nothing judged it — so it must not land
+// in blocked, where it reads as a failure of the work and PropagateBlocked
+// strands every dependent behind it. to_scope is human-owned: dependents stay
+// where they are, and promoting the task back to ready_to_dev reviews it again.
+// The error is still returned so the caller reports the failure and does not
+// hand the task to another specialist as if a reviewer had rejected it.
+func (r *Runner) escalateReviewerUnavailable(current plan.Task, err error) (plan.Task, *escalation, error) {
+	why := "reviewer unavailable: " + err.Error()
+	current.MoveTo(plan.ColToScope)
+	current.Error = why
+	current.Notes = strings.TrimSpace(current.Notes + "\nESCALATED: reviewer unavailable (" + err.Error() +
+		"). The work was not judged — check the model endpoint, then promote back to ready_to_dev to review it again.")
+	r.logf("%s escalated to to_scope: %s", current.ID, why)
+	r.fireIntervention(current.ID, "escalate",
+		fmt.Sprintf("%s needs human review — reviewer unavailable", current.ID), why)
+	return current, nil, err
+}
+
 // rootDir is the nil-safe project root.
 func (r *Runner) rootDir() string {
 	if r == nil {
diff --git a/pkg/loop/runner_test.go b/pkg/loop/runner_test.go
index 8092d95..efe5a3b 100644
--- a/pkg/loop/runner_test.go
+++ b/pkg/loop/runner_test.go
@@ -153,6 +153,10 @@ func TestRunBoardTimeoutsDoNotInterruptOrLeaveTasksInProgress(t *testing.T) {
 	r.IdleWait = time.Millisecond
 	r.PostWorkerSmoke = false
 	r.RequireSmoke = false
+	// A timed-out worker is re-queued to resume from its checkpoint while it
+	// is under the attempt ceiling (see TestTimedOutWorkerIsResumedNotParked);
+	// this test pins the park path, so the ceiling is one attempt.
+	r.MaxTaskAttempts = 1
 	r.FailureHandler = NewEnhancedFailureHandler(root)
 
 	var interventions int
diff --git a/pkg/loop/speculate.go b/pkg/loop/speculate.go
index 3fada43..d350dbe 100644
--- a/pkg/loop/speculate.go
+++ b/pkg/loop/speculate.go
@@ -141,8 +141,11 @@ func (r *Runner) speculate(ctx context.Context, slots []SpecSlot) []SpecResult {
 					if r.Executor == nil {
 						err = fmt.Errorf("nil executor")
 					} else {
-						slotTimeout := r.Timeout
-						if j.slot.Timeout > 0 {
+						// Runway-clamped like every other dispatch: a slot
+						// that outlives the run takes the finish path with
+						// it. A per-slot Timeout only ever shortens that.
+						slotTimeout := r.callTimeout(gctx)
+						if j.slot.Timeout > 0 && j.slot.Timeout < slotTimeout {
 							slotTimeout = j.slot.Timeout
 						}
 						// The racing reviewers stream too; the task id rides on
@@ -197,19 +200,3 @@ func (r *Runner) speculate(ctx context.Context, slots []SpecSlot) []SpecResult {
 	}
 	return results
 }
-
-// acceptanceProbe repeatedly checks a predicate so disk acceptance can cancel a
-// slower reviewer/tester LLM mid-flight.
-func acceptanceProbe(ctx context.Context, win func() bool, approveJSON string) (string, error) {
-	for i := 0; i < 8; i++ {
-		if win() {
-			return approveJSON, nil
-		}
-		select {
-		case <-ctx.Done():
-			return "", ctx.Err()
-		case <-time.After(30 * time.Millisecond):
-		}
-	}
-	return "", fmt.Errorf("no acceptance")
-}
diff --git a/pkg/loop/speculate_cancel_test.go b/pkg/loop/speculate_cancel_test.go
index a569618..9a216be 100644
--- a/pkg/loop/speculate_cancel_test.go
+++ b/pkg/loop/speculate_cancel_test.go
@@ -123,23 +123,25 @@ func TestSpeculateReportsARealInterrupt(t *testing.T) {
 	}
 }
 
-// TestSpeculativeReviewKeepsTheWinnersVerdict is the regression net for
-// defect 2. The reviewer's stream is cut short by the winner and comes back as
-// a truncated `{"approved":true,"score":92,"summ`. That is not a verdict —
-// preferring it over the strict reviewer's COMPLETE approval is how an
-// approved:true score:92 payload was rendered and acted on as
-// `approved=false score=0`, buying a correction round nobody needed.
-func TestSpeculativeReviewKeepsTheWinnersVerdict(t *testing.T) {
+// TestReviewKeepsTheStrictVerdictWhenThePrimarySaysNothing is the regression
+// net for defect 2 under the sequential contract. The primary reviewer answers
+// nothing; the strict second opinion is a COMPLETE approval. That verdict must
+// be the one acted on — dropping it is how an approved:true score:92 payload
+// was rendered and acted on as `approved=false score=0`, buying a correction
+// round nobody needed.
+func TestReviewKeepsTheStrictVerdictWhenThePrimarySaysNothing(t *testing.T) {
 	exec := &streamingRaceExec{
 		delay: map[string]time.Duration{
-			plan.RoleReviewer:  2 * time.Second,
+			plan.RoleReviewer:  2 * time.Millisecond,
 			roleReviewerStrict: 2 * time.Millisecond,
 		},
-		full:    map[string]string{roleReviewerStrict: `{"approved":true,"score":92,"summary":"acceptance met"}`},
-		partial: map[string]string{plan.RoleReviewer: `{"approved":true,"score":92,"summ`},
+		full: map[string]string{
+			plan.RoleReviewer:  "",
+			roleReviewerStrict: `{"approved":true,"score":92,"summary":"acceptance met"}`,
+		},
 	}
 	r := NewRunner(exec, ggagent.NewSharedState())
-	r.MaxParallel = 4 // the shipped default; >=3 also arms the strict slot
+	r.MaxParallel = 4 // the shipped default
 	r.Timeout = 30 * time.Second
 	r.Log = func(string, ...interface{}) {}
 
@@ -149,16 +151,16 @@ func TestSpeculativeReviewKeepsTheWinnersVerdict(t *testing.T) {
 		Files:  []string{"a.go"},
 		Output: `{"status":"done","summary":"x","files_changed":["a.go"]}`,
 	}
-	review, raw, err := r.speculativeReview(context.Background(), cur, gateState{}, map[string]string{})
+	review, raw, err := r.llmReview(context.Background(), cur, gateState{})
 	if err != nil {
-		t.Fatalf("speculativeReview: %v", err)
+		t.Fatalf("llmReview: %v", err)
 	}
 	if !review.Approved || review.Score != 92 {
-		t.Fatalf("winner's verdict dropped: approved=%v score=%d raw=%q",
+		t.Fatalf("strict verdict dropped: approved=%v score=%d raw=%q",
 			review.Approved, review.Score, raw)
 	}
-	if strings.Contains(raw, `"summ`) && !strings.Contains(raw, `"summary"`) {
-		t.Fatalf("the truncated loser's body was used as the verdict: %q", raw)
+	if !strings.Contains(raw, "acceptance met") {
+		t.Fatalf("the raw verdict is not the strict reviewer's: %q", raw)
 	}
 }
 
diff --git a/pkg/loop/speculate_test.go b/pkg/loop/speculate_test.go
index 5b50941..1a0140d 100644
--- a/pkg/loop/speculate_test.go
+++ b/pkg/loop/speculate_test.go
@@ -38,7 +38,14 @@ func (f *fakeReviewExec) ExecuteSubAgents(ctx context.Context, reqs []ggagent.Su
 	return out, nil
 }
 
-func TestSpeculateReviewCancelsOnAcceptanceWin(t *testing.T) {
+// TestSpeculateLocalWinnerCancelsSlowerSlot exercises the speculate primitive:
+// a required local slot that answers first cancels the slower LLM slot.
+//
+// The review path no longer races a local "acceptance" probe against the
+// reviewer — that probe re-tested a subset of fastPath's conditions with none
+// of its guards, so it could approve a task fastPath had just declined. The
+// primitive itself is unchanged and still has to cancel losers correctly.
+func TestSpeculateLocalWinnerCancelsSlowerSlot(t *testing.T) {
 	fe := &fakeReviewExec{
 		delay: map[string]time.Duration{
 			plan.RoleReviewer: 400 * time.Millisecond,
@@ -54,13 +61,11 @@ func TestSpeculateReviewCancelsOnAcceptanceWin(t *testing.T) {
 		Timeout:     time.Minute,
 		Log:         func(string, ...interface{}) {},
 	}
-	ready := make(chan struct{})
-	close(ready)
 	slots := []SpecSlot{
 		{
-			Role: "acceptance", Required: true,
+			Role: "probe", Required: true,
 			Local: func(ctx context.Context) (string, error) {
-				return `{"approved":true,"score":85,"summary":"auto-approved: acceptance race won"}`, nil
+				return `{"approved":true,"score":85,"summary":"local probe won"}`, nil
 			},
 		},
 		{Role: plan.RoleReviewer, Prompt: "review", Required: false},
@@ -70,17 +75,17 @@ func TestSpeculateReviewCancelsOnAcceptanceWin(t *testing.T) {
 	if time.Since(start) > 350*time.Millisecond {
 		t.Fatalf("expected early cancel; elapsed=%s", time.Since(start))
 	}
-	var acc, rev SpecResult
+	var probe, rev SpecResult
 	for _, sr := range res {
 		switch sr.Role {
-		case "acceptance":
-			acc = sr
+		case "probe":
+			probe = sr
 		case plan.RoleReviewer:
 			rev = sr
 		}
 	}
-	if acc.Err != nil || acc.Output == "" {
-		t.Fatalf("acceptance: %+v", acc)
+	if probe.Err != nil || probe.Output == "" {
+		t.Fatalf("probe: %+v", probe)
 	}
 	if !rev.Skipped && rev.Err == nil && rev.Output != "" {
 		t.Fatalf("expected reviewer canceled/skipped, got %+v", rev)
diff --git a/pkg/loop/wiring_test.go b/pkg/loop/wiring_test.go
index bd97119..179634b 100644
--- a/pkg/loop/wiring_test.go
+++ b/pkg/loop/wiring_test.go
@@ -9,6 +9,7 @@ import (
 	"strings"
 	"sync"
 	"testing"
+	"time"
 
 	"github.com/UnicoLab/slmcode/pkg/evolve"
 	"github.com/UnicoLab/slmcode/pkg/memory"
@@ -350,41 +351,71 @@ func TestResolveRoleAndBuiltinSlot(t *testing.T) {
 	}
 }
 
-// TestStrictReviewerSlotIsOfferedAtCapacity asserts the second reviewer is now
-// really part of the race. speculate.go referenced "reviewer-strict" while no
-// such agent was registered, so every strict slot returned
-// "subagent 'reviewer-strict' not found" and the path never once ran.
-func TestStrictReviewerSlotIsOfferedAtCapacity(t *testing.T) {
-	r := &Runner{Log: func(string, ...interface{}) {}}
+// TestStrictReviewerIsASequentialSecondOpinion pins the cost of a review.
+//
+// The review used to be a race: at max_parallel>=3 it dispatched reviewer AND
+// reviewer-strict with the same prompt on EVERY review, and read the strict
+// answer only when the primary's was empty — two full reviewer prefills for
+// one verdict, on a server that runs inference serially. The strict reviewer
+// is now asked sequentially, and only in the one case its answer was ever
+// used: the primary said nothing readable.
+func TestStrictReviewerIsASequentialSecondOpinion(t *testing.T) {
+	task := plan.Task{
+		ID: "T1", Title: "Update a", Role: plan.RoleWorker,
+		Description: "update the greeting in a.go", Acceptance: "greeting updated",
+		Files:  []string{"a.go"},
+		Output: `{"status":"done","summary":"x","files_changed":["a.go"]}`,
+	}
 	cases := []struct {
 		name        string
 		maxParallel int
+		primary     string
 		resolve     func(string) string
-		wantRoles   []string
+		wantPrimary int
+		wantStrict  int
 	}{
-		{"two slots below capacity", 2, nil, []string{"acceptance", plan.RoleReviewer}},
-		{"strict joins at capacity", 3, nil,
-			[]string{"acceptance", plan.RoleReviewer, roleReviewerStrict}},
-		{"unregistered override is dropped, not dispatched", 4,
+		{"primary answers: exactly one reviewer request, no strict", 4,
+			`{"approved":false,"score":40,"summary":"needs a test"}`, nil, 1, 0},
+		{"primary answers below the old capacity threshold too", 2,
+			`{"approved":false,"score":40,"summary":"needs a test"}`, nil, 1, 0},
+		{"empty primary: strict asked once, sequentially", 4, "", nil, 1, 1},
+		{"unregistered strict override is dropped, not dispatched", 4, "",
 			func(id string) string {
 				if id == roleReviewerStrict {
 					return "no-such-agent"
 				}
 				return id
-			},
-			[]string{"acceptance", plan.RoleReviewer}},
+			}, 1, 0},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
+			exec := &scriptedExec{answer: func(req ggagent.SubAgentRequest, _ int) string {
+				if req.AgentID == plan.RoleReviewer {
+					return tc.primary
+				}
+				return `{"approved":true,"score":88,"summary":"strict ok"}`
+			}}
+			r := NewRunner(exec, ggagent.NewSharedState())
 			r.MaxParallel = tc.maxParallel
 			r.ResolveRole = tc.resolve
-			slots := r.reviewSlots(plan.Task{ID: "T1"}, gateState{}, nil, "prompt", plan.RoleReviewer)
-			var roles []string
-			for _, s := range slots {
-				roles = append(roles, s.Role)
+			r.Timeout = time.Minute
+			r.Log = func(string, ...interface{}) {}
+			if _, _, err := r.llmReview(context.Background(), task, gateState{}); err != nil {
+				t.Fatalf("llmReview: %v", err)
 			}
-			if strings.Join(roles, ",") != strings.Join(tc.wantRoles, ",") {
-				t.Fatalf("slot roles = %v, want %v", roles, tc.wantRoles)
+			if got := exec.countFor(plan.RoleReviewer); got != tc.wantPrimary {
+				t.Fatalf("reviewer requests = %d, want %d", got, tc.wantPrimary)
+			}
+			if got := exec.countFor(roleReviewerStrict); got != tc.wantStrict {
+				t.Fatalf("reviewer-strict requests = %d, want %d", got, tc.wantStrict)
+			}
+			if got := exec.countFor("no-such-agent"); got != 0 {
+				t.Fatalf("an unregistered role was dispatched %d time(s)", got)
+			}
+			for _, p := range exec.promptsFor(roleReviewerStrict) {
+				if !strings.Contains(p, "STRICT:") {
+					t.Fatalf("strict reviewer was not told to be strict:\n%s", p)
+				}
 			}
 		})
 	}

From d1cba9eb422c48564f5c21a901631b07642b0023 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 08:34:22 +0000
Subject: [PATCH 05/23] prompts: corrector keeps the harness evidence; worker
 prompt puts the pack first

formatCorrectPrompt clipped the previous output head-first at 2.5 KB while
runGates appends the failing command's section and observation to the END
of Task.Output, so once the prose passed the budget the corrector was told
to fix a smoke failure it was never shown. It now uses the same body /
evidence split the reviewer prompt uses (clipForReview): the prose is
budgeted and the evidence kept whole. It also carries the HARD SCOPE focus
list (via the new shared agents.FocusFilesSection, which BuildWorkerPrompt
uses too), the acceptance and the project language hint, so the corrector
is shown the same scope the gate grades it against. The self-critique
dispatch is clamped to the runway like every other call.

BuildWorkerPrompt opened with "ID / Title / Column / Role" BEFORE the
scoped context pack, so two tasks sharing one pack shared a prefix of a few
dozen bytes and the whole pack was re-prefilled per task. When the
description starts with a pack, the pack (and the project-wide language
line) now come first and the task header sits immediately before
"## Task instructions"; the Column line, which changed between attempts at
the same task, is dropped. Descriptions without a pack keep their shape.
---
 pkg/agents/workerprompt.go      | 82 +++++++++++++++++++++++++++------
 pkg/agents/workerprompt_test.go | 75 ++++++++++++++++++++++++++++++
 pkg/loop/critique.go            | 29 +++++++++++-
 pkg/loop/reviewclip_test.go     | 49 ++++++++++++++++++++
 4 files changed, 220 insertions(+), 15 deletions(-)

diff --git a/pkg/agents/workerprompt.go b/pkg/agents/workerprompt.go
index 89e3998..685e55a 100644
--- a/pkg/agents/workerprompt.go
+++ b/pkg/agents/workerprompt.go
@@ -29,6 +29,44 @@ func WorkerScopeRules() string {
 		"If ws_patch fails, re-read the file and retry a minimal SEARCH/REPLACE; never invent new root files.\n"
 }
 
+// FocusFilesSection renders the HARD SCOPE block: the focus-file list and the
+// scope rules that follow it, or "" when the task names no files.
+//
+// It is shared by the worker prompt and the corrector prompt on purpose. The
+// scope gate grades both agents against the same list, so both must be shown
+// the same list — the corrector used to be given only the review issues and a
+// clip of the previous output, and had to infer its scope from prose.
+func FocusFilesSection(files []string) string {
+	if len(files) == 0 {
+		return ""
+	}
+	return "\n## Focus files (HARD SCOPE)\nOnly edit these paths or files in the same package directory:\n- " +
+		strings.Join(files, "\n- ") + "\n" + WorkerScopeRules()
+}
+
+// Scoped-pack markers. The orchestrator prepends context.TaskPack.Render() —
+// which begins with ScopedPackHeader — to a task's description and separates
+// it from the task's own text with TaskInstructionsHeader.
+const (
+	ScopedPackHeader       = "# Scoped context"
+	TaskInstructionsHeader = "## Task instructions"
+)
+
+// SplitScopedPack separates a description that begins with a scoped context
+// pack into the pack and the task instructions. A description without a pack
+// comes back whole as the body with an empty pack.
+func SplitScopedPack(desc string) (pack, body string) {
+	trimmed := strings.TrimSpace(desc)
+	if !strings.HasPrefix(trimmed, ScopedPackHeader) {
+		return "", desc
+	}
+	idx := strings.Index(trimmed, TaskInstructionsHeader)
+	if idx < 0 {
+		return "", desc
+	}
+	return strings.TrimSpace(trimmed[:idx]), strings.TrimSpace(trimmed[idx+len(TaskInstructionsHeader):])
+}
+
 // WorkerTaskRules is the canonical "## Required finish" block for an
 // implementation role, with a language-appropriate smoke command.
 //
@@ -93,34 +131,52 @@ type WorkerPromptOptions struct {
 	Description string
 }
 
-// BuildWorkerPrompt renders the full task-adjacent worker prompt: task
-// identity, language, body, hard-scoped focus files, acceptance, checklist,
-// human notes and the required-finish rules for the task's role.
+// BuildWorkerPrompt renders the full task-adjacent worker prompt: scoped
+// context pack (when the description carries one), language, task identity,
+// body, hard-scoped focus files, acceptance, checklist, human notes and the
+// required-finish rules for the task's role.
 //
 // Both the inner loop's fallback and the orchestrator's production builder
 // should go through this, so a rule can never again exist in the gate but not
 // in the prompt.
+//
+// Order is load-bearing for KV-cache reuse. The scoped pack is rendered
+// most-stable-first (skills, docs, repo map, then file bodies) and is byte
+// identical across every task that shares it — but the prompt used to open
+// with "ID: T3 / Title: … / Column: …", which differs per task, so the shared
+// prefix was a few dozen bytes long and the whole pack was re-prefilled for
+// every task. The pack now comes first and the task header sits immediately
+// before the task's own instructions; the Column line, which changed between
+// attempts at the same task, is gone.
 func BuildWorkerPrompt(t plan.Task, opt WorkerPromptOptions) string {
 	desc := opt.Description
 	if strings.TrimSpace(desc) == "" {
 		desc = t.Description
 	}
+	pack, body := SplitScopedPack(desc)
+	lang := ""
+	if h := strings.TrimSpace(opt.LangHint); h != "" {
+		lang = "## Project language\n" + h + "\n\n"
+	}
 
 	var b strings.Builder
+	if pack != "" {
+		// Stable prefix first: the pack, then the project-wide language line.
+		b.WriteString(pack)
+		b.WriteString("\n\n")
+		b.WriteString(lang)
+	}
 	b.WriteString("Atomic task — complete only this:\n\n")
-	fmt.Fprintf(&b, "ID: %s\nTitle: %s\nColumn: %s\nRole: %s\n\n", t.ID, t.Title, t.Column, t.Role)
-	if h := strings.TrimSpace(opt.LangHint); h != "" {
-		b.WriteString("## Project language\n" + h + "\n\n")
+	fmt.Fprintf(&b, "ID: %s\nTitle: %s\nRole: %s\n\n", t.ID, t.Title, t.Role)
+	if pack != "" {
+		b.WriteString(TaskInstructionsHeader + "\n\n")
+	} else {
+		b.WriteString(lang)
 	}
-	b.WriteString(desc)
+	b.WriteString(body)
 	b.WriteString("\n")
 
-	if len(t.Files) > 0 {
-		b.WriteString("\n## Focus files (HARD SCOPE)\nOnly edit these paths or files in the same package directory:\n- ")
-		b.WriteString(strings.Join(t.Files, "\n- "))
-		b.WriteString("\n")
-		b.WriteString(WorkerScopeRules())
-	}
+	b.WriteString(FocusFilesSection(t.Files))
 	if strings.TrimSpace(t.Acceptance) != "" {
 		b.WriteString("\nAcceptance criteria:\n")
 		b.WriteString(t.Acceptance)
diff --git a/pkg/agents/workerprompt_test.go b/pkg/agents/workerprompt_test.go
index 8326007..25de0b3 100644
--- a/pkg/agents/workerprompt_test.go
+++ b/pkg/agents/workerprompt_test.go
@@ -49,6 +49,81 @@ func TestAWorkerKeepsTheWorkerFinishContract(t *testing.T) {
 	}
 }
 
+// ── The scoped pack is the shared byte prefix ─────────────────────────────
+//
+// context.TaskPack.Render is written most-stable-first so that every task
+// sharing a pack shares a KV-cache prefix. The prompt used to open with
+// "ID: T1 / Title: … / Column: …" BEFORE the pack, so the shared prefix ended
+// at "Atomic task — complete only this:\n\nID: T" and the whole pack was
+// re-prefilled for every task.
+
+func TestTasksSharingAPackShareItAsABytePrefix(t *testing.T) {
+	pack := "# Scoped context for role=worker\n\n## Doc: README\n\nUse the store.\n\n" +
+		"## File: internal/store.go\n\n```go\npackage store\n```"
+	mk := func(id, title, body string) plan.Task {
+		return plan.Task{
+			ID: id, Title: title, Role: plan.RoleWorker, Column: plan.ColInProgress,
+			Description: pack + "\n## Task instructions\n\n" + body,
+			Files:       []string{"internal/store.go"},
+			Acceptance:  "go test ./... passes",
+		}
+	}
+	opt := WorkerPromptOptions{LangHint: "Project language: Go."}
+	a := BuildWorkerPrompt(mk("T1", "add List", "Add List to the store."), opt)
+	b := BuildWorkerPrompt(mk("T2", "add Delete", "Add Delete to the store."), opt)
+
+	common := 0
+	for common < len(a) && common < len(b) && a[common] == b[common] {
+		common++
+	}
+	if common < len(pack) {
+		t.Fatalf("shared byte prefix is %d bytes; the %d-byte pack must be inside it:\n%q", common, len(pack), a[:common])
+	}
+	if !strings.HasPrefix(a, "# Scoped context for role=worker") {
+		t.Errorf("prompt does not open with the pack:\n%s", a[:120])
+	}
+	// The language line is project-wide, so it belongs to the shared prefix too.
+	if !strings.Contains(a[:common], "## Project language\nProject language: Go.") {
+		t.Error("the language hint is outside the shared prefix")
+	}
+	// The task header sits immediately before the task's own instructions.
+	header := strings.Index(a, "Atomic task — complete only this:\n\nID: T1\nTitle: add List\nRole: worker\n\n## Task instructions\n\nAdd List to the store.")
+	if header < 0 {
+		t.Errorf("task header is not immediately before the instructions:\n%s", a)
+	}
+	if strings.Contains(a, "Column:") {
+		t.Error("the Column line varies between attempts and must not be in the prompt")
+	}
+	// Nothing the gates enforce was lost in the reorder.
+	for _, want := range []string{"## Focus files (HARD SCOPE)", "internal/store.go", "Acceptance criteria:", "## Required finish", `"files_changed"`} {
+		if !strings.Contains(a, want) {
+			t.Errorf("prompt lost %q", want)
+		}
+	}
+}
+
+// A description without a pack keeps the historical shape: header first.
+func TestPromptWithoutAPackOpensWithTheTaskHeader(t *testing.T) {
+	task := plan.Task{ID: "T1", Title: "x", Role: plan.RoleWorker, Description: "Do it.", Files: []string{"a.go"}}
+	got := BuildWorkerPrompt(task, WorkerPromptOptions{LangHint: "Project language: Go."})
+	if !strings.HasPrefix(got, "Atomic task — complete only this:\n\nID: T1\nTitle: x\nRole: worker\n\n## Project language\nProject language: Go.\n\nDo it.\n") {
+		t.Errorf("unexpected shape:\n%s", got)
+	}
+	if strings.Contains(got, "## Task instructions") {
+		t.Error("a pack-less prompt grew a Task instructions heading")
+	}
+}
+
+func TestSplitScopedPack(t *testing.T) {
+	pack, body := SplitScopedPack("# Scoped context for role=worker\n\nbig pack\n\n## Task instructions\n\nDo the thing\n")
+	if pack != "# Scoped context for role=worker\n\nbig pack" || body != "Do the thing" {
+		t.Fatalf("pack=%q body=%q", pack, body)
+	}
+	if pack, body := SplitScopedPack("plain description"); pack != "" || body != "plain description" {
+		t.Fatalf("pack-less split: pack=%q body=%q", pack, body)
+	}
+}
+
 func tail(s string) string {
 	if len(s) < 600 {
 		return s
diff --git a/pkg/loop/critique.go b/pkg/loop/critique.go
index d6a38da..fed85d0 100644
--- a/pkg/loop/critique.go
+++ b/pkg/loop/critique.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/UnicoLab/slmcode/pkg/memory"
 
+	"github.com/UnicoLab/slmcode/pkg/agents"
 	"github.com/UnicoLab/slmcode/pkg/context/textutil"
 	"github.com/UnicoLab/slmcode/pkg/evolve"
 	"github.com/UnicoLab/slmcode/pkg/multipass"
@@ -296,7 +297,7 @@ func (r *Runner) critiquePass(ctx context.Context, t *plan.Task, role string,
 	})
 	res, ok := r.execOne(ctx, t.ID, "self-critique", ggagent.SubAgentRequest{
 		AgentID: r.correctorID(), Input: corrIn,
-		Timeout: r.Timeout, ShareState: true, TaskID: t.ID,
+		Timeout: r.callTimeout(ctx), ShareState: true, TaskID: t.ID,
 	})
 	if !ok {
 		// Budget exhausted: escalate rather than loop.
@@ -425,14 +426,38 @@ func (r *Runner) focusDiff(t plan.Task, maxBytes int) string {
 	return textutil.TruncateDefault(diff, maxBytes)
 }
 
+// correctorOutputBudget bounds the previous output shown to the corrector. The
+// harness evidence inside it is budgeted separately by clipForReview.
+const correctorOutputBudget = 2500
+
 // formatCorrectPrompt builds the corrector prompt. Unlike the old package-level
 // helper it varies per attempt: it carries the real diff of the previous
 // attempt and names the fixes that were already tried and did not work.
+//
+// The previous output is clipped the way the reviewer's is (clipForReview):
+// the model's prose is budgeted and the harness-appended evidence — the
+// `## Deterministic smoke` / `## Acceptance criteria` sections and the failing
+// command's observation that runGates puts at the END of Task.Output — is kept
+// whole. A head-first clip used to delete exactly that once the prose passed
+// 2.5 KB, so the corrector was told "fix the smoke failure" and never shown
+// the failing command or its output.
+//
+// It also carries the same HARD SCOPE list, acceptance and language hint the
+// worker was given: the scope gate grades the corrector against them too.
 func (r *Runner) formatCorrectPrompt(t plan.Task, review plan.ReviewResult) string {
 	var b strings.Builder
 	b.WriteString("Fix task " + t.ID + " after failed review.\n\n")
 	b.WriteString("## Original task\n" + StripScopedPack(t.Description) + "\n\n")
-	b.WriteString("## Previous output\n" + truncate(t.Output, 2500) + "\n\n")
+	if h := detectProjectLangHint(r.rootDir()); h != "" {
+		b.WriteString("## Project language\n" + h + "\n\n")
+	}
+	if sec := agents.FocusFilesSection(t.Files); sec != "" {
+		b.WriteString(strings.TrimLeft(sec, "\n") + "\n")
+	}
+	if strings.TrimSpace(t.Acceptance) != "" {
+		b.WriteString("## Acceptance\n" + t.Acceptance + "\n\n")
+	}
+	b.WriteString("## Previous output\n" + clipForReview(t.Output, correctorOutputBudget) + "\n\n")
 	if diff := r.focusDiff(t, 1500); diff != "" {
 		b.WriteString("## What the previous attempt actually changed (git diff)\n" +
 			"```diff\n" + diff + "\n```\n\n")
diff --git a/pkg/loop/reviewclip_test.go b/pkg/loop/reviewclip_test.go
index 3c03bc3..3a87cb6 100644
--- a/pkg/loop/reviewclip_test.go
+++ b/pkg/loop/reviewclip_test.go
@@ -1,6 +1,8 @@
 package loop
 
 import (
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
@@ -45,6 +47,53 @@ func TestReviewerAlwaysSeesHarnessEvidenceEvenWhenProseIsHuge(t *testing.T) {
 	}
 }
 
+// TestCorrectorAlwaysSeesHarnessEvidenceEvenWhenProseIsHuge mirrors the
+// reviewer guard above for the CORRECTOR. formatCorrectPrompt clipped the
+// previous output head-first at 2.5 KB while runGates appends the failing
+// command's section and observation to the END of it — so a verbose worker
+// meant the corrector was told to fix a smoke failure it was never shown. The
+// prompt must carry the FAILED evidence, the focus files it is scoped to, the
+// acceptance and the project language.
+func TestCorrectorAlwaysSeesHarnessEvidenceEvenWhenProseIsHuge(t *testing.T) {
+	root := t.TempDir()
+	if err := os.WriteFile(filepath.Join(root, "go.mod"), []byte("module demo\n\ngo 1.22\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	prose := strings.Repeat("The worker reasons at length about the change. ", 400) // ~19 KB
+	failed := quality.SmokeSectionHeader + "\n" + quality.SmokeFailedMarker + " cmd: go test ./...\n" +
+		"--- FAIL: TestMedian (0.00s)\n    stats_test.go:12: got 2, want 3\n"
+	out := prose + "\n\n" + failed
+	if strings.Contains(truncate(out, correctorOutputBudget), quality.SmokeFailedMarker) {
+		t.Fatal("fixture no longer reproduces the defect — head clip kept the evidence")
+	}
+
+	r := NewRunner(nil, nil)
+	r.Root = root
+	task := plan.Task{
+		ID: "T1", Title: "Implement Median", Role: plan.RoleWorker,
+		Description: "Implement Median in stats.go.", Acceptance: "go test ./... passes",
+		Files:  []string{"pkg/stats/stats.go", "pkg/stats/stats_test.go"},
+		Output: out,
+	}
+	got := r.formatCorrectPrompt(task, plan.ReviewResult{
+		Summary: "rejected: deterministic smoke failed",
+		Issues:  []string{"deterministic smoke command failed — corrector must fix"},
+	})
+	for _, want := range []string{
+		quality.SmokeSectionHeader, quality.SmokeFailedMarker, "--- FAIL: TestMedian", "got 2, want 3",
+		"## Focus files (HARD SCOPE)", "pkg/stats/stats.go", "pkg/stats/stats_test.go",
+		"## Acceptance\ngo test ./... passes", "## Project language\nProject language: Go.",
+		"## Review issues\n- deterministic smoke command failed",
+	} {
+		if !strings.Contains(got, want) {
+			t.Errorf("corrector prompt lost %q — it cannot fix a failure it cannot see", want)
+		}
+	}
+	if !strings.Contains(got, "The worker reasons") {
+		t.Error("corrector prompt dropped the previous answer entirely")
+	}
+}
+
 // TestClipForReviewLeavesShortOutputAlone pins the no-regression case: when
 // everything fits, the reviewer sees exactly what it saw before.
 func TestClipForReviewLeavesShortOutputAlone(t *testing.T) {

From 9df5a99fbe1255e35a1085681f3d30757730ee8c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 08:34:22 +0000
Subject: [PATCH 06/23] backends: an explicitly set temperature of 0 is
 emitted, not treated as unset
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

reviewer-strict pins Temperature 0.0, and buildBody emitted the key only
when the value was > 0 — so the one temperature that was set on purpose was
dropped and the server sampled at its default. RoleSpec gains
TemperatureSet, set for reviewer-strict and carried on the provider
Directives; the structured request always emits `temperature` for a role
that set one, while roles that never set it keep the unset behavior. The
delegated (non-structured) path is built inside GoLangGraph and still
applies its default to a zero; docs/decoding.md says so.
---
 docs/decoding.md                |  9 ++++++++
 pkg/agents/factory.go           | 37 ++++++++++++++++++++-------------
 pkg/agents/factory_test.go      | 32 ++++++++++++++++++++++++++++
 pkg/backends/structured.go      | 16 +++++++++++++-
 pkg/backends/structured_test.go | 34 ++++++++++++++++++++++++++++++
 5 files changed, 113 insertions(+), 15 deletions(-)

diff --git a/docs/decoding.md b/docs/decoding.md
index 9af3c50..fc5c42f 100644
--- a/docs/decoding.md
+++ b/docs/decoding.md
@@ -107,6 +107,15 @@ to its first tool call. The prompt asks for one; the transport guarantees it.
 Language-specialised ids fold back to their generic role (`go-worker` → `worker`,
 `python-tester` → `tester`), so YAML-defined agents inherit the right contract automatically.
 
+**Temperature 0 is a setting, not an absence.** The request encoding treats a zero temperature as
+unset — GoLangGraph substitutes the provider's default and the OpenAI-compatible body omits the
+key — so a role pinned at 0 (`reviewer-strict`) was in fact sampled at the server's default. A
+spec that sets a temperature deliberately marks it `TemperatureSet`, which travels with the role's
+directives, and the structured path then always emits `temperature` for that role, zero included.
+Roles that never set one keep the unset behavior. The delegated (non-structured) request path is
+built inside GoLangGraph and still applies its own default to a zero; the constrained-decoding
+path is the one `reviewer-strict` takes.
+
 ## 4. The repair ladder (`pkg/repair`)
 
 When output still arrives unconstrained, the ladder is tried in a fixed order, and the name of
diff --git a/pkg/agents/factory.go b/pkg/agents/factory.go
index 4d4345d..cebf5a3 100644
--- a/pkg/agents/factory.go
+++ b/pkg/agents/factory.go
@@ -25,13 +25,20 @@ type RoleSpec struct {
 	Tools        []string `json:"tools,omitempty"`
 	MaxIter      int      `json:"max_iter"`
 	Temperature  float64  `json:"temperature"`
-	MaxTokens    int      `json:"max_tokens"`
-	Model        string   `json:"model,omitempty"`
-	Provider     string   `json:"provider,omitempty"`
-	Endpoint     string   `json:"endpoint,omitempty"`
-	Skills       []string `json:"skills,omitempty"`
-	Custom       bool     `json:"custom"`
-	Override     bool     `json:"override,omitempty"`
+	// TemperatureSet marks Temperature as deliberate even when it is 0. The
+	// request encoding treats a zero temperature as unset (GoLangGraph
+	// substitutes the provider default, the OpenAI-compatible body omits the
+	// key), so a role pinned at 0 was sampled at the server default. Only a
+	// spec that sets this gets its zero emitted; roles that never set a
+	// temperature keep the unset behavior.
+	TemperatureSet bool     `json:"temperature_set,omitempty"`
+	MaxTokens      int      `json:"max_tokens"`
+	Model          string   `json:"model,omitempty"`
+	Provider       string   `json:"provider,omitempty"`
+	Endpoint       string   `json:"endpoint,omitempty"`
+	Skills         []string `json:"skills,omitempty"`
+	Custom         bool     `json:"custom"`
+	Override       bool     `json:"override,omitempty"`
 
 	// JSONOnly marks a role whose entire output is one JSON document. Factory
 	// attaches constrained decoding (response_format / guided_json / GBNF) for
@@ -62,12 +69,14 @@ func (s RoleSpec) Directives() backends.Directives {
 		toolChoice = "auto"
 	}
 	return backends.Directives{
-		Role:          s.ID,
-		SchemaRole:    s.SchemaRole,
-		JSONOnly:      s.JSONOnly,
-		SerialTools:   s.SerialTools,
-		StopSequences: s.StopSequences,
-		ToolChoice:    toolChoice,
+		Role:           s.ID,
+		SchemaRole:     s.SchemaRole,
+		JSONOnly:       s.JSONOnly,
+		SerialTools:    s.SerialTools,
+		StopSequences:  s.StopSequences,
+		ToolChoice:     toolChoice,
+		Temperature:    s.Temperature,
+		TemperatureSet: s.TemperatureSet,
 	}
 }
 
@@ -163,7 +172,7 @@ func specs(coding []string) []RoleSpec {
 		// pkg/loop has always asked for. Until it was registered here,
 		// SubAgentExecutor answered "subagent 'reviewer-strict' not found" and
 		// the documented second opinion never ran.
-		{ID: RoleReviewerStrict, Title: "Strict second reviewer", Description: "Second opinion on a task: approves only on complete, demonstrated evidence.", SystemPrompt: PromptReviewerStrict, Tools: nil, MaxIter: 2, Temperature: 0.0, MaxTokens: 768, SchemaRole: schema.RoleReview},
+		{ID: RoleReviewerStrict, Title: "Strict second reviewer", Description: "Second opinion on a task: approves only on complete, demonstrated evidence.", SystemPrompt: PromptReviewerStrict, Tools: nil, MaxIter: 2, Temperature: 0.0, TemperatureSet: true, MaxTokens: 768, SchemaRole: schema.RoleReview},
 
 		// Architect/editor pair (Aider's measured decomposition win). The
 		// describer reasons with no format constraints and no tools; the editor
diff --git a/pkg/agents/factory_test.go b/pkg/agents/factory_test.go
index 60617a7..86e1c09 100644
--- a/pkg/agents/factory_test.go
+++ b/pkg/agents/factory_test.go
@@ -33,6 +33,38 @@ func TestSpecsRoster(t *testing.T) {
 	}
 }
 
+// TestStrictReviewerPinsTemperatureZeroDeliberately: reviewer-strict is the one
+// built-in that asks for temperature 0, and 0 is the float zero value. Without
+// an explicit "set" marker the request encoding dropped it and the strict
+// reviewer sampled at the server default. The marker must reach the provider
+// directives; roles that never set a temperature must not carry it.
+func TestStrictReviewerPinsTemperatureZeroDeliberately(t *testing.T) {
+	var strict, reviewer *RoleSpec
+	for i := range Specs() {
+		switch Specs()[i].ID {
+		case RoleReviewerStrict:
+			s := Specs()[i]
+			strict = &s
+		case plan.RoleReviewer:
+			s := Specs()[i]
+			reviewer = &s
+		}
+	}
+	if strict == nil || reviewer == nil {
+		t.Fatal("roster is missing reviewer or reviewer-strict")
+	}
+	if strict.Temperature != 0 || !strict.TemperatureSet {
+		t.Fatalf("reviewer-strict temperature=%v set=%v, want 0 set deliberately", strict.Temperature, strict.TemperatureSet)
+	}
+	d := strict.Directives()
+	if !d.TemperatureSet || d.Temperature != 0 {
+		t.Fatalf("directives lost the pin: %+v", d)
+	}
+	if reviewer.TemperatureSet || reviewer.Directives().TemperatureSet {
+		t.Fatal("a role that never pinned its temperature is marked as having set one")
+	}
+}
+
 func TestCodingAgentsAllowFindModelsAndMCP(t *testing.T) {
 	need := map[string]bool{"find_models": false, "mcp_call": false}
 	for _, s := range Specs() {
diff --git a/pkg/backends/structured.go b/pkg/backends/structured.go
index 5ede661..e2a1945 100644
--- a/pkg/backends/structured.go
+++ b/pkg/backends/structured.go
@@ -39,6 +39,14 @@ type Directives struct {
 	StopSequences []string
 	// ToolChoice is passed through as `tool_choice` (normally "auto").
 	ToolChoice string
+	// Temperature is the role's sampling temperature, meaningful only when
+	// TemperatureSet is true. It exists because the request encoding treats a
+	// zero temperature as UNSET: GoLangGraph substitutes the provider's default
+	// and the OpenAI-compatible body omits the key, so a role that deliberately
+	// asked for 0 (reviewer-strict) was sampled at the server default instead.
+	// The structured path always emits `temperature` for a role that set one.
+	Temperature    float64
+	TemperatureSet bool
 }
 
 // backendMeta is what the direct structured path needs to talk to a server on
@@ -386,8 +394,14 @@ func (p *structuredProvider) buildBody(req llm.CompletionRequest, spec schema.Sp
 		"messages": msgs,
 		"stream":   false,
 	}
-	if req.Temperature > 0 {
+	// A zero temperature is only "unset" for a role that never set one. A role
+	// whose spec pinned it — reviewer-strict at 0 — gets the key regardless,
+	// or the server samples at its own default and the pin was fiction.
+	switch {
+	case req.Temperature > 0:
 		body["temperature"] = req.Temperature
+	case p.directives.TemperatureSet:
+		body["temperature"] = p.directives.Temperature
 	}
 	if req.MaxTokens > 0 {
 		body["max_tokens"] = req.MaxTokens
diff --git a/pkg/backends/structured_test.go b/pkg/backends/structured_test.go
index 7fc2d94..f92376e 100644
--- a/pkg/backends/structured_test.go
+++ b/pkg/backends/structured_test.go
@@ -379,6 +379,40 @@ func TestBuildBodyOmitsEmptyFields(t *testing.T) {
 	}
 }
 
+// TestBuildBodyEmitsAnExplicitlySetZeroTemperature: reviewer-strict pins
+// temperature 0, and 0 is the float zero value — so "omit when zero" silently
+// dropped the one temperature that was set on purpose and the server sampled
+// at its default. A role that SET a temperature always gets the key.
+func TestBuildBodyEmitsAnExplicitlySetZeroTemperature(t *testing.T) {
+	p := &structuredProvider{
+		meta:       backendMeta{Provider: "openai", Endpoint: "http://x/v1"},
+		directives: Directives{Role: "reviewer-strict", Temperature: 0, TemperatureSet: true},
+	}
+	spec, _ := schema.For(schema.RoleReview)
+	body := p.buildBody(llm.CompletionRequest{
+		Messages: []llm.Message{{Role: "user", Content: "hi"}},
+	}, spec, MechJSONObject, "m")
+	got, ok := body["temperature"]
+	if !ok {
+		t.Fatal("an explicitly set temperature of 0 was omitted from the body")
+	}
+	if got != 0.0 {
+		t.Fatalf("temperature = %v, want 0", got)
+	}
+	b, err := json.Marshal(body)
+	if err != nil || !strings.Contains(string(b), `"temperature":0`) {
+		t.Errorf("body = %s err=%v", b, err)
+	}
+	// A request that carries its own non-zero temperature still wins.
+	body = p.buildBody(llm.CompletionRequest{
+		Messages:    []llm.Message{{Role: "user", Content: "hi"}},
+		Temperature: 0.3,
+	}, spec, MechJSONObject, "m")
+	if body["temperature"] != 0.3 {
+		t.Errorf("request temperature overridden: %v", body["temperature"])
+	}
+}
+
 func TestStructuredPathObservesThroughput(t *testing.T) {
 	ResetCapabilityCache()
 	GlobalThroughput.Reset()

From a116044411f2ce8f1f8581c6942d9053f943a01a Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 08:39:04 +0000
Subject: [PATCH 07/23] feat(studio): run history that reads at a glance,
 dialogs that trap focus, tabs that roam
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

RunHistory list rows show the archive's numbers when the server sends
them — duration, tasks done/total, failed count, tokens, cost and team
chips — and stay as they were for older archives. Every run gets a
Replay on the floor button (navigates to /?run=ID&replay=1; harmless
while Live ignores the parameters), /runs?run=ID preselects a run, and
the empty state distinguishes no runs from no filter match with a CTA.

HITLPopup reuses Modal's focus trap: Tab stays inside the gate and Esc
returns focus to the first action with a note on why the gate stays,
since a gate cannot be dismissed. The Artifacts tabs on Runs and the
kind tabs on Blocks use a roving tabindex with aria-controls. Blocks'
empty state explains what a block is and offers the first one.

TopBar's model search waits 200 ms and drops superseded answers via an
AbortController instead of firing per keystroke. docs/studio.md gains
the stuck-task story, the run-end actions, the keyboard table and the
cross-component event/URL contract.
---
 docs/studio.md                              |  74 ++++++-
 web/src/components/Blocks/BlockManager.tsx  |  43 +++-
 web/src/components/Live/HITLPopup.test.tsx  |  25 +++
 web/src/components/Live/HITLPopup.tsx       |  15 ++
 web/src/components/Runs/RunHistory.test.tsx | 111 ++++++++++
 web/src/components/Runs/RunHistory.tsx      | 220 ++++++++++++++++----
 web/src/components/TopBar.tsx               |  35 +++-
 7 files changed, 467 insertions(+), 56 deletions(-)
 create mode 100644 web/src/components/Runs/RunHistory.test.tsx

diff --git a/docs/studio.md b/docs/studio.md
index 5511040..2b4dca1 100644
--- a/docs/studio.md
+++ b/docs/studio.md
@@ -79,8 +79,50 @@ the binary. `make web-check` runs the SPA's lint, typecheck, tests and build.
 | `/settings` | **Settings** | Provider, model, stacks, packs, HITL modes, parallelism, MCP, API keys |
 
 A global **HITL modal** surfaces clarify / plan-approve / continue / escalate / shell gates from
-any page — you no longer have to be on the Live view to answer one. A **connection badge** shows
-stream health, and an error boundary keeps one broken panel from blanking the app.
+any page — you no longer have to be on the Live view to answer one. It traps Tab and answers Esc
+by returning focus to the decision (a gate cannot be dismissed — the harness is waiting). A
+**connection badge** shows stream health, and an error boundary keeps one broken panel from
+blanking the app.
+
+### When a task gets stuck
+
+A blocked or failed card tells its story instead of showing one error line: the **Attempts**
+timeline (`attempt_log` — "attempt 2 failed because …"), the gate-retry count, the **review
+verdict**, and the structured **criteria** checklist. Under it, a next-step row:
+
+| Action | What it does |
+|---|---|
+| **Send back to Ready** | `PATCH /api/tasks/{id}` → column `ready_to_dev`; the next wave picks it up |
+| **Retry** | `POST /api/tasks/{id}/retry` — same, keeping the attempt log so the next try knows what failed (falls back to the Ready move on a server without the endpoint; `409` means no board is loaded) |
+| **Reassign team** | opens the edit form on the team control |
+| **Steer** | prefills the live-feedback composer with `@task:ID ` — from the board it navigates to Live first |
+
+The same row appears in the Live task panel, whose **Blocked / Failed** counters are filters over
+the list. The panel accepts a `focusTaskId` prop (and Live reads `/?task=ID`) to expand, scroll
+to and flash one task.
+
+### When a run ends
+
+The result panel's **What next** row offers whichever of these apply: **Resume interrupted run**,
+**Open blocked on Board** (`/board?column=blocked`), **Review N pending**, and **Run again with
+this prompt**. The app also fires a toast, flashes the tab title while the tab is hidden, sends a
+browser notification when the tab is hidden *and* permission was already granted (Studio never
+asks for it on its own), and throws a two-second confetti burst on a green run — not under
+`prefers-reduced-motion`.
+
+### Keyboard
+
+| Keys | Does |
+|---|---|
+| `?` | shortcut sheet |
+| `⌘K` / `Ctrl+K` | command palette — pages, tasks by id or title, agents, teams, recent runs, theme |
+| `/` | focus the run prompt |
+| `⌘↵` / `Ctrl+Enter` | run the prompt, while it is focused |
+| `⌘.` / `Ctrl+.` | stop the active run, while the prompt is focused |
+| `g` then `l` `b` `r` `p` `a` `t` `k` `f` `s` `h` `,` | go to Live, Board, Review, Pipeline, Agents, Teams, Blocks, Files, Skills, Runs, Settings |
+| `Esc` | close a dialog, the sheet or the palette |
+
+Plain-key shortcuts are inert while typing in a field; the modifier ones are not.
 
 ---
 
@@ -174,6 +216,9 @@ than resolved.
 - When events genuinely could not be replayed, an explicit `event: gap` frame is emitted with
   `{from, to}`, so the UI can say *"events N–M were dropped"* instead of quietly showing an
   incomplete run. A slow consumer is flagged rather than silently dropped.
+- Kind `run_end` (phase `done` or `error`, message = the summary) is what the run-end toast,
+  title flash and notification key on. Kind `review_pending` (`{pending: N}`) tells the Review
+  page to refresh while a run is still writing; without it the page polls every 15 s during a run.
 
 `GET /api/queries/{id}/events` replays a recorded run's log, and `GET /api/queries/{id}/trace`
 groups it into contiguous phase segments with totals — the numbers that matter when tuning a
@@ -343,6 +388,31 @@ otherwise.
 `react-hooks/exhaustive-deps` is an **error**, not a warning: a stale closure in the SSE handler
 once reduced the live event log to a single row, and that rule is what catches it.
 
+### Cross-component contracts
+
+A few interactions cross component boundaries without a shared parent. They go through
+`CustomEvent`s on `window`, all named in `web/src/components/ui/events.ts`. Every event is
+dispatched `cancelable`; a listener that handles it calls `preventDefault()`, and the dispatcher
+falls back to doing the work itself when nobody does.
+
+| Event | Fired by | Listened to by |
+|---|---|---|
+| `slmcode:focus-prompt` | `/` | Live view — focuses the prompt |
+| `slmcode:run-prompt` (`detail.query?`) | `⌘↵` in the prompt; the result panel's *Run again* | Live view — starts the prompt (or `detail.query`) with the chosen teams/specialist; the result panel calls `POST /api/runs` directly when unclaimed |
+| `slmcode:stop-run` | `⌘.` in the prompt | Live view — `POST /api/runs/stop` |
+| `slmcode:steer-task` (`detail.taskId`) | a task's *Steer* | `LiveFeedback` — prefills `@task:ID `; parked in `sessionStorage` when no composer is mounted |
+| `slmcode:command-palette` | anything | `Layout` — toggles the palette |
+
+The prompt input is recognised by its accessible name `Run prompt` (or a `data-run-prompt`
+attribute). URL parameters that pages read: `/board?column=blocked` (Board), `/files?path=a/b.go`
+(Files), `/runs?run=ID` (Runs), `/?task=ID` (Live → task panel `focusTaskId`),
+`/?run=ID&replay=1` (Runs → *Replay on the floor*; harmless when Live ignores it).
+
+Errors on every editor page go through `useToast().reportError`; list pages render
+`ui/ErrorState` with a Retry in place of the list when their load fails. Tab strips use
+`ui/useRovingTabs` (one Tab stop, arrows between tabs, `aria-controls` to the panel). Dialogs
+share `useFocusTrap` from `ui/Modal.tsx`.
+
 `make ui-react` builds and syncs `web/dist/` into `cmd/slmcode/ui/`, which is embedded with
 `go:embed all:ui`. `make bootstrap` does the same but only when the assets are missing.
 
diff --git a/web/src/components/Blocks/BlockManager.tsx b/web/src/components/Blocks/BlockManager.tsx
index 54004ef..bd24cbf 100644
--- a/web/src/components/Blocks/BlockManager.tsx
+++ b/web/src/components/Blocks/BlockManager.tsx
@@ -19,6 +19,7 @@ import {
 import clsx from 'clsx';
 import BlockEditor from './BlockEditor';
 import { useConfirm } from '@/components/ui/Modal';
+import { useRovingTabs } from '@/components/ui/useRovingTabs';
 
 const KIND_ICONS: Record<string, ReactNode> = {
   pack: <Package size={20} />,
@@ -164,6 +165,13 @@ export default function BlockManager() {
   };
 
   const blocks = getBlocksForTab();
+  const selectTab = useCallback((id: string) => {
+    setActiveTab(id);
+    setLoading(true);
+  }, []);
+  // 'all' stands in for the empty id: ids become element ids, which cannot be empty.
+  const tabs = TABS.map((t) => ({ id: t.id || 'all' }));
+  const { tabProps, panelProps, listProps } = useRovingTabs(tabs, activeTab || 'all', (id) => selectTab(id === 'all' ? '' : id));
 
   return (
     <div className="mx-auto w-full max-w-[120rem] space-y-6 p-4 2xl:p-8">
@@ -194,13 +202,13 @@ export default function BlockManager() {
       </div>
 
       {/* Tabs */}
-      <div className="flex gap-1 p-1 bg-gray-100 dark:bg-gray-800 rounded-lg">
+      <div {...listProps} aria-label="Block kinds" className="flex gap-1 p-1 bg-gray-100 dark:bg-gray-800 rounded-lg">
         {TABS.map((tab) => (
           <button
             key={tab.id}
-            onClick={() => { setActiveTab(tab.id); setLoading(true); }}
+            {...tabProps(tab.id || 'all')}
             className={clsx(
-              'flex-1 px-4 py-2 text-sm font-medium rounded-md transition-all duration-150',
+              'focus-ring flex-1 px-4 py-2 text-sm font-medium rounded-md transition-all duration-150',
               activeTab === tab.id
                 ? 'bg-white dark:bg-gray-700 text-gray-900 dark:text-white shadow-sm'
                 : 'text-gray-500 dark:text-gray-400 hover:text-gray-700 dark:hover:text-gray-200',
@@ -211,6 +219,8 @@ export default function BlockManager() {
         ))}
       </div>
 
+      <div {...panelProps(activeTab || 'all')} className="space-y-6 focus:outline-none">
+
       {/* Notice */}
       {notice && (
         <div className="flex items-center gap-2 px-4 py-3 rounded-lg bg-emerald-50 dark:bg-emerald-900/20 text-emerald-700 dark:text-emerald-300 text-sm">
@@ -238,12 +248,28 @@ export default function BlockManager() {
       {!loading && blocks.length === 0 && (
         <div className="text-center py-20 text-gray-400 dark:text-gray-500">
           <Package size={48} className="mx-auto mb-4 opacity-50" />
-          <p className="text-lg font-medium">No blocks found</p>
-          <p className="text-sm mt-1">
-            {activeTab
-              ? `Add YAML blocks to .slmcode/blocks/ or click "New ${KIND_TITLES[activeTab]}" above`
-              : 'Add YAML blocks to .slmcode/blocks/ or ~/.slmcode/blocks/'}
+          <p className="text-lg font-medium">
+            {activeTab ? `No ${KIND_TITLES[activeTab].toLowerCase()} blocks yet` : 'No blocks yet'}
+          </p>
+          <p className="text-sm mt-1 mx-auto max-w-md">
+            Blocks are the YAML presets a run is assembled from: a pack picks a stack, a pipeline orders the
+            phases, agents fill the seats and quality blocks gate the work. They live in{' '}
+            <code className="font-mono">.slmcode/blocks/</code> (project) or <code className="font-mono">~/.slmcode/blocks/</code>.
           </p>
+          {activeTab ? (
+            <button
+              type="button"
+              onClick={() => setEditor({ kind: activeTab, mode: 'create', block: null })}
+              className="btn-primary mx-auto mt-4 gap-1.5 text-sm"
+            >
+              <Plus size={15} />
+              New {KIND_TITLES[activeTab]}
+            </button>
+          ) : (
+            <button type="button" onClick={() => selectTab('pack')} className="btn-secondary mx-auto mt-4 text-sm">
+              Browse packs
+            </button>
+          )}
         </div>
       )}
 
@@ -392,6 +418,7 @@ export default function BlockManager() {
           ))}
         </div>
       )}
+      </div>
 
       {/* Create/Edit modal */}
       {editor && (
diff --git a/web/src/components/Live/HITLPopup.test.tsx b/web/src/components/Live/HITLPopup.test.tsx
index 9435223..3c92556 100644
--- a/web/src/components/Live/HITLPopup.test.tsx
+++ b/web/src/components/Live/HITLPopup.test.tsx
@@ -114,4 +114,29 @@ describe('HITLPopup', () => {
     rerender(<HITLPopup running askSignal={1} />);
     await waitFor(() => expect(getShellPending.mock.calls.length).toBeGreaterThan(before));
   });
+
+  // The dialog had the role but not the behaviour: Tab wandered into the page
+  // underneath, and Esc did nothing at all.
+  it('keeps Tab inside the gate and answers Esc without dismissing it', async () => {
+    const user = userEvent.setup();
+    render(
+      <>
+        <button type="button">outside</button>
+        <HITLPopup running askSignal={0} />
+      </>,
+    );
+    const dialog = await screen.findByRole('dialog');
+    await waitFor(() => expect(dialog.contains(document.activeElement)).toBe(true));
+
+    // Twenty tabs in either direction never leave the dialog.
+    for (let i = 0; i < 20; i++) await user.tab();
+    expect(dialog.contains(document.activeElement)).toBe(true);
+    for (let i = 0; i < 20; i++) await user.tab({ shift: true });
+    expect(dialog.contains(document.activeElement)).toBe(true);
+
+    await user.keyboard('{Escape}');
+    expect(screen.getByRole('dialog')).toBeInTheDocument();
+    expect(await screen.findByText(/waits for an answer/i)).toBeInTheDocument();
+    expect(dialog.contains(document.activeElement)).toBe(true);
+  });
 });
diff --git a/web/src/components/Live/HITLPopup.tsx b/web/src/components/Live/HITLPopup.tsx
index b411374..91c99a6 100644
--- a/web/src/components/Live/HITLPopup.tsx
+++ b/web/src/components/Live/HITLPopup.tsx
@@ -13,6 +13,7 @@ import {
   AlertOctagon,
 } from 'lucide-react';
 import clsx from 'clsx';
+import { useFocusTrap } from '@/components/ui/Modal';
 import PlanEditor from './PlanEditor';
 import {
   getClarifyPending,
@@ -332,6 +333,19 @@ export default function HITLPopup({ running, askSignal = 0 }: HITLPopupProps) {
     };
   }, [pending, currentPendingKey]);
 
+  // ── Tab stays inside the gate; Esc returns to the decision ──
+  //
+  // A gate cannot be dismissed — the harness is waiting for an answer, and
+  // closing the dialog would only hide the countdown. So Esc does the one
+  // safe thing: it puts focus back on the first action and says why the
+  // dialog is still there. The trap itself is Modal's.
+  const panelRef = useRef<HTMLDivElement>(null);
+  const onEscape = useCallback(() => {
+    firstActionRef.current?.focus();
+    setSyncNotice('This gate waits for an answer — pick an action, or let the timer apply the default.');
+  }, []);
+  useFocusTrap(panelRef, { active: Boolean(pending), onEscape, manageInitialFocus: false });
+
   // ── Countdown timer ──
   useEffect(() => {
     if (!pending || countdown <= 0) return;
@@ -455,6 +469,7 @@ export default function HITLPopup({ running, askSignal = 0 }: HITLPopupProps) {
 
       {/* Modal */}
       <div
+        ref={panelRef}
         role="dialog"
         aria-modal="true"
         aria-labelledby={titleId}
diff --git a/web/src/components/Runs/RunHistory.test.tsx b/web/src/components/Runs/RunHistory.test.tsx
new file mode 100644
index 0000000..4c15b45
--- /dev/null
+++ b/web/src/components/Runs/RunHistory.test.tsx
@@ -0,0 +1,111 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { MemoryRouter, Route, Routes, useLocation } from 'react-router-dom';
+import { describe, expect, it, vi } from 'vitest';
+import RunHistory, { formatCost, formatDuration, formatTokens } from './RunHistory';
+import type { QuerySession, QueryView } from '@/types';
+
+const runs: QuerySession[] = [
+  {
+    id: 'q-20260910-1',
+    query: 'add a health endpoint',
+    success: false,
+    summary: '',
+    updated_at: '2026-09-10T08:00:00Z',
+    duration_ms: 754_000,
+    tokens: 48_200,
+    cost_usd: 0.0132,
+    tasks_total: 5,
+    tasks_done: 3,
+    failed_tasks: 2,
+    teams: ['api', 'web'],
+  },
+  // A run from an older archive: none of the new fields.
+  { id: 'q-old', query: 'old run', success: true, summary: '', updated_at: '2026-09-01T08:00:00Z' },
+];
+
+const view: QueryView = {
+  id: 'q-20260910-1',
+  query: 'add a health endpoint',
+  success: false,
+  updated_at: '',
+  summary_md: '',
+  plan_md: '',
+  tasks_md: '',
+  summary: '',
+  board: { plan: { summary: '', goals: [], assumptions: [], risks: [], steps: [], raw: '' }, tasks: [], columns: [], by_column: {} },
+};
+
+vi.mock('@/api/client', () => ({
+  errorText: (e: unknown) => String(e),
+  getQueries: vi.fn(async () => runs),
+  getQuery: vi.fn(async () => view),
+  getQueryEvents: vi.fn(async () => ({ id: 'q-20260910-1', events: [] })),
+  getQueryTrace: vi.fn(async () => ({ id: 'q-20260910-1', phases: [], totals: {} })),
+  resumeRun: vi.fn(),
+}));
+vi.mock('@/components/Live/EventLog', () => ({ default: () => <div data-testid="eventlog" /> }));
+vi.mock('./TraceView', () => ({ default: () => <div data-testid="trace" /> }));
+
+function Location() {
+  const loc = useLocation();
+  return <div data-testid="location">{loc.pathname + loc.search}</div>;
+}
+
+describe('formatters', () => {
+  it('render durations, tokens and cost at a glance', () => {
+    expect(formatDuration(754_000)).toBe('12m 34s');
+    expect(formatDuration(42_000)).toBe('42s');
+    expect(formatDuration(3_720_000)).toBe('1h 2m');
+    expect(formatTokens(48_200)).toBe('48k tok');
+    expect(formatTokens(1_250_000)).toBe('1.3M tok');
+    expect(formatCost(0.0132)).toBe('$0.01');
+    expect(formatCost(0.0004)).toBe('$0.0004');
+  });
+});
+
+describe('RunHistory list', () => {
+  it('shows the archive numbers and team chips when the server sends them', async () => {
+    render(
+      <MemoryRouter initialEntries={['/runs']}>
+        <RunHistory />
+      </MemoryRouter>,
+    );
+    const item = (await screen.findByText('add a health endpoint', { selector: 'div' })).closest('button')!;
+    expect(item).toHaveTextContent('12m 34s');
+    expect(item).toHaveTextContent('3/5 done');
+    expect(item).toHaveTextContent('2 failed');
+    expect(item).toHaveTextContent('48k tok');
+    expect(item).toHaveTextContent('$0.01');
+    expect(item).toHaveTextContent('api');
+    expect(item).toHaveTextContent('web');
+
+    // The older archive shows only what it has.
+    const old = screen.getByText('old run').closest('button')!;
+    expect(old).not.toHaveTextContent('done');
+    expect(old).not.toHaveTextContent('tok');
+  });
+
+  it('replays the selected run on the Live floor', async () => {
+    render(
+      <MemoryRouter initialEntries={['/runs']}>
+        <Routes>
+          <Route path="/runs" element={<RunHistory />} />
+          <Route path="/" element={<Location />} />
+        </Routes>
+      </MemoryRouter>,
+    );
+    await userEvent.click(await screen.findByRole('button', { name: /Replay on the floor/ }));
+    expect(await screen.findByTestId('location')).toHaveTextContent('/?run=q-20260910-1&replay=1');
+  });
+
+  it('opens the run named by ?run=', async () => {
+    render(
+      <MemoryRouter initialEntries={['/runs?run=q-old']}>
+        <RunHistory />
+      </MemoryRouter>,
+    );
+    const old = await screen.findByText('old run');
+    expect(old.closest('button')).toHaveAttribute('aria-current', 'true');
+  });
+});
diff --git a/web/src/components/Runs/RunHistory.tsx b/web/src/components/Runs/RunHistory.tsx
index 20504cb..34b8f45 100644
--- a/web/src/components/Runs/RunHistory.tsx
+++ b/web/src/components/Runs/RunHistory.tsx
@@ -1,22 +1,27 @@
 import { useContext, useEffect, useMemo, useState } from 'react';
+import { Link, useNavigate, useSearchParams } from 'react-router-dom';
 import {
   Activity,
   AlertTriangle,
   Bot,
   CheckCircle2,
   Clock,
+  Coins,
   FileText,
   GitBranch,
   ListChecks,
   Play,
   RefreshCw,
   Search,
+  Timer,
   XCircle,
 } from 'lucide-react';
 import { getQueries, getQuery, getQueryEvents, resumeRun } from '@/api/client';
 import type { DynamicComposition, QuerySession, QueryView, RunEvent, RunEventSummary, Task } from '@/types';
 import { AppContext } from '@/App';
 import EventLog from '@/components/Live/EventLog';
+import { useRovingTabs } from '@/components/ui/useRovingTabs';
+import { teamColor } from '@/components/Board/teamColor';
 import clsx from 'clsx';
 import TraceView from './TraceView';
 
@@ -32,8 +37,13 @@ const COLUMN_LABELS: Record<string, string> = {
 
 export default function RunHistory() {
   const ctx = useContext(AppContext);
+  const navigate = useNavigate();
+  // `/runs?run=<id>` opens that run — the command palette and the review
+  // queue's provenance link land here.
+  const [searchParams] = useSearchParams();
+  const requestedID = searchParams.get('run') || '';
   const [runs, setRuns] = useState<QuerySession[]>([]);
-  const [selectedID, setSelectedID] = useState('');
+  const [selectedID, setSelectedID] = useState(requestedID);
   const [selected, setSelected] = useState<QueryView | null>(null);
   const [events, setEvents] = useState<RunEvent[]>([]);
   const [eventSummary, setEventSummary] = useState<RunEventSummary | null>(null);
@@ -61,6 +71,10 @@ export default function RunHistory() {
     loadRuns();
   }, []);
 
+  useEffect(() => {
+    if (requestedID) setSelectedID(requestedID);
+  }, [requestedID]);
+
   useEffect(() => {
     if (!selectedID) {
       setSelected(null);
@@ -146,36 +160,28 @@ export default function RunHistory() {
 
         <div className="flex-1 overflow-auto p-2 space-y-1">
           {filteredRuns.map((run) => (
-            <button
-              key={run.id}
-              onClick={() => setSelectedID(run.id)}
-              className={clsx(
-                'w-full text-left p-3 rounded-lg border transition-colors',
-                selectedID === run.id
-                  ? 'border-brand-300 bg-brand-50 dark:border-brand-800 dark:bg-brand-950/30'
-                  : 'border-transparent hover:bg-gray-100 dark:hover:bg-gray-800',
-              )}
-            >
-              <div className="flex items-center gap-2">
-                {run.success ? (
-                  <CheckCircle2 size={14} className="text-emerald-500 shrink-0" />
-                ) : (
-                  <XCircle size={14} className="text-red-500 shrink-0" />
-                )}
-                <span className="font-mono text-[10px] text-gray-400 truncate">{run.id}</span>
-                {run.interrupted && <span className="badge-neutral ml-auto text-[10px]">Interrupted</span>}
-              </div>
-              <div className="mt-1 text-sm font-medium text-gray-900 dark:text-gray-100 line-clamp-2">
-                {run.query || '(empty query)'}
-              </div>
-              <div className="mt-1 flex items-center gap-2 text-[10px] text-gray-500">
-                <Clock size={11} />
-                <span>{formatDate(run.updated_at)}</span>
-              </div>
-            </button>
+            <RunListItem key={run.id} run={run} selected={selectedID === run.id} onSelect={() => setSelectedID(run.id)} />
           ))}
-          {!loadingList && filteredRuns.length === 0 && (
-            <div className="p-6 text-center text-xs text-gray-400">No archived runs match this filter.</div>
+          {!loadingList && filteredRuns.length === 0 && runs.length > 0 && (
+            <div className="p-6 text-center text-xs text-gray-400">
+              <p>No archived runs match “{filter.trim()}”.</p>
+              <button type="button" onClick={() => setFilter('')} className="mt-2 text-brand-600 hover:underline dark:text-brand-400">
+                Clear the filter
+              </button>
+            </div>
+          )}
+          {!loadingList && runs.length === 0 && !error && (
+            <div className="p-6 text-center text-xs text-gray-400">
+              <p className="font-medium text-gray-500 dark:text-gray-300">No runs yet.</p>
+              <p className="mt-1">
+                Every run is archived here with its plan, board, event log and a per-phase trace of time,
+                tokens and cost — the numbers to compare when tuning a local model.
+              </p>
+              <Link to="/" className="btn-primary mt-3 inline-flex h-8 items-center gap-1.5 px-3 text-xs">
+                <Play size={12} fill="currentColor" aria-hidden="true" />
+                Start your first run
+              </Link>
+            </div>
           )}
         </div>
       </aside>
@@ -201,6 +207,7 @@ export default function RunHistory() {
               resuming={resuming === selected?.id}
               running={!!ctx?.liveRunning}
               onResume={handleResume}
+              onReplay={(id) => navigate(`/?run=${encodeURIComponent(id)}&replay=1`)}
             />
             {compositionError && <CompositionWarning message={compositionError} />}
             {composition && <CompositionPanel composition={composition} />}
@@ -232,6 +239,111 @@ export default function RunHistory() {
   );
 }
 
+// ── One archived run in the list ──
+//
+// It used to be an icon, an id, the query and a date, so telling a
+// forty-second smoke run from a twenty-minute build meant opening each.
+// The archive's own numbers ride on the row when the server sends them.
+
+export function formatDuration(ms: number): string {
+  if (!Number.isFinite(ms) || ms < 0) return '';
+  if (ms < 1000) return `${Math.round(ms)}ms`;
+  const s = Math.round(ms / 1000);
+  if (s < 60) return `${s}s`;
+  const m = Math.floor(s / 60);
+  if (m < 60) return `${m}m ${s % 60}s`;
+  return `${Math.floor(m / 60)}h ${m % 60}m`;
+}
+
+export function formatTokens(n: number): string {
+  if (!Number.isFinite(n)) return '';
+  if (n >= 1_000_000) return `${(n / 1_000_000).toFixed(1)}M tok`;
+  if (n >= 1000) return `${(n / 1000).toFixed(n >= 10_000 ? 0 : 1)}k tok`;
+  return `${n} tok`;
+}
+
+export function formatCost(usd: number): string {
+  if (!Number.isFinite(usd)) return '';
+  if (usd === 0) return '$0';
+  return usd < 0.01 ? `$${usd.toFixed(4)}` : `$${usd.toFixed(2)}`;
+}
+
+function RunListItem({ run, selected, onSelect }: { run: QuerySession; selected: boolean; onSelect: () => void }) {
+  const hasTasks = typeof run.tasks_total === 'number' && run.tasks_total > 0;
+  const failed = run.failed_tasks ?? 0;
+  const facts: Array<{ key: string; icon: React.ReactNode; text: string; title: string; bad?: boolean }> = [];
+  if (typeof run.duration_ms === 'number' && run.duration_ms > 0) {
+    facts.push({ key: 'duration', icon: <Timer size={10} aria-hidden="true" />, text: formatDuration(run.duration_ms), title: 'Wall time' });
+  }
+  if (hasTasks) {
+    facts.push({
+      key: 'tasks',
+      icon: <ListChecks size={10} aria-hidden="true" />,
+      text: `${run.tasks_done ?? 0}/${run.tasks_total} done`,
+      title: 'Tasks done / total',
+    });
+  }
+  if (failed > 0) {
+    facts.push({ key: 'failed', icon: <XCircle size={10} aria-hidden="true" />, text: `${failed} failed`, title: 'Failed tasks', bad: true });
+  }
+  if (typeof run.tokens === 'number' && run.tokens > 0) {
+    facts.push({ key: 'tokens', icon: <Activity size={10} aria-hidden="true" />, text: formatTokens(run.tokens), title: 'Tokens' });
+  }
+  if (typeof run.cost_usd === 'number' && run.cost_usd > 0) {
+    facts.push({ key: 'cost', icon: <Coins size={10} aria-hidden="true" />, text: formatCost(run.cost_usd), title: 'Estimated cost' });
+  }
+  return (
+    <button
+      onClick={onSelect}
+      aria-current={selected ? 'true' : undefined}
+      className={clsx(
+        'w-full text-left p-3 rounded-lg border transition-colors',
+        selected
+          ? 'border-brand-300 bg-brand-50 dark:border-brand-800 dark:bg-brand-950/30'
+          : 'border-transparent hover:bg-gray-100 dark:hover:bg-gray-800',
+      )}
+    >
+      <div className="flex items-center gap-2">
+        {run.success ? (
+          <CheckCircle2 size={14} className="text-emerald-500 shrink-0" aria-label="Succeeded" />
+        ) : (
+          <XCircle size={14} className="text-red-500 shrink-0" aria-label="Needs review" />
+        )}
+        <span className="font-mono text-[10px] text-gray-400 truncate">{run.id}</span>
+        {run.interrupted && <span className="badge-neutral ml-auto text-[10px]">Interrupted</span>}
+      </div>
+      <div className="mt-1 text-sm font-medium text-gray-900 dark:text-gray-100 line-clamp-2">
+        {run.query || '(empty query)'}
+      </div>
+      <div className="mt-1 flex flex-wrap items-center gap-x-2 gap-y-0.5 text-[10px] text-gray-500">
+        <span className="inline-flex items-center gap-1">
+          <Clock size={11} aria-hidden="true" />
+          {formatDate(run.updated_at)}
+        </span>
+        {facts.map((f) => (
+          <span
+            key={f.key}
+            title={f.title}
+            className={clsx('inline-flex items-center gap-0.5 font-mono tabular-nums', f.bad && 'text-red-600 dark:text-red-400')}
+          >
+            {f.icon}
+            {f.text}
+          </span>
+        ))}
+      </div>
+      {run.teams && run.teams.length > 0 && (
+        <div className="mt-1.5 flex flex-wrap gap-1">
+          {run.teams.map((t) => (
+            <span key={t} className={clsx('rounded px-1.5 py-px font-mono text-[9px] font-semibold', teamColor(t).badge)} title={`Team ${t}`}>
+              {t}
+            </span>
+          ))}
+        </div>
+      )}
+    </button>
+  );
+}
+
 function RunHeader({
   run,
   loading,
@@ -239,6 +351,7 @@ function RunHeader({
   resuming,
   running,
   onResume,
+  onReplay,
 }: {
   run: QueryView | null;
   loading: boolean;
@@ -246,6 +359,7 @@ function RunHeader({
   resuming: boolean;
   running: boolean;
   onResume: (id: string) => void;
+  onReplay: (id: string) => void;
 }) {
   return (
     <section className="card p-4">
@@ -262,6 +376,18 @@ function RunHeader({
           {run?.summary && <p className="mt-2 text-sm text-gray-500 dark:text-gray-400">{run.summary}</p>}
         </div>
         <div className="flex items-center gap-2">
+          {run && (
+            <button
+              type="button"
+              onClick={() => onReplay(run.id)}
+              disabled={running}
+              className="btn-secondary gap-1.5 text-xs"
+              title="Open the Live floor with this run's archived events"
+            >
+              <Activity size={13} aria-hidden="true" />
+              Replay on the floor
+            </button>
+          )}
           {run?.interrupted && (
             <button
               onClick={() => onResume(run.id)}
@@ -427,35 +553,41 @@ function BoardSnapshot({ tasks, stats }: { tasks: Task[]; stats: TaskStats }) {
   );
 }
 
+const ARTIFACT_TABS = [
+  { id: 'summary_md', label: 'Summary' },
+  { id: 'plan_md', label: 'Plan' },
+  { id: 'tasks_md', label: 'Tasks' },
+] as const;
+type ArtifactTab = (typeof ARTIFACT_TABS)[number]['id'];
+
 function SummaryPanel({ run }: { run: QueryView | null }) {
-  const tabs = [
-    ['summary_md', 'Summary'],
-    ['plan_md', 'Plan'],
-    ['tasks_md', 'Tasks'],
-  ] as const;
-  const [active, setActive] = useState<(typeof tabs)[number][0]>('summary_md');
+  const [active, setActive] = useState<ArtifactTab>('summary_md');
+  const { tabProps, panelProps, listProps } = useRovingTabs<ArtifactTab>(ARTIFACT_TABS, active, setActive);
   const content = run?.[active] || '';
   return (
     <section className="card p-4">
       <div className="flex items-center gap-2 mb-3">
         <FileText size={16} className="text-sky-500" />
         <h2 className="text-sm font-bold">Artifacts</h2>
-        <div className="ml-auto flex items-center gap-1 rounded-lg bg-gray-100 p-1 dark:bg-gray-800">
-          {tabs.map(([id, label]) => (
+        <div {...listProps} aria-label="Run artifacts" className="ml-auto flex items-center gap-1 rounded-lg bg-gray-100 p-1 dark:bg-gray-800">
+          {ARTIFACT_TABS.map((tab) => (
             <button
-              key={id}
-              onClick={() => setActive(id)}
+              key={tab.id}
+              {...tabProps(tab.id)}
               className={clsx(
-                'rounded-md px-2 py-1 text-xs font-medium',
-                active === id ? 'bg-white text-gray-900 shadow-sm dark:bg-gray-700 dark:text-gray-100' : 'text-gray-500',
+                'focus-ring rounded-md px-2 py-1 text-xs font-medium',
+                active === tab.id ? 'bg-white text-gray-900 shadow-sm dark:bg-gray-700 dark:text-gray-100' : 'text-gray-500',
               )}
             >
-              {label}
+              {tab.label}
             </button>
           ))}
         </div>
       </div>
-      <pre className="max-h-96 overflow-auto whitespace-pre-wrap rounded-lg bg-gray-50 p-3 text-xs text-gray-700 dark:bg-gray-950 dark:text-gray-300">
+      <pre
+        {...panelProps(active)}
+        className="focus-ring max-h-96 overflow-auto whitespace-pre-wrap rounded-lg bg-gray-50 p-3 text-xs text-gray-700 dark:bg-gray-950 dark:text-gray-300"
+      >
         {content || 'No artifact saved for this run.'}
       </pre>
     </section>
diff --git a/web/src/components/TopBar.tsx b/web/src/components/TopBar.tsx
index fa85f62..3ba0aa5 100644
--- a/web/src/components/TopBar.tsx
+++ b/web/src/components/TopBar.tsx
@@ -15,6 +15,9 @@ import { useToast } from './ui/Toast';
 import type { AgentSpec, AuthStatus, ModelCost } from '@/types';
 import clsx from 'clsx';
 
+/** Quiet time before a model-catalog search fires. */
+const MODEL_SEARCH_DEBOUNCE_MS = 200;
+
 export default function TopBar() {
   const ctx = useContext(AppContext);
   const navigate = useNavigate();
@@ -61,9 +64,25 @@ export default function TopBar() {
     }
   }, [showModelMenu]);
 
-  const fetchModels = async (q = '') => {
+  // The catalog search used to fire one request per keystroke and apply
+  // whichever answer landed last — not necessarily the one for the text in
+  // the box. Now: 200 ms of quiet first, and an AbortController per search
+  // so a superseded answer is dropped when it arrives. (The fetch itself
+  // runs to completion: the client does not take a signal.)
+  const modelSearchTimer = useRef<number | null>(null);
+  const modelSearchAbort = useRef<AbortController | null>(null);
+  useEffect(
+    () => () => {
+      if (modelSearchTimer.current !== null) window.clearTimeout(modelSearchTimer.current);
+      modelSearchAbort.current?.abort();
+    },
+    [],
+  );
+
+  const fetchModels = async (q = '', signal?: AbortSignal) => {
     try {
       const res = await getModels(q ? { q, limit: 40 } : { limit: 40 });
+      if (signal?.aborted) return;
       setModels(res.models || []);
       setCurrentModel(res.current);
       setAuth(res.auth || null);
@@ -75,10 +94,22 @@ export default function TopBar() {
       });
       setModelCosts(costMap);
     } catch (err) {
+      if (signal?.aborted) return;
       toast.reportError(err, 'Could not load the model catalog');
     }
   };
 
+  const searchModels = (q: string) => {
+    if (modelSearchTimer.current !== null) window.clearTimeout(modelSearchTimer.current);
+    modelSearchAbort.current?.abort();
+    const controller = new AbortController();
+    modelSearchAbort.current = controller;
+    modelSearchTimer.current = window.setTimeout(() => {
+      modelSearchTimer.current = null;
+      fetchModels(q, controller.signal);
+    }, MODEL_SEARCH_DEBOUNCE_MS);
+  };
+
   const cycleEnabledModel = async () => {
     const list = enabledModels.length > 0 ? enabledModels : models;
     if (list.length < 2) return;
@@ -227,7 +258,7 @@ export default function TopBar() {
                 value={modelFilter}
                 onChange={(e) => {
                   setModelFilter(e.target.value);
-                  fetchModels(e.target.value);
+                  searchModels(e.target.value);
                 }}
                 placeholder="Search models…"
                 className="input-mono text-xs h-8 w-full"

From e560a6ae5436c2ef81e52f8925d4616275c78506 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 08:43:37 +0000
Subject: [PATCH 08/23] backends: elide old tool results on live ReAct requests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Live ReAct compaction, deterministic half only. A ReAct iteration is one
provider completion and every role is bound to its own registration, so a
provider wrapper is the one place that sees iteration N of a 16-iteration
worker with its full transcript — the same route live token streaming took.
BindRole now stacks liveElideProvider outermost (above the structured
wrapper, so the delegate and the direct constrained-decoding call send the
same transcript) for any role whose Directives carry a LiveElide policy.

Once the estimated transcript passes AtPercent of the model's context window
the content of every tool RESULT but the last five is replaced with a
placeholder. Every tool call, every tool_call_id pair, the leading system
message and every user/assistant turn stay; nothing is summarized — on a
live request the head is the role's tool contract. The rewrite is per
request and never mutates the agent's conversation, so it is repeatable and
the elided prefix is byte-identical between iterations until the keep
window slides.

The factory sizes the policy per tool-using role from the model profile's
context_limit; the orchestrator sets it from react_compact and
react_compact_at_percent. Tool-less roles, an unset policy and a model with
no known window install nothing. The config docstring, schema description,
readiness comment and docs/context.md describe both paths.
---
 docs/context.md                  |  26 +++-
 pkg/agents/factory.go            |  34 +++++-
 pkg/agents/factory_test.go       |  28 +++++
 pkg/backends/live_elide.go       | 197 ++++++++++++++++++++++++++++++
 pkg/backends/live_elide_test.go  | 202 +++++++++++++++++++++++++++++++
 pkg/backends/structured.go       |   8 ++
 pkg/config/config.go             |  12 +-
 pkg/config/schema.go             |   2 +-
 pkg/orchestrator/orchestrator.go |   8 ++
 pkg/readiness/readiness.go       |  13 +-
 10 files changed, 511 insertions(+), 19 deletions(-)
 create mode 100644 pkg/backends/live_elide.go
 create mode 100644 pkg/backends/live_elide_test.go

diff --git a/docs/context.md b/docs/context.md
index 9b7b75b..cb11be6 100644
--- a/docs/context.md
+++ b/docs/context.md
@@ -179,11 +179,27 @@ Anything that stayed a card can be pulled on demand with the `ws_skill` tool.
 
 ## 7. Compaction (`pkg/compact`)
 
-### ReAct compaction (mid-run conversation)
-
-Triggers at `react_compact_at_percent` (default 80) of the window, with a 5-point hysteresis band
-— a compaction that does not open at least that much headroom pauses auto-compaction rather than
-thrashing.
+### ReAct compaction
+
+Two paths share one threshold: `react_compact_at_percent` (default 80) of the model's context
+window (`context_limit` from the model profile). `loop.LiveReactCompactionWired` is the constant of
+record for whether the live path exists; `react_compact` says whether it is used.
+
+**Live iterations — deterministic elision only.** A ReAct iteration is one provider completion, and
+every role is bound to its own provider registration, so a provider wrapper
+(`pkg/backends.LiveElide`, installed by `BindRole` for tool-using roles) sees each iteration's full
+transcript. Once the estimated transcript passes the threshold, the content of every tool *result*
+but the last 5 is replaced with `[tool result elided]`. Every tool *call*, every `tool_call_id`
+pair, the leading system message and every user/assistant turn stay — a transcript that was legal
+before is legal after. Nothing is summarized on a live request: the head of the transcript is the
+role's tool contract, and dropping it mid-call breaks the agent more reliably than a long context
+does. The rewrite is per request and never touches the agent's own conversation, so it is
+repeatable, and the elided prefix stays byte-identical between iterations until the keep window
+slides — KV-cache reuse survives.
+
+**Checkpoint and resume — elision, then a digest.** A restored or checkpointed transcript is
+compacted by `maybeCompactReact`, with a 5-point hysteresis band — a compaction that does not open
+at least that much headroom pauses auto-compaction rather than thrashing.
 
 Two invariants:
 
diff --git a/pkg/agents/factory.go b/pkg/agents/factory.go
index cebf5a3..71e9f1c 100644
--- a/pkg/agents/factory.go
+++ b/pkg/agents/factory.go
@@ -397,6 +397,13 @@ type Factory struct {
 	// ModelProfiles resolves caps against each agent's effective model
 	// (per-agent override ?? global stack/config model).
 	ModelProfiles map[string]config.ModelProfile
+	// LiveElide is the live ReAct compaction policy: on every request a
+	// tool-using role sends, old tool results are elided deterministically
+	// once the transcript passes AtPercent of the model's context window.
+	// WindowTokens is resolved per role from the model profile when left 0.
+	// The zero value installs nothing; the orchestrator sets it from
+	// react_compact / react_compact_at_percent. See loop.LiveReactCompactionWired.
+	LiveElide backends.LiveElide
 	// Optional global fallback caps when ModelProfiles is empty.
 	ProfileMaxTokens int
 	ProfileMaxTurns  int
@@ -764,7 +771,7 @@ func (f *Factory) definition(spec RoleSpec) *agent.BaseAgentDefinition {
 	// response_format, stop, or tool_choice — but it does resolve the provider
 	// by the name set here, which is the one hook the read-only dependency
 	// leaves open. Everything downstream (orchestrator, loop) gets it for free.
-	cfg.Provider = backends.BindRole(f.LLM, cfg.Provider, spec.Directives())
+	cfg.Provider = backends.BindRole(f.LLM, cfg.Provider, f.directivesFor(spec, cfg.Model))
 	cfg.SystemPrompt = spec.SystemPrompt
 	cfg.Tools = spec.Tools
 	cfg.Temperature = spec.Temperature
@@ -813,6 +820,31 @@ func (f *Factory) definition(spec RoleSpec) *agent.BaseAgentDefinition {
 	return def
 }
 
+// directivesFor is the role's decoding contract plus, for a tool-using role,
+// the live elision policy sized to the model it will actually run on.
+func (f *Factory) directivesFor(spec RoleSpec, model string) backends.Directives {
+	d := spec.Directives()
+	d.LiveElide = f.liveElideFor(spec, model)
+	return d
+}
+
+// liveElideFor sizes the live elision policy for one role. A tool-less role
+// has no tool results to elide, and a role whose model has no known context
+// window cannot be given a threshold, so both get the zero policy.
+func (f *Factory) liveElideFor(spec RoleSpec, model string) backends.LiveElide {
+	if len(spec.Tools) == 0 || f.LiveElide.AtPercent <= 0 {
+		return backends.LiveElide{}
+	}
+	e := f.LiveElide
+	if e.WindowTokens <= 0 {
+		e.WindowTokens = config.ResolveModelProfile(f.ModelProfiles, model).ContextLimit
+	}
+	if !e.Enabled() {
+		return backends.LiveElide{}
+	}
+	return e
+}
+
 // isCodingRole classifies by BASE role. An escalated worker that stopped
 // matching here would silently lose its model_profile caps — same agent, wrong
 // token budget, and nothing in the output to say so.
diff --git a/pkg/agents/factory_test.go b/pkg/agents/factory_test.go
index 86e1c09..587265d 100644
--- a/pkg/agents/factory_test.go
+++ b/pkg/agents/factory_test.go
@@ -5,6 +5,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/UnicoLab/slmcode/pkg/backends"
 	"github.com/UnicoLab/slmcode/pkg/config"
 	"github.com/UnicoLab/slmcode/pkg/plan"
 	"github.com/UnicoLab/slmcode/pkg/schema"
@@ -65,6 +66,33 @@ func TestStrictReviewerPinsTemperatureZeroDeliberately(t *testing.T) {
 	}
 }
 
+// TestLiveElideIsSizedPerToolRole: the live elision policy reaches the
+// provider directives of tool-using roles only, sized to the model's context
+// window from the profile; tool-less roles and an unset policy get nothing.
+func TestLiveElideIsSizedPerToolRole(t *testing.T) {
+	f := &Factory{
+		LiveElide:     backends.LiveElide{AtPercent: 80},
+		ModelProfiles: map[string]config.ModelProfile{"default": {ContextLimit: 8192}},
+	}
+	worker := RoleSpec{ID: plan.RoleWorker, Tools: []string{"ws_read", "ws_edit"}}
+	got := f.directivesFor(worker, "some-model").LiveElide
+	if !got.Enabled() || got.WindowTokens != 8192 || got.AtPercent != 80 {
+		t.Fatalf("worker policy = %+v, want enabled at 80%% of 8192", got)
+	}
+	if e := f.directivesFor(RoleSpec{ID: plan.RolePlanner}, "some-model").LiveElide; e.Enabled() {
+		t.Fatalf("a tool-less role was given live elision: %+v", e)
+	}
+	off := &Factory{ModelProfiles: f.ModelProfiles}
+	if e := off.directivesFor(worker, "some-model").LiveElide; e.Enabled() {
+		t.Fatalf("an unset policy was installed: %+v", e)
+	}
+	noWindow := &Factory{LiveElide: backends.LiveElide{AtPercent: 80},
+		ModelProfiles: map[string]config.ModelProfile{"default": {}}}
+	if e := noWindow.directivesFor(worker, "some-model").LiveElide; e.Enabled() {
+		t.Fatalf("a model with no known window was given a threshold: %+v", e)
+	}
+}
+
 func TestCodingAgentsAllowFindModelsAndMCP(t *testing.T) {
 	need := map[string]bool{"find_models": false, "mcp_call": false}
 	for _, s := range Specs() {
diff --git a/pkg/backends/live_elide.go b/pkg/backends/live_elide.go
new file mode 100644
index 0000000..7130c84
--- /dev/null
+++ b/pkg/backends/live_elide.go
@@ -0,0 +1,197 @@
+package backends
+
+import (
+	"context"
+	"strings"
+	"sync"
+
+	"github.com/UnicoLab/slmcode/pkg/compact"
+	"github.com/piotrlaczkowski/GoLangGraph/pkg/llm"
+)
+
+// Live ReAct compaction: deterministic elision of old tool results.
+//
+// A ReAct iteration is exactly one llm.Provider completion, and the roles are
+// already bound to their own provider registrations (BindRole). So the one
+// place in the process that sees iteration N of a 16-iteration worker — with
+// its whole transcript — is a provider wrapper, the same route live token
+// streaming took (stream.go). This file is that wrapper. It sits OUTERMOST in
+// the role's stack, above the structured wrapper, so the elided transcript is
+// what both the delegate and the direct constrained-decoding call send:
+//
+//	liveElideProvider   (role, THIS FILE)
+//	  └── structuredProvider (role, constrained decoding)
+//	        └── streamTeeProvider (role, live tokens)
+//	              └── retryProvider → raw provider
+//
+// It does ONE thing, and only when the estimated transcript is over the
+// threshold: the content of every tool RESULT but the last KeepLast is
+// replaced with a placeholder. Every tool CALL stays, every tool_call_id pair
+// stays, the leading system message and every user/assistant turn stay — a
+// transcript that was legal before is legal after. Nothing is summarized: the
+// checkpoint/resume path (pkg/loop.maybeCompactReact) may fold the head into a
+// system digest, but on a LIVE request the head is the role's tool contract
+// and dropping it mid-call would break the agent more reliably than a long
+// context does. Deterministic elision costs no inference and is measured to
+// beat summarization, which is also why the checkpoint path tries it first.
+//
+// The rewrite is per request and never touches the agent's own conversation,
+// so it is repeatable: iteration N+1 sends the full transcript again and is
+// elided the same way, and the elided prefix is byte-identical between
+// iterations until the keep window slides — KV-cache reuse survives.
+
+// LiveElide configures the wrapper for one role. The zero value disables it.
+type LiveElide struct {
+	// WindowTokens is the model's context window in tokens; <=0 disables.
+	WindowTokens int
+	// AtPercent triggers elision when the estimated transcript reaches this
+	// percentage of WindowTokens; <=0 or >=100 disables.
+	AtPercent int
+	// KeepLast is how many trailing tool results stay verbatim; <=0 means
+	// compact.DefaultElideKeepLast.
+	KeepLast int
+}
+
+// Enabled reports whether this configuration elides anything at all.
+func (e LiveElide) Enabled() bool {
+	return e.WindowTokens > 0 && e.AtPercent > 0 && e.AtPercent < 100
+}
+
+func (e LiveElide) keep() int {
+	if e.KeepLast > 0 {
+		return e.KeepLast
+	}
+	return compact.DefaultElideKeepLast
+}
+
+type liveElideProvider struct {
+	inner llm.Provider
+	role  string
+	cfg   LiveElide
+}
+
+// newLiveElide wraps p, or returns it unchanged when there is nothing to do.
+func newLiveElide(p llm.Provider, role string, cfg LiveElide) llm.Provider {
+	if p == nil || !cfg.Enabled() {
+		return p
+	}
+	return &liveElideProvider{inner: p, role: strings.TrimSpace(role), cfg: cfg}
+}
+
+// requestBytes approximates the prompt the request will render: the system
+// prompt plus every message's text and tool-call payload.
+func requestBytes(req llm.CompletionRequest) int {
+	n := len(req.SystemPrompt)
+	for _, m := range req.Messages {
+		n += len(m.Role) + len(m.Content) + len(m.Name) + len(m.ToolCallID)
+		for _, tc := range m.ToolCalls {
+			n += len(tc.Function.Name) + len(tc.Function.Arguments)
+		}
+	}
+	return n
+}
+
+// elide returns req with old tool results collapsed when the transcript is
+// over the threshold, and req unchanged otherwise.
+func (p *liveElideProvider) elide(req llm.CompletionRequest) llm.CompletionRequest {
+	tokens := compact.EstimateTokens(requestBytes(req))
+	if compact.UsagePercent(tokens, p.cfg.WindowTokens) < float64(p.cfg.AtPercent) {
+		return req
+	}
+	out, n := compact.ElideOldToolResultsFunc(req.Messages, p.cfg.keep(), compact.DefaultElidedPlaceholder,
+		func(m llm.Message) bool { return strings.EqualFold(m.Role, compact.RoleTool) },
+		func(m llm.Message, placeholder string) llm.Message { m.Content = placeholder; return m })
+	if n == 0 {
+		return req
+	}
+	recordElided(p.role, n)
+	req.Messages = out
+	return req
+}
+
+func (p *liveElideProvider) GetName() string { return p.inner.GetName() }
+
+func (p *liveElideProvider) GetModels(ctx context.Context) ([]string, error) {
+	return p.inner.GetModels(ctx)
+}
+
+func (p *liveElideProvider) Complete(ctx context.Context, req llm.CompletionRequest) (*llm.CompletionResponse, error) {
+	return p.inner.Complete(ctx, p.elide(req))
+}
+
+func (p *liveElideProvider) CompleteWithMode(
+	ctx context.Context, req llm.CompletionRequest, mode llm.StreamMode,
+) (*llm.CompletionResponse, error) {
+	return p.inner.CompleteWithMode(ctx, p.elide(req), mode)
+}
+
+func (p *liveElideProvider) CompleteStream(
+	ctx context.Context, req llm.CompletionRequest, cb llm.StreamCallback,
+) error {
+	return p.inner.CompleteStream(ctx, p.elide(req), cb)
+}
+
+func (p *liveElideProvider) CompleteStreamWithMode(
+	ctx context.Context, req llm.CompletionRequest, cb llm.StreamCallback, mode llm.StreamMode,
+) error {
+	return p.inner.CompleteStreamWithMode(ctx, p.elide(req), cb, mode)
+}
+
+func (p *liveElideProvider) IsHealthy(ctx context.Context) error { return p.inner.IsHealthy(ctx) }
+
+func (p *liveElideProvider) GetConfig() map[string]interface{} {
+	c := p.inner.GetConfig()
+	if c == nil {
+		c = map[string]interface{}{}
+	}
+	c["slmcode_live_elide"] = true
+	c["slmcode_live_elide_window_tokens"] = p.cfg.WindowTokens
+	c["slmcode_live_elide_at_percent"] = p.cfg.AtPercent
+	return c
+}
+
+func (p *liveElideProvider) SetConfig(c map[string]interface{}) error { return p.inner.SetConfig(c) }
+func (p *liveElideProvider) SupportsStreaming() bool                  { return p.inner.SupportsStreaming() }
+func (p *liveElideProvider) GetStreamingConfig() *llm.StreamingConfig {
+	return p.inner.GetStreamingConfig()
+}
+
+func (p *liveElideProvider) SetStreamingConfig(c *llm.StreamingConfig) error {
+	return p.inner.SetStreamingConfig(c)
+}
+func (p *liveElideProvider) Close() error { return p.inner.Close() }
+
+// Elision telemetry: how many tool results each role has had collapsed on live
+// requests. Diagnostics read it the way they read MechanismStats.
+var elideStats = struct {
+	mu     sync.Mutex
+	byRole map[string]int
+}{byRole: map[string]int{}}
+
+func recordElided(role string, n int) {
+	if n <= 0 {
+		return
+	}
+	elideStats.mu.Lock()
+	defer elideStats.mu.Unlock()
+	elideStats.byRole[role] += n
+}
+
+// LiveElideStats returns, per role, how many tool results live elision has
+// collapsed so far in this process.
+func LiveElideStats() map[string]int {
+	elideStats.mu.Lock()
+	defer elideStats.mu.Unlock()
+	out := make(map[string]int, len(elideStats.byRole))
+	for k, v := range elideStats.byRole {
+		out[k] = v
+	}
+	return out
+}
+
+// ResetLiveElideStats clears the elision counters (tests).
+func ResetLiveElideStats() {
+	elideStats.mu.Lock()
+	defer elideStats.mu.Unlock()
+	elideStats.byRole = map[string]int{}
+}
diff --git a/pkg/backends/live_elide_test.go b/pkg/backends/live_elide_test.go
new file mode 100644
index 0000000..ded07dd
--- /dev/null
+++ b/pkg/backends/live_elide_test.go
@@ -0,0 +1,202 @@
+package backends
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/UnicoLab/slmcode/pkg/compact"
+	"github.com/piotrlaczkowski/GoLangGraph/pkg/llm"
+)
+
+// recordingProvider captures every request the wrapper hands down.
+type recordingProvider struct {
+	*fakeStreamProvider
+	mu   sync.Mutex
+	reqs []llm.CompletionRequest
+}
+
+func newRecordingProvider() *recordingProvider {
+	return &recordingProvider{fakeStreamProvider: &fakeStreamProvider{
+		name: "rec", model: "m", chunks: []string{"ok"},
+	}}
+}
+
+func (p *recordingProvider) record(req llm.CompletionRequest) {
+	p.mu.Lock()
+	p.reqs = append(p.reqs, req)
+	p.mu.Unlock()
+}
+
+func (p *recordingProvider) last() llm.CompletionRequest {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	return p.reqs[len(p.reqs)-1]
+}
+
+func (p *recordingProvider) Complete(ctx context.Context, req llm.CompletionRequest) (*llm.CompletionResponse, error) {
+	p.record(req)
+	return p.fakeStreamProvider.Complete(ctx, req)
+}
+
+func (p *recordingProvider) CompleteWithMode(ctx context.Context, req llm.CompletionRequest, mode llm.StreamMode) (*llm.CompletionResponse, error) {
+	p.record(req)
+	return p.fakeStreamProvider.CompleteWithMode(ctx, req, mode)
+}
+
+func (p *recordingProvider) CompleteStream(ctx context.Context, req llm.CompletionRequest, cb llm.StreamCallback) error {
+	p.record(req)
+	return p.fakeStreamProvider.CompleteStream(ctx, req, cb)
+}
+
+func (p *recordingProvider) CompleteStreamWithMode(ctx context.Context, req llm.CompletionRequest, cb llm.StreamCallback, mode llm.StreamMode) error {
+	p.record(req)
+	return p.fakeStreamProvider.CompleteStreamWithMode(ctx, req, cb, mode)
+}
+
+// liveTranscript is a ReAct transcript: system prompt, the task, then n tool
+// pairs whose results are `size` bytes each.
+func liveTranscript(n, size int) []llm.Message {
+	msgs := []llm.Message{
+		{Role: "system", Content: "You are the worker. Tools: ws_read, ws_edit."},
+		{Role: "user", Content: "implement the thing"},
+	}
+	for i := 0; i < n; i++ {
+		id := fmt.Sprintf("call_%d", i)
+		msgs = append(msgs,
+			llm.Message{Role: "assistant", ToolCalls: []llm.ToolCall{{
+				ID: id, Type: "function",
+				Function: llm.FunctionCall{Name: "ws_read", Arguments: fmt.Sprintf(`{"path":"f%d.go"}`, i)},
+			}}},
+			llm.Message{Role: "tool", ToolCallID: id, Name: "ws_read", Content: strings.Repeat("x", size)},
+		)
+	}
+	return msgs
+}
+
+func toolResults(msgs []llm.Message) []llm.Message {
+	var out []llm.Message
+	for _, m := range msgs {
+		if m.Role == "tool" {
+			out = append(out, m)
+		}
+	}
+	return out
+}
+
+// TestLiveElideCollapsesOldToolResultsOverThreshold: over the threshold, every
+// tool result but the last five is replaced with the placeholder — and nothing
+// else in the transcript moves. Under it, the request goes through untouched.
+func TestLiveElideCollapsesOldToolResultsOverThreshold(t *testing.T) {
+	ResetLiveElideStats()
+	inner := newRecordingProvider()
+	// 2000-token window, elide at 50% → 1000 tokens ≈ 4000 chars.
+	p := newLiveElide(inner, "worker", LiveElide{WindowTokens: 2000, AtPercent: 50})
+
+	big := liveTranscript(8, 1000)
+	if _, err := p.CompleteWithMode(context.Background(), llm.CompletionRequest{
+		Messages: big, Model: "m",
+	}, llm.StreamModeNone); err != nil {
+		t.Fatal(err)
+	}
+	got := inner.last().Messages
+	if len(got) != len(big) {
+		t.Fatalf("elision changed the message count: %d → %d", len(big), len(got))
+	}
+	if got[0].Role != "system" || got[0].Content != big[0].Content {
+		t.Fatalf("the leading system message was touched: %+v", got[0])
+	}
+	if got[1].Role != "user" || got[1].Content != big[1].Content {
+		t.Fatalf("the user turn was touched: %+v", got[1])
+	}
+	results := toolResults(got)
+	if len(results) != 8 {
+		t.Fatalf("tool results = %d, want 8", len(results))
+	}
+	for i, m := range results {
+		wantID := fmt.Sprintf("call_%d", i)
+		if m.ToolCallID != wantID {
+			t.Errorf("result %d lost its tool_call_id: %q", i, m.ToolCallID)
+		}
+		elided := m.Content == compact.DefaultElidedPlaceholder
+		if i < 3 && !elided {
+			t.Errorf("old result %d was kept verbatim (%d bytes)", i, len(m.Content))
+		}
+		if i >= 3 && elided {
+			t.Errorf("one of the last five results (%d) was elided", i)
+		}
+	}
+	calls := 0
+	for i, m := range got {
+		if m.Role == "assistant" {
+			calls += len(m.ToolCalls)
+			if len(m.ToolCalls) != 1 || m.ToolCalls[0].ID != big[i].ToolCalls[0].ID {
+				t.Errorf("assistant tool call at %d was changed: %+v", i, m)
+			}
+		}
+	}
+	if calls != 8 {
+		t.Fatalf("tool calls = %d, want 8 (elision must never drop a call)", calls)
+	}
+	if n := LiveElideStats()["worker"]; n != 3 {
+		t.Fatalf("elision telemetry = %d, want 3", n)
+	}
+	// The agent's own slice is not mutated: the next iteration re-sends the
+	// full transcript and is elided the same way.
+	if big[2*1+2].Content == compact.DefaultElidedPlaceholder {
+		t.Fatal("the caller's transcript was mutated in place")
+	}
+
+	small := liveTranscript(2, 100)
+	if _, err := p.Complete(context.Background(), llm.CompletionRequest{Messages: small}); err != nil {
+		t.Fatal(err)
+	}
+	for i, m := range inner.last().Messages {
+		if m.Role != small[i].Role || m.Content != small[i].Content || m.ToolCallID != small[i].ToolCallID {
+			t.Fatalf("an under-threshold transcript was rewritten at %d: %+v", i, m)
+		}
+	}
+	if n := LiveElideStats()["worker"]; n != 3 {
+		t.Fatalf("an under-threshold request was counted: %d", n)
+	}
+}
+
+// TestLiveElideIsAPassThroughWhenDisabled: the zero policy installs nothing.
+func TestLiveElideIsAPassThroughWhenDisabled(t *testing.T) {
+	inner := newRecordingProvider()
+	for _, cfg := range []LiveElide{{}, {WindowTokens: 8192}, {AtPercent: 80}, {WindowTokens: 8192, AtPercent: 100}} {
+		if got := newLiveElide(inner, "worker", cfg); got != llm.Provider(inner) {
+			t.Errorf("%+v installed a wrapper", cfg)
+		}
+	}
+}
+
+// TestBindRoleInstallsLiveElideOutermost: a role bound with a LiveElide policy
+// gets the wrapper on top of its stack; a role without one does not.
+func TestBindRoleInstallsLiveElideOutermost(t *testing.T) {
+	m := llm.NewProviderManager()
+	if err := m.RegisterProvider("base", newRecordingProvider()); err != nil {
+		t.Fatal(err)
+	}
+	key := BindRole(m, "base", Directives{
+		Role: "worker", SerialTools: true, ToolChoice: "auto",
+		LiveElide: LiveElide{WindowTokens: 8192, AtPercent: 80},
+	})
+	p, err := m.GetProvider(key)
+	if err != nil {
+		t.Fatalf("role not registered: %v", err)
+	}
+	if p.GetConfig()["slmcode_live_elide"] != true {
+		t.Fatalf("live elision is not on the role's stack: %v", p.GetConfig())
+	}
+	if _, outer := p.(*liveElideProvider); !outer {
+		t.Fatalf("the elision wrapper is not outermost: %T", p)
+	}
+	plainKey := BindRole(m, "base", Directives{Role: "planner", JSONOnly: true})
+	plain, _ := m.GetProvider(plainKey)
+	if _, has := plain.GetConfig()["slmcode_live_elide"]; has {
+		t.Fatal("a role with no policy was given the wrapper")
+	}
+}
diff --git a/pkg/backends/structured.go b/pkg/backends/structured.go
index e2a1945..8bbae96 100644
--- a/pkg/backends/structured.go
+++ b/pkg/backends/structured.go
@@ -47,6 +47,11 @@ type Directives struct {
 	// The structured path always emits `temperature` for a role that set one.
 	Temperature    float64
 	TemperatureSet bool
+	// LiveElide is the live ReAct compaction policy for this role: old tool
+	// results are elided deterministically on every request once the
+	// transcript passes the threshold. The zero value installs nothing. See
+	// live_elide.go.
+	LiveElide LiveElide
 }
 
 // backendMeta is what the direct structured path needs to talk to a server on
@@ -132,6 +137,9 @@ func BindRole(m *llm.ProviderManager, baseKey string, d Directives) string {
 			client:     &http.Client{},
 		}
 	}
+	// Outermost: the elided transcript must be what BOTH the delegate and the
+	// structured wrapper's direct constrained-decoding call send.
+	p = newLiveElide(p, d.Role, d.LiveElide)
 	if err := m.RegisterProvider(key, p); err != nil {
 		// A concurrent Create won the race — reuse whatever landed.
 		if _, gerr := m.GetProvider(key); gerr == nil {
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 4256a34..eb62267 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -539,12 +539,12 @@ type Config struct {
 	ContextCompact bool `yaml:"context_compact" json:"context_compact"`
 	// ContextCompactEngine: heuristic | llm | auto (LLM with heuristic fallback).
 	ContextCompactEngine string `yaml:"context_compact_engine" json:"context_compact_engine"`
-	// ReactCompact enables ReAct conversation compaction at CHECKPOINT and
-	// RESUME — it does NOT compact a live agent call between its iterations.
-	// loop.LiveReactCompactionWired is the constant of record (it is false, and
-	// nothing an operator sets changes it); loop.ReactCompactionStatus renders
-	// the honest one-line claim. This setting says what was asked for, not what
-	// the harness does.
+	// ReactCompact enables ReAct conversation compaction: deterministic elision
+	// of old tool results on LIVE requests (pkg/backends.LiveElide, installed
+	// for tool-using roles) and elision-then-digest at CHECKPOINT and RESUME.
+	// loop.LiveReactCompactionWired is the constant of record for the live
+	// half; loop.ReactCompactionStatus renders the honest one-line claim. This
+	// setting says what was asked for; the constant says what exists.
 	ReactCompact bool `yaml:"react_compact" json:"react_compact"`
 	// ReactCompactAtPercent triggers ReAct compaction at this % of MaxContextKB
 	// (little-coder default 80). <=0 or >=100 disables.
diff --git a/pkg/config/schema.go b/pkg/config/schema.go
index 4f45df7..c023c08 100644
--- a/pkg/config/schema.go
+++ b/pkg/config/schema.go
@@ -97,7 +97,7 @@ var schemaFields = map[string]schemaMeta{
 	"max_context_kb":         {"Max context KB", "Legacy prompt budget in KB, used when a model profile declares no real context window", "context", nil, false, false, false, false},
 	"context_compact":        {"CONTEXT compaction", "Summarize CONTEXT.md mid-run when it outgrows the budget", "context", nil, false, false, false, false},
 	"context_compact_engine": {"Compaction engine", "How CONTEXT.md is compacted", "context", []string{"heuristic", "llm", "auto"}, false, false, false, false},
-	"react_compact": {"ReAct compaction", "Compact the agent conversation at checkpoint and resume when it approaches the window. A single long agent call is NOT compacted mid-flight",
+	"react_compact": {"ReAct compaction", "Compact the agent conversation when it approaches the window: old tool results are elided deterministically on live requests, and a checkpoint or resume is elided then digested",
 		"context", nil, false, false, false, false},
 	"react_compact_at_percent": {"ReAct compaction threshold", "Percentage of the context budget at which the conversation is compacted (0 disables)",
 		"context", nil, false, false, false, false},
diff --git a/pkg/orchestrator/orchestrator.go b/pkg/orchestrator/orchestrator.go
index 30d13e2..2b540f8 100644
--- a/pkg/orchestrator/orchestrator.go
+++ b/pkg/orchestrator/orchestrator.go
@@ -377,6 +377,14 @@ func New(cfg *config.Config) (*Orchestrator, error) {
 		}
 	}
 	factory.ModelProfiles = cfg.ModelProfiles
+	if cfg.ReactCompact {
+		// Live ReAct compaction: old tool results are elided deterministically
+		// on every request a tool-using role sends once its transcript passes
+		// the threshold. The window is resolved per role from the model profile.
+		factory.LiveElide = backends.LiveElide{
+			AtPercent: cfg.ReactCompactAtPercent, KeepLast: compact.DefaultElideKeepLast,
+		}
+	}
 	if prof := config.ResolveModelProfile(cfg.ModelProfiles, cfg.Model); prof.MaxTokens > 0 || prof.MaxTurns > 0 || prof.Temperature > 0 {
 		factory.ProfileMaxTokens = prof.MaxTokens
 		factory.ProfileMaxTurns = prof.MaxTurns
diff --git a/pkg/readiness/readiness.go b/pkg/readiness/readiness.go
index b2b6169..4833e29 100644
--- a/pkg/readiness/readiness.go
+++ b/pkg/readiness/readiness.go
@@ -428,12 +428,13 @@ func fixPatchIf(cond bool, kv ...interface{}) map[string]interface{} {
 // what the config asked for.
 //
 // It used to say "Document and ReAct compaction are enabled" whenever
-// context_compact and react_compact were both on. Only one of the two ReAct
-// call sites exists: the resume path compacts a restored checkpoint, and
-// nothing compacts a live 16-iteration worker mid-call (loop.CompactLiveMessages
-// has no caller — see loop.LiveReactCompactionWired). An operator reading a
-// green "Context Compaction" check concluded a long agent call could not
-// exhaust the window, which is the one thing this check did not cover.
+// context_compact and react_compact were both on, at a time when only the
+// resume path compacted anything: an operator reading a green "Context
+// Compaction" check concluded a long agent call could not exhaust the window,
+// which was the one thing the check did not cover. The message now comes from
+// loop.ReactCompactionStatus, which reads loop.LiveReactCompactionWired — the
+// constant of record for whether live requests are compacted (deterministic
+// elision of old tool results) — so the claim and the wiring cannot drift.
 func compactionCheck(cfg *config.Config) Check {
 	on := cfg.ContextCompact && cfg.ReactCompact
 	msg := boolMessage(on,

From f95758558cce8551a5a06e406857267a94644d59 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 08:43:37 +0000
Subject: [PATCH 09/23] loop: resume steer reaches the model behind pending
 tool calls; live compaction is wired
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A checkpoint is saved when tool calls are still pending, so the restored
transcript ends on an assistant tool_calls message and the finalize steer
could not be appended as a user turn there. It was left to req.Input — and
the agent library adds Input as a user turn on a cold start only, keeping
it out of a seeded conversation. So the one resume that most needed the
turn-budget warning never saw it. The steer is now injected as a system
message right after the leading system message on that path, the technique
CompactChatMessagesWithDigest uses for its digest.

LiveReactCompactionWired flips to true: pkg/backends now elides old tool
results on live requests for tool-using roles (deterministic elision only;
summarization stays at checkpoint and resume). ReactCompactionStatus says
so, and the readiness and config consumers read it as before.
---
 pkg/loop/react_resume.go      | 100 ++++++++++++++++++--------------
 pkg/loop/react_resume_test.go | 106 ++++++++++++++++++++++++++++++++++
 2 files changed, 164 insertions(+), 42 deletions(-)

diff --git a/pkg/loop/react_resume.go b/pkg/loop/react_resume.go
index 0a8eb6e..0e8e923 100644
--- a/pkg/loop/react_resume.go
+++ b/pkg/loop/react_resume.go
@@ -131,9 +131,19 @@ func (r *Runner) applyResumeRequest(req *ggagent.SubAgentRequest, taskID string)
 		// the restored transcript routinely ENDS on an assistant tool_calls
 		// message. A user message may not sit between that and the tool results
 		// the executor is about to append — every OpenAI-compatible server
-		// answers HTTP 400. The steer still reaches the model through req.Input.
+		// answers HTTP 400.
+		//
+		// The steer used to be left to req.Input on that path, and it never
+		// arrived: the agent library adds Input as a user turn on a COLD start
+		// only and, on a seeded conversation, keeps it out of the transcript.
+		// So the one resume that most needs the turn-budget warning — a worker
+		// interrupted deep in its tool loop — was the one that never saw it.
+		// A system message is legal at any position, so it goes in right after
+		// the leading system message (the technique
+		// compact.CompactChatMessagesWithDigest uses for its digest).
 		if trailingUnansweredToolCalls(msgs) {
-			r.logf("%s finalize-steer kept out of the transcript: tool calls still pending", taskID)
+			req.Messages = injectSystemSteer(req.Messages, steer)
+			r.logf("%s finalize-steer injected as a system message: tool calls still pending", taskID)
 		} else {
 			req.Messages = append(req.Messages, llm.Message{Role: "user", Content: steer})
 		}
@@ -147,6 +157,21 @@ func (r *Runner) applyResumeRequest(req *ggagent.SubAgentRequest, taskID string)
 	return true
 }
 
+// injectSystemSteer places steer as a system message immediately after the
+// transcript's leading system message, or first when there is none. It never
+// appends: the tail of a resumed transcript is an assistant tool_calls message
+// whose results the executor is about to add, and nothing may sit between them.
+func injectSystemSteer(msgs []llm.Message, steer string) []llm.Message {
+	at := 0
+	if len(msgs) > 0 && strings.EqualFold(msgs[0].Role, compact.RoleSystem) {
+		at = 1
+	}
+	out := make([]llm.Message, 0, len(msgs)+1)
+	out = append(out, msgs[:at]...)
+	out = append(out, llm.Message{Role: compact.RoleSystem, Content: steer})
+	return append(out, msgs[at:]...)
+}
+
 // reactCompactMinMessages is the floor below which compaction never triggers.
 const reactCompactMinMessages = 10
 
@@ -219,42 +244,33 @@ func (r *Runner) maybeCompactReact(msgs []session.ReactMessage, agentID string,
 // LiveReactCompactionWired reports whether per-iteration ReAct compaction is
 // actually installed in the request path.
 //
-// It is FALSE, and it is a constant rather than a config field because nothing
-// an operator can set changes it: the call site does not exist. Every consumer
-// that describes compaction to a human — pkg/readiness, the config docstring,
-// the run notice — must read this rather than react_compact, because
-// react_compact says what the operator ASKED FOR and this says what the harness
-// DOES. Telling someone their 16-iteration worker is protected from context
-// exhaustion when only the resume path compacts is worse than telling them
-// nothing.
-//
-// What IS wired, with react_compact on:
-//   - document (CONTEXT.md) compaction — pkg/compact, driven by the orchestrator;
-//   - ReAct compaction at CHECKPOINT and RESUME — maybeCompactReact, called from
-//     saveReactFromResult and applyResumeRequest.
-//
-// What is not: compaction between iterations of a live agent call.
+// It is TRUE. ggagent's SubAgentRequest carries no per-iteration callback and
+// its Middleware interface is BeforeRun/AfterRun only, so nothing in THIS
+// package sees iteration N of a 16-iteration worker — but a ReAct iteration is
+// exactly one llm.Provider completion, and every role is bound to its own
+// provider registration. pkg/backends.BindRole therefore stacks a
+// liveElideProvider (pkg/backends/live_elide.go) outermost over every
+// tool-using role whose factory carries a LiveElide policy; the orchestrator
+// sets that policy from react_compact / react_compact_at_percent, and the
+// window comes from the model profile's context_limit. The same wall was hit
+// by live token streaming and the way round it was the same wrapper route.
 //
-// The blocker and the way through, so the next person does not re-derive it:
-// ggagent's SubAgentRequest carries no per-iteration callback and its
-// Middleware interface is BeforeRun/AfterRun only, so nothing in this package
-// sees iteration N of a 16-iteration worker. The same wall was hit by live
-// token streaming, and the way round it was a PROVIDER WRAPPER — a ReAct
-// iteration is exactly one llm.Provider.Complete call, so a wrapper registered
-// under the role-bound key (pkg/backends.BindRole, which already stacks
-// structuredProvider over streamTeeProvider over retryProvider) sees every
-// iteration's full transcript and can rewrite req.Messages.
+// It stays a constant rather than a config field because nothing an operator
+// sets changes whether the call site EXISTS — react_compact says whether it
+// is used. Every consumer that describes compaction to a human — pkg/readiness,
+// the config docstring, the run notice — must read this rather than
+// react_compact.
 //
-// That wrapper is NOT this method, and it is why this is still false: the
-// policy below is written for a CHECKPOINT transcript, and
-// compact.CompactChatMessagesWithDigest folds the head of the conversation into
-// a system digest and appends a "resuming" user turn. On a live request the
-// head is the role's system prompt — the tool contract — and dropping it
-// mid-call would break the agent far more reliably than a long context does.
-// Wiring this needs a live variant that pins the leading system message and
-// omits the resume notice; that belongs beside the other provider wrappers in
-// pkg/backends.
-const LiveReactCompactionWired = false
+// What the live path does, and deliberately does not do: it elides old tool
+// RESULTS deterministically (the last compact.DefaultElideKeepLast stay
+// verbatim), keeping every tool call, every tool_call_id pair, the leading
+// system message and every user/assistant turn. It never summarizes.
+// maybeCompactReact below may fold the head of a CHECKPOINT transcript into a
+// system digest, but on a live request the head is the role's tool contract,
+// and dropping it mid-call would break the agent more reliably than a long
+// context does. Summarization therefore stays where it was: at checkpoint and
+// resume, after the same elision has been tried first.
+const LiveReactCompactionWired = true
 
 // ReactCompactionStatus describes, in one line, what compaction the harness is
 // actually performing for a given react_compact setting. Consumers that show
@@ -264,17 +280,17 @@ func ReactCompactionStatus(reactCompact bool) string {
 		return "ReAct compaction is off"
 	}
 	if LiveReactCompactionWired {
-		return "ReAct compaction is on for live iterations, checkpoints and resume"
+		return "ReAct compaction is on for live iterations (old tool results elided deterministically), checkpoints and resume"
 	}
 	return "ReAct compaction runs at checkpoint/resume only — a single long agent call is not compacted mid-flight"
 }
 
-// CompactLiveMessages is the LIVE per-iteration compaction entry point.
+// CompactLiveMessages applies the CHECKPOINT policy — deterministic elision,
+// then the structured digest — to an in-memory transcript.
 //
-// It is the POLICY half of a protection whose call site does not exist yet —
-// see LiveReactCompactionWired for the blocker, the proposed provider-wrapper
-// design, and the reason this policy cannot simply be pointed at a live
-// transcript as written.
+// It is exposed for embedders that hold a transcript between calls of their
+// own. The harness's live path is the provider wrapper described at
+// LiveReactCompactionWired, which elides only and does not go through here.
 func (r *Runner) CompactLiveMessages(agentID string, iteration int, msgs []llm.Message) []llm.Message {
 	if r == nil || !r.ReactCompact || len(msgs) < reactCompactMinMessages {
 		return msgs
diff --git a/pkg/loop/react_resume_test.go b/pkg/loop/react_resume_test.go
index 9ad4cc0..36978e1 100644
--- a/pkg/loop/react_resume_test.go
+++ b/pkg/loop/react_resume_test.go
@@ -225,6 +225,112 @@ func TestApplyResumeInjectsFinalizeSteer(t *testing.T) {
 	}
 }
 
+// steerCaptureExec records the messages the worker was resumed with.
+type steerCaptureExec struct {
+	mu   sync.Mutex
+	root string
+	seen [][]llm.Message
+}
+
+func (e *steerCaptureExec) ExecuteSubAgents(_ context.Context, reqs []ggagent.SubAgentRequest,
+	_ *ggagent.SharedState) ([]ggagent.SubAgentResult, error) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	out := make([]ggagent.SubAgentResult, len(reqs))
+	for i, req := range reqs {
+		if req.AgentID == plan.RoleReviewer {
+			out[i] = ggagent.SubAgentResult{AgentID: req.AgentID, Output: `{"approved":true,"score":90,"summary":"ok"}`}
+			continue
+		}
+		e.seen = append(e.seen, append([]llm.Message(nil), req.Messages...))
+		_ = os.WriteFile(filepath.Join(e.root, "a.go"), []byte("package main\n\nconst Greeting = \"hi\"\n"), 0o644)
+		out[i] = ggagent.SubAgentResult{AgentID: req.AgentID, TaskID: req.TaskID,
+			Output: `{"status":"done","summary":"finished","files_changed":["a.go"]}`}
+	}
+	return out, nil
+}
+
+// TestResumeSteerReachesTheModelWhenToolCallsArePending: a checkpoint saved
+// mid tool-loop ends on an unanswered assistant tool_calls message. The steer
+// could not be appended as a user turn there, and req.Input is not added to a
+// seeded conversation — so the turn-budget warning never reached the model on
+// exactly the resume that needed it. It must arrive as a system message, in
+// the transcript the executor is handed, without a user turn after the
+// pending tool calls.
+func TestResumeSteerReachesTheModelWhenToolCallsArePending(t *testing.T) {
+	root := t.TempDir()
+	slm := filepath.Join(root, ".slmcode")
+	_ = os.MkdirAll(slm, 0o755)
+	_ = os.WriteFile(filepath.Join(root, "a.go"), []byte("package main\n"), 0o644)
+	turn, err := session.BeginTurn(slm, "run-steer-pending", "update the greeting")
+	if err != nil {
+		t.Fatal(err)
+	}
+	pending := []session.ReactToolCall{{ID: "call_9", Type: "function", Name: "ws_edit", Arguments: `{"path":"a.go"}`}}
+	cp := session.ReactCheckpoint{
+		TurnID: turn.ID, TaskID: "T1", AgentID: plan.RoleWorker,
+		Iteration: 13, MaxIterations: 16,
+		Messages: []session.ReactMessage{
+			{Role: "system", Content: "You are the worker."},
+			{Role: "user", Content: "update the greeting in a.go"},
+			{Role: "assistant", Content: "editing", ToolCalls: pending},
+		},
+		PendingToolCalls: pending,
+	}
+	if err := session.SaveReactCheckpoint(slm, cp); err != nil {
+		t.Fatal(err)
+	}
+
+	// The request builder alone: the steer is a system message right after the
+	// leading one, and nothing follows the pending tool calls.
+	r := NewRunner(nil, ggagent.NewSharedState())
+	r.SlmDir, r.TurnID, r.FinalizeWarn = slm, turn.ID, true
+	req := &ggagent.SubAgentRequest{AgentID: plan.RoleWorker, Input: "continue"}
+	if !r.applyResumeRequest(req, "T1") {
+		t.Fatal("expected resume")
+	}
+	assertSteerInjected(t, req.Messages)
+
+	// End to end: the executor is handed that transcript.
+	exec := &steerCaptureExec{root: root}
+	r2 := defaultRunner(t, root, exec)
+	r2.SlmDir, r2.TurnID, r2.FinalizeWarn = slm, turn.ID, true
+	r2.MaxRetries = 0
+	board := &plan.Board{QueryID: turn.ID, Query: turn.Query, Tasks: []plan.Task{{
+		ID: "T1", Title: "update the greeting", Role: plan.RoleWorker, Column: plan.ColReadyToDev,
+		Description: "update the greeting in a.go", Acceptance: "greeting updated", Files: []string{"a.go"},
+	}}}
+	if err := r2.RunBoard(context.Background(), board); err != nil {
+		t.Fatalf("RunBoard: %v", err)
+	}
+	if len(exec.seen) != 1 {
+		t.Fatalf("worker dispatched %d time(s), want 1", len(exec.seen))
+	}
+	assertSteerInjected(t, exec.seen[0])
+}
+
+func assertSteerInjected(t *testing.T, msgs []llm.Message) {
+	t.Helper()
+	if len(msgs) < 4 {
+		t.Fatalf("transcript too short: %+v", msgs)
+	}
+	if msgs[0].Role != "system" || msgs[0].Content != "You are the worker." {
+		t.Fatalf("leading system message was displaced: %+v", msgs[0])
+	}
+	if msgs[1].Role != "system" || !strings.Contains(msgs[1].Content, "TURN BUDGET") {
+		t.Fatalf("steer is not the system message after the leading one: %+v", msgs[1])
+	}
+	last := msgs[len(msgs)-1]
+	if last.Role != "assistant" || len(last.ToolCalls) != 1 || last.ToolCalls[0].ID != "call_9" {
+		t.Fatalf("a message was appended after the pending tool calls: %+v", last)
+	}
+	for _, m := range msgs {
+		if m.Role == "user" && strings.Contains(m.Content, "TURN BUDGET") {
+			t.Fatal("steer was appended as a user turn behind unanswered tool calls (HTTP 400 on every server)")
+		}
+	}
+}
+
 func TestSaveLoadReactCheckpoint(t *testing.T) {
 	slm := t.TempDir()
 	cp := session.ReactCheckpoint{

From e51eb4382a13ba3bec3e00deb6212701c9c22783 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 08:44:34 +0000
Subject: [PATCH 10/23] fix(workspace,hitl,review): close the dangling-symlink
 jail gap, apply review entries by kind, per-ask shell approvals

Workspace:
- checkSymlinkEscape returned nil when EvalSymlinks failed, so a symlink whose
  target did not exist yet passed the jail and os.WriteFile followed it,
  creating the target anywhere on the host. Dangling links are now resolved
  with Readlink and judged lexically against the real root (re-checked for a
  chained link); anything that cannot be judged is refused.
- ws_edit/ws_write/ws_patch accept the argument spellings small models mix in
  (old_string/search/old, new_string/replace/new, contents/text/body,
  diff/hunk); the canonical key always wins.
- ws_write refuses an empty body on a new file (it used to write 0 bytes and
  report success) and names the accepted keys; emptying an existing file needs
  allow_shrink.
- A ws_read gutter on EVERY line of old_str/patch is stripped and the edit
  proceeds, with a note appended so evolve still sees the drift; a partial
  gutter is still refused by name.
- replace_all is honored on the tolerant ladder too: all spans of the first
  matching strategy are replaced instead of reporting ambiguity.
- ws_patch: pure-insertion hunks (-N,0) insert AFTER line N as unified diff
  semantics require; the marker-less SEARCH/REPLACE form is reachable; trailing
  prose and Markdown fences no longer become unmatched context lines.
- The syntax guard memoizes the before-verdict per path by content hash, so
  consecutive edits spawn one checker each after the first instead of two.

Review queue:
- Entries are stamped with from (ws_mv source), task_id, agent and query_id
  at record time; a shell ask is no longer mirrored into the queue.
- Both appliers (Studio POST /api/review/apply and slmcode apply) switch on
  kind: delete removes, mv moves the source, shell is hidden and refused.
  Applying every kind as a write truncated deleted files, left moved sources
  behind and wrote shell.sh at the project root.
- review_pending {pending: N} is emitted after apply/reject and whenever a
  running agent records a proposal.

HITL:
- Shell asks live in per-ask files (shell/asks/<id>.json, answers/<id>.json).
  The single ask.json slot let a second parallel worker overwrite the first
  ask and delete the winner's answer. GET /api/shell/pending returns asks[]
  alongside the first ask's fields for compatibility.
- plan.AddBoardHook / workspace.AddPendingHook are the change feeds Studio
  turns into task_update / review_pending events.
---
 cmd/slmcode/cmd_review.go              |  90 ++++++++-
 cmd/slmcode/cmd_review_kinds_test.go   | 108 +++++++++++
 pkg/hitl/pending.go                    | 186 +++++++++++++++++-
 pkg/hitl/perask_test.go                |  97 +++++++++
 pkg/plan/tasks.go                      |  89 ++++++++-
 pkg/server/review_api.go               | 224 +++++++++++++++++++--
 pkg/server/review_kinds_test.go        | 210 ++++++++++++++++++++
 pkg/server/server.go                   | 194 +++++++++++++++---
 pkg/server/server_test.go              |   6 +-
 pkg/workspace/adversarial_jail_test.go |  47 +++++
 pkg/workspace/coerce.go                |  27 +++
 pkg/workspace/ergonomics_test.go       | 202 +++++++++++++++++++
 pkg/workspace/match.go                 |  71 +++++++
 pkg/workspace/observer_test.go         |   6 +-
 pkg/workspace/patch.go                 | 197 +++++++++++++++----
 pkg/workspace/patch_semantics_test.go  | 145 ++++++++++++++
 pkg/workspace/pending.go               | 146 ++++++++++++++
 pkg/workspace/pending_test.go          | 177 +++++++++++++++++
 pkg/workspace/syntax.go                |  71 ++++++-
 pkg/workspace/syntax_memo_test.go      |  80 ++++++++
 pkg/workspace/tools.go                 | 259 ++++++++++++++++++++++---
 pkg/workspace/tools_hardening_test.go  |  22 ++-
 22 files changed, 2514 insertions(+), 140 deletions(-)
 create mode 100644 cmd/slmcode/cmd_review_kinds_test.go
 create mode 100644 pkg/hitl/perask_test.go
 create mode 100644 pkg/server/review_kinds_test.go
 create mode 100644 pkg/workspace/ergonomics_test.go
 create mode 100644 pkg/workspace/patch_semantics_test.go
 create mode 100644 pkg/workspace/pending.go
 create mode 100644 pkg/workspace/pending_test.go
 create mode 100644 pkg/workspace/syntax_memo_test.go

diff --git a/cmd/slmcode/cmd_review.go b/cmd/slmcode/cmd_review.go
index d32de9a..4b14a37 100644
--- a/cmd/slmcode/cmd_review.go
+++ b/cmd/slmcode/cmd_review.go
@@ -30,23 +30,50 @@ type pendingPatch struct {
 	Path    string `json:"path"`
 	Kind    string `json:"kind"`
 	Content string `json:"content"`
+	// From is the source of a ws_mv proposal (stamped by pkg/workspace).
+	From string `json:"from,omitempty"`
+	// TaskID / Agent / QueryID attribute the proposal when known.
+	TaskID  string `json:"task_id,omitempty"`
+	Agent   string `json:"agent,omitempty"`
+	QueryID string `json:"query_id,omitempty"`
 }
 
+// Queue kinds that are not "write Content to Path". See writePatch.
+const (
+	pendingKindDelete = "delete"
+	pendingKindMove   = "mv"
+	pendingKindShell  = "shell"
+)
+
 // abs resolves the target file inside the project root.
 func (p pendingPatch) abs(root string) string { return filepath.Join(root, p.Path) }
 
-// before reads the on-disk content the patch would replace.
+// before reads the on-disk content the patch would replace. A move is diffed
+// against its SOURCE: the destination does not exist yet, and what the
+// reviewer needs to see is that the content is unchanged in transit.
 func (p pendingPatch) before(root string) string {
-	data, err := os.ReadFile(p.abs(root))
+	path := p.abs(root)
+	if p.Kind == pendingKindMove && p.From != "" {
+		path = filepath.Join(root, p.From)
+	}
+	data, err := os.ReadFile(path) //nolint:gosec // project path under root
 	if err != nil {
 		return ""
 	}
 	return string(data)
 }
 
+// after is the content the applier will leave at Path ("" for a delete).
+func (p pendingPatch) after() string {
+	if p.Kind == pendingKindDelete {
+		return ""
+	}
+	return p.Content
+}
+
 // diff computes the unified diff for this patch.
 func (p pendingPatch) diff(root string) cli.FileDiff {
-	fd := cli.Diff(p.Path, p.before(root), p.Content, 3)
+	fd := cli.Diff(p.Path, p.before(root), p.after(), 3)
 	if mode, ok := fileMode(p.abs(root)); ok && mode&0o111 != 0 {
 		fd.ModeNote = fmt.Sprintf("mode %04o", mode)
 	}
@@ -87,6 +114,11 @@ func loadPending(slmDir string) ([]pendingPatch, error) {
 		if json.Unmarshal(data, &p) != nil || strings.TrimSpace(p.Path) == "" {
 			continue
 		}
+		if p.Kind == pendingKindShell {
+			// An older workspace mirrored every shell ask into the queue;
+			// a command is not a file change and must never be "applied".
+			continue
+		}
 		p.File = e.Name()
 		out = append(out, p)
 	}
@@ -94,10 +126,58 @@ func loadPending(slmDir string) ([]pendingPatch, error) {
 	return out, nil
 }
 
-// writePatch applies one patch, preserving the existing file mode. A brand new
-// file gets 0o644; an existing executable keeps its +x bits.
+// writePatch applies one patch according to its KIND, preserving the existing
+// file mode for writes. A brand new file gets 0o644; an existing executable
+// keeps its +x bits.
+//
+// Every kind used to be applied as "write Content to Path", which truncated a
+// "deleted" file to zero bytes, copied a moved file while leaving its source
+// behind, and wrote a literal shell.sh for a shell approval.
 func writePatch(root string, p pendingPatch) error {
 	abs := p.abs(root)
+	switch p.Kind {
+	case pendingKindShell:
+		return errors.New("shell approvals are not file changes; reject the entry instead")
+	case pendingKindDelete:
+		if err := os.Remove(abs); err != nil && !os.IsNotExist(err) {
+			return err
+		}
+		return nil
+	case pendingKindMove:
+		if strings.TrimSpace(p.From) == "" {
+			return errors.New("move entry has no source path")
+		}
+		src := filepath.Join(root, p.From)
+		if err := os.MkdirAll(filepath.Dir(abs), 0o755); err != nil { //nolint:gosec // directory in the user's source tree — conventional 0755, not harness state
+			return err
+		}
+		if _, err := os.Stat(abs); err == nil {
+			return fmt.Errorf("destination %s already exists", p.Path)
+		}
+		if _, err := os.Lstat(src); err != nil {
+			if !os.IsNotExist(err) {
+				return err
+			}
+			// Source gone in the meantime: the intent is the content at the
+			// destination, which was recorded.
+			return os.WriteFile(abs, []byte(p.Content), 0o644) //nolint:gosec // project source file, conventional perms
+		}
+		if err := os.Rename(src, abs); err == nil {
+			return nil
+		}
+		data, err := os.ReadFile(src) //nolint:gosec // project path under root
+		if err != nil {
+			return err
+		}
+		mode := os.FileMode(0o644)
+		if m, ok := fileMode(src); ok {
+			mode = m
+		}
+		if err := os.WriteFile(abs, data, mode); err != nil {
+			return err
+		}
+		return os.Remove(src)
+	}
 	if err := os.MkdirAll(filepath.Dir(abs), 0o755); err != nil { //nolint:gosec // directory in the user's source tree — conventional 0755, not harness state
 		return err
 	}
diff --git a/cmd/slmcode/cmd_review_kinds_test.go b/cmd/slmcode/cmd_review_kinds_test.go
new file mode 100644
index 0000000..676e8d3
--- /dev/null
+++ b/cmd/slmcode/cmd_review_kinds_test.go
@@ -0,0 +1,108 @@
+package main
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func writeKindFixture(t *testing.T, slmDir, name string, obj map[string]string) {
+	t.Helper()
+	dir := filepath.Join(slmDir, "pending")
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	body, err := json.Marshal(obj)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, name), body, 0o644); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// `slmcode apply --all` used to write every entry's content to its path:
+// a delete became a 0-byte file, a move left its source, a shell ask became
+// a literal shell.sh. Each kind now does what it says.
+func TestWritePatchHonorsKind(t *testing.T) {
+	root := t.TempDir()
+	slm := filepath.Join(root, ".slmcode")
+
+	// delete
+	if err := os.WriteFile(filepath.Join(root, "gone.go"), []byte("package a\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := writePatch(root, pendingPatch{Path: "gone.go", Kind: "delete"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(filepath.Join(root, "gone.go")); !os.IsNotExist(err) {
+		t.Fatalf("delete left the file (err=%v)", err)
+	}
+	// deleting an already-missing file is not an error
+	if err := writePatch(root, pendingPatch{Path: "gone.go", Kind: "delete"}); err != nil {
+		t.Fatalf("second delete: %v", err)
+	}
+
+	// mv
+	if err := os.MkdirAll(filepath.Join(root, "old"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "old", "a.sh"), []byte("#!/bin/sh\n"), 0o755); err != nil { //nolint:gosec // executable fixture
+		t.Fatal(err)
+	}
+	if err := writePatch(root, pendingPatch{Path: "new/a.sh", Kind: "mv", From: "old/a.sh", Content: "#!/bin/sh\n"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(filepath.Join(root, "old", "a.sh")); !os.IsNotExist(err) {
+		t.Fatalf("mv left the source (err=%v)", err)
+	}
+	if got, err := os.ReadFile(filepath.Join(root, "new", "a.sh")); err != nil || string(got) != "#!/bin/sh\n" {
+		t.Fatalf("mv destination: %q err=%v", got, err)
+	}
+	// mv whose source vanished falls back to the recorded content
+	if err := writePatch(root, pendingPatch{Path: "new/b.go", Kind: "mv", From: "old/b.go", Content: "package b\n"}); err != nil {
+		t.Fatal(err)
+	}
+	if got, _ := os.ReadFile(filepath.Join(root, "new", "b.go")); string(got) != "package b\n" {
+		t.Fatalf("mv fallback: %q", got)
+	}
+	// mv onto an existing destination is refused
+	if err := writePatch(root, pendingPatch{Path: "new/b.go", Kind: "mv", From: "new/a.sh", Content: "x"}); err == nil {
+		t.Fatal("mv over an existing destination was allowed")
+	}
+
+	// shell: never a file
+	err := writePatch(root, pendingPatch{Path: "shell.sh", Kind: "shell", Content: "rm -rf /"})
+	if err == nil || !strings.Contains(err.Error(), "shell") {
+		t.Fatalf("shell entry applied: err=%v", err)
+	}
+	if _, serr := os.Stat(filepath.Join(root, "shell.sh")); serr == nil {
+		t.Fatal("shell.sh written to the project root")
+	}
+
+	// loadPending hides stale shell mirrors entirely, and surfaces from/stamps.
+	writeKindFixture(t, slm, "1000_shell_shell.sh.patch.json", map[string]string{"path": "shell.sh", "kind": "shell", "content": "ls"})
+	writeKindFixture(t, slm, "2000_mv_x.patch.json", map[string]string{"path": "n.go", "kind": "mv", "from": "o.go", "content": "p", "task_id": "T1", "agent": "worker"})
+	got, err := loadPending(slm)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 1 || got[0].Kind != "mv" || got[0].From != "o.go" || got[0].TaskID != "T1" || got[0].Agent != "worker" {
+		t.Fatalf("loadPending = %+v", got)
+	}
+
+	// The diff of a delete is everything removed; of a move, source vs content.
+	if err := os.WriteFile(filepath.Join(root, "d.go"), []byte("a\nb\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	fd := pendingPatch{Path: "d.go", Kind: "delete"}.diff(root)
+	if fd.Removed != 2 || fd.Added != 0 {
+		t.Fatalf("delete diff: +%d -%d", fd.Added, fd.Removed)
+	}
+	fd = pendingPatch{Path: "moved.go", Kind: "mv", From: "d.go", Content: "a\nb\n"}.diff(root)
+	if fd.Removed != 0 || fd.Added != 0 {
+		t.Fatalf("mv diff should be empty for unchanged content: +%d -%d", fd.Added, fd.Removed)
+	}
+}
diff --git a/pkg/hitl/pending.go b/pkg/hitl/pending.go
index 25a72e8..930472b 100644
--- a/pkg/hitl/pending.go
+++ b/pkg/hitl/pending.go
@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"os"
 	"path/filepath"
+	"sort"
 	"strings"
 	"time"
 
@@ -51,13 +52,196 @@ func Clear(slmDir, kind string) {
 	_ = os.Remove(AnswersPath(slmDir, kind))
 }
 
-// ClearAll removes every known pending HITL ask/answer pair.
+// ClearAll removes every known pending HITL ask/answer pair, including the
+// per-ask files (see WriteAskID).
 func ClearAll(slmDir string) {
 	if slmDir == "" {
 		return
 	}
 	for _, kind := range []string{"clarify", "plan", "continue", "escalate", "shell"} {
 		Clear(slmDir, kind)
+		_ = os.RemoveAll(AsksDir(slmDir, kind))
+		_ = os.RemoveAll(AnswersDir(slmDir, kind))
+	}
+}
+
+// ── Per-ask files ──────────────────────────────────────────────────────────
+//
+// The single ask.json / answers.json slot above is fine for asks that are by
+// construction one-at-a-time (plan approval, continue). Shell approval is not:
+// a wave runs N workers in parallel and each may need a command approved. With
+// one slot the second WriteAsk overwrote the first (and deleted its answer),
+// and WaitAnswersForID's "not my id → delete it" step made the loser destroy
+// the winner's decision. Each ask now lives in its own pair of files:
+//
+//	.slmcode/<kind>/asks/<id>.json
+//	.slmcode/<kind>/answers/<id>.json
+//
+// so N concurrent asks each wait on exactly their own answer.
+
+// AsksDir is where per-ask payloads live for kind.
+func AsksDir(slmDir, kind string) string { return filepath.Join(slmDir, kind, "asks") }
+
+// AnswersDir is where per-ask answers live for kind.
+func AnswersDir(slmDir, kind string) string { return filepath.Join(slmDir, kind, "answers") }
+
+// AskIDPath / AnswerIDPath name the files for one ask id.
+func AskIDPath(slmDir, kind, id string) string {
+	return filepath.Join(AsksDir(slmDir, kind), safeAskID(id)+".json")
+}
+
+// AnswerIDPath is the answer file for one ask id.
+func AnswerIDPath(slmDir, kind, id string) string {
+	return filepath.Join(AnswersDir(slmDir, kind), safeAskID(id)+".json")
+}
+
+// safeAskID flattens an id into one file-name component.
+func safeAskID(id string) string {
+	id = strings.TrimSpace(id)
+	var b strings.Builder
+	for _, r := range id {
+		switch {
+		case r >= 'a' && r <= 'z', r >= 'A' && r <= 'Z', r >= '0' && r <= '9', r == '.', r == '-', r == '_':
+			b.WriteRune(r)
+		default:
+			b.WriteByte('_')
+		}
+	}
+	out := strings.Trim(b.String(), ".")
+	if out == "" {
+		out = "ask"
+	}
+	if len(out) > 120 {
+		out = out[:120]
+	}
+	return out
+}
+
+// WriteAskID persists one ask under its own id without touching any other
+// pending ask of the same kind.
+func WriteAskID(slmDir, kind, id string, payload any) error {
+	if slmDir == "" {
+		return nil
+	}
+	if err := os.MkdirAll(AsksDir(slmDir, kind), 0o750); err != nil { // HITL ask/answer state, owner-only
+		return err
+	}
+	_ = os.Remove(AnswerIDPath(slmDir, kind, id))
+	data, err := json.MarshalIndent(payload, "", "  ")
+	if err != nil {
+		return err
+	}
+	return atomicfile.Write(AskIDPath(slmDir, kind, id), data, 0o644)
+}
+
+// ReadAskID loads one ask by id.
+func ReadAskID(slmDir, kind, id string, dest any) (bool, error) {
+	data, err := os.ReadFile(AskIDPath(slmDir, kind, id))
+	if err != nil {
+		if os.IsNotExist(err) {
+			return false, nil
+		}
+		return false, err
+	}
+	if err := json.Unmarshal(data, dest); err != nil {
+		return false, err
+	}
+	return true, nil
+}
+
+// ListAskIDs returns the ids of every pending per-ask file for kind, oldest
+// first (ids carry a nanosecond timestamp, so name order is creation order).
+func ListAskIDs(slmDir, kind string) ([]string, error) {
+	entries, err := os.ReadDir(AsksDir(slmDir, kind))
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	var ids []string
+	for _, e := range entries {
+		if e.IsDir() || !strings.HasSuffix(e.Name(), ".json") {
+			continue
+		}
+		ids = append(ids, strings.TrimSuffix(e.Name(), ".json"))
+	}
+	sort.Strings(ids)
+	return ids, nil
+}
+
+// WriteAnswerIDOnce stores the answer for one ask, refusing to overwrite an
+// existing decision (os.IsExist on the returned error).
+func WriteAnswerIDOnce(slmDir, kind, id string, payload any) error {
+	if slmDir == "" {
+		return nil
+	}
+	if err := os.MkdirAll(AnswersDir(slmDir, kind), 0o750); err != nil { // HITL ask/answer state, owner-only
+		return err
+	}
+	data, err := json.MarshalIndent(payload, "", "  ")
+	if err != nil {
+		return err
+	}
+	return atomicfile.WriteOnce(AnswerIDPath(slmDir, kind, id), data, 0o644)
+}
+
+// ReadAnswerID loads the answer for one ask if present.
+func ReadAnswerID(slmDir, kind, id string, dest any) (bool, error) {
+	data, err := os.ReadFile(AnswerIDPath(slmDir, kind, id))
+	if err != nil {
+		if os.IsNotExist(err) {
+			return false, nil
+		}
+		return false, err
+	}
+	if err := json.Unmarshal(data, dest); err != nil {
+		return false, err
+	}
+	return true, nil
+}
+
+// ClearID removes the ask and answer files for one id only.
+func ClearID(slmDir, kind, id string) {
+	if slmDir == "" {
+		return
+	}
+	_ = os.Remove(AskIDPath(slmDir, kind, id))
+	_ = os.Remove(AnswerIDPath(slmDir, kind, id))
+}
+
+// WaitAnswerID polls for THIS ask's answer until timeout or ctx cancel. It
+// never touches another ask's files. On timeout the ask is withdrawn (its
+// files removed) and ok=false is returned; an answer file that appears after
+// the deadline is ignored the same way.
+func WaitAnswerID(ctx context.Context, slmDir, kind, id string, timeout time.Duration, dest any) (bool, error) {
+	if timeout <= 0 {
+		timeout = 2 * time.Minute
+	}
+	deadline := time.Now().Add(timeout)
+	ticker := time.NewTicker(250 * time.Millisecond)
+	defer ticker.Stop()
+	for {
+		ok, err := ReadAnswerID(slmDir, kind, id, dest)
+		if err != nil {
+			return false, err
+		}
+		if ok {
+			if info, serr := os.Stat(AnswerIDPath(slmDir, kind, id)); serr == nil && info.ModTime().After(deadline) {
+				ClearID(slmDir, kind, id)
+				return false, nil
+			}
+			return true, nil
+		}
+		if time.Now().After(deadline) {
+			ClearID(slmDir, kind, id)
+			return false, nil
+		}
+		select {
+		case <-ctx.Done():
+			return false, ctx.Err()
+		case <-ticker.C:
+		}
 	}
 }
 
diff --git a/pkg/hitl/perask_test.go b/pkg/hitl/perask_test.go
new file mode 100644
index 0000000..a4452ba
--- /dev/null
+++ b/pkg/hitl/perask_test.go
@@ -0,0 +1,97 @@
+package hitl
+
+import (
+	"context"
+	"os"
+	"sync"
+	"testing"
+	"time"
+)
+
+type perAskAnswer struct {
+	AskID    string `json:"ask_id"`
+	Decision string `json:"decision"`
+}
+
+// Two parallel workers each raise a shell ask; each must receive exactly its
+// own decision, and neither may disturb the other's files. With the single
+// ask.json/answers.json slot the second ask erased the first and the loser's
+// WaitAnswersForID deleted the winner's answer.
+func TestConcurrentAsksGetTheirOwnDecision(t *testing.T) {
+	dir := t.TempDir()
+	if err := WriteAskID(dir, "shell", "shell-1", map[string]string{"id": "shell-1", "command": "go test ./a"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := WriteAskID(dir, "shell", "shell-2", map[string]string{"id": "shell-2", "command": "rm -rf build"}); err != nil {
+		t.Fatal(err)
+	}
+	ids, err := ListAskIDs(dir, "shell")
+	if err != nil || len(ids) != 2 || ids[0] != "shell-1" || ids[1] != "shell-2" {
+		t.Fatalf("ListAskIDs = %v err=%v", ids, err)
+	}
+
+	var wg sync.WaitGroup
+	results := make([]perAskAnswer, 2)
+	oks := make([]bool, 2)
+	for i, id := range []string{"shell-1", "shell-2"} {
+		wg.Add(1)
+		go func(i int, id string) {
+			defer wg.Done()
+			ok, err := WaitAnswerID(context.Background(), dir, "shell", id, 5*time.Second, &results[i])
+			if err != nil {
+				t.Errorf("wait %s: %v", id, err)
+			}
+			oks[i] = ok
+		}(i, id)
+	}
+	// Answer the SECOND ask first with a deny, then the first with an approve.
+	time.Sleep(60 * time.Millisecond)
+	if err := WriteAnswerIDOnce(dir, "shell", "shell-2", perAskAnswer{AskID: "shell-2", Decision: "deny"}); err != nil {
+		t.Fatal(err)
+	}
+	time.Sleep(300 * time.Millisecond)
+	if err := WriteAnswerIDOnce(dir, "shell", "shell-1", perAskAnswer{AskID: "shell-1", Decision: "approve"}); err != nil {
+		t.Fatal(err)
+	}
+	wg.Wait()
+
+	if !oks[0] || results[0].Decision != "approve" || results[0].AskID != "shell-1" {
+		t.Fatalf("ask 1 got %+v ok=%v", results[0], oks[0])
+	}
+	if !oks[1] || results[1].Decision != "deny" || results[1].AskID != "shell-2" {
+		t.Fatalf("ask 2 got %+v ok=%v", results[1], oks[1])
+	}
+	// A second decision on an answered ask is refused, not overwritten.
+	if err := WriteAnswerIDOnce(dir, "shell", "shell-1", perAskAnswer{AskID: "shell-1", Decision: "deny"}); err == nil || !os.IsExist(err) {
+		t.Fatalf("second answer should be refused with IsExist, got %v", err)
+	}
+	// Clearing one id leaves the other's files alone.
+	ClearID(dir, "shell", "shell-1")
+	if _, err := os.Stat(AskIDPath(dir, "shell", "shell-2")); err != nil {
+		t.Fatalf("ClearID(shell-1) removed shell-2's ask: %v", err)
+	}
+	if _, err := os.Stat(AnswerIDPath(dir, "shell", "shell-1")); err == nil {
+		t.Fatal("ClearID left shell-1's answer behind")
+	}
+}
+
+func TestWaitAnswerIDTimesOutAndWithdraws(t *testing.T) {
+	dir := t.TempDir()
+	if err := WriteAskID(dir, "shell", "shell-9", map[string]string{"id": "shell-9"}); err != nil {
+		t.Fatal(err)
+	}
+	var got perAskAnswer
+	ok, err := WaitAnswerID(context.Background(), dir, "shell", "shell-9", 300*time.Millisecond, &got)
+	if err != nil || ok {
+		t.Fatalf("ok=%v err=%v", ok, err)
+	}
+	if _, err := os.Stat(AskIDPath(dir, "shell", "shell-9")); err == nil {
+		t.Fatal("timed-out ask was not withdrawn")
+	}
+	// ClearAll sweeps the per-ask directories too.
+	_ = WriteAskID(dir, "shell", "shell-10", map[string]string{"id": "shell-10"})
+	ClearAll(dir)
+	if ids, _ := ListAskIDs(dir, "shell"); len(ids) != 0 {
+		t.Fatalf("ClearAll left per-ask files: %v", ids)
+	}
+}
diff --git a/pkg/plan/tasks.go b/pkg/plan/tasks.go
index 7219813..d4da4d0 100644
--- a/pkg/plan/tasks.go
+++ b/pkg/plan/tasks.go
@@ -142,32 +142,98 @@ func (b *Board) ReadyTasks() []Task {
 	return b.executableTasksLocked()
 }
 
+// BoardHook observes one task after a change to it has been applied. The
+// task is passed by value (a snapshot), and hooks run AFTER boardMu is
+// released, so a hook may read the board or emit an event without deadlocking.
+//
+// Hooks are package-level for the same reason boardMu is: Board is copied by
+// value at every boundary, so a hook stored on the struct would be lost in
+// the copy. Studio installs one to publish task_update events.
+type BoardHook func(t Task)
+
+var (
+	boardHookMu sync.RWMutex
+	boardHooks  = map[int]BoardHook{}
+	boardHookID int
+)
+
+// AddBoardHook registers fn and returns a function that removes it.
+func AddBoardHook(fn BoardHook) (remove func()) {
+	if fn == nil {
+		return func() {}
+	}
+	boardHookMu.Lock()
+	boardHookID++
+	id := boardHookID
+	boardHooks[id] = fn
+	boardHookMu.Unlock()
+	return func() {
+		boardHookMu.Lock()
+		delete(boardHooks, id)
+		boardHookMu.Unlock()
+	}
+}
+
+// fireBoardHooks calls every registered hook with t. Never call it while
+// holding boardMu.
+func fireBoardHooks(t Task) {
+	boardHookMu.RLock()
+	if len(boardHooks) == 0 {
+		boardHookMu.RUnlock()
+		return
+	}
+	hooks := make([]BoardHook, 0, len(boardHooks))
+	for _, h := range boardHooks {
+		hooks = append(hooks, h)
+	}
+	boardHookMu.RUnlock()
+	for _, h := range hooks {
+		h(t)
+	}
+}
+
 // UpdateTask replaces a task by ID.
 func (b *Board) UpdateTask(updated Task) {
 	updated.Normalize()
 	updated.UpdatedAt = time.Now().Format(time.RFC3339)
 	boardMu.Lock()
-	defer boardMu.Unlock()
+	replaced := false
 	for i, t := range b.Tasks {
 		if t.ID == updated.ID {
 			b.Tasks[i] = updated
-			return
+			replaced = true
+			break
 		}
 	}
-	b.Tasks = append(b.Tasks, updated)
+	if !replaced {
+		b.Tasks = append(b.Tasks, updated)
+	}
+	boardMu.Unlock()
+	fireBoardHooks(updated)
 }
 
 // RemoveTask deletes a task by ID.
 func (b *Board) RemoveTask(id string) bool {
 	boardMu.Lock()
-	defer boardMu.Unlock()
+	var removed *Task
 	for i, t := range b.Tasks {
 		if t.ID == id {
+			cp := t
+			removed = &cp
 			b.Tasks = append(b.Tasks[:i], b.Tasks[i+1:]...)
-			return true
+			break
 		}
 	}
-	return false
+	boardMu.Unlock()
+	if removed == nil {
+		return false
+	}
+	// A removed task is reported with an empty column so a consumer can drop
+	// it from its view.
+	removed.Column = ""
+	removed.Status = ""
+	fireBoardHooks(*removed)
+	return true
 }
 
 // NextID generates a unique task id.
@@ -197,19 +263,24 @@ func (b *Board) nextIDLocked() string {
 // Returns the stored task.
 func (b *Board) AddTask(t Task) Task {
 	boardMu.Lock()
-	defer boardMu.Unlock()
 	if strings.TrimSpace(t.ID) == "" {
 		t.ID = b.nextIDLocked()
 	}
 	t.Normalize()
 	t.UpdatedAt = time.Now().Format(time.RFC3339)
+	replaced := false
 	for i := range b.Tasks {
 		if b.Tasks[i].ID == t.ID {
 			b.Tasks[i] = t
-			return t
+			replaced = true
+			break
 		}
 	}
-	b.Tasks = append(b.Tasks, t)
+	if !replaced {
+		b.Tasks = append(b.Tasks, t)
+	}
+	boardMu.Unlock()
+	fireBoardHooks(t)
 	return t
 }
 
diff --git a/pkg/server/review_api.go b/pkg/server/review_api.go
index f28320a..61fdd33 100644
--- a/pkg/server/review_api.go
+++ b/pkg/server/review_api.go
@@ -26,10 +26,17 @@ import (
 
 // PendingChange is one queued file change with both sides of the diff.
 type PendingChange struct {
-	ID        string     `json:"id"`
-	Path      string     `json:"path"`
-	Kind      string     `json:"kind"`
-	CreatedAt string     `json:"created_at"`
+	ID        string `json:"id"`
+	Path      string `json:"path"`
+	Kind      string `json:"kind"`
+	CreatedAt string `json:"created_at"`
+	// From is the source path of a ws_mv proposal; empty for other kinds.
+	From string `json:"from,omitempty"`
+	// TaskID / Agent / QueryID attribute the proposal to the board task, the
+	// role and the query that produced it, when the tool call carried them.
+	TaskID    string     `json:"task_id,omitempty"`
+	Agent     string     `json:"agent,omitempty"`
+	QueryID   string     `json:"query_id,omitempty"`
 	Exists    bool       `json:"exists"`
 	IsNew     bool       `json:"is_new"`
 	Before    string     `json:"before"`
@@ -41,10 +48,34 @@ type PendingChange struct {
 	Error     string     `json:"error,omitempty"`
 }
 
+// pendingFile is the on-disk queue entry. path/kind/content come from
+// permissions.RecordPending; the rest is stamped by pkg/workspace at record
+// time (workspace.PendingStamp) and is absent from older entries.
 type pendingFile struct {
 	Path    string `json:"path"`
 	Kind    string `json:"kind"`
 	Content string `json:"content"`
+	From    string `json:"from,omitempty"`
+	TaskID  string `json:"task_id,omitempty"`
+	Agent   string `json:"agent,omitempty"`
+	QueryID string `json:"query_id,omitempty"`
+}
+
+// Queue kinds. write/edit/patch all mean "the file's next content is
+// Content"; delete and mv are the two that must NOT be applied as a write —
+// doing so truncated a "deleted" file to zero bytes and left a moved file's
+// source in place. shell entries were never files at all (an older workspace
+// mirrored every shell ask into the queue); they are hidden and never applied.
+const (
+	pendingKindDelete = "delete"
+	pendingKindMove   = "mv"
+	pendingKindShell  = "shell"
+)
+
+// pendingKindApplicable reports whether a queue kind is something apply can
+// act on.
+func pendingKindApplicable(kind string) bool {
+	return kind != pendingKindShell
 }
 
 func (s *Server) pendingDir() string {
@@ -98,12 +129,16 @@ func (s *Server) readPending(id string, withHunks bool, context int) (PendingCha
 	}
 
 	ch := PendingChange{
-		ID:     id,
-		Path:   filepath.ToSlash(pf.Path),
-		Kind:   pf.Kind,
-		After:  pf.Content,
-		Bytes:  len(pf.Content),
-		Exists: true,
+		ID:      id,
+		Path:    filepath.ToSlash(pf.Path),
+		Kind:    pf.Kind,
+		From:    filepath.ToSlash(pf.From),
+		TaskID:  pf.TaskID,
+		Agent:   pf.Agent,
+		QueryID: pf.QueryID,
+		After:   pf.Content,
+		Bytes:   len(pf.Content),
+		Exists:  true,
 	}
 	if info, err := os.Stat(full); err == nil {
 		ch.CreatedAt = info.ModTime().UTC().Format(time.RFC3339)
@@ -111,6 +146,25 @@ func (s *Server) readPending(id string, withHunks bool, context int) (PendingCha
 	if ts := leadingNanos(id); ts > 0 {
 		ch.CreatedAt = time.Unix(0, ts).UTC().Format(time.RFC3339)
 	}
+	if !pendingKindApplicable(pf.Kind) {
+		ch.Error = "not a file change (kind " + pf.Kind + ") — reject it"
+		ch.After = ""
+		ch.Bytes = 0
+		return ch, nil
+	}
+	if pf.Kind == pendingKindMove {
+		if strings.TrimSpace(pf.From) == "" {
+			ch.Error = "move entry has no source path"
+			return ch, nil
+		}
+		if herr := s.pendingTargetAllowed(pf.From); herr != nil {
+			ch.Error = "source: " + herr.Error()
+			ch.Exists = false
+			ch.After = ""
+			ch.Bytes = 0
+			return ch, nil
+		}
+	}
 
 	// A queue entry is a FILE in `.slmcode/pending/`, which means a cloned
 	// repository can ship one — nothing here proves the harness wrote it. An
@@ -141,6 +195,25 @@ func (s *Server) readPending(id string, withHunks bool, context int) (PendingCha
 	} else {
 		ch.Before = string(before)
 	}
+	switch pf.Kind {
+	case pendingKindDelete:
+		// The diff of a delete is "everything removed"; the recorded content
+		// is empty by construction.
+		ch.After = ""
+		ch.Bytes = 0
+		ch.IsNew = false
+	case pendingKindMove:
+		// Rendered at the DESTINATION path: before is what the source holds
+		// now (the destination normally does not exist yet), after is the
+		// content that will land there.
+		if src, err := s.workspacePath(pf.From); err == nil {
+			if data, rerr := os.ReadFile(src); rerr == nil {
+				ch.Before = string(data)
+			} else if os.IsNotExist(rerr) && ch.Before == "" {
+				ch.Error = "source " + filepath.ToSlash(pf.From) + " no longer exists; the recorded content will be written instead"
+			}
+		}
+	}
 
 	d := ComputeDiff(ch.Before, ch.After, context)
 	ch.Stat = d.Stat
@@ -199,6 +272,10 @@ func (s *Server) handleReviewPending(w http.ResponseWriter, r *http.Request) {
 		if err != nil {
 			continue
 		}
+		if !pendingKindApplicable(ch.Kind) {
+			// Stale shell mirrors from an older workspace: not a change.
+			continue
+		}
 		added += ch.Stat.Added
 		removed += ch.Stat.Removed
 		items = append(items, ch)
@@ -244,7 +321,20 @@ func (s *Server) reviewTargets(r *http.Request) ([]string, error) {
 		_ = json.NewDecoder(r.Body).Decode(&req)
 	}
 	if req.All {
-		return s.listPendingIDs()
+		ids, err := s.listPendingIDs()
+		if err != nil {
+			return nil, err
+		}
+		// "all" means every CHANGE; stale shell mirrors are hidden from the
+		// listing and are skipped here for the same reason.
+		out := ids[:0]
+		for _, id := range ids {
+			if ch, err := s.readPending(id, false, 0); err == nil && !pendingKindApplicable(ch.Kind) {
+				continue
+			}
+			out = append(out, id)
+		}
+		return out, nil
 	}
 	ids := append([]string(nil), req.IDs...)
 	if strings.TrimSpace(req.ID) != "" {
@@ -282,6 +372,7 @@ func (s *Server) handleReviewApply(w http.ResponseWriter, r *http.Request) {
 			Message: fmt.Sprintf("applied %d pending change(s) from Studio", len(applied)),
 			Output:  strings.Join(applied, "\n"), Time: time.Now(),
 		})
+		s.emitReviewPending()
 	}
 	writeJSON(w, map[string]any{
 		"ok": len(failed) == 0, "applied": applied, "failed": failed,
@@ -316,6 +407,7 @@ func (s *Server) handleReviewReject(w http.ResponseWriter, r *http.Request) {
 			Message: fmt.Sprintf("rejected %d pending change(s) from Studio", len(rejected)),
 			Time:    time.Now(),
 		})
+		s.emitReviewPending()
 	}
 	writeJSON(w, map[string]any{
 		"ok": len(failed) == 0, "rejected": rejected, "failed": failed,
@@ -355,13 +447,43 @@ func (s *Server) applyPending(id string) (string, error) {
 	if herr := s.pendingTargetAllowed(pf.Path); herr != nil {
 		return pf.Path, herr
 	}
-	if err := os.MkdirAll(filepath.Dir(target), 0o755); err != nil { //nolint:gosec // directory in the user's source tree — conventional 0755, not harness state
-		return pf.Path, err
-	}
-	// target is a project source file (re-validated above to stay inside the
-	// workspace) — conventional perms, not secret state.
-	if err := os.WriteFile(target, []byte(pf.Content), 0o644); err != nil { //nolint:gosec // project source file, conventional perms
-		return pf.Path, err
+	// The KIND decides what "apply" means. Every kind used to be applied as
+	// "write Content to Path": a delete entry (Content "") truncated the file
+	// instead of removing it, a move entry copied the destination and left the
+	// source behind, and a shell entry wrote shell.sh at the project root.
+	switch pf.Kind {
+	case pendingKindShell:
+		return pf.Path, errors.New("shell approvals are not file changes and cannot be applied; reject the entry")
+	case pendingKindDelete:
+		if err := os.Remove(target); err != nil && !os.IsNotExist(err) {
+			return pf.Path, err
+		}
+	case pendingKindMove:
+		if strings.TrimSpace(pf.From) == "" {
+			return pf.Path, errors.New("move entry has no source path")
+		}
+		if herr := s.pendingTargetAllowed(pf.From); herr != nil {
+			return pf.Path, fmt.Errorf("source: %w", herr)
+		}
+		src, err := s.workspacePath(pf.From)
+		if err != nil {
+			return pf.Path, ErrPathEscape
+		}
+		if err := os.MkdirAll(filepath.Dir(target), 0o755); err != nil { //nolint:gosec // directory in the user's source tree — conventional 0755, not harness state
+			return pf.Path, err
+		}
+		if err := movePendingFile(src, target, pf.Content); err != nil {
+			return pf.Path, err
+		}
+	default:
+		if err := os.MkdirAll(filepath.Dir(target), 0o755); err != nil { //nolint:gosec // directory in the user's source tree — conventional 0755, not harness state
+			return pf.Path, err
+		}
+		// target is a project source file (re-validated above to stay inside
+		// the workspace) — conventional perms, not secret state.
+		if err := os.WriteFile(target, []byte(pf.Content), 0o644); err != nil { //nolint:gosec // project source file, conventional perms
+			return pf.Path, err
+		}
 	}
 	if err := os.Remove(full); err != nil && !os.IsNotExist(err) {
 		return pf.Path, err
@@ -369,9 +491,73 @@ func (s *Server) applyPending(id string) (string, error) {
 	return filepath.ToSlash(pf.Path), nil
 }
 
+// movePendingFile realises a queued ws_mv: rename when the source still
+// exists, else write the recorded content (the source was moved or deleted by
+// something else in the meantime, and the proposal's intent is the content at
+// the destination).
+func movePendingFile(src, dst, content string) error {
+	if _, err := os.Stat(dst); err == nil {
+		return fmt.Errorf("destination %s already exists", filepath.Base(dst))
+	}
+	if _, err := os.Lstat(src); err != nil {
+		if !os.IsNotExist(err) {
+			return err
+		}
+		return os.WriteFile(dst, []byte(content), 0o644) //nolint:gosec // project source file, conventional perms
+	}
+	if err := os.Rename(src, dst); err == nil {
+		return nil
+	}
+	// Cross-device or otherwise un-renamable: copy, verify, then remove.
+	data, err := os.ReadFile(src) //nolint:gosec // src re-validated against the workspace root by the caller
+	if err != nil {
+		return err
+	}
+	if err := os.WriteFile(dst, data, 0o644); err != nil { //nolint:gosec // project source file, conventional perms
+		return err
+	}
+	if st, err := os.Stat(dst); err != nil || st.Size() != int64(len(data)) {
+		_ = os.Remove(dst)
+		return errors.New("copy of the source was incomplete; source left in place")
+	}
+	return os.Remove(src)
+}
+
+// pendingCount is the number of applicable queue entries (shell mirrors from
+// an older workspace are not counted; the listing hides them too).
 func (s *Server) pendingCount() int {
 	ids, _ := s.listPendingIDs()
-	return len(ids)
+	n := 0
+	for _, id := range ids {
+		full, err := s.pendingIDPath(id)
+		if err != nil {
+			continue
+		}
+		raw, err := os.ReadFile(full) //nolint:gosec // queue file under the harness state dir
+		if err != nil {
+			continue
+		}
+		var pf pendingFile
+		if json.Unmarshal(raw, &pf) == nil && !pendingKindApplicable(pf.Kind) {
+			continue
+		}
+		n++
+	}
+	return n
+}
+
+// emitReviewPending publishes the queue depth as a `review_pending` event
+// ({"pending": N}) so Studio's badge follows the queue without polling. It is
+// called after every apply/reject and, through the workspace hook installed in
+// NewWithOptions, after every proposal a running agent records.
+func (s *Server) emitReviewPending() {
+	n := s.pendingCount()
+	s.emit(orchestrator.Event{
+		Phase: "review", Kind: "review_pending", Level: "info",
+		Message: fmt.Sprintf("%d pending review change(s)", n),
+		Data:    map[string]any{"pending": n},
+		Time:    time.Now(),
+	})
 }
 
 func boolParam(r *http.Request, key string, def bool) bool {
diff --git a/pkg/server/review_kinds_test.go b/pkg/server/review_kinds_test.go
new file mode 100644
index 0000000..27d0d51
--- /dev/null
+++ b/pkg/server/review_kinds_test.go
@@ -0,0 +1,210 @@
+package server
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+// writeQueueEntry writes a raw review-queue entry, as pkg/workspace records
+// (and stamps) it, with a controllable timestamp prefix for ordering.
+func writeQueueEntry(t *testing.T, slmDir string, nanos int64, obj map[string]any) string {
+	t.Helper()
+	dir := filepath.Join(slmDir, "pending")
+	if err := os.MkdirAll(dir, 0o750); err != nil {
+		t.Fatal(err)
+	}
+	raw, err := json.Marshal(obj)
+	if err != nil {
+		t.Fatal(err)
+	}
+	kind, _ := obj["kind"].(string)
+	name := strings.ReplaceAll(time.Unix(0, nanos).UTC().Format("20060102150405.000000000"), ".", "")
+	id := name + "_" + kind + "_x.patch.json"
+	if err := os.WriteFile(filepath.Join(dir, id), raw, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	return id
+}
+
+func applyAll(t *testing.T, s *Server) (applied []string, failed []reviewActionFailure) {
+	t.Helper()
+	rec := httptest.NewRecorder()
+	s.Handler().ServeHTTP(rec, newAPIRequest(http.MethodPost, "/api/review/apply", strings.NewReader(`{"all":true}`)))
+	if rec.Code != 200 {
+		t.Fatalf("apply status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	var out struct {
+		Applied []string              `json:"applied"`
+		Failed  []reviewActionFailure `json:"failed"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
+		t.Fatal(err)
+	}
+	return out.Applied, out.Failed
+}
+
+func lastEventOfKind(s *Server, kind string) (map[string]any, bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	for i := len(s.events) - 1; i >= 0; i-- {
+		if s.events[i].Event.Kind == kind {
+			data, _ := s.events[i].Event.Data.(map[string]any)
+			return data, true
+		}
+	}
+	return nil, false
+}
+
+// A "delete" entry must remove the file — applying it as a write truncated
+// the file to zero bytes and reported success.
+func TestReviewApplyDeleteRemovesFile(t *testing.T) {
+	h := newHarness(t)
+	s := New(h, nil)
+	root := h.Config.Root
+	mustWrite(t, filepath.Join(root, "gone.go"), "package a\n")
+	writeQueueEntry(t, h.Config.SlmDir(), 1, map[string]any{"path": "gone.go", "kind": "delete", "content": ""})
+
+	// The listing renders it as everything-removed, not as a 0-byte write.
+	rec := httptest.NewRecorder()
+	s.Handler().ServeHTTP(rec, newAPIRequest(http.MethodGet, "/api/review/pending", nil))
+	var listing struct {
+		Items []PendingChange `json:"items"`
+	}
+	_ = json.Unmarshal(rec.Body.Bytes(), &listing)
+	if len(listing.Items) != 1 || listing.Items[0].Kind != "delete" || listing.Items[0].IsNew || listing.Items[0].Stat.Removed != 1 {
+		t.Fatalf("listing: %+v", listing.Items)
+	}
+
+	applied, failed := applyAll(t, s)
+	if len(failed) != 0 || len(applied) != 1 {
+		t.Fatalf("applied=%v failed=%+v", applied, failed)
+	}
+	if _, err := os.Stat(filepath.Join(root, "gone.go")); !os.IsNotExist(err) {
+		t.Fatalf("file not removed (err=%v)", err)
+	}
+}
+
+// An "mv" entry moves the source; applying it as a write copied the content
+// to the destination and left the source in place.
+func TestReviewApplyMoveMovesSource(t *testing.T) {
+	h := newHarness(t)
+	s := New(h, nil)
+	root := h.Config.Root
+	mustWrite(t, filepath.Join(root, "old", "a.go"), "package a\n")
+	writeQueueEntry(t, h.Config.SlmDir(), 1, map[string]any{
+		"path": "new/a.go", "kind": "mv", "content": "package a\n", "from": "old/a.go",
+		"task_id": "T2", "agent": "worker", "query_id": "run-7",
+	})
+
+	rec := httptest.NewRecorder()
+	s.Handler().ServeHTTP(rec, newAPIRequest(http.MethodGet, "/api/review/pending", nil))
+	var listing struct {
+		Items []PendingChange `json:"items"`
+	}
+	_ = json.Unmarshal(rec.Body.Bytes(), &listing)
+	if len(listing.Items) != 1 {
+		t.Fatalf("listing: %+v", listing.Items)
+	}
+	it := listing.Items[0]
+	if it.From != "old/a.go" || it.TaskID != "T2" || it.Agent != "worker" || it.QueryID != "run-7" {
+		t.Fatalf("stamps not exposed: %+v", it)
+	}
+	if it.Before != "package a\n" || it.Stat.Added != 0 || it.Stat.Removed != 0 {
+		t.Fatalf("move should diff against its source (unchanged content): %+v", it)
+	}
+
+	applied, failed := applyAll(t, s)
+	if len(failed) != 0 || len(applied) != 1 {
+		t.Fatalf("applied=%v failed=%+v", applied, failed)
+	}
+	if _, err := os.Stat(filepath.Join(root, "old", "a.go")); !os.IsNotExist(err) {
+		t.Fatalf("source left behind (err=%v)", err)
+	}
+	got, err := os.ReadFile(filepath.Join(root, "new", "a.go"))
+	if err != nil || string(got) != "package a\n" {
+		t.Fatalf("destination: %q err=%v", got, err)
+	}
+	// A move whose source escapes the workspace is refused, not performed.
+	writeQueueEntry(t, h.Config.SlmDir(), 2, map[string]any{
+		"path": "stolen.txt", "kind": "mv", "content": "x", "from": "../../etc/hostname",
+	})
+	_, failed = applyAll(t, s)
+	if len(failed) != 1 {
+		t.Fatalf("escaping move not refused: %+v", failed)
+	}
+}
+
+// A stale "shell" mirror is never a file: hidden from the listing, skipped by
+// {all:true}, refused by id.
+func TestReviewShellEntriesAreNeverApplied(t *testing.T) {
+	h := newHarness(t)
+	s := New(h, nil)
+	root := h.Config.Root
+	id := writeQueueEntry(t, h.Config.SlmDir(), 1, map[string]any{"path": "shell.sh", "kind": "shell", "content": "rm -rf /"})
+	writeQueueEntry(t, h.Config.SlmDir(), 2, map[string]any{"path": "b.go", "kind": "write", "content": "package b\n"})
+
+	rec := httptest.NewRecorder()
+	s.Handler().ServeHTTP(rec, newAPIRequest(http.MethodGet, "/api/review/pending", nil))
+	var listing struct {
+		Count int             `json:"count"`
+		Items []PendingChange `json:"items"`
+	}
+	_ = json.Unmarshal(rec.Body.Bytes(), &listing)
+	if listing.Count != 1 || listing.Items[0].Path != "b.go" {
+		t.Fatalf("shell entry visible in listing: %+v", listing.Items)
+	}
+
+	applied, failed := applyAll(t, s)
+	if len(applied) != 1 || len(failed) != 0 {
+		t.Fatalf("all: applied=%v failed=%+v", applied, failed)
+	}
+	if _, err := os.Stat(filepath.Join(root, "shell.sh")); err == nil {
+		t.Fatal("shell.sh was written to the project root")
+	}
+	rec = httptest.NewRecorder()
+	s.Handler().ServeHTTP(rec, newAPIRequest(http.MethodPost, "/api/review/apply", strings.NewReader(`{"id":"`+id+`"}`)))
+	var out struct {
+		OK     bool                  `json:"ok"`
+		Failed []reviewActionFailure `json:"failed"`
+	}
+	_ = json.Unmarshal(rec.Body.Bytes(), &out)
+	if out.OK || len(out.Failed) != 1 || !strings.Contains(out.Failed[0].Error, "shell") {
+		t.Fatalf("shell entry applied by id: %s", rec.Body.String())
+	}
+	if _, err := os.Stat(filepath.Join(root, "shell.sh")); err == nil {
+		t.Fatal("shell.sh was written to the project root by id")
+	}
+}
+
+// Apply and reject both publish the queue depth as a review_pending event.
+func TestReviewPendingEventOnApplyAndReject(t *testing.T) {
+	h := newHarness(t)
+	s := New(h, nil)
+	writeQueueEntry(t, h.Config.SlmDir(), 1, map[string]any{"path": "a.go", "kind": "write", "content": "package a\n"})
+	id2 := writeQueueEntry(t, h.Config.SlmDir(), 2, map[string]any{"path": "b.go", "kind": "write", "content": "package b\n"})
+	writeQueueEntry(t, h.Config.SlmDir(), 3, map[string]any{"path": "c.go", "kind": "write", "content": "package c\n"})
+
+	rec := httptest.NewRecorder()
+	s.Handler().ServeHTTP(rec, newAPIRequest(http.MethodPost, "/api/review/reject", strings.NewReader(`{"id":"`+id2+`"}`)))
+	data, ok := lastEventOfKind(s, "review_pending")
+	if !ok || data["pending"] != 2 {
+		t.Fatalf("after reject: event=%v ok=%v", data, ok)
+	}
+	applyAll(t, s)
+	data, ok = lastEventOfKind(s, "review_pending")
+	if !ok || data["pending"] != 0 {
+		t.Fatalf("after apply: event=%v ok=%v", data, ok)
+	}
+	// The event is in the replay buffer like any other.
+	rec = httptest.NewRecorder()
+	s.Handler().ServeHTTP(rec, newAPIRequest(http.MethodGet, "/api/runs/latest", nil))
+	if !strings.Contains(rec.Body.String(), `"kind": "review_pending"`) {
+		t.Fatalf("review_pending not replayed: %s", rec.Body.String())
+	}
+}
diff --git a/pkg/server/server.go b/pkg/server/server.go
index c141bf8..610cbfb 100644
--- a/pkg/server/server.go
+++ b/pkg/server/server.go
@@ -77,8 +77,29 @@ type Server struct {
 	seq     uint64
 	lastRes *orchestrator.Result
 	running bool
-	subs    map[*subscriber]struct{}
-	closed  bool
+	// stopping is set by POST /api/runs/stop while the run goroutine is still
+	// unwinding. running stays true until that goroutine exits, so a new run
+	// cannot start on top of the old one's teardown.
+	stopping bool
+	// runGen counts run starts. The run goroutine captures the generation it
+	// was started under and only clears running / restores per-run options
+	// when it still matches, so a goroutine from a stopped run that finishes
+	// late cannot clobber the state of the run that replaced it.
+	runGen uint64
+	// lastPhase is the most recent phase seen on a structural event; the
+	// task_update events synthesized from the board hook carry it because the
+	// board itself does not know which phase moved the task.
+	lastPhase string
+	subs      map[*subscriber]struct{}
+	closed    bool
+	// hookRemovers undo the package-level change hooks installed by
+	// installChangeHooks; run in Shutdown.
+	hookRemovers []func()
+	// runFn / resumeFn are the engine entry points POST /api/runs and
+	// /api/runs/resume drive. They default to the harness and are swappable so
+	// lifecycle tests can run a controllable fake instead of a model.
+	runFn    func(ctx context.Context, query string) (*orchestrator.Result, error)
+	resumeFn func(ctx context.Context, id string) (*orchestrator.Result, error)
 
 	// cfgMu guards mutation of the shared *config.Config and of the
 	// Orchestrator pointer. Handlers must go through cfg()/orch()/
@@ -131,10 +152,30 @@ func NewWithOptions(h *harness.Harness, ui fs.FS, opts Options) *Server {
 		baseCancel: cancel,
 	}
 	s.wireOrchestratorEvents()
+	s.installChangeHooks()
 	s.routes()
 	return s
 }
 
+// installChangeHooks subscribes the server to the two package-level change
+// feeds it turns into SSE events: review-queue proposals recorded by a running
+// agent's workspace (review_pending) and board task changes (task_update).
+// Both hooks are removed again in Shutdown so a test that builds several
+// servers does not leak emitters between them.
+func (s *Server) installChangeHooks() {
+	s.hookRemovers = append(s.hookRemovers,
+		workspace.AddPendingHook(func(_, _, _ string) { s.emitReviewPending() }),
+		plan.AddBoardHook(func(t plan.Task) { s.emitTaskUpdate(t) }),
+	)
+}
+
+func (s *Server) removeChangeHooks() {
+	for _, rm := range s.hookRemovers {
+		rm()
+	}
+	s.hookRemovers = nil
+}
+
 // wireOrchestratorEvents keeps Studio SSE subscribed across config rebuilds.
 func (s *Server) wireOrchestratorEvents() {
 	orch := s.orch()
@@ -146,12 +187,55 @@ func (s *Server) wireOrchestratorEvents() {
 	})
 }
 
+// taskUpdateKind is the SSE kind for a board task change; reviewPendingKind
+// announces the review-queue depth. Both are synthesized by the server from
+// the package-level hooks, not emitted by the engine.
+const (
+	taskUpdateKind    = "task_update"
+	reviewPendingKind = "review_pending"
+)
+
+// emitTaskUpdate publishes one task change as a task_update event:
+// Phase = the current run phase when one is known, else "board"; TaskID = the
+// task id; Message = "<id> -> <column>"; Data = {"task": <task JSON as GET
+// /api/tasks returns it>}. A removed task arrives with an empty column.
+func (s *Server) emitTaskUpdate(t plan.Task) {
+	s.mu.Lock()
+	phase := s.lastPhase
+	s.mu.Unlock()
+	if phase == "" {
+		phase = "board"
+	}
+	col := t.Column
+	if col == "" {
+		col = "removed"
+	}
+	s.emit(orchestrator.Event{
+		Phase: phase, Kind: taskUpdateKind, Level: "info", TaskID: t.ID,
+		Message: t.ID + " -> " + col,
+		Data:    map[string]any{"task": t},
+		Time:    time.Now(),
+	})
+}
+
 func (s *Server) emit(e orchestrator.Event) {
 	s.mu.Lock()
 	if s.closed {
 		s.mu.Unlock()
 		return
 	}
+	// Track the run's current phase for the synthesized task_update events.
+	// Only engine phases count: the synthesized kinds and the review
+	// endpoints' own "review" phase would otherwise mislabel later updates.
+	switch e.Kind {
+	case taskUpdateKind, reviewPendingKind, tokenKind:
+	case "run_end", "run_stop":
+		s.lastPhase = ""
+	default:
+		if e.Phase != "" && e.Phase != "review" {
+			s.lastPhase = e.Phase
+		}
+	}
 	s.seq++
 	se := seqEvent{Seq: s.seq, Event: e}
 	s.events = append(s.events, se)
@@ -247,6 +331,7 @@ func (s *Server) Shutdown(ctx context.Context) error {
 	case <-time.After(shutdownRunGrace):
 	}
 
+	s.removeChangeHooks()
 	s.mu.Lock()
 	s.closed = true
 	subs := make([]*subscriber, 0, len(s.subs))
@@ -1442,57 +1527,104 @@ func (s *Server) handleEscalateAnswer(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, map[string]any{"ok": true, "action": ans.Action})
 }
 
+// pendingShellAsks lists the shell asks that are still waiting for a decision,
+// oldest first. Expired asks are withdrawn on the way; answered ones are left
+// for their worker to collect and skipped.
+func (s *Server) pendingShellAsks() ([]workspace.ShellAsk, error) {
+	ids, err := hitl.ListAskIDs(s.slmDir(), "shell")
+	if err != nil {
+		return nil, err
+	}
+	fallback := s.cfg().ShellAskTimeout
+	var out []workspace.ShellAsk
+	for _, id := range ids {
+		var ask workspace.ShellAsk
+		ok, err := hitl.ReadAskID(s.slmDir(), "shell", id, &ask)
+		if err != nil || !ok {
+			continue
+		}
+		if ask.ID == "" {
+			ask.ID = id
+		}
+		askPath := hitl.AskIDPath(s.slmDir(), "shell", id)
+		if askExpiredWithFallback(ask.CreatedAt, ask.TimeoutS, fallback, askPath) {
+			hitl.ClearID(s.slmDir(), "shell", id)
+			continue
+		}
+		if answered, expired := answeredAskState(hitl.AnswerIDPath(s.slmDir(), "shell", id), ask.ID, ask.CreatedAt, ask.TimeoutS, fallback, askPath); answered || expired {
+			if expired {
+				hitl.ClearID(s.slmDir(), "shell", id)
+			}
+			continue
+		}
+		out = append(out, ask)
+	}
+	return out, nil
+}
+
+// handleShellPending — GET /api/shell/pending
+//
+// Shell asks are per-ask files now (a parallel wave raises several at once),
+// so the response carries the whole list in `asks`. The single-ask shape the
+// UI was built on is kept: `pending` and `ask` describe the OLDEST open ask.
+//
+//	{"pending": true, "ask": {…first…}, "asks": [{…}, {…}], "count": 2}
+//	{"pending": false, "asks": [], "count": 0}
 func (s *Server) handleShellPending(w http.ResponseWriter, r *http.Request) {
-	var ask workspace.ShellAsk
-	ok, err := hitl.ReadAsk(s.slmDir(), "shell", &ask)
+	asks, err := s.pendingShellAsks()
 	if err != nil {
 		http.Error(w, err.Error(), 500)
 		return
 	}
-	if !ok {
-		writeJSON(w, map[string]any{"pending": false})
-		return
-	}
-	if answered, expired := answeredAskState(hitl.AnswersPath(s.slmDir(), "shell"), ask.ID, ask.CreatedAt, ask.TimeoutS, s.cfg().ShellAskTimeout, hitl.AskPath(s.slmDir(), "shell")); answered || expired {
-		if expired {
-			hitl.Clear(s.slmDir(), "shell")
-			writeJSON(w, map[string]any{"pending": false, "expired": true})
-			return
-		}
-		writeJSON(w, map[string]any{"pending": false, "answered": true})
-		return
-	}
-	if askExpiredWithFallback(ask.CreatedAt, ask.TimeoutS, s.cfg().ShellAskTimeout, hitl.AskPath(s.slmDir(), "shell")) {
-		hitl.Clear(s.slmDir(), "shell")
-		writeJSON(w, map[string]any{"pending": false, "expired": true})
+	if len(asks) == 0 {
+		writeJSON(w, map[string]any{"pending": false, "asks": []workspace.ShellAsk{}, "count": 0})
 		return
 	}
-	writeJSON(w, map[string]any{"pending": true, "ask": ask})
+	writeJSON(w, map[string]any{"pending": true, "ask": asks[0], "asks": asks, "count": len(asks)})
 }
 
+// handleShellApprove — POST /api/shell/approve {ask_id, decision}
+//
+// ask_id selects which of the pending asks is being decided. It may be omitted
+// only when exactly one ask is pending; with several, an unspecified or
+// unknown id is a 409 so a stale card can never approve a newer command.
 func (s *Server) handleShellApprove(w http.ResponseWriter, r *http.Request) {
 	var ans workspace.ShellAnswer
 	if err := json.NewDecoder(r.Body).Decode(&ans); err != nil {
 		http.Error(w, "invalid JSON", 400)
 		return
 	}
-	var ask workspace.ShellAsk
-	ok, err := hitl.ReadAsk(s.slmDir(), "shell", &ask)
+	asks, err := s.pendingShellAsks()
 	if err != nil {
 		http.Error(w, err.Error(), 500)
 		return
 	}
-	if !ok {
+	posted := strings.TrimSpace(ans.AskID)
+	// An id that already has a decision on file is a duplicate click, not a
+	// missing ask — even once the worker has collected it.
+	if posted != "" {
+		if ok, _ := hitl.ReadAnswerID(s.slmDir(), "shell", posted, &workspace.ShellAnswer{}); ok {
+			http.Error(w, "shell ask already answered", http.StatusConflict)
+			return
+		}
+	}
+	if len(asks) == 0 {
 		http.Error(w, "no pending shell ask", http.StatusNotFound)
 		return
 	}
-	if !requireMatchingAskID(w, ans.AskID, ask.ID) {
-		return
+	var ask *workspace.ShellAsk
+	for i := range asks {
+		if asks[i].ID == posted {
+			ask = &asks[i]
+			break
+		}
 	}
-	if askExpiredWithFallback(ask.CreatedAt, ask.TimeoutS, s.cfg().ShellAskTimeout, hitl.AskPath(s.slmDir(), "shell")) {
-		hitl.Clear(s.slmDir(), "shell")
-		http.Error(w, "shell ask expired", http.StatusGone)
-		return
+	if ask == nil {
+		if posted == "" && len(asks) == 1 {
+			ask = &asks[0]
+		} else if !requireMatchingAskID(w, posted, asks[0].ID) {
+			return
+		}
 	}
 	ans.Decision = strings.ToLower(strings.TrimSpace(ans.Decision))
 	if ans.Decision != "approve" && ans.Decision != "deny" {
@@ -1503,7 +1635,7 @@ func (s *Server) handleShellApprove(w http.ResponseWriter, r *http.Request) {
 	if ans.AnsweredAt == "" {
 		ans.AnsweredAt = time.Now().UTC().Format(time.RFC3339)
 	}
-	if err := hitl.WriteAnswersOnce(s.slmDir(), "shell", ans); err != nil {
+	if err := hitl.WriteAnswerIDOnce(s.slmDir(), "shell", ask.ID, ans); err != nil {
 		if os.IsExist(err) {
 			http.Error(w, "shell ask already answered", http.StatusConflict)
 			return
diff --git a/pkg/server/server_test.go b/pkg/server/server_test.go
index 230a848..7dc8050 100644
--- a/pkg/server/server_test.go
+++ b/pkg/server/server_test.go
@@ -309,7 +309,7 @@ func TestHITLAnswersRequireCurrentAskIDForAllKinds(t *testing.T) {
 			name:     "shell",
 			endpoint: "/api/shell/approve",
 			writeAsk: func(h *harness.Harness, id string) error {
-				return hitl.WriteAsk(h.Config.SlmDir(), "shell", workspace.ShellAsk{
+				return hitl.WriteAskID(h.Config.SlmDir(), "shell", id, workspace.ShellAsk{
 					ID:        id,
 					Kind:      "shell",
 					Command:   "go test ./...",
@@ -456,7 +456,7 @@ func TestShellApproveRejectsInvalidDecision(t *testing.T) {
 		OnTimeout: "deny",
 		CreatedAt: time.Now().UTC().Format(time.RFC3339),
 	}
-	if err := hitl.WriteAsk(h.Config.SlmDir(), "shell", ask); err != nil {
+	if err := hitl.WriteAskID(h.Config.SlmDir(), "shell", ask.ID, ask); err != nil {
 		t.Fatal(err)
 	}
 
@@ -472,7 +472,7 @@ func TestShellApproveRejectsInvalidDecision(t *testing.T) {
 			t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
 		}
 	}
-	if ok, err := hitl.ReadAnswers(h.Config.SlmDir(), "shell", &workspace.ShellAnswer{}); err != nil || ok {
+	if ok, err := hitl.ReadAnswerID(h.Config.SlmDir(), "shell", ask.ID, &workspace.ShellAnswer{}); err != nil || ok {
 		t.Fatalf("invalid decision wrote answer ok=%v err=%v", ok, err)
 	}
 }
diff --git a/pkg/workspace/adversarial_jail_test.go b/pkg/workspace/adversarial_jail_test.go
index fbf01ab..8c83be9 100644
--- a/pkg/workspace/adversarial_jail_test.go
+++ b/pkg/workspace/adversarial_jail_test.go
@@ -116,6 +116,53 @@ func TestJailEscapes(t *testing.T) {
 	if _, err := ws.resolve("etcx/passwd"); err == nil {
 		t.Errorf("agent-created symlink escape not blocked")
 	}
+
+	// 10. DANGLING symlink: the target does not exist, so EvalSymlinks fails —
+	// the check used to fall back to the lexical verdict and os.WriteFile then
+	// followed the link and CREATED the outside file.
+	t.Run("dangling_symlink", func(t *testing.T) {
+		victim := filepath.Join(outside, "victim.txt")
+		_ = os.Remove(victim)
+		_ = os.Symlink(victim, filepath.Join(root, "dangling.txt"))
+		_ = os.WriteFile(filepath.Join(root, "src.txt"), []byte("move me"), 0o644)
+		ws.markRead("src.txt")
+
+		s, err := advCall(t, ws.writeFile, map[string]interface{}{"path": "dangling.txt", "content": "PWNED"})
+		if err == nil && !strings.Contains(s, "escape") && !strings.Contains(s, "refus") {
+			t.Errorf("ws_write through dangling symlink not refused: %q", s)
+		}
+		if _, serr := os.Stat(victim); serr == nil {
+			t.Fatalf("ws_write created %s outside the root", victim)
+		}
+
+		s, err = advCall(t, ws.patchFile, map[string]interface{}{
+			"path":  "dangling.txt",
+			"patch": "<<<<<<< SEARCH\n=======\nPWNED\n>>>>>>> REPLACE",
+		})
+		if err == nil && !strings.Contains(s, "escape") && !strings.Contains(s, "refus") {
+			t.Errorf("ws_patch (create form) through dangling symlink not refused: %q", s)
+		}
+		if _, serr := os.Stat(victim); serr == nil {
+			t.Fatalf("ws_patch created %s outside the root", victim)
+		}
+
+		s, err = advCall(t, ws.moveFile, map[string]interface{}{"from": "src.txt", "to": "dangling.txt"})
+		if err == nil && !strings.Contains(s, "escape") && !strings.Contains(s, "refus") {
+			t.Errorf("ws_mv onto dangling symlink not refused: %q", s)
+		}
+		if _, serr := os.Stat(victim); serr == nil {
+			t.Fatalf("ws_mv created %s outside the root", victim)
+		}
+		if _, serr := os.Stat(filepath.Join(root, "src.txt")); serr != nil {
+			t.Fatalf("ws_mv source vanished: %v", serr)
+		}
+
+		// A dangling link whose target stays INSIDE the root is still usable.
+		_ = os.Symlink(filepath.Join(root, "inner-target.txt"), filepath.Join(root, "inner-link.txt"))
+		if _, err := ws.resolve("inner-link.txt"); err != nil {
+			t.Errorf("in-root dangling symlink wrongly refused: %v", err)
+		}
+	})
 }
 
 func TestSymlinkLoopAndProc(t *testing.T) {
diff --git a/pkg/workspace/coerce.go b/pkg/workspace/coerce.go
index 7abb57a..d9722b7 100644
--- a/pkg/workspace/coerce.go
+++ b/pkg/workspace/coerce.go
@@ -131,3 +131,30 @@ func strArg(args map[string]interface{}, key string) string {
 		return ""
 	}
 }
+
+// Argument aliases. Small models mix vocabularies from every editing tool they
+// were trained on — old_string/new_string, search/replace, plain old/new — and
+// a strict key match turned each of those into a wasted turn ("old_str is
+// required"). The canonical key always wins; an alias is consulted only when
+// the canonical key is absent or empty.
+var (
+	oldStrKeys  = []string{"old_str", "old_string", "search", "old", "old_text", "before"}
+	newStrKeys  = []string{"new_str", "new_string", "replace", "new", "new_text", "replacement", "after"}
+	contentKeys = []string{"content", "contents", "text", "body", "data"}
+	patchKeys   = []string{"patch", "diff", "hunk"}
+)
+
+// strArgAny returns the first non-empty string among keys (see strArg).
+func strArgAny(args map[string]interface{}, keys ...string) string {
+	for _, k := range keys {
+		if v := strArg(args, k); v != "" {
+			return v
+		}
+	}
+	return ""
+}
+
+// aliasList renders the accepted spellings for an error message.
+func aliasList(keys []string) string {
+	return strings.Join(keys, " / ")
+}
diff --git a/pkg/workspace/ergonomics_test.go b/pkg/workspace/ergonomics_test.go
new file mode 100644
index 0000000..2dc234b
--- /dev/null
+++ b/pkg/workspace/ergonomics_test.go
@@ -0,0 +1,202 @@
+package workspace
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// Edit-tool ergonomics for small models: argument aliases, the empty-content
+// refusal, automatic gutter stripping and replace_all on drifted matches.
+
+func TestEditAcceptsArgAliases(t *testing.T) {
+	ctx := context.Background()
+	for _, tc := range []struct {
+		name string
+		args map[string]interface{}
+	}{
+		{"claude-style", map[string]interface{}{"old_string": "b = 2", "new_string": "b = 20"}},
+		{"aider-style", map[string]interface{}{"search": "b = 2", "replace": "b = 20"}},
+		{"bare", map[string]interface{}{"old": "b = 2", "new": "b = 20"}},
+		{"canonical-wins", map[string]interface{}{"old_str": "b = 2", "old": "nope", "new_str": "b = 20", "new": "nope"}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			w, root := newTestWS(t)
+			p := filepath.Join(root, "f.txt")
+			if err := os.WriteFile(p, []byte("a = 1\nb = 2\nc = 3\n"), 0o644); err != nil {
+				t.Fatal(err)
+			}
+			w.markRead("f.txt")
+			args := map[string]interface{}{"path": "f.txt"}
+			for k, v := range tc.args {
+				args[k] = v
+			}
+			out := strOut(w.editFile(ctx, args))
+			if !strings.HasPrefix(out, "edited f.txt") {
+				t.Fatalf("alias edit refused: %q", out)
+			}
+			got, _ := os.ReadFile(p)
+			if string(got) != "a = 1\nb = 20\nc = 3\n" {
+				t.Fatalf("content after alias edit: %q", got)
+			}
+		})
+	}
+
+	t.Run("write-contents-alias", func(t *testing.T) {
+		w, root := newTestWS(t)
+		w.SyntaxCheck = false
+		out := strOut(w.writeFile(ctx, map[string]interface{}{"path": "n.txt", "contents": "hello\n"}))
+		if !strings.HasPrefix(out, "wrote n.txt") {
+			t.Fatalf("contents alias not honored: %q", out)
+		}
+		got, _ := os.ReadFile(filepath.Join(root, "n.txt"))
+		if string(got) != "hello\n" {
+			t.Fatalf("content: %q", got)
+		}
+	})
+
+	t.Run("patch-diff-alias", func(t *testing.T) {
+		w, root := newTestWS(t)
+		w.SyntaxCheck = false
+		if err := os.WriteFile(filepath.Join(root, "f.txt"), []byte("a\nb\nc\n"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		w.markRead("f.txt")
+		out := strOut(w.patchFile(ctx, map[string]interface{}{
+			"path": "f.txt", "diff": "<<<<<<< SEARCH\nb\n=======\nB\n>>>>>>> REPLACE",
+		}))
+		if !strings.HasPrefix(out, "patched f.txt") {
+			t.Fatalf("diff alias not honored: %q", out)
+		}
+	})
+}
+
+func TestWriteRefusesEmptyContentNamesAliases(t *testing.T) {
+	ctx := context.Background()
+	w, root := newTestWS(t)
+	w.SyntaxCheck = false
+
+	out := strOut(w.writeFile(ctx, map[string]interface{}{"path": "new.go", "code": "package x\n"}))
+	if !strings.Contains(out, "Write refused") || !strings.Contains(out, "0-byte") {
+		t.Fatalf("empty write not refused: %q", out)
+	}
+	for _, k := range []string{"content", "contents", "text", "body"} {
+		if !strings.Contains(out, k) {
+			t.Errorf("message does not name accepted key %q: %q", k, out)
+		}
+	}
+	if !strings.Contains(out, "code") {
+		t.Errorf("message should point at the unrecognized key the model used: %q", out)
+	}
+	if _, err := os.Stat(filepath.Join(root, "new.go")); err == nil {
+		t.Fatal("0-byte file was created")
+	}
+
+	// Existing file: same trap truncates; allow_shrink is the way through.
+	if err := os.WriteFile(filepath.Join(root, "old.txt"), []byte("keep"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	w.markRead("old.txt")
+	out = strOut(w.writeFile(ctx, map[string]interface{}{"path": "old.txt", "content": ""}))
+	if !strings.Contains(out, "truncate") || !strings.Contains(out, "allow_shrink") {
+		t.Fatalf("empty overwrite not refused with the escape hatch named: %q", out)
+	}
+	if got, _ := os.ReadFile(filepath.Join(root, "old.txt")); string(got) != "keep" {
+		t.Fatalf("file truncated: %q", got)
+	}
+	out = strOut(w.writeFile(ctx, map[string]interface{}{"path": "old.txt", "content": "", "allow_shrink": true}))
+	if !strings.HasPrefix(out, "overwrote old.txt (0 bytes)") {
+		t.Fatalf("allow_shrink empty write: %q", out)
+	}
+}
+
+func TestEditStripsGutterAutomatically(t *testing.T) {
+	ctx := context.Background()
+	w, root := newTestWS(t)
+	w.SyntaxCheck = false
+	src := "package x\n\nfunc f() {\n\tif err != nil {\n\t\treturn err\n\t}\n}\n"
+	if err := os.WriteFile(filepath.Join(root, "f.go"), []byte(src), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	w.markRead("f.go")
+
+	out := strOut(w.editFile(ctx, map[string]interface{}{
+		"path":    "f.go",
+		"old_str": "     4|\tif err != nil {\n     5|\t\treturn err\n     6|\t}",
+		"new_str": "     4|\tif err != nil {\n     5|\t\treturn fmt.Errorf(\"f: %w\", err)\n     6|\t}",
+	}))
+	if !strings.HasPrefix(out, "edited f.go (1 replacement(s))") {
+		t.Fatalf("gutter edit did not apply: %q", out)
+	}
+	if !strings.Contains(out, "[stripped ws_read line numbers from old_str") {
+		t.Fatalf("note missing so evolve cannot see the drift: %q", out)
+	}
+	got, _ := os.ReadFile(filepath.Join(root, "f.go"))
+	if !strings.Contains(string(got), "\t\treturn fmt.Errorf(\"f: %w\", err)\n") || strings.Contains(string(got), "|") {
+		t.Fatalf("content after gutter strip: %q", got)
+	}
+
+	// A PARTIAL gutter is not a paste: still refused by name.
+	out = strOut(w.editFile(ctx, map[string]interface{}{
+		"path": "f.go", "old_str": "     4|\tif err != nil {\n\t\treturn err", "new_str": "x",
+	}))
+	if !strings.Contains(out, "line-number prefix") {
+		t.Fatalf("mixed gutter should still be refused: %q", out)
+	}
+
+	// ws_patch: same treatment, marker lines exempt.
+	out = strOut(w.patchFile(ctx, map[string]interface{}{
+		"path":  "f.go",
+		"patch": "<<<<<<< SEARCH\n     1|package x\n=======\n     1|package y\n>>>>>>> REPLACE",
+	}))
+	if !strings.HasPrefix(out, "patched f.go") || !strings.Contains(out, "[stripped ws_read line numbers") {
+		t.Fatalf("patch gutter strip: %q", out)
+	}
+	got, _ = os.ReadFile(filepath.Join(root, "f.go"))
+	if !strings.HasPrefix(string(got), "package y\n") {
+		t.Fatalf("patched content: %q", got)
+	}
+}
+
+func TestReplaceAllOnDriftedMatches(t *testing.T) {
+	ctx := context.Background()
+	w, root := newTestWS(t)
+	w.SyntaxCheck = false
+	// Three call sites, all indented deeper than the model's old_str.
+	src := "func a() {\n\t\tlog.Println(\"x\")\n}\nfunc b() {\n\t\tlog.Println(\"x\")\n}\nfunc c() {\n\t\tlog.Println(\"x\")\n}\n"
+	if err := os.WriteFile(filepath.Join(root, "f.go"), []byte(src), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	w.markRead("f.go")
+
+	// Without replace_all the ladder is (correctly) ambiguous.
+	out := strOut(w.editFile(ctx, map[string]interface{}{
+		"path": "f.go", "old_str": "log.Println(\"x\")", "new_str": "slog.Info(\"x\")",
+	}))
+	if !strings.Contains(out, "Ambiguous") && !strings.Contains(out, "found 3 times") {
+		t.Fatalf("expected ambiguity without replace_all: %q", out)
+	}
+	// Exact count is 3 here (the search has no leading whitespace), so drive
+	// the LADDER path with trailing-whitespace drift instead.
+	out = strOut(w.editFile(ctx, map[string]interface{}{
+		"path": "f.go", "old_str": "\tlog.Println(\"x\")   ", "new_str": "\tslog.Info(\"x\")", "replace_all": true,
+	}))
+	if !strings.HasPrefix(out, "edited f.go (3 replacement(s))") {
+		t.Fatalf("replace_all on drifted matches: %q", out)
+	}
+	if !strings.Contains(out, "[matched") {
+		t.Fatalf("strategy note missing: %q", out)
+	}
+	got, _ := os.ReadFile(filepath.Join(root, "f.go"))
+	if strings.Count(string(got), "slog.Info") != 3 || strings.Contains(string(got), "log.Println") {
+		t.Fatalf("content after replace_all: %q", got)
+	}
+
+	// Helper-level: overlapping exact spans are deduplicated.
+	next, n, strat := ReplaceAllDrifted("aaa", "aa", "b")
+	if n != 1 || next != "ba" || strat != MatchExact {
+		t.Fatalf("ReplaceAllDrifted(aaa,aa,b) = %q n=%d strat=%s", next, n, strat)
+	}
+}
diff --git a/pkg/workspace/match.go b/pkg/workspace/match.go
index 7eebd00..9cde428 100644
--- a/pkg/workspace/match.go
+++ b/pkg/workspace/match.go
@@ -83,6 +83,77 @@ func FindEditMatchIn(content, search string, lo, hi int) MatchOutcome {
 	return out
 }
 
+// FindAllEditMatches runs the ladder and returns EVERY span of the first
+// strategy that matches at least once, plus that strategy's name. It is the
+// replace_all counterpart of FindEditMatch: when the exact search misses but a
+// tolerant rung finds the drifted text in N places, the caller asked for all of
+// them and should get all of them. Spans are ordered by offset and never
+// overlap.
+func FindAllEditMatches(content, search string) ([]EditMatch, string) {
+	if search == "" || content == "" {
+		return nil, ""
+	}
+	for _, strategy := range matchLadder {
+		spans := matchStrategy(content, search, 0, len(content), strategy)
+		if len(spans) > 0 {
+			return disjointSpans(spans), strategy
+		}
+	}
+	return nil, ""
+}
+
+// disjointSpans keeps the earliest of any overlapping spans (exactSpans
+// advances one byte at a time, so "aa" in "aaa" yields two overlapping hits).
+func disjointSpans(spans []EditMatch) []EditMatch {
+	out := spans[:0:0]
+	end := -1
+	for _, sp := range spans {
+		if sp.Start < end {
+			continue
+		}
+		out = append(out, sp)
+		end = sp.End
+	}
+	return out
+}
+
+// ReplaceAllDrifted is replace_all for the case where the exact search misses:
+// every span of the first ladder strategy that matches is replaced, then the
+// ladder is run again until nothing matches (the per-strategy scans cap their
+// hit lists, so one pass is not guaranteed to be exhaustive). It returns the
+// new content, how many spans were replaced and which strategy found them.
+// A replacement that still matches its own search under the tolerant strategy
+// is bounded by the round limit and the unchanged-content check rather than
+// looping forever.
+func ReplaceAllDrifted(content, oldStr, newStr string) (string, int, string) {
+	total := 0
+	first := ""
+	for round := 0; round < 16; round++ {
+		spans, strategy := FindAllEditMatches(content, oldStr)
+		if len(spans) == 0 {
+			break
+		}
+		if first == "" {
+			first = strategy
+		}
+		next := content
+		for i := len(spans) - 1; i >= 0; i-- {
+			next = ApplyEditReplacement(next, spans[i], oldStr, newStr)
+		}
+		if next == content {
+			break
+		}
+		content = next
+		total += len(spans)
+		// Only a capped scan can have left matches behind (lineSpans stops
+		// at 9, exactSpans at 65); a shorter list was already exhaustive.
+		if len(spans) < 9 {
+			break
+		}
+	}
+	return content, total, first
+}
+
 func matchStrategy(content, search string, lo, hi int, strategy string) []EditMatch {
 	switch strategy {
 	case MatchExact:
diff --git a/pkg/workspace/observer_test.go b/pkg/workspace/observer_test.go
index b405200..8248a94 100644
--- a/pkg/workspace/observer_test.go
+++ b/pkg/workspace/observer_test.go
@@ -97,7 +97,7 @@ func TestObserverRepairsAndRetriesInPlace(t *testing.T) {
 	}, nil)
 
 	out := callTool(t, reg, "ws_edit", map[string]interface{}{
-		"path": "a.go", "old_str": "   3|var A = 1", "new_str": "var A = 2",
+		"path": "a.go", "old_str": "   3|var A = 1\nvar B", "new_str": "var A = 2",
 	})
 	if !strings.Contains(out, "edited a.go") {
 		t.Fatalf("the repaired retry did not land: %s", out)
@@ -163,7 +163,7 @@ func TestRetrySinkReportsTheVerdict(t *testing.T) {
 		called, gotOK = true, ok
 	})
 	callTool(t, reg, "ws_edit", map[string]interface{}{
-		"path": "a.go", "old_str": "  1|var A = 1", "new_str": "var A = 2",
+		"path": "a.go", "old_str": "  1|var A = 1\nvar B", "new_str": "var A = 2",
 	})
 	if !called {
 		t.Fatal("the retry sink was never called")
@@ -201,7 +201,7 @@ func TestRetrySinkReportsAFailedRepairAsFailed(t *testing.T) {
 		called, gotOK = true, ok
 	})
 	callTool(t, reg, "ws_edit", map[string]interface{}{
-		"path": "a.go", "old_str": "  1|var A = 1", "new_str": "var A = 2",
+		"path": "a.go", "old_str": "  1|var A = 1\nvar B", "new_str": "var A = 2",
 	})
 	if !called {
 		t.Fatal("the retry sink was never called")
diff --git a/pkg/workspace/patch.go b/pkg/workspace/patch.go
index 8b13586..60a47c9 100644
--- a/pkg/workspace/patch.go
+++ b/pkg/workspace/patch.go
@@ -26,23 +26,15 @@ func ApplyPatch(content, patch string) (next string, summary string, err error)
 		return "", "", fmt.Errorf("rejected bad patch format — use a single SEARCH/REPLACE or one unified diff hunk (no prose, no multiple files)")
 	}
 
-	if strings.Contains(patch, "<<<<<<<") && strings.Contains(patch, ">>>>>>>") {
+	if strings.Contains(patch, "<<<<<<<") {
 		return applySearchReplace(content, patch)
 	}
-	if strings.Contains(patch, "=======") && (strings.Contains(patch, "SEARCH") || strings.Contains(patch, "REPLACE")) {
-		return applySearchReplace(content, patch)
-	}
-	// SEARCH / REPLACE without git conflict markers
-	if i := strings.Index(patch, "\n=======\n"); i >= 0 {
-		oldPart := strings.TrimPrefix(patch, "SEARCH\n")
-		if j := strings.Index(oldPart, "\n=======\n"); j >= 0 {
-			oldStr := strings.TrimPrefix(oldPart[:j], "SEARCH\n")
-			rest := oldPart[j+len("\n=======\n"):]
-			rest = strings.TrimPrefix(rest, "REPLACE\n")
-			rest = strings.TrimSuffix(rest, "\n>>>>>>> REPLACE")
-			rest = strings.TrimSuffix(rest, ">>>>>>> REPLACE")
-			return applyExact(content, strings.TrimRight(oldStr, "\n"), strings.TrimRight(rest, "\n"))
-		}
+	// SEARCH / REPLACE without the git conflict markers: "SEARCH\n…\n=======\n…"
+	// with or without a REPLACE header or a ">>>>>>> REPLACE" trailer. This
+	// form used to be routed to applySearchReplace (which insists on <<<<<<<)
+	// whenever the words SEARCH/REPLACE appeared, so it was unreachable.
+	if oldStr, newStr, ok := splitBareSearchReplace(patch); ok {
+		return applyExact(content, oldStr, newStr)
 	}
 	if strings.Contains(patch, "@@") || strings.HasPrefix(patch, "---") || looksLikeDiff(patch) {
 		return applyUnifiedHunks(content, patch)
@@ -75,6 +67,54 @@ func applySearchReplace(content, patch string) (string, string, error) {
 	return applyExact(content, oldBlock, newBlock)
 }
 
+// splitBareSearchReplace parses the marker-less SEARCH/REPLACE form. The
+// separator is a line that is exactly "=======" (the FIRST one — a later one
+// may be a Markdown rule inside the replacement). An optional "SEARCH" header
+// line, an optional "REPLACE" header line after the separator and an optional
+// ">>>>>>> REPLACE" trailer are all tolerated and dropped.
+func splitBareSearchReplace(patch string) (oldStr, newStr string, ok bool) {
+	lines := strings.Split(patch, "\n")
+	sep := -1
+	for i, ln := range lines {
+		// Exactly "=======" at column 0: a unified-diff context line reads
+		// " =======" and a removed one "-=======", neither is a separator.
+		if strings.TrimRight(ln, " \t\r") == "=======" {
+			sep = i
+			break
+		}
+	}
+	if sep < 0 {
+		return "", "", false
+	}
+	before := lines[:sep]
+	after := lines[sep+1:]
+	isHeader := func(ln, word string) bool {
+		t := strings.ToUpper(strings.TrimSpace(ln))
+		return t == word || t == word+":"
+	}
+	if len(before) > 0 && isHeader(before[0], "SEARCH") {
+		before = before[1:]
+	}
+	if len(after) > 0 && isHeader(after[0], "REPLACE") {
+		after = after[1:]
+	}
+	if n := len(after); n > 0 {
+		t := strings.TrimSpace(after[n-1])
+		if strings.HasPrefix(t, ">>>>>>>") || strings.EqualFold(t, "REPLACE") {
+			after = after[:n-1]
+		}
+	}
+	// The word SEARCH or REPLACE somewhere in the text is not enough on its
+	// own: a unified diff that happens to touch a line saying "=======" must
+	// still be a unified diff.
+	if strings.Contains(patch, "@@") && !strings.Contains(strings.ToUpper(patch), "SEARCH") {
+		return "", "", false
+	}
+	oldStr = strings.TrimRight(strings.Join(before, "\n"), "\n")
+	newStr = strings.TrimRight(strings.Join(after, "\n"), "\n")
+	return oldStr, newStr, true
+}
+
 // applyExact locates oldStr with the full match ladder and refuses to apply a
 // non-unique match. The old behavior (strings.Replace ..., 1 — first
 // occurrence wins) silently patched the wrong function.
@@ -142,8 +182,26 @@ func ParseUnifiedHunks(patch string) ([]hunk, error) {
 	var hunks []hunk
 	var cur *hunk
 	seenHunk := false
+	// pending holds unprefixed lines that have not yet been proven to be
+	// context. An unprefixed line FOLLOWED by a real diff line is context a
+	// model forgot to prefix (blank lines especially); an unprefixed line at
+	// the END of a hunk is trailing prose ("This adds the check.") or a
+	// closing code fence, and the old parser turned both into context lines
+	// that could never match, failing the whole hunk.
+	var pending []string
+	flush := func() {
+		if cur == nil {
+			return
+		}
+		for _, l := range pending {
+			cur.Old = append(cur.Old, l)
+			cur.New = append(cur.New, l)
+		}
+		pending = nil
+	}
 	for _, line := range lines {
 		if strings.HasPrefix(line, "@@") {
+			pending = nil // trailing prose of the previous hunk
 			if cur != nil {
 				hunks = append(hunks, *cur)
 			}
@@ -158,25 +216,35 @@ func ParseUnifiedHunks(patch string) ([]hunk, error) {
 		if line == `\ No newline at end of file` {
 			continue
 		}
-		if cur == nil {
-			// Bare -/+ block with no @@ header: open an anchorless hunk.
-			cur = &hunk{Header: "(no @@ header)"}
-			seenHunk = true
+		if strings.HasPrefix(strings.TrimSpace(line), "```") {
+			// A Markdown fence is never file content on either side.
+			continue
 		}
 		switch {
-		case strings.HasPrefix(line, "-"):
-			cur.Old = append(cur.Old, line[1:])
-		case strings.HasPrefix(line, "+"):
-			cur.New = append(cur.New, line[1:])
-		case strings.HasPrefix(line, " "):
-			cur.Old = append(cur.Old, line[1:])
-			cur.New = append(cur.New, line[1:])
+		case strings.HasPrefix(line, "-"), strings.HasPrefix(line, "+"), strings.HasPrefix(line, " "):
+			if cur == nil {
+				// Bare -/+ block with no @@ header: open an anchorless hunk.
+				cur = &hunk{Header: "(no @@ header)"}
+				seenHunk = true
+				// Leading prose ("Here is the diff:") is not context; a
+				// leading unprefixed CODE line is kept, as before.
+				pending = dropLeadingProse(pending)
+			}
+			flush()
+			switch line[0] {
+			case '-':
+				cur.Old = append(cur.Old, line[1:])
+			case '+':
+				cur.New = append(cur.New, line[1:])
+			default:
+				cur.Old = append(cur.Old, line[1:])
+				cur.New = append(cur.New, line[1:])
+			}
 		default:
-			// A completely empty line inside a hunk is an unprefixed blank
-			// CONTEXT line (many models emit "" instead of " "). Dropping it
-			// desynchronised both sides of the diff.
-			cur.Old = append(cur.Old, line)
-			cur.New = append(cur.New, line)
+			// An unprefixed line: blank context a model emitted as "" instead
+			// of " ", forgotten-prefix context, or prose. Decided when we see
+			// what follows it.
+			pending = append(pending, line)
 		}
 	}
 	if cur != nil {
@@ -442,27 +510,80 @@ func closestTextHint(content string, oldLines []string, near int) string {
 		fmt.Sprintf("\n(lines %d–%d — copy this text verbatim, no line numbers)", lo+1, hi)
 }
 
-// insertHunk places a pure-addition hunk at its @@ line, or appends.
+// dropLeadingProse trims blank lines and sentence-shaped lines ("Here is the
+// diff:") from the front of an anchorless hunk's unprefixed prefix, keeping a
+// leading code line the model merely forgot to prefix.
+func dropLeadingProse(pending []string) []string {
+	for len(pending) > 0 {
+		t := strings.TrimSpace(pending[0])
+		if t == "" || (strings.HasSuffix(t, ":") && strings.Contains(t, " ")) {
+			pending = pending[1:]
+			continue
+		}
+		break
+	}
+	return pending
+}
+
+// insertHunk places a pure-addition hunk, or appends when it has no anchor.
+//
+// A hunk with no removed lines ("@@ -N,0 +M,K @@") has unified-diff semantics
+// of "insert AFTER line N" (N = 0 means at the very top). It used to be
+// inserted BEFORE line N, one line too early — an import added "after line 3"
+// landed between lines 2 and 3. When the hunk does carry old lines that are
+// all blank (blank context around the insertion), those blank lines are
+// replaced in place when the file has them at the anchor, otherwise the block
+// goes before the anchor as before. The returned int is the 1-based line the
+// new text now starts on (0 for an unanchored append).
 func insertHunk(content string, h hunk, newStr string, lineDelta int) (string, int) {
-	if h.NewStart <= 0 && h.OldStart <= 0 {
+	appendAtEnd := func() string {
 		if content != "" && !strings.HasSuffix(content, "\n") {
 			content += "\n"
 		}
-		return content + newStr + "\n", 0
+		return content + newStr + "\n"
+	}
+	if h.NewStart <= 0 && h.OldStart <= 0 && !strings.HasPrefix(h.Header, "@@") {
+		// Headerless (anchorless) additions: nowhere to anchor, append.
+		return appendAtEnd(), 0
+	}
+	li := indexLines(content)
+	if len(h.Old) == 0 {
+		// Pure insertion: after line N.
+		after := h.OldStart + lineDelta
+		if after < 0 {
+			after = 0
+		}
+		if after >= len(li.starts) || (after == len(li.starts)-1 && li.text[after] == "" && strings.HasSuffix(content, "\n")) {
+			return appendAtEnd(), after + 1
+		}
+		off := li.starts[after]
+		return content[:off] + newStr + "\n" + content[off:], after + 1
 	}
+	// Blank context lines on the old side: replace them in place when they
+	// really are blank in the file at the anchor.
 	at := h.OldStart + lineDelta
 	if at <= 0 {
 		at = h.NewStart
 	}
-	li := indexLines(content)
 	if at < 1 {
 		at = 1
 	}
 	if at > len(li.starts) {
-		if content != "" && !strings.HasSuffix(content, "\n") {
-			content += "\n"
+		return appendAtEnd(), len(li.starts) + 1
+	}
+	if end := at - 1 + len(h.Old); end <= len(li.starts) {
+		blank := true
+		for i := at - 1; i < end; i++ {
+			if strings.TrimSpace(li.text[i]) != "" {
+				blank = false
+				break
+			}
+		}
+		if blank {
+			lo := li.starts[at-1]
+			hi := li.ends[end-1]
+			return content[:lo] + newStr + content[hi:], at
 		}
-		return content + newStr + "\n", len(li.starts) + 1
 	}
 	off := li.starts[at-1]
 	return content[:off] + newStr + "\n" + content[off:], at
diff --git a/pkg/workspace/patch_semantics_test.go b/pkg/workspace/patch_semantics_test.go
new file mode 100644
index 0000000..e23702e
--- /dev/null
+++ b/pkg/workspace/patch_semantics_test.go
@@ -0,0 +1,145 @@
+package workspace
+
+import (
+	"strings"
+	"testing"
+)
+
+// Pure-insertion hunks ("-N,0") insert AFTER line N, as in every unified-diff
+// consumer; they used to land one line early.
+func TestApplyPatchPureInsertionIsAfterLine(t *testing.T) {
+	content := "a\nb\nc\n"
+	for _, tc := range []struct {
+		name, patch, want string
+	}{
+		{"after line 1", "@@ -1,0 +2,1 @@\n+X", "a\nX\nb\nc\n"},
+		{"top of file (line 0)", "@@ -0,0 +1,1 @@\n+X", "X\na\nb\nc\n"},
+		{"after last line", "@@ -3,0 +4,1 @@\n+X", "a\nb\nc\nX\n"},
+		{"two lines after line 2", "@@ -2,0 +3,2 @@\n+X\n+Y", "a\nb\nX\nY\nc\n"},
+		{"no trailing newline", "@@ -2,0 +3,1 @@\n+X", ""}, // handled below
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			src := content
+			want := tc.want
+			if tc.want == "" {
+				src = "a\nb"
+				want = "a\nb\nX\n"
+			}
+			got, _, err := ApplyPatch(src, tc.patch)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if got != want {
+				t.Fatalf("got %q want %q", got, want)
+			}
+		})
+	}
+
+	// Multi-hunk: the line delta of an earlier insertion carries forward.
+	got, _, err := ApplyPatch("a\nb\nc\nd\n", "@@ -1,0 +2,1 @@\n+X\n@@ -3,0 +5,1 @@\n+Y")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != "a\nX\nb\nc\nY\nd\n" {
+		t.Fatalf("multi-hunk insertion: %q", got)
+	}
+
+	// Empty file, GNU-style header.
+	got, _, err = ApplyPatch("", "@@ -0,0 +1,2 @@\n+one\n+two")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != "one\ntwo\n" {
+		t.Fatalf("insert into empty file: %q", got)
+	}
+}
+
+// The marker-less SEARCH/REPLACE form was routed to the <<<<<<< parser, which
+// rejected it as malformed, so it never worked at all.
+func TestApplyPatchBareSearchReplace(t *testing.T) {
+	content := "package a\n\nfunc F() int { return 1 }\n"
+	for _, tc := range []struct{ name, patch string }{
+		{"SEARCH/REPLACE headers", "SEARCH\nfunc F() int { return 1 }\n=======\nREPLACE\nfunc F() int { return 2 }"},
+		{"SEARCH header only", "SEARCH\nfunc F() int { return 1 }\n=======\nfunc F() int { return 2 }"},
+		{"trailer only", "func F() int { return 1 }\n=======\nfunc F() int { return 2 }\n>>>>>>> REPLACE"},
+		{"colon headers", "SEARCH:\nfunc F() int { return 1 }\n=======\nREPLACE:\nfunc F() int { return 2 }"},
+		{"no words at all", "func F() int { return 1 }\n=======\nfunc F() int { return 2 }"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			got, summary, err := ApplyPatch(content, tc.patch)
+			if err != nil {
+				t.Fatalf("bare form rejected: %v", err)
+			}
+			if !strings.Contains(got, "return 2") || strings.Contains(got, "return 1") {
+				t.Fatalf("got %q", got)
+			}
+			if strings.Contains(got, "SEARCH") || strings.Contains(got, "REPLACE") || strings.Contains(got, "=======") {
+				t.Fatalf("headers leaked into the file: %q (summary %q)", got, summary)
+			}
+		})
+	}
+
+	// A "=======" INSIDE a replacement (Markdown rule) after the first
+	// separator is content, not a second separator.
+	got, _, err := ApplyPatch("# T\n\nbody\n", "SEARCH\nbody\n=======\nbody\n\nRule\n=======\n")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(got, "Rule\n=======") {
+		t.Fatalf("second ======= was not kept as content: %q", got)
+	}
+
+	// A unified-diff context line " =======" is not a bare separator.
+	got, _, err = ApplyPatch("x\n=======\ny\n", "@@ -1,3 +1,3 @@\n-x\n+X\n =======\n y")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != "X\n=======\ny\n" {
+		t.Fatalf("diff with ======= context: %q", got)
+	}
+}
+
+// Trailing prose and Markdown fences around a hunk are dropped instead of
+// becoming context lines that can never match.
+func TestApplyPatchIgnoresTrailingProseAndFences(t *testing.T) {
+	content := "a\nb\nc\n"
+	for _, tc := range []struct{ name, patch string }{
+		{"closing fence", "@@ -2,1 +2,1 @@\n-b\n+B\n```"},
+		{"opening and closing fence", "```diff\n@@ -2,1 +2,1 @@\n-b\n+B\n```"},
+		{"trailing sentence", "@@ -2,1 +2,1 @@\n-b\n+B\nThis changes b to B."},
+		{"fence then sentence", "@@ -2,1 +2,1 @@\n-b\n+B\n```\nThat should do it."},
+		// ("Here is the patch:" essays are still rejected outright by the
+		// anti-wander junk rule; a shorter lead-in reaches the parser.)
+		{"anchorless with leading prose", "Apply this change:\n-b\n+B"},
+		{"anchorless with trailing prose", "-b\n+B\nDone."},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			got, _, err := ApplyPatch(content, tc.patch)
+			if err != nil {
+				t.Fatalf("patch rejected: %v", err)
+			}
+			if got != "a\nB\nc\n" {
+				t.Fatalf("got %q", got)
+			}
+		})
+	}
+
+	// An unprefixed line FOLLOWED by a diff line is still context (models
+	// drop the leading space), and blank context in the middle still counts.
+	got, _, err := ApplyPatch("a\n\nb\nc\n", "@@ -1,4 +1,4 @@\na\n\n-b\n+B\nc")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != "a\n\nB\nc\n" {
+		t.Fatalf("unprefixed context: %q", got)
+	}
+
+	// Trailing unprefixed lines in a MULTI-hunk diff are dropped per hunk.
+	got, _, err = ApplyPatch("a\nb\nc\nd\n", "@@ -1,1 +1,1 @@\n-a\n+A\nnote one\n@@ -3,1 +3,1 @@\n-c\n+C\nnote two")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != "A\nb\nC\nd\n" {
+		t.Fatalf("multi-hunk with trailing notes: %q", got)
+	}
+}
diff --git a/pkg/workspace/pending.go b/pkg/workspace/pending.go
new file mode 100644
index 0000000..b8dba24
--- /dev/null
+++ b/pkg/workspace/pending.go
@@ -0,0 +1,146 @@
+package workspace
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+
+	"github.com/UnicoLab/slmcode/pkg/internal/atomicfile"
+	"github.com/UnicoLab/slmcode/pkg/permissions"
+)
+
+// Review-queue recording (permission mode "review").
+//
+// permissions.RecordPending writes the queue entry {path, kind, content}. The
+// workspace knows more than that at the moment of the proposal — which task
+// and role produced it, which query is running, and for a move where the file
+// came FROM — and the appliers (Studio's review page, `slmcode apply`) need
+// the extra fields to act on a kind correctly and to attribute the change.
+// So the entry is stamped here, in place, right after it is recorded.
+
+// PendingStamp is the attribution added to every review-queue entry.
+type PendingStamp struct {
+	// From is the source path of a ws_mv proposal ("" for other kinds).
+	From string `json:"from,omitempty"`
+	// TaskID is the board task whose tool call produced the proposal, from the
+	// context tag pkg/loop sets per dispatch (WithTaskID). "" when untagged.
+	TaskID string `json:"task_id,omitempty"`
+	// Agent is the role that made the call (WithRole). "" when untagged.
+	Agent string `json:"agent,omitempty"`
+	// QueryID is the id of the running query, read from the live board
+	// (.slmcode/board.json) at record time. "" when no board is live.
+	QueryID string `json:"query_id,omitempty"`
+}
+
+// PendingHook observes a review-queue entry being recorded. Studio installs
+// one to emit a `review_pending` event with the new queue depth.
+type PendingHook func(path, kind, file string)
+
+var (
+	pendingHookMu sync.RWMutex
+	pendingHooks  = map[int]PendingHook{}
+	pendingHookID int
+)
+
+// AddPendingHook registers fn and returns a function that removes it again.
+// Hooks run synchronously after the queue file exists on disk, never under a
+// workspace lock.
+func AddPendingHook(fn PendingHook) (remove func()) {
+	if fn == nil {
+		return func() {}
+	}
+	pendingHookMu.Lock()
+	pendingHookID++
+	id := pendingHookID
+	pendingHooks[id] = fn
+	pendingHookMu.Unlock()
+	return func() {
+		pendingHookMu.Lock()
+		delete(pendingHooks, id)
+		pendingHookMu.Unlock()
+	}
+}
+
+func firePendingHooks(path, kind, file string) {
+	pendingHookMu.RLock()
+	hooks := make([]PendingHook, 0, len(pendingHooks))
+	for _, h := range pendingHooks {
+		hooks = append(hooks, h)
+	}
+	pendingHookMu.RUnlock()
+	for _, h := range hooks {
+		h(path, kind, file)
+	}
+}
+
+// recordPending writes the queue entry, stamps it, and notifies hooks. It
+// returns the queue file path.
+func (w *Workspace) recordPending(ctx context.Context, path, kind, content, from string) (string, error) {
+	file, err := permissions.RecordPending(w.SlmDir, path, kind, content)
+	if err != nil {
+		return "", err
+	}
+	stamp := PendingStamp{
+		From:    from,
+		TaskID:  TaskIDFrom(ctx),
+		Agent:   RoleFrom(ctx),
+		QueryID: liveQueryID(w.SlmDir),
+	}
+	// Best effort: the entry is complete without the stamp, so a failure to
+	// stamp must not turn a recorded proposal into an error the model sees.
+	_ = stampPendingFile(file, stamp)
+	firePendingHooks(path, kind, filepath.Base(file))
+	return file, nil
+}
+
+// stampPendingFile merges stamp into the JSON object in file.
+func stampPendingFile(file string, stamp PendingStamp) error {
+	raw, err := os.ReadFile(file) //nolint:gosec // path produced by permissions.RecordPending under SlmDir
+	if err != nil {
+		return err
+	}
+	var obj map[string]any
+	if err := json.Unmarshal(raw, &obj); err != nil {
+		return err
+	}
+	if stamp.From != "" {
+		obj["from"] = stamp.From
+	}
+	if stamp.TaskID != "" {
+		obj["task_id"] = stamp.TaskID
+	}
+	if stamp.Agent != "" {
+		obj["agent"] = stamp.Agent
+	}
+	if stamp.QueryID != "" {
+		obj["query_id"] = stamp.QueryID
+	}
+	out, err := json.MarshalIndent(obj, "", "  ")
+	if err != nil {
+		return err
+	}
+	return atomicfile.Write(file, append(out, '\n'), 0o644)
+}
+
+// liveQueryID reads query_id from the live board mirror, if there is one.
+// Review mode only ever reaches this on a proposal, so one small read per
+// proposal is the whole cost.
+func liveQueryID(slmDir string) string {
+	if slmDir == "" {
+		return ""
+	}
+	raw, err := os.ReadFile(filepath.Join(slmDir, "board.json")) //nolint:gosec // harness state under SlmDir
+	if err != nil {
+		return ""
+	}
+	var b struct {
+		QueryID string `json:"query_id"`
+	}
+	if json.Unmarshal(raw, &b) != nil {
+		return ""
+	}
+	return strings.TrimSpace(b.QueryID)
+}
diff --git a/pkg/workspace/pending_test.go b/pkg/workspace/pending_test.go
new file mode 100644
index 0000000..6a16fc2
--- /dev/null
+++ b/pkg/workspace/pending_test.go
@@ -0,0 +1,177 @@
+package workspace
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/UnicoLab/slmcode/pkg/hitl"
+)
+
+func reviewWS(t *testing.T) (*Workspace, string, string) {
+	t.Helper()
+	root := t.TempDir()
+	if real, err := filepath.EvalSymlinks(root); err == nil {
+		root = real
+	}
+	slm := filepath.Join(root, ".slmcode")
+	ws, _, err := NewWorkspace(root, ToolOpts{
+		Permission: "review", ShellPermission: "ask", SlmDir: slm,
+		DisableSyntaxCheck: true, DisableReadBeforeEdit: true, ShellAskTimeout: 5 * time.Second,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return ws, root, slm
+}
+
+func readQueue(t *testing.T, slm string) []map[string]any {
+	t.Helper()
+	entries, _ := os.ReadDir(filepath.Join(slm, "pending"))
+	var out []map[string]any
+	for _, e := range entries {
+		if !strings.HasSuffix(e.Name(), ".patch.json") {
+			continue
+		}
+		raw, err := os.ReadFile(filepath.Join(slm, "pending", e.Name())) //nolint:gosec // test-owned path
+		if err != nil {
+			t.Fatal(err)
+		}
+		var obj map[string]any
+		if err := json.Unmarshal(raw, &obj); err != nil {
+			t.Fatalf("%s: %v", e.Name(), err)
+		}
+		obj["_file"] = e.Name()
+		out = append(out, obj)
+	}
+	return out
+}
+
+func TestReviewQueueEntriesAreStamped(t *testing.T) {
+	ws, root, slm := reviewWS(t)
+	if err := os.MkdirAll(slm, 0o750); err != nil {
+		t.Fatal(err)
+	}
+	// The live board mirror is where the query id comes from.
+	if err := os.WriteFile(filepath.Join(slm, "board.json"), []byte(`{"query_id":"run-42","tasks":[]}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "old.go"), []byte("package a\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	var mu sync.Mutex
+	var hooked []string
+	remove := AddPendingHook(func(path, kind, file string) {
+		mu.Lock()
+		hooked = append(hooked, kind+":"+path)
+		mu.Unlock()
+	})
+	defer remove()
+
+	ctx := WithRole(WithTaskID(context.Background(), "T3"), "worker")
+	if out := strOut(ws.writeFile(ctx, map[string]interface{}{"path": "new.go", "content": "package b\n"})); !strings.HasPrefix(out, "review: staged new.go") {
+		t.Fatalf("write in review mode: %q", out)
+	}
+	if out := strOut(ws.moveFile(ctx, map[string]interface{}{"from": "old.go", "to": "moved.go"})); !strings.HasPrefix(out, "review: staged moved.go") {
+		t.Fatalf("mv in review mode: %q", out)
+	}
+	if out := strOut(ws.deleteFile(ctx, map[string]interface{}{"path": "old.go"})); !strings.HasPrefix(out, "review: staged old.go") {
+		t.Fatalf("delete in review mode: %q", out)
+	}
+	// Nothing was touched on disk.
+	if _, err := os.Stat(filepath.Join(root, "new.go")); err == nil {
+		t.Fatal("review mode wrote new.go")
+	}
+	if _, err := os.Stat(filepath.Join(root, "old.go")); err != nil {
+		t.Fatal("review mode removed old.go")
+	}
+
+	q := readQueue(t, slm)
+	if len(q) != 3 {
+		t.Fatalf("queue has %d entries, want 3", len(q))
+	}
+	byKind := map[string]map[string]any{}
+	for _, e := range q {
+		byKind[e["kind"].(string)] = e
+	}
+	for _, kind := range []string{"write", "mv", "delete"} {
+		e := byKind[kind]
+		if e == nil {
+			t.Fatalf("no %s entry", kind)
+		}
+		if e["task_id"] != "T3" || e["agent"] != "worker" || e["query_id"] != "run-42" {
+			t.Errorf("%s entry not stamped: %v", kind, e)
+		}
+	}
+	if byKind["mv"]["from"] != "old.go" || byKind["mv"]["path"] != "moved.go" || byKind["mv"]["content"] != "package a\n" {
+		t.Errorf("mv entry: %v", byKind["mv"])
+	}
+	if byKind["delete"]["content"] != "" || byKind["delete"]["path"] != "old.go" {
+		t.Errorf("delete entry: %v", byKind["delete"])
+	}
+	mu.Lock()
+	defer mu.Unlock()
+	if len(hooked) != 3 || hooked[0] != "write:new.go" || hooked[1] != "mv:moved.go" || hooked[2] != "delete:old.go" {
+		t.Errorf("hooks saw %v", hooked)
+	}
+}
+
+func TestShellAskIsNotAQueueEntry(t *testing.T) {
+	ws, _, slm := reviewWS(t)
+	ws.OnShellAsk = func(ask ShellAsk) {
+		// Approve from "the UI" through the per-ask answer file.
+		go func() {
+			_ = hitl.WriteAnswerIDOnce(slm, "shell", ask.ID, ShellAnswer{AskID: ask.ID, Decision: "approve"})
+		}()
+	}
+	ok, err := ws.waitShellApproval(context.Background(), "echo hi")
+	if err != nil || !ok {
+		t.Fatalf("approval: ok=%v err=%v", ok, err)
+	}
+	if q := readQueue(t, slm); len(q) != 0 {
+		t.Fatalf("a shell ask landed in the review queue: %v", q)
+	}
+	if ids, _ := hitl.ListAskIDs(slm, "shell"); len(ids) != 0 {
+		t.Fatalf("answered ask not cleared: %v", ids)
+	}
+}
+
+// Two workers asking at once each get their own decision (the single-slot
+// ask.json used to make the second ask erase the first).
+func TestParallelShellAsksAreIndependent(t *testing.T) {
+	ws, _, slm := reviewWS(t)
+	decisions := map[string]string{"go test ./a": "approve", "rm -rf build": "deny"}
+	ws.OnShellAsk = func(ask ShellAsk) {
+		d := decisions[ask.Command]
+		go func() {
+			time.Sleep(100 * time.Millisecond)
+			_ = hitl.WriteAnswerIDOnce(slm, "shell", ask.ID, ShellAnswer{AskID: ask.ID, Decision: d})
+		}()
+	}
+	var wg sync.WaitGroup
+	got := map[string]bool{}
+	var mu sync.Mutex
+	for cmd := range decisions {
+		wg.Add(1)
+		go func(cmd string) {
+			defer wg.Done()
+			ok, err := ws.waitShellApproval(context.Background(), cmd)
+			if err != nil {
+				t.Errorf("%s: %v", cmd, err)
+			}
+			mu.Lock()
+			got[cmd] = ok
+			mu.Unlock()
+		}(cmd)
+	}
+	wg.Wait()
+	if !got["go test ./a"] || got["rm -rf build"] {
+		t.Fatalf("decisions crossed: %v", got)
+	}
+}
diff --git a/pkg/workspace/syntax.go b/pkg/workspace/syntax.go
index 8c698da..0eb330c 100644
--- a/pkg/workspace/syntax.go
+++ b/pkg/workspace/syntax.go
@@ -2,6 +2,7 @@ package workspace
 
 import (
 	"context"
+	"crypto/sha256"
 	"fmt"
 	"os"
 	"os/exec"
@@ -183,30 +184,92 @@ func (w *Workspace) applyWithSyntaxGuard(ctx context.Context, rel, abs, prev, ne
 		return "", false, nil
 	}
 	// Establish the "before" verdict from the in-memory previous content so we
-	// never blame an edit for a break that was already there.
+	// never blame an edit for a break that was already there. The verdict is
+	// memoized per path by content hash: a worker editing the same file three
+	// times in a row used to spawn two checkers per edit (before + after),
+	// although the "before" of edit N+1 is byte-identical to the "after" of
+	// edit N. Now consecutive edits cost one checker each after the first.
 	before := SyntaxResult{Status: SyntaxSkipped}
 	if existed {
-		before = w.checkSyntaxOfText(ctx, abs, prev)
+		if memo, ok := w.syntaxMemoLookup(rel, prev); ok {
+			before = memo
+		} else {
+			before = w.checkSyntaxOfText(ctx, abs, prev)
+			w.syntaxMemoStore(rel, prev, before)
+		}
 	}
 	if err := os.WriteFile(abs, []byte(next), 0o644); err != nil { //nolint:gosec // project source file, conventional perms
 		return "", false, err
 	}
-	after := CheckSyntax(ctx, abs, w.syntaxTimeout())
+	after := checkSyntaxFn(ctx, abs, w.syntaxTimeout())
 	if after.Status != SyntaxBroken {
+		w.syntaxMemoStore(rel, next, after)
 		return "", false, nil
 	}
 	if before.Status == SyntaxOK {
 		// Regression introduced by this edit → put the file back.
 		if rerr := os.WriteFile(abs, []byte(prev), 0o644); rerr != nil { //nolint:gosec // project source file, conventional perms
 			// Could not restore: keep the broken file but say so loudly.
+			w.syntaxMemoStore(rel, next, after)
 			return SyntaxWarning(rel, after) +
 				"\n(NOTE: automatic revert failed: " + rerr.Error() + ")", false, nil
 		}
+		// File is back to prev, whose verdict is already memoized.
 		return SyntaxRevertMessage(rel, after), true, nil
 	}
+	w.syntaxMemoStore(rel, next, after)
 	return SyntaxWarning(rel, after), false, nil
 }
 
+// checkSyntaxFn is the checker the guard invokes. A variable so tests can
+// count invocations with a fake instead of spawning gofmt/python/node.
+var checkSyntaxFn = CheckSyntax
+
+// syntaxMemoEntry is one memoized verdict: the hash of the content it was
+// computed for and the verdict itself.
+type syntaxMemoEntry struct {
+	hash   [32]byte
+	result SyntaxResult
+}
+
+// maxSyntaxMemoPaths bounds the memo; a run touches a handful of files, and
+// past that the oldest entries are simply dropped (worst case: one extra
+// checker, exactly today's cost).
+const maxSyntaxMemoPaths = 256
+
+func (w *Workspace) syntaxMemoLookup(rel, content string) (SyntaxResult, bool) {
+	if w == nil {
+		return SyntaxResult{}, false
+	}
+	h := sha256.Sum256([]byte(content))
+	w.syntaxMu.Lock()
+	defer w.syntaxMu.Unlock()
+	e, ok := w.syntaxMemo[rel]
+	if !ok || e.hash != h || e.result.Status == SyntaxSkipped {
+		return SyntaxResult{}, false
+	}
+	return e.result, true
+}
+
+func (w *Workspace) syntaxMemoStore(rel, content string, res SyntaxResult) {
+	if w == nil || res.Status == SyntaxSkipped {
+		// A timed-out / unavailable checker is not a verdict worth keeping.
+		return
+	}
+	w.syntaxMu.Lock()
+	defer w.syntaxMu.Unlock()
+	if w.syntaxMemo == nil {
+		w.syntaxMemo = map[string]syntaxMemoEntry{}
+	}
+	if _, exists := w.syntaxMemo[rel]; !exists && len(w.syntaxMemo) >= maxSyntaxMemoPaths {
+		for k := range w.syntaxMemo {
+			delete(w.syntaxMemo, k)
+			break
+		}
+	}
+	w.syntaxMemo[rel] = syntaxMemoEntry{hash: sha256.Sum256([]byte(content)), result: res}
+}
+
 func (w *Workspace) syntaxTimeout() time.Duration {
 	if w != nil && w.SyntaxCheckTimeout > 0 {
 		return w.SyntaxCheckTimeout
@@ -229,5 +292,5 @@ func (w *Workspace) checkSyntaxOfText(ctx context.Context, abs, text string) Syn
 	if err := os.WriteFile(tmp, []byte(text), 0o600); err != nil { //nolint:gosec // tmp is our own os.MkdirTemp-generated private scratch path, not external input
 		return SyntaxResult{Status: SyntaxSkipped}
 	}
-	return CheckSyntax(ctx, tmp, w.syntaxTimeout())
+	return checkSyntaxFn(ctx, tmp, w.syntaxTimeout())
 }
diff --git a/pkg/workspace/syntax_memo_test.go b/pkg/workspace/syntax_memo_test.go
new file mode 100644
index 0000000..c399bd0
--- /dev/null
+++ b/pkg/workspace/syntax_memo_test.go
@@ -0,0 +1,80 @@
+package workspace
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// Consecutive edits to one file used to spawn two checkers per edit (the
+// "before" of edit N+1 is the "after" of edit N, re-parsed from scratch). The
+// verdict is now memoized by content hash per path.
+func TestSyntaxGuardMemoizesBeforeVerdict(t *testing.T) {
+	var calls atomic.Int32
+	orig := checkSyntaxFn
+	checkSyntaxFn = func(_ context.Context, abs string, _ time.Duration) SyntaxResult {
+		calls.Add(1)
+		data, _ := os.ReadFile(abs) //nolint:gosec // test-owned temp path
+		if strings.Contains(string(data), "BROKEN") {
+			return SyntaxResult{Status: SyntaxBroken, Errors: "fake: broken", Tool: "fake"}
+		}
+		return SyntaxResult{Status: SyntaxOK, Tool: "fake"}
+	}
+	t.Cleanup(func() { checkSyntaxFn = orig })
+
+	w, root := newTestWS(t)
+	w.SyntaxCheck = true
+	ctx := context.Background()
+	if err := os.WriteFile(filepath.Join(root, "a.go"), []byte("package a\n\nvar A = 1\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	w.markRead("a.go")
+
+	edit := func(oldS, newS string) string {
+		return strOut(w.editFile(ctx, map[string]interface{}{"path": "a.go", "old_str": oldS, "new_str": newS}))
+	}
+	if out := edit("var A = 1", "var A = 2"); !strings.HasPrefix(out, "edited a.go") {
+		t.Fatalf("edit 1: %q", out)
+	}
+	if got := calls.Load(); got != 2 {
+		t.Fatalf("first edit spawned %d checkers, want 2 (before + after)", got)
+	}
+	if out := edit("var A = 2", "var A = 3"); !strings.HasPrefix(out, "edited a.go") {
+		t.Fatalf("edit 2: %q", out)
+	}
+	if got := calls.Load(); got != 3 {
+		t.Fatalf("two consecutive edits spawned %d checkers, want 3 (the before-verdict was memoized)", got)
+	}
+
+	// A revert leaves the file at prev, whose verdict is still memoized: the
+	// next good edit costs one checker again.
+	if out := edit("var A = 3", "BROKEN"); !strings.Contains(out, "EDIT REVERTED") {
+		t.Fatalf("broken edit not reverted: %q", out)
+	}
+	if got := calls.Load(); got != 4 {
+		t.Fatalf("reverted edit spawned %d checkers total, want 4", got)
+	}
+	if out := edit("var A = 3", "var A = 4"); !strings.HasPrefix(out, "edited a.go") {
+		t.Fatalf("edit after revert: %q", out)
+	}
+	if got := calls.Load(); got != 5 {
+		t.Fatalf("edit after revert spawned %d checkers total, want 5", got)
+	}
+
+	// Content changed behind the memo (a shell command, another worker): the
+	// hash misses and the before-check runs again rather than trusting a
+	// stale verdict.
+	if err := os.WriteFile(filepath.Join(root, "a.go"), []byte("package a\n\nvar A = 40\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if out := edit("var A = 40", "var A = 41"); !strings.HasPrefix(out, "edited a.go") {
+		t.Fatalf("edit after external change: %q", out)
+	}
+	if got := calls.Load(); got != 7 {
+		t.Fatalf("edit after external change spawned %d checkers total, want 7", got)
+	}
+}
diff --git a/pkg/workspace/tools.go b/pkg/workspace/tools.go
index 5eed5b8..c36aa30 100644
--- a/pkg/workspace/tools.go
+++ b/pkg/workspace/tools.go
@@ -481,6 +481,12 @@ type Workspace struct {
 	todoMu sync.Mutex
 	todos  []TodoItem
 
+	// syntaxMemo remembers the last syntax verdict per path, keyed by a hash
+	// of the content it was computed for, so the "before" check of the next
+	// edit to the same file is a lookup rather than a fourth checker process.
+	syntaxMu   sync.Mutex
+	syntaxMemo map[string]syntaxMemoEntry
+
 	rootOnce sync.Once
 	realRoot string
 
@@ -578,7 +584,11 @@ func (w *Workspace) capResult(s string) string {
 			len(s), max)
 }
 
-func (w *Workspace) guardWrite(path, kind, content string) (string, bool, error) {
+// guardWrite is the permission gate for a proposed change to path. In review
+// mode the proposal is recorded to the queue — stamped with the task, role and
+// query from ctx (see pending.go) — and from names the source of a ws_mv so
+// the applier can move rather than copy.
+func (w *Workspace) guardWrite(ctx context.Context, path, kind, content, from string) (string, bool, error) {
 	switch permissions.Normalize(w.Permission) {
 	case permissions.ModeDryRun:
 		return fmt.Sprintf("dry-run: would %s %s (%d bytes)", kind, path, len(content)), true, nil
@@ -586,7 +596,7 @@ func (w *Workspace) guardWrite(path, kind, content string) (string, bool, error)
 		if w.SlmDir == "" {
 			w.SlmDir = filepath.Join(w.Root, ".slmcode")
 		}
-		p, err := permissions.RecordPending(w.SlmDir, path, kind, content)
+		p, err := w.recordPending(ctx, path, kind, content, from)
 		if err != nil {
 			return "", true, err
 		}
@@ -644,12 +654,23 @@ func (w *Workspace) resolvedRoot() string {
 }
 
 func (w *Workspace) checkSymlinkEscape(abs, rel string) error {
+	return w.checkSymlinkEscapeDepth(abs, rel, 0)
+}
+
+// maxDanglingSymlinkHops bounds how many dangling links in a row are chased
+// lexically before the path is refused outright.
+const maxDanglingSymlinkHops = 8
+
+func (w *Workspace) checkSymlinkEscapeDepth(abs, rel string, depth int) error {
 	real := w.resolvedRoot()
 	// Walk up to the deepest component that actually exists; components that
 	// do not exist yet cannot be symlinks.
 	p := abs
+	var info os.FileInfo
 	for {
-		if _, err := os.Lstat(p); err == nil {
+		st, err := os.Lstat(p)
+		if err == nil {
+			info = st
 			break
 		}
 		parent := filepath.Dir(p)
@@ -660,8 +681,47 @@ func (w *Workspace) checkSymlinkEscape(abs, rel string) error {
 	}
 	evaluated, err := filepath.EvalSymlinks(p)
 	if err != nil {
-		// Cannot evaluate (permissions, race) → fall back to the lexical check.
-		return nil
+		if info == nil || info.Mode()&os.ModeSymlink == 0 {
+			// Not a link and not evaluable (permissions, race) → the lexical
+			// check above is all there is.
+			return nil
+		}
+		// A DANGLING symlink: EvalSymlinks fails because the target does not
+		// exist yet, but os.WriteFile / os.Create would happily follow it and
+		// create that target — anywhere on the host. This used to be the one
+		// gap in the jail: `ln -s /elsewhere/victim.txt link.txt` followed by
+		// ws_write link.txt created /elsewhere/victim.txt. Resolve the link
+		// text ourselves and judge the target lexically; when the target sits
+		// inside the root it is re-checked in case it chains through another
+		// link. Anything that cannot be judged is refused — fail closed.
+		if depth >= maxDanglingSymlinkHops {
+			return fmt.Errorf(
+				"path escapes workspace via symlink: %s is a chain of unresolved symlinks. "+
+					"Pick a path that names a real file inside the project", rel)
+		}
+		target, rerr := os.Readlink(p)
+		if rerr != nil {
+			return fmt.Errorf(
+				"path refused: %s is a symlink whose target cannot be resolved (%v). "+
+					"Pick a path that names a real file inside the project", rel, rerr)
+		}
+		parent := filepath.Dir(p)
+		if pr, perr := filepath.EvalSymlinks(parent); perr == nil {
+			parent = pr
+		}
+		if !filepath.IsAbs(target) {
+			target = filepath.Join(parent, target)
+		}
+		target = filepath.Clean(target)
+		if target != real && !strings.HasPrefix(target, real+string(os.PathSeparator)) {
+			return fmt.Errorf(
+				"path escapes workspace via symlink: %s → %s (target does not exist yet). "+
+					"The harness only operates on real files inside the project root; "+
+					"pick a path that stays in the project", rel, target)
+		}
+		// The (missing) target is inside the root lexically; make sure no
+		// existing ancestor of it is itself a link out of the jail.
+		return w.checkSymlinkEscapeDepth(target, rel, depth+1)
 	}
 	if evaluated == real || strings.HasPrefix(evaluated, real+string(os.PathSeparator)) {
 		return nil
@@ -809,7 +869,7 @@ func readErrorHint(path string, err error) string {
 
 func (w *Workspace) writeFile(ctx context.Context, args map[string]interface{}) (interface{}, error) {
 	path := w.normalizeRelPath(strArg(args, "path"))
-	content := strArg(args, "content")
+	content := strArgAny(args, contentKeys...)
 	allowShrink := boolArg(args, "allow_shrink", false)
 	if strings.TrimSpace(path) == "" {
 		return "ws_write: path is required, e.g. {\"path\":\"pkg/foo/bar.go\",\"content\":\"…\"}.", nil
@@ -826,12 +886,20 @@ func (w *Workspace) writeFile(ctx context.Context, args map[string]interface{})
 	// of `prev` and the write derived from it.
 	defer w.lockPath(path)()
 	prev, existed := readIfExists(abs)
+	// An empty body on a NEW file is, in practice, never the intent — it is a
+	// model that put the text under a key this tool does not read. Writing a
+	// 0-byte file and reporting "wrote" sent the loop on to the next step with
+	// an empty source file in the tree. The same trap truncates an existing
+	// file, so that case needs the explicit allow_shrink escape hatch.
+	if content == "" && (!existed || !allowShrink) {
+		return EmptyContentReason(path, existed, args), nil
+	}
 	if w.WriteGuard {
 		if refuse, reason := w.checkOverwrite(path, abs, existed, prev, content, allowShrink); refuse {
 			return reason, nil
 		}
 	}
-	if msg, stop, err := w.guardWrite(path, "write", content); stop {
+	if msg, stop, err := w.guardWrite(ctx, path, "write", content, ""); stop {
 		kind := "review"
 		if strings.HasPrefix(msg, "dry-run:") {
 			kind = "dry-run"
@@ -897,10 +965,10 @@ func readIfExists(abs string) (string, bool) {
 	return string(data), true
 }
 
-func (w *Workspace) editFile(ctx context.Context, args map[string]interface{}) (interface{}, error) {
+func (w *Workspace) editFile(ctx context.Context, args map[string]interface{}) (out interface{}, err error) {
 	path := w.normalizeRelPath(strArg(args, "path"))
-	oldStr := strArg(args, "old_str")
-	newStr := strArg(args, "new_str")
+	oldStr := strArgAny(args, oldStrKeys...)
+	newStr := strArgAny(args, newStrKeys...)
 	replaceAll := boolArg(args, "replace_all", false)
 	if strings.TrimSpace(path) == "" {
 		return "ws_edit: path is required, e.g. {\"path\":\"pkg/foo/bar.go\",\"old_str\":\"…\",\"new_str\":\"…\"}.", nil
@@ -911,9 +979,31 @@ func (w *Workspace) editFile(ctx context.Context, args map[string]interface{}) (
 	if strings.TrimSpace(oldStr) == "" {
 		return EmptyOldStrReason(path), nil
 	}
+	// Text pasted straight out of a ws_read result carries the "   42|"
+	// gutter. When EVERY non-blank line carries it the intent is unambiguous,
+	// so the gutter is stripped and the edit proceeds; the note stays on the
+	// result so evolve still sees the drift and can learn the rule. A partial
+	// gutter is still refused — that is not a paste, that is confusion.
+	var gutterNote string
 	if lineNumberPrefixRe.MatchString(oldStr) {
-		return LineNumberedOldStrReason(path), nil
+		stripped, ok := stripReadGutter(oldStr)
+		if !ok {
+			return LineNumberedOldStrReason(path), nil
+		}
+		oldStr = stripped
+		if ns, ok := stripReadGutter(newStr); ok {
+			newStr = ns
+		}
+		gutterNote = GutterStrippedNote
+		if strings.TrimSpace(oldStr) == "" {
+			return EmptyOldStrReason(path), nil
+		}
 	}
+	defer func() {
+		if s, ok := out.(string); ok && gutterNote != "" {
+			out = s + gutterNote
+		}
+	}()
 	abs, err := w.resolve(path)
 	if err != nil {
 		return nil, err
@@ -959,6 +1049,16 @@ func (w *Workspace) editFile(ctx context.Context, args map[string]interface{}) (
 			exact, path,
 		) + augment.FailureRecovery("ws_edit", path), nil
 	default:
+		// replace_all with a drifted old_str: every span the first matching
+		// rung finds is replaced. Honoring the flag only on an exact hit
+		// meant "found 3 places (indentation-normalized) — ambiguous" for a
+		// caller who had explicitly asked for all of them.
+		if replaceAll {
+			if drifted, n, strat := ReplaceAllDrifted(text, oldStr, newStr); n > 0 {
+				next, count, strategy = drifted, n, strat
+				break
+			}
+		}
 		// Exact match missed: run the tolerant fallback ladder.
 		res := FindEditMatch(text, oldStr)
 		if !res.Found {
@@ -977,7 +1077,7 @@ func (w *Workspace) editFile(ctx context.Context, args map[string]interface{}) (
 	}
 
 	snippet := diffSnippet(oldStr, newStr)
-	if msg, stop, err := w.guardWrite(path, "edit", next); stop {
+	if msg, stop, err := w.guardWrite(ctx, path, "edit", next, ""); stop {
 		if msg != "" && strings.HasPrefix(msg, "dry-run:") {
 			out := fmt.Sprintf("dry-run: would edit %s (%d replacement(s))", path, count)
 			w.notify(path, "dry-run", snippet)
@@ -1028,9 +1128,105 @@ func LineNumberedOldStrReason(path string) string {
 		path)
 }
 
-func (w *Workspace) patchFile(ctx context.Context, args map[string]interface{}) (interface{}, error) {
+// GutterStrippedNote is appended to a ws_edit / ws_patch result whose search
+// text arrived with ws_read's line-number gutter on every line. The edit went
+// ahead; the note is what pkg/evolve keys its strip_line_number_prefix rule on.
+const GutterStrippedNote = "\n[stripped ws_read line numbers from old_str — do not include them]"
+
+// gutterLineRe is lineNumberPrefixRe anchored for one line, capturing the text
+// after the "|" so the original indentation survives.
+var gutterLineRe = regexp.MustCompile(`^\s*\d+\|(.*)$`)
+
+// stripReadGutter removes the "   42|" prefix from every line of s. It reports
+// ok=false when any non-blank line lacks the gutter — a mixed block is not a
+// paste from ws_read and is left for the caller to refuse by name.
+func stripReadGutter(s string) (string, bool) {
+	if s == "" {
+		return s, false
+	}
+	lines := strings.Split(s, "\n")
+	for i, ln := range lines {
+		if strings.TrimSpace(ln) == "" {
+			continue
+		}
+		m := gutterLineRe.FindStringSubmatch(ln)
+		if m == nil {
+			return s, false
+		}
+		lines[i] = m[1]
+	}
+	return strings.Join(lines, "\n"), true
+}
+
+// stripReadGutterPatch is stripReadGutter for ws_patch input. Marker lines
+// (<<<<<<<, =======, >>>>>>>, @@) never carry a gutter and are skipped; every
+// other non-blank line must, or the whole text is left alone (ok=false). A
+// unified-diff "+"/"-" sign in front of the gutter is kept; a space sign is
+// indistinguishable from the gutter's own padding and simply becomes an
+// unprefixed context line, which the hunk parser already accepts.
+func stripReadGutterPatch(s string) (string, bool) {
+	lines := strings.Split(s, "\n")
+	for i, ln := range lines {
+		t := strings.TrimSpace(ln)
+		if t == "" || strings.HasPrefix(t, "<<<<<<<") || strings.HasPrefix(t, "=======") ||
+			strings.HasPrefix(t, ">>>>>>>") || strings.HasPrefix(t, "@@") {
+			continue
+		}
+		sign, rest := "", ln
+		if strings.HasPrefix(ln, "+") || strings.HasPrefix(ln, "-") {
+			sign, rest = ln[:1], ln[1:]
+		}
+		m := gutterLineRe.FindStringSubmatch(rest)
+		if m == nil {
+			return s, false
+		}
+		lines[i] = sign + m[1]
+	}
+	return strings.Join(lines, "\n"), true
+}
+
+// EmptyContentReason explains a refused empty ws_write and names every key the
+// tool reads for the body, since the usual cause is the text sitting under a
+// key that was never looked at.
+func EmptyContentReason(path string, existed bool, args map[string]interface{}) string {
+	var extra []string
+	for k := range args {
+		switch k {
+		case "path", "allow_shrink":
+			continue
+		}
+		known := false
+		for _, c := range contentKeys {
+			if k == c {
+				known = true
+				break
+			}
+		}
+		if !known {
+			extra = append(extra, k)
+		}
+	}
+	sort.Strings(extra)
+	msg := fmt.Sprintf(
+		"Write refused — content is empty, so this would create %s as a 0-byte file.\n"+
+			"ws_write reads the file body from one of: %s. ", path, aliasList(contentKeys))
+	if existed {
+		msg = fmt.Sprintf(
+			"Write refused — content is empty, so this would truncate %s to 0 bytes.\n"+
+				"ws_write reads the file body from one of: %s. "+
+				"To really empty the file, repeat the call with \"allow_shrink\": true. ",
+			path, aliasList(contentKeys))
+	}
+	if len(extra) > 0 {
+		msg += fmt.Sprintf("Unrecognized argument(s) in this call: %s. ", strings.Join(extra, ", "))
+	}
+	msg += "Repeat the call with the full file text under \"content\"."
+	return msg
+}
+
+func (w *Workspace) patchFile(ctx context.Context, args map[string]interface{}) (out interface{}, err error) {
 	path := w.normalizeRelPath(strArg(args, "path"))
-	patch := strArg(args, "patch")
+	patch := strArgAny(args, patchKeys...)
 	if strings.TrimSpace(path) == "" {
 		return "ws_patch: path is required, e.g. {\"path\":\"pkg/foo/bar.go\",\"patch\":\"@@ …\"}.", nil
 	}
@@ -1038,9 +1234,23 @@ func (w *Workspace) patchFile(ctx context.Context, args map[string]interface{})
 		return "ws_patch: patch is required — supply a unified diff with @@ hunks, or a " +
 			"<<<<<<< SEARCH / ======= / >>>>>>> REPLACE block.", nil
 	}
+	// Same rule as ws_edit: a ws_read gutter on every content line is
+	// stripped (marker and @@ lines are exempt from the "every line" test);
+	// anything less uniform is refused by name.
+	var gutterNote string
 	if lineNumberPrefixRe.MatchString(patch) {
-		return LineNumberedOldStrReason(path), nil
+		stripped, ok := stripReadGutterPatch(patch)
+		if !ok {
+			return LineNumberedOldStrReason(path), nil
+		}
+		patch = stripped
+		gutterNote = GutterStrippedNote
 	}
+	defer func() {
+		if s, ok := out.(string); ok && gutterNote != "" {
+			out = s + gutterNote
+		}
+	}()
 	abs, err := w.resolve(path)
 	if err != nil {
 		return nil, err
@@ -1076,7 +1286,7 @@ func (w *Workspace) patchFile(ctx context.Context, args map[string]interface{})
 			}
 		}
 	}
-	if msg, stop, err := w.guardWrite(path, "patch", next); stop {
+	if msg, stop, err := w.guardWrite(ctx, path, "patch", next, ""); stop {
 		kind := "review"
 		if strings.HasPrefix(msg, "dry-run:") {
 			kind = "dry-run"
@@ -1157,7 +1367,7 @@ func (w *Workspace) moveFile(ctx context.Context, args map[string]interface{}) (
 	if readErr != nil {
 		return fmt.Sprintf("ws_mv: cannot read %s: %v. Fix the path or permissions, then retry.", from, readErr), nil
 	}
-	if msg, stop, err := w.guardWrite(to, "mv", string(content)); stop {
+	if msg, stop, err := w.guardWrite(ctx, to, "mv", string(content), from); stop {
 		kind := "review"
 		if strings.HasPrefix(msg, "dry-run:") {
 			kind = "dry-run"
@@ -1239,7 +1449,7 @@ func (w *Workspace) deleteFile(ctx context.Context, args map[string]interface{})
 		return fmt.Sprintf(
 			"ws_delete: %s is a directory. This tool deletes single files only.", path), nil
 	}
-	if msg, stop, err := w.guardWrite(path, "delete", ""); stop {
+	if msg, stop, err := w.guardWrite(ctx, path, "delete", "", ""); stop {
 		kind := "review"
 		if strings.HasPrefix(msg, "dry-run:") {
 			kind = "dry-run"
@@ -1807,17 +2017,20 @@ func (w *Workspace) waitShellApproval(ctx context.Context, command string) (bool
 		OnTimeout: "deny",
 		CreatedAt: time.Now().UTC().Format(time.RFC3339),
 	}
-	if err := hitl.WriteAsk(w.SlmDir, "shell", ask); err != nil {
+	// One file per ask (hitl.WriteAskID): parallel workers each wait on their
+	// own answer instead of sharing — and clobbering — a single slot. The
+	// command is deliberately NOT mirrored into the review queue any more: a
+	// queue entry is a file write, and `slmcode apply --all` used to land a
+	// literal shell.sh at the project root for every ask.
+	if err := hitl.WriteAskID(w.SlmDir, "shell", ask.ID, ask); err != nil {
 		return false, err
 	}
-	// Also record classic pending for apply CLI visibility.
-	_, _ = permissions.RecordPending(w.SlmDir, "shell.sh", "shell", command)
 	if w.OnShellAsk != nil {
 		w.OnShellAsk(ask)
 	}
 	var ans ShellAnswer
-	ok, err := hitl.WaitAnswersForID(ctx, w.SlmDir, "shell", ask.ID, timeout, &ans)
-	hitl.Clear(w.SlmDir, "shell")
+	ok, err := hitl.WaitAnswerID(ctx, w.SlmDir, "shell", ask.ID, timeout, &ans)
+	hitl.ClearID(w.SlmDir, "shell", ask.ID)
 	if err != nil {
 		return false, err
 	}
diff --git a/pkg/workspace/tools_hardening_test.go b/pkg/workspace/tools_hardening_test.go
index 9532c86..fcc35e4 100644
--- a/pkg/workspace/tools_hardening_test.go
+++ b/pkg/workspace/tools_hardening_test.go
@@ -87,20 +87,34 @@ func TestAssessOverEditDoesNotMaskEmptyOldStr(t *testing.T) {
 
 // ── item 11: line-number prefixes ──────────────────────────────────────────
 
+// A gutter on EVERY line is a paste from ws_read: the edit proceeds with the
+// gutter stripped and the note appended (see TestEditStripsGutterAutomatically).
+// A gutter on only SOME lines is still refused by name.
 func TestEditRejectsLineNumberedOldStr(t *testing.T) {
-	cases := []struct{ name, oldStr string }{
-		{"single line", "     3|func F() {}"},
-		{"multi line", "     1|package a\n     2|"},
-		{"no padding", "3|func F() {}"},
+	cases := []struct {
+		name, oldStr string
+		stripped     bool
+	}{
+		{"single line", "     3|func F() {}", true},
+		{"multi line", "     1|package a\n     2|", true},
+		{"no padding", "3|func F() {}", true},
+		{"mixed", "     3|func F() {}\nfunc F() {}", false},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			w, root := newTestWS(t)
+			w.SyntaxCheck = false
 			mustWrite(t, filepath.Join(root, "a.go"), "package a\n\nfunc F() {}\n")
 			w.Reads.Mark("a.go")
 			out := strOut(w.editFile(context.Background(), map[string]interface{}{
 				"path": "a.go", "old_str": tc.oldStr, "new_str": "func G() {}",
 			}))
+			if tc.stripped {
+				if !strings.Contains(out, "[stripped ws_read line numbers") {
+					t.Fatalf("expected gutter to be stripped with a note, got %q", out)
+				}
+				return
+			}
 			if !strings.Contains(out, "line-number prefix") {
 				t.Fatalf("expected line-number diagnosis, got %q", out)
 			}

From 57e7038c768907edc11939a27431a5c1bb9693d6 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 08:44:48 +0000
Subject: [PATCH 11/23] loop, agents: comments no longer describe the removed
 review race

---
 pkg/agents/factory.go | 14 +++++++-------
 pkg/loop/runner.go    |  3 ++-
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/pkg/agents/factory.go b/pkg/agents/factory.go
index 71e9f1c..df5cb1f 100644
--- a/pkg/agents/factory.go
+++ b/pkg/agents/factory.go
@@ -168,10 +168,10 @@ func specs(coding []string) []RoleSpec {
 		{ID: "manager", Title: "Engineering manager (squad assembly)", Description: "Splits a query into parallel squads with disjoint ownership and a frozen interface contract.", SystemPrompt: PromptManager, Tools: nil, MaxIter: 3, Temperature: 0.15, MaxTokens: 2048, SchemaRole: schema.RoleSquads},
 		{ID: "composer", Title: "Dynamic pipeline composer", Description: "Assembles the right team, tools, and skills into a task-specific pipeline.", SystemPrompt: PromptComposer, Tools: nil, MaxIter: 3, Temperature: 0.2, MaxTokens: 2048, SchemaRole: schema.RoleComposition},
 
-		// reviewer-strict is the second reviewer the speculative review race in
-		// pkg/loop has always asked for. Until it was registered here,
-		// SubAgentExecutor answered "subagent 'reviewer-strict' not found" and
-		// the documented second opinion never ran.
+		// reviewer-strict is the sequential second opinion pkg/loop asks for
+		// when the primary reviewer returns no readable verdict. Until it was
+		// registered here, SubAgentExecutor answered "subagent 'reviewer-strict'
+		// not found" and the documented second opinion never ran.
 		{ID: RoleReviewerStrict, Title: "Strict second reviewer", Description: "Second opinion on a task: approves only on complete, demonstrated evidence.", SystemPrompt: PromptReviewerStrict, Tools: nil, MaxIter: 2, Temperature: 0.0, TemperatureSet: true, MaxTokens: 768, SchemaRole: schema.RoleReview},
 
 		// Architect/editor pair (Aider's measured decomposition win). The
@@ -185,8 +185,8 @@ func specs(coding []string) []RoleSpec {
 
 // Built-in role ids added alongside the original 17-specialist roster.
 const (
-	// RoleReviewerStrict is the second reviewer used by the speculative review
-	// race in pkg/loop when max_parallel >= 3.
+	// RoleReviewerStrict is the second reviewer pkg/loop asks, sequentially,
+	// only when the primary reviewer produced no readable verdict.
 	RoleReviewerStrict = "reviewer-strict"
 	// RoleDescriber is the prose half of the architect/editor pair.
 	RoleDescriber = "describer"
@@ -574,7 +574,7 @@ func (f *Factory) AllSpecs() []RoleSpec {
 }
 
 // IsKnownRole reports whether id names a built-in specialist. Wire-up code that
-// names a slot role (pkg/loop's speculative review race, pipeline phase
+// names a slot role (pkg/loop's strict second-opinion reviewer, pipeline phase
 // bindings) should assert with this so a typo fails loudly at configuration
 // time instead of silently at runtime, the way "reviewer-strict" did for as
 // long as it went unregistered.
diff --git a/pkg/loop/runner.go b/pkg/loop/runner.go
index 61a15e4..212d767 100644
--- a/pkg/loop/runner.go
+++ b/pkg/loop/runner.go
@@ -1723,7 +1723,8 @@ func (r *Runner) fireTurn(taskID string, iter, maxIter int) {
 
 // noteUsage is the single choke point every agent result passes through, which
 // makes it the right place to fold the transcript into the edit ledger too —
-// wave results, sequential round-trips and the speculative race all land here.
+// wave results, review and correction round-trips and the speculate primitive
+// all land here.
 func (r *Runner) noteUsage(res ggagent.SubAgentResult, input, output string) {
 	r.noteEdits(res.Messages)
 	if r.OnUsage == nil {

From 69b388c71a11249aea6288e4db3758211f39e536 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 08:49:24 +0000
Subject: [PATCH 12/23] feat(studio): one vocabulary and one chip for every
 identifier
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Column labels, ticket-state labels and seat/role glyphs move to
components/shared/labels.ts; the flat and 3D floors and the dossier
read them from there instead of each carrying a copy. API field names
are untouched — only what a person reads is unified (Team, Manager,
Task; the floor keeps "ticket" for what lies on a table).

EntityLink renders a task, agent, team, run or file as one consistent
chip that goes somewhere: task/agent -> Live ?task=/?agent= (the
dossier), team -> Teams ?team=, run -> Runs ?run=, file -> Files ?file=.
Outside a router it degrades to a plain anchor to the same path.

Types: QuerySession gains the per-run totals the server is adding
(duration_ms, tokens, cost_usd, tasks_total, tasks_done, failed_tasks,
teams); RunEvent.data may carry a task (task_update) or a pending
count (review_pending). Client: retryTask(id) for POST /api/tasks/{id}/retry.
---
 web/src/api/client.ts                         |  5 +
 .../components/Live/floor/TeamFloorFlat.tsx   | 60 +-----------
 web/src/components/Live/floor/floorShared.ts  | 43 +++-----
 web/src/components/shared/EntityLink.test.tsx | 44 +++++++++
 web/src/components/shared/EntityLink.tsx      | 90 +++++++++++++++++
 web/src/components/shared/entityHref.ts       | 21 ++++
 web/src/components/shared/labels.ts           | 97 +++++++++++++++++++
 web/src/types/index.ts                        | 17 +++-
 8 files changed, 289 insertions(+), 88 deletions(-)
 create mode 100644 web/src/components/shared/EntityLink.test.tsx
 create mode 100644 web/src/components/shared/EntityLink.tsx
 create mode 100644 web/src/components/shared/entityHref.ts
 create mode 100644 web/src/components/shared/labels.ts

diff --git a/web/src/api/client.ts b/web/src/api/client.ts
index d97d1b3..e1e251a 100644
--- a/web/src/api/client.ts
+++ b/web/src/api/client.ts
@@ -293,6 +293,11 @@ export async function patchTask(id: string, patch: Partial<Task>): Promise<Task>
   });
 }
 
+// POST /api/tasks/{id}/retry → the task, back on the board for another attempt
+export async function retryTask(id: string): Promise<Task> {
+  return request<Task>(`/tasks/${encodeURIComponent(id)}/retry`, { method: 'POST' });
+}
+
 // DELETE /api/tasks/{id} → {ok: "true"}
 export async function deleteTask(id: string): Promise<{ ok: string }> {
   return request(`/tasks/${encodeURIComponent(id)}`, {
diff --git a/web/src/components/Live/floor/TeamFloorFlat.tsx b/web/src/components/Live/floor/TeamFloorFlat.tsx
index 215e3cb..1cc7f9a 100644
--- a/web/src/components/Live/floor/TeamFloorFlat.tsx
+++ b/web/src/components/Live/floor/TeamFloorFlat.tsx
@@ -1,8 +1,8 @@
 import { useEffect, useMemo, useState } from 'react';
 import clsx from 'clsx';
 import { teamColor } from '@/components/Board/teamColor';
-import type { FloorAgent, FloorHandoff, FloorModel, FloorPhase, FloorPulse, FloorStageSeat, FloorTeam, FloorTicket, SeatKind, TicketState } from './floorModel';
-import { ago, type FloorSelection } from './floorShared';
+import type { FloorAgent, FloorHandoff, FloorModel, FloorPhase, FloorPulse, FloorStageSeat, FloorTeam, FloorTicket, TicketState } from './floorModel';
+import { LEGEND_STATES, TICKET_LABEL, ago, glyphFor, type FloorSelection } from './floorShared';
 
 // ── The team floor ───────────────────────────────────────────────────────
 //
@@ -44,32 +44,6 @@ const HEX: Record<string, string> = {
   gray: '#9ca3af',
 };
 
-const SEAT_GLYPH: Record<SeatKind, string> = {
-  manager: '👔',
-  worker: '🔧',
-  reviewer: '👁️',
-  tester: '🧪',
-  member: '🤖',
-};
-
-const ROLE_GLYPH: Record<string, string> = {
-  planner: '📋',
-  splitter: '✂️',
-  explorer: '🔍',
-  architect: '🏗️',
-  coordinator: '🎯',
-  docs: '📖',
-  memory: '💾',
-  context: '📝',
-  composer: '🎼',
-  triage: '👔',
-  corrector: '✏️',
-  deep: '🧠',
-  reviewer: '👁️',
-  tester: '🧪',
-  worker: '🔧',
-};
-
 const TICKET_FILL: Record<TicketState, string> = {
   queued: '#cbd5e1',
   working: '#f59e0b',
@@ -79,15 +53,6 @@ const TICKET_FILL: Record<TicketState, string> = {
   failed: '#dc2626',
 };
 
-const TICKET_LABEL: Record<TicketState, string> = {
-  queued: 'queued',
-  working: 'in progress',
-  review: 'in review',
-  blocked: 'blocked',
-  done: 'done',
-  failed: 'failed',
-};
-
 // Stage geometry, in SVG units. The viewBox scales to the container.
 const W = 1000;
 const H = 560;
@@ -103,14 +68,6 @@ interface Placed {
   agentPos: Map<string, { x: number; y: number }>;
 }
 
-function glyphFor(agent: FloorAgent): string {
-  if (agent.seat !== 'member') return SEAT_GLYPH[agent.seat];
-  for (const [role, glyph] of Object.entries(ROLE_GLYPH)) {
-    if (agent.id === role || agent.id.endsWith('-' + role)) return glyph;
-  }
-  return SEAT_GLYPH.member;
-}
-
 /** Islands are laid out on a shallow arc, so three read as a floor and not a row. */
 function layout(teams: FloorTeam[]): Placed[] {
   const n = teams.length;
@@ -552,20 +509,13 @@ function IntegrationPlate({ integration, unassigned }: { integration: NonNullabl
 }
 
 function Legend({ floor }: { floor: FloorModel }) {
-  const items: [TicketState, string][] = [
-    ['working', 'in progress'],
-    ['review', 'in review'],
-    ['blocked', 'blocked'],
-    ['done', 'done'],
-    ['queued', 'queued'],
-  ];
   return (
     <div className="pointer-events-none absolute bottom-2 left-3 flex flex-wrap items-center gap-x-3 gap-y-1 text-[10px] text-gray-500 dark:text-gray-400">
-      <span className="font-semibold uppercase tracking-wider">{floor.mode === 'teams' ? floor.summary : floor.summary}</span>
-      {items.map(([state, label]) => (
+      <span className="font-semibold uppercase tracking-wider">{floor.summary}</span>
+      {LEGEND_STATES.map((state) => (
         <span key={state} className="inline-flex items-center gap-1">
           <span className="inline-block h-2 w-3 rounded-sm" style={{ background: TICKET_FILL[state] }} />
-          {label}
+          {TICKET_LABEL[state]}
         </span>
       ))}
     </div>
diff --git a/web/src/components/Live/floor/floorShared.ts b/web/src/components/Live/floor/floorShared.ts
index 9e1f648..cc1704b 100644
--- a/web/src/components/Live/floor/floorShared.ts
+++ b/web/src/components/Live/floor/floorShared.ts
@@ -1,35 +1,18 @@
 import type { FloorAgent, FloorModel, FloorTeam, FloorTicket, SeatKind, TicketState } from './floorModel';
+import { ROLE_GLYPHS, SEAT_GLYPHS, TICKET_STATE_LABELS } from '@/components/shared/labels';
 
 // ── What both stages and the dossier share ───────────────────────────────
+//
+// The words — seat glyphs, ticket-state labels — come from the studio-wide
+// vocabulary in components/shared/labels, so the floor, the board and the
+// rail say the same thing about the same state.
 
 /** What the user has clicked on the floor: a person or a ticket. */
 export type FloorSelection = { kind: 'agent'; id: string; team: string } | { kind: 'ticket'; id: string; team: string } | null;
 
-export const SEAT_GLYPH: Record<SeatKind, string> = {
-  manager: '👔',
-  worker: '🔧',
-  reviewer: '👁️',
-  tester: '🧪',
-  member: '🤖',
-};
+export const SEAT_GLYPH: Record<SeatKind, string> = SEAT_GLYPHS;
 
-export const ROLE_GLYPH: Record<string, string> = {
-  planner: '📋',
-  splitter: '✂️',
-  explorer: '🔍',
-  architect: '🏗️',
-  coordinator: '🎯',
-  docs: '📖',
-  memory: '💾',
-  context: '📝',
-  composer: '🎼',
-  triage: '👔',
-  corrector: '✏️',
-  deep: '🧠',
-  reviewer: '👁️',
-  tester: '🧪',
-  worker: '🔧',
-};
+export const ROLE_GLYPH: Record<string, string> = ROLE_GLYPHS;
 
 export const TICKET_HEX: Record<TicketState, string> = {
   queued: '#cbd5e1',
@@ -40,14 +23,10 @@ export const TICKET_HEX: Record<TicketState, string> = {
   failed: '#dc2626',
 };
 
-export const TICKET_LABEL: Record<TicketState, string> = {
-  queued: 'queued',
-  working: 'in progress',
-  review: 'in review',
-  blocked: 'blocked',
-  done: 'done',
-  failed: 'failed',
-};
+export const TICKET_LABEL: Record<TicketState, string> = TICKET_STATE_LABELS;
+
+/** The legend both stages draw, in the order a reader scans it. */
+export const LEGEND_STATES: TicketState[] = ['working', 'review', 'blocked', 'done', 'queued'];
 
 export function glyphFor(agent: FloorAgent): string {
   if (agent.seat !== 'member') return SEAT_GLYPH[agent.seat];
diff --git a/web/src/components/shared/EntityLink.test.tsx b/web/src/components/shared/EntityLink.test.tsx
new file mode 100644
index 0000000..8c87c0b
--- /dev/null
+++ b/web/src/components/shared/EntityLink.test.tsx
@@ -0,0 +1,44 @@
+import { render, screen } from '@testing-library/react';
+import { MemoryRouter, Route, Routes, useLocation } from 'react-router-dom';
+import userEvent from '@testing-library/user-event';
+import { describe, expect, it } from 'vitest';
+import EntityLink from './EntityLink';
+import { entityHref } from './entityHref';
+
+function Where() {
+  const loc = useLocation();
+  return <output data-testid="where">{`${loc.pathname}${loc.search}`}</output>;
+}
+
+describe('EntityLink', () => {
+  it('routes each kind to its page and parameter', () => {
+    expect(entityHref('task', 'T4')).toBe('/?task=T4');
+    expect(entityHref('task', 'T4', { team: 'backend-go' })).toBe('/?task=T4&team=backend-go');
+    expect(entityHref('agent', 'go-worker')).toBe('/?agent=go-worker');
+    expect(entityHref('team', 'backend-go')).toBe('/teams?team=backend-go');
+    expect(entityHref('run', 'q_123')).toBe('/runs?run=q_123');
+    expect(entityHref('file', 'web/src/App.tsx')).toBe('/files?file=web%2Fsrc%2FApp.tsx');
+  });
+
+  it('navigates inside the router', async () => {
+    render(
+      <MemoryRouter initialEntries={['/board']}>
+        <Routes>
+          <Route path="*" element={<><EntityLink kind="task" id="T4" params={{ team: 'backend-go' }} /><Where /></>} />
+        </Routes>
+      </MemoryRouter>,
+    );
+    const link = screen.getByRole('link', { name: /T4/ });
+    expect(link).toHaveAttribute('href', '/?task=T4&team=backend-go');
+    expect(link).toHaveAttribute('data-entity', 'task');
+    await userEvent.click(link);
+    expect(screen.getByTestId('where')).toHaveTextContent('/?task=T4&team=backend-go');
+  });
+
+  it('is a plain anchor to the same place outside a router', () => {
+    render(<EntityLink kind="agent" id="go-worker" label="@go-worker" />);
+    const a = screen.getByRole('link', { name: /@go-worker/ });
+    expect(a).toHaveAttribute('href', '/?agent=go-worker');
+    expect(a).toHaveAttribute('title', 'Agent go-worker — open');
+  });
+});
diff --git a/web/src/components/shared/EntityLink.tsx b/web/src/components/shared/EntityLink.tsx
new file mode 100644
index 0000000..19100b8
--- /dev/null
+++ b/web/src/components/shared/EntityLink.tsx
@@ -0,0 +1,90 @@
+import type { ReactNode, MouseEvent } from 'react';
+import { Link, useInRouterContext } from 'react-router-dom';
+import { Archive, Bot, FileCode, ListTodo, Users } from 'lucide-react';
+import clsx from 'clsx';
+import { ENTITY_LABEL, type EntityKind } from './labels';
+import { entityHref } from './entityHref';
+
+// ── One chip for every identifier ────────────────────────────────────────
+//
+// A task id in the log, an agent name in the ticker, a team on a card: they
+// used to be inert text in five different styles. Each is now the same chip,
+// and each goes somewhere:
+//
+//   task  → Live  ?task=ID     opens the ticket's dossier, flags it in Tasks
+//   agent → Live  ?agent=ID    opens the person's dossier
+//   team  → Teams ?team=ID
+//   run   → Runs  ?run=ID
+//   file  → Files ?file=path
+//
+// The Live page reads ?task/?agent on mount and writes its selection back, so
+// a dossier survives navigation and a reload — and a link to one can be
+// pasted.
+
+export interface EntityLinkProps {
+  kind: EntityKind;
+  id: string;
+  /** Shown instead of the id. */
+  label?: ReactNode;
+  /** Extra query parameters, e.g. the team a task belongs to. */
+  params?: Record<string, string | undefined>;
+  title?: string;
+  className?: string;
+  /** Drop the glyph; the surrounding text already says what this is. */
+  bare?: boolean;
+  /** Stop the click from reaching a card or row that is itself clickable. */
+  stopPropagation?: boolean;
+  onClick?: (e: MouseEvent<HTMLAnchorElement>) => void;
+}
+
+const TONE: Record<EntityKind, string> = {
+  task: 'border-gray-200 bg-gray-50 text-gray-700 hover:border-gray-300 hover:bg-gray-100 dark:border-gray-700 dark:bg-gray-800/70 dark:text-gray-200 dark:hover:border-gray-600',
+  agent: 'border-brand-200 bg-brand-50 text-brand-700 hover:border-brand-300 hover:bg-brand-100 dark:border-brand-800 dark:bg-brand-950/40 dark:text-brand-300 dark:hover:border-brand-700',
+  team: 'border-teal-200 bg-teal-50 text-teal-800 hover:border-teal-300 hover:bg-teal-100 dark:border-teal-800 dark:bg-teal-950/40 dark:text-teal-200 dark:hover:border-teal-700',
+  run: 'border-sky-200 bg-sky-50 text-sky-700 hover:border-sky-300 hover:bg-sky-100 dark:border-sky-800 dark:bg-sky-950/40 dark:text-sky-300 dark:hover:border-sky-700',
+  file: 'border-violet-200 bg-violet-50 text-violet-700 hover:border-violet-300 hover:bg-violet-100 dark:border-violet-800 dark:bg-violet-950/40 dark:text-violet-300 dark:hover:border-violet-700',
+};
+
+const GLYPH: Record<EntityKind, ReactNode> = {
+  task: <ListTodo size={10} aria-hidden="true" />,
+  agent: <Bot size={10} aria-hidden="true" />,
+  team: <Users size={10} aria-hidden="true" />,
+  run: <Archive size={10} aria-hidden="true" />,
+  file: <FileCode size={10} aria-hidden="true" />,
+};
+
+export default function EntityLink({ kind, id, label, params, title, className, bare, stopPropagation, onClick }: EntityLinkProps) {
+  // Rendered inside the router in the app, but the components that use it are
+  // also rendered bare in tests and could be embedded anywhere: a plain anchor
+  // to the same path is the honest fallback, not a crash.
+  const inRouter = useInRouterContext();
+  const href = entityHref(kind, id, params);
+  const classes = clsx(
+    'focus-ring inline-flex max-w-full items-center gap-1 rounded border px-1.5 py-px font-mono text-[10px] font-semibold leading-4 no-underline transition-colors',
+    TONE[kind],
+    className,
+  );
+  const text = (
+    <>
+      {!bare && GLYPH[kind]}
+      <span className="truncate">{label ?? id}</span>
+    </>
+  );
+  const tip = title ?? `${ENTITY_LABEL[kind]} ${id} — open`;
+  const handleClick = (e: MouseEvent<HTMLAnchorElement>) => {
+    if (stopPropagation) e.stopPropagation();
+    onClick?.(e);
+  };
+  if (!inRouter) {
+    return (
+      <a href={href} className={classes} title={tip} data-entity={kind} data-entity-id={id} onClick={handleClick}>
+        {text}
+      </a>
+    );
+  }
+  return (
+    <Link to={href} className={classes} title={tip} data-entity={kind} data-entity-id={id} onClick={handleClick}>
+      {text}
+    </Link>
+  );
+}
diff --git a/web/src/components/shared/entityHref.ts b/web/src/components/shared/entityHref.ts
new file mode 100644
index 0000000..1af5b7e
--- /dev/null
+++ b/web/src/components/shared/entityHref.ts
@@ -0,0 +1,21 @@
+import type { EntityKind } from './labels';
+
+// Where each kind of thing lives in the studio, and the query parameter that
+// names one. EntityLink renders these; anything that builds a URL by hand
+// (a toast, a keyboard shortcut) should build it from here too.
+const ROUTE: Record<EntityKind, { path: string; param: string }> = {
+  task: { path: '/', param: 'task' },
+  agent: { path: '/', param: 'agent' },
+  team: { path: '/teams', param: 'team' },
+  run: { path: '/runs', param: 'run' },
+  file: { path: '/files', param: 'file' },
+};
+
+/** The in-app path for an entity, e.g. `/?task=T4`, with any extra parameters. */
+export function entityHref(kind: EntityKind, id: string, params?: Record<string, string | undefined>): string {
+  const route = ROUTE[kind];
+  const qs = new URLSearchParams();
+  qs.set(route.param, id);
+  for (const [k, v] of Object.entries(params ?? {})) if (v) qs.set(k, v);
+  return `${route.path}?${qs.toString()}`;
+}
diff --git a/web/src/components/shared/labels.ts b/web/src/components/shared/labels.ts
new file mode 100644
index 0000000..8575ada
--- /dev/null
+++ b/web/src/components/shared/labels.ts
@@ -0,0 +1,97 @@
+import type { SeatKind, TicketState } from '@/components/Live/floor/floorModel';
+
+// ── One vocabulary for the whole studio ──────────────────────────────────
+//
+// The board, the task rail, the floor and the dossier all name the same
+// things, and they used to each carry their own copy of the words: the board
+// said "In Progress" where the floor said "in progress", the flat floor and
+// the 3D floor each declared the seat glyphs, and a ticket state had three
+// label tables. This file is the one place those words live. The API field
+// names are untouched — only what a person reads is unified.
+//
+// The nouns: a TEAM (never "squad" in the UI), its MANAGER, a TASK. The
+// floor's own metaphor may call a task a "ticket" while it is lying on a
+// table, but a link, a chip or a heading says Task.
+
+/** What each kind of thing is called when it is named in the UI. */
+export const ENTITY_LABEL = {
+  task: 'Task',
+  agent: 'Agent',
+  team: 'Team',
+  manager: 'Manager',
+  run: 'Run',
+  file: 'File',
+} as const;
+
+export type EntityKind = 'task' | 'agent' | 'team' | 'run' | 'file';
+
+/** Board column id → its heading. */
+export const COLUMN_LABELS: Record<string, string> = {
+  to_scope: 'To Scope',
+  scoped: 'Scoped',
+  ready_to_dev: 'Ready',
+  in_progress: 'In Progress',
+  in_review: 'In Review',
+  blocked: 'Blocked',
+  done: 'Done',
+};
+
+/** The board's columns, left to right. Unknown columns the server adds go after. */
+export const COLUMN_ORDER = ['to_scope', 'scoped', 'ready_to_dev', 'in_progress', 'in_review', 'blocked', 'done'];
+
+export function columnLabel(column: string): string {
+  return COLUMN_LABELS[column] || column;
+}
+
+/** The six states the floor folds a task's column and status into. */
+export const TICKET_STATE_LABELS: Record<TicketState, string> = {
+  queued: 'queued',
+  working: 'in progress',
+  review: 'in review',
+  blocked: 'blocked',
+  done: 'done',
+  failed: 'failed',
+};
+
+/** The glyph for a seat at a team's table. */
+export const SEAT_GLYPHS: Record<SeatKind, string> = {
+  manager: '👔',
+  worker: '🔧',
+  reviewer: '👁️',
+  tester: '🧪',
+  member: '🤖',
+};
+
+/** The glyph for a pipeline role, matched on an agent id's suffix. */
+export const ROLE_GLYPHS: Record<string, string> = {
+  planner: '📋',
+  splitter: '✂️',
+  explorer: '🔍',
+  architect: '🏗️',
+  coordinator: '🎯',
+  docs: '📖',
+  memory: '💾',
+  context: '📝',
+  composer: '🎼',
+  triage: '👔',
+  corrector: '✏️',
+  deep: '🧠',
+  reviewer: '👁️',
+  tester: '🧪',
+  worker: '🔧',
+};
+
+/** The glyph for a phase or a phase agent on the pipeline's stage. */
+export const STAGE_GLYPHS: Record<string, string> = {
+  ...ROLE_GLYPHS,
+  plan: '📋',
+  split: '✂️',
+  explore: '🔍',
+  coord: '🎯',
+  clarify: '💬',
+  skills: '🧰',
+  learn: '🎓',
+  polish: '✨',
+  qa: '🧪',
+  test: '🧪',
+};
diff --git a/web/src/types/index.ts b/web/src/types/index.ts
index 28931a2..511c766 100644
--- a/web/src/types/index.ts
+++ b/web/src/types/index.ts
@@ -310,6 +310,12 @@ export interface ConfigureResult {
 
 export interface RunEvent {
   phase: string;
+  /**
+   * The event's kind. Two kinds are BOARD events, folded into the board store
+   * rather than shown in the log: `task_update` (data.task is the task as
+   * GET /api/tasks returns it) and `review_pending` (data.pending is the
+   * review queue's length).
+   */
   kind: string;
   level?: 'info' | 'warning' | 'error' | 'success' | 'problem' | string;
   message: string;
@@ -317,7 +323,7 @@ export interface RunEvent {
   agent?: string;
   scope?: string;
   output?: string;
-  data?: DynamicComposition;
+  data?: DynamicComposition & { task?: Task; pending?: number };
   model?: string;
   tokens?: number;
   cost_usd?: number;
@@ -677,6 +683,15 @@ export interface QuerySession {
   interrupted?: boolean;
   phase?: string;
   resume_from?: string;
+  // ── Per-run totals, when the server has them ──
+  duration_ms?: number;
+  tokens?: number;
+  cost_usd?: number;
+  tasks_total?: number;
+  tasks_done?: number;
+  failed_tasks?: number;
+  /** The teams that staffed the run, by id. */
+  teams?: string[];
 }
 
 export interface QueryView {

From 411fa0ec2fa2d524bfe42a9aa5b587ecb064871b Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 08:49:33 +0000
Subject: [PATCH 13/23] feat(studio): the floor keeps its state, renders on
 demand and can be walked by keyboard
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

State: the selection is now controlled by the page (LiveView keeps it
in the URL) with the wrapper's own state as the fallback; the pulse
feed, the last floor it was diffed against, the camera, follow and spin
live in a module-level store mirrored to sessionStorage, so leaving for
the Board and coming back finds the scene where it was left and what
happened in between still pulses. "reset view" restores OrbitControls'
saved state instead of remounting the Canvas.

Rendering: frameloop is 'always' only while something moves (a run,
live tickets, fresh pulses, follow, spin), 'demand' when the floor is
still — camera glides and hover eases ask for their own frames — and
'never' while the tab is hidden. Per-frame allocations are gone: scratch
vectors for the lerps and camera maths, precomputed emissive colours,
curve.getPoint(u, target), and one wall-clock read per frame shared by
everything that ages a pulse; per-table pulse filtering is memoised.

Robustness: the body cursor is reset when the pointer leaves the canvas;
webglcontextlost drops the page to the flat map with a toast, and picking
3D again retries.

Mobile: below sm the 3D/map toggle sits in a strip under the floor and
the feed opens from it as a bottom sheet; a coarse pointer with no stored
preference defaults to the map.

Keyboard: every person and ticket is also a visually hidden button that
opens the same dossier; the dossier moves focus to its close button on
open and restores it on close, and its Esc handler ignores typing
targets.
---
 .../components/Live/floor/FloorDossier.tsx    |  35 +-
 .../components/Live/floor/TeamFloor.test.tsx  |  96 +++++
 web/src/components/Live/floor/TeamFloor.tsx   | 191 +++++++---
 web/src/components/Live/floor/TeamFloor3D.tsx | 342 +++++++++++++-----
 web/src/components/Live/floor/floorStore.ts   |  99 +++++
 5 files changed, 627 insertions(+), 136 deletions(-)
 create mode 100644 web/src/components/Live/floor/floorStore.ts

diff --git a/web/src/components/Live/floor/FloorDossier.tsx b/web/src/components/Live/floor/FloorDossier.tsx
index 5d7d638..04a9850 100644
--- a/web/src/components/Live/floor/FloorDossier.tsx
+++ b/web/src/components/Live/floor/FloorDossier.tsx
@@ -1,8 +1,9 @@
-import { useEffect, useMemo } from 'react';
+import { useEffect, useMemo, useRef } from 'react';
 import { ArrowUpRight, X } from 'lucide-react';
 import clsx from 'clsx';
 import type { RunEvent } from '@/types';
 import { teamColor } from '@/components/Board/teamColor';
+import { isTypingTarget } from '@/hooks/useKeyboard';
 import { agentTrail, type FloorAgent, type FloorModel, type FloorStageSeat, type FloorTeam, type FloorTicket } from './floorModel';
 import { TICKET_HEX, TICKET_LABEL, ago, clock, findAgent, findTicket, glyphFor, seatTitle, type FloorSelection } from './floorShared';
 
@@ -38,23 +39,47 @@ export default function FloorDossier({ floor, events, selection, running, now, o
   const person = findAgent(floor, selection);
   const ticket = findTicket(floor, selection);
   const onStage = !person && selection?.kind === 'agent' ? floor.stage.find((a) => a.id === selection.id) ?? null : null;
+  const open = !!(person || ticket || onStage);
 
-  // Esc closes, like every other overlay in the studio.
+  // Esc closes, like every other overlay in the studio — unless the key was
+  // typed into a field, where Esc means "clear what I typed", not "close".
   useEffect(() => {
     if (!selection) return undefined;
     const onKey = (e: KeyboardEvent) => {
-      if (e.key === 'Escape') onSelect(null);
+      if (e.key === 'Escape' && !isTypingTarget(e.target)) onSelect(null);
     };
     window.addEventListener('keydown', onKey);
     return () => window.removeEventListener('keydown', onKey);
   }, [selection, onSelect]);
 
-  if (!person && !ticket && !onStage) return null;
+  // Opening moves focus to the close button so a keyboard user lands inside
+  // the dossier they just opened; closing gives focus back to whatever opened
+  // it (the sr-only button, a feed card, a chip), so they are not dropped at
+  // the top of the document.
+  const asideRef = useRef<HTMLElement>(null);
+  const returnTo = useRef<HTMLElement | null>(null);
+  const openKey = open ? `${selection?.kind}:${selection?.id}` : '';
+  useEffect(() => {
+    if (!openKey) return undefined;
+    const active = document.activeElement;
+    if (active instanceof HTMLElement && !asideRef.current?.contains(active)) returnTo.current = active;
+    const close = asideRef.current?.querySelector<HTMLElement>('[data-dossier-close]');
+    close?.focus({ preventScroll: true });
+    return () => {
+      const back = returnTo.current;
+      if (back && back.isConnected && document.contains(back)) back.focus({ preventScroll: true });
+    };
+    // Re-run per dossier, not per render: `openKey` names the thing open.
+  }, [openKey]);
+
+  if (!open) return null;
 
   return (
     <aside
+      ref={asideRef}
       className="floor-dossier pointer-events-auto absolute left-2 top-2 z-[60] flex max-h-[calc(100%-1rem)] w-[min(20rem,calc(100%-1rem))] flex-col overflow-hidden rounded-lg border border-gray-200/90 bg-white/92 text-xs shadow-xl backdrop-blur-md dark:border-gray-700/80 dark:bg-gray-900/92"
       data-testid="floor-dossier"
+      role="dialog"
       aria-label={person ? `About ${person.agent.id}` : onStage ? `About ${onStage.id}` : `About ${ticket!.ticket.id}`}
     >
       {person ? (
@@ -76,7 +101,7 @@ function Header({ hex, glyph, title, sub, onClose }: { hex: string; glyph: strin
         <div className="truncate font-mono text-[13px] font-bold text-gray-900 dark:text-gray-100">{title}</div>
         <div className="truncate text-[10.5px] font-semibold text-gray-500 dark:text-gray-400">{sub}</div>
       </div>
-      <button type="button" onClick={onClose} aria-label="Close" className="focus-ring -mr-1 rounded p-1 text-gray-400 hover:bg-gray-100 hover:text-gray-700 dark:hover:bg-gray-800 dark:hover:text-gray-200">
+      <button type="button" onClick={onClose} aria-label="Close" data-dossier-close className="focus-ring -mr-1 rounded p-1 text-gray-400 hover:bg-gray-100 hover:text-gray-700 dark:hover:bg-gray-800 dark:hover:text-gray-200">
         <X size={13} aria-hidden="true" />
       </button>
     </header>
diff --git a/web/src/components/Live/floor/TeamFloor.test.tsx b/web/src/components/Live/floor/TeamFloor.test.tsx
index e542c65..0661fee 100644
--- a/web/src/components/Live/floor/TeamFloor.test.tsx
+++ b/web/src/components/Live/floor/TeamFloor.test.tsx
@@ -2,6 +2,7 @@ import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { fireEvent, render, screen, within } from '@testing-library/react';
 import TeamFloor from './TeamFloor';
 import { buildFloor } from './floorModel';
+import { resetFloorStore } from './floorStore';
 import type { RunEvent, SquadsView, Task } from '@/types';
 
 // jsdom has no WebGL, so the wrapper renders the flat stage — which draws the
@@ -40,6 +41,9 @@ const events: RunEvent[] = [
 
 beforeEach(() => {
   localStorage.clear();
+  // The floor remembers pulses and the last floor across mounts, by design;
+  // each test starts from an empty memory.
+  resetFloorStore();
 });
 
 describe('TeamFloor', () => {
@@ -200,6 +204,98 @@ describe('TeamFloor', () => {
     expect(screen.getByTestId('team-floor-idle')).toHaveTextContent('The floor is empty');
   });
 
+  // The page keeps the selection in the URL and passes it down; the floor
+  // draws it and reports clicks, but does not own it.
+  it('draws a controlled selection and reports changes instead of keeping its own', () => {
+    const onSelect = vi.fn();
+    const floor = buildFloor({ squads: chart, tasks, events, composition: null, running: true, now: T0 });
+    const { rerender } = render(<TeamFloor floor={floor} running selection={{ kind: 'ticket', id: 'T2', team: 'backend-go' }} onSelect={onSelect} now={T0} />);
+    expect(screen.getByTestId('floor-dossier')).toHaveAttribute('aria-label', 'About T2');
+    expect(screen.getByTestId('ticket-T2')).toHaveAttribute('data-selected', 'true');
+
+    fireEvent.click(screen.getByTestId('agent-go-worker'));
+    expect(onSelect).toHaveBeenCalledWith({ kind: 'agent', id: 'go-worker', team: 'backend-go' });
+    // Still T2 until the owner says otherwise.
+    expect(screen.getByTestId('floor-dossier')).toHaveAttribute('aria-label', 'About T2');
+
+    rerender(<TeamFloor floor={floor} running selection={{ kind: 'agent', id: 'go-worker', team: 'backend-go' }} onSelect={onSelect} now={T0} />);
+    expect(screen.getByTestId('floor-dossier')).toHaveAttribute('aria-label', 'About go-worker');
+
+    rerender(<TeamFloor floor={floor} running selection={null} onSelect={onSelect} now={T0} />);
+    expect(screen.queryByTestId('floor-dossier')).not.toBeInTheDocument();
+  });
+
+  // Leaving the Live page unmounts the floor. What happened while the user was
+  // on the Board must still be in the feed when they come back, and the first
+  // floor after the return must be diffed against the last one seen.
+  it('keeps its pulses and its last floor across an unmount', () => {
+    const before = buildFloor({ squads: chart, tasks, events: [], composition: null, running: true, now: T0 });
+    const { unmount } = render(<TeamFloor floor={before} running now={T0} />);
+    unmount();
+
+    const after = buildFloor({
+      squads: chart,
+      tasks: [...tasks.slice(0, 1), task('T2', { status: 'done', column: 'done' }), tasks[2]],
+      events,
+      composition: null,
+      running: true,
+      now: T0 + 3000,
+    });
+    render(<TeamFloor floor={after} running now={T0 + 3000} />);
+    const feed = screen.getByTestId('floor-feed');
+    expect(within(feed).getByText(/^T2 done ✓/)).toBeInTheDocument();
+  });
+
+  // A keyboard user who opens a dossier lands inside it, and is handed back to
+  // where they were when it closes — not dropped at the top of the document.
+  it('moves focus into the dossier on open and back on close', () => {
+    const floor = buildFloor({ squads: chart, tasks, events, composition: null, running: true, now: T0 });
+    render(
+      <>
+        <button type="button">opener</button>
+        <TeamFloor floor={floor} running now={T0} />
+      </>,
+    );
+    // jsdom does not focus SVG elements, so the opener stands in for the
+    // focused ticket, feed card or sr-only button a real keyboard would use.
+    const opener = screen.getByRole('button', { name: 'opener' });
+    opener.focus();
+    fireEvent.click(screen.getByTestId('ticket-T2'));
+    const close = within(screen.getByTestId('floor-dossier')).getByRole('button', { name: 'Close' });
+    expect(document.activeElement).toBe(close);
+    fireEvent.click(close);
+    expect(screen.queryByTestId('floor-dossier')).not.toBeInTheDocument();
+    expect(document.activeElement).toBe(opener);
+  });
+
+  // Esc in a text field means "clear what I typed", not "close the dossier".
+  it('ignores Esc typed into a field', () => {
+    const floor = buildFloor({ squads: chart, tasks, events, composition: null, running: true, now: T0 });
+    render(
+      <>
+        <input aria-label="a field" />
+        <TeamFloor floor={floor} running now={T0} />
+      </>,
+    );
+    fireEvent.click(screen.getByTestId('ticket-T2'));
+    const field = screen.getByLabelText('a field');
+    field.focus();
+    fireEvent.keyDown(field, { key: 'Escape' });
+    expect(screen.getByTestId('floor-dossier')).toBeInTheDocument();
+    fireEvent.keyDown(window, { key: 'Escape' });
+    expect(screen.queryByTestId('floor-dossier')).not.toBeInTheDocument();
+  });
+
+  it('puts the feed in a bottom sheet for a phone', () => {
+    const floor = buildFloor({ squads: chart, tasks, events, composition: null, running: true, now: T0 });
+    render(<TeamFloor floor={floor} running now={T0} />);
+    const strip = screen.getByTestId('floor-mobile-strip');
+    expect(strip).toHaveClass('sm:hidden');
+    expect(screen.queryByTestId('floor-sheet')).not.toBeInTheDocument();
+    fireEvent.click(within(strip).getByRole('button', { name: /feed/ }));
+    expect(screen.getByTestId('floor-sheet')).toBeInTheDocument();
+  });
+
   it('offers no 3D toggle where WebGL is absent', () => {
     const floor = buildFloor({ squads: chart, tasks, events, composition: null, running: true, now: T0 });
     render(<TeamFloor floor={floor} running />);
diff --git a/web/src/components/Live/floor/TeamFloor.tsx b/web/src/components/Live/floor/TeamFloor.tsx
index 398cef1..48b8780 100644
--- a/web/src/components/Live/floor/TeamFloor.tsx
+++ b/web/src/components/Live/floor/TeamFloor.tsx
@@ -1,13 +1,15 @@
 import { Suspense, lazy, useCallback, useContext, useEffect, useMemo, useRef, useState } from 'react';
-import { Box, LayoutTemplate } from 'lucide-react';
+import { Box, ChevronDown, ChevronUp, LayoutTemplate } from 'lucide-react';
 import clsx from 'clsx';
 import { AppContext } from '@/App';
 import { usePersistentState } from '@/hooks/useUiState';
+import { useToast } from '@/components/ui/Toast';
 import type { RunEvent } from '@/types';
 import TeamFloorFlat from './TeamFloorFlat';
 import FloorDossier from './FloorDossier';
 import PulseFeed from './PulseFeed';
 import { diffFloors, freshPulses, type FloorModel, type FloorPulse } from './floorModel';
+import { floorStore } from './floorStore';
 import type { FloorSelection } from './floorShared';
 
 // ── The team floor: 3D when the machine can, flat when it cannot ────────
@@ -18,9 +20,10 @@ import type { FloorSelection } from './floorShared';
 // only where it can run, and the user can pin either.
 //
 // Whichever stage draws, this wrapper owns what is interactive about it:
-// the selection (a clicked person or ticket, opened in the dossier), and
-// the pulses (what changed since the last floor, flashed on the stage and
-// listed in the feed).
+// the selection (a clicked person or ticket, opened in the dossier — held by
+// the page in the URL when it passes one, else here), and the pulses (what
+// changed since the last floor, flashed on the stage and listed in the feed;
+// kept in a module-level store so leaving and returning does not blank them).
 
 export interface TeamFloorProps {
   floor: FloorModel;
@@ -30,6 +33,12 @@ export interface TeamFloorProps {
   onTicket?: (id: string) => void;
   /** Current time, injected for tests. */
   now?: number;
+  /**
+   * Controlled selection. LiveView keeps it in the URL (?task / ?agent) so a
+   * dossier survives navigation and reload; left undefined, the floor owns it.
+   */
+  selection?: FloorSelection;
+  onSelect?: (sel: FloorSelection) => void;
 }
 
 const TeamFloor3D = lazy(() => import('./TeamFloor3D'));
@@ -52,6 +61,16 @@ function webGLAvailable(): boolean {
   }
 }
 
+/** A touch-first device: the flat map is the better default there. */
+function coarsePointer(): boolean {
+  if (typeof window === 'undefined' || typeof window.matchMedia !== 'function') return false;
+  try {
+    return window.matchMedia('(pointer: coarse)').matches;
+  } catch {
+    return false;
+  }
+}
+
 function useReducedMotion(): boolean {
   const [reduced, setReduced] = useState(() =>
     typeof window !== 'undefined' && typeof window.matchMedia === 'function'
@@ -87,42 +106,86 @@ function useClock(alive: boolean, fixed?: number): number {
 /**
  * usePulses diffs each new floor against the last and keeps the changes for
  * PULSE_TTL_MS. Diffing happens in the effect, not in render, so a floor that
- * re-renders without changing produces nothing.
+ * re-renders without changing produces nothing. Both the list and the last
+ * floor live in the module-level store: coming back from another page picks
+ * up where the feed left off, and the first floor after a return is diffed
+ * against the last one seen, so what happened in between still pulses.
  */
 function usePulses(floor: FloorModel, now: number, fixed?: number): FloorPulse[] {
-  const prev = useRef<FloorModel | null>(null);
-  const [pulses, setPulses] = useState<FloorPulse[]>([]);
+  const [pulses, setPulses] = useState<FloorPulse[]>(() => freshPulses(floorStore.pulses, fixed ?? Date.now()));
   useEffect(() => {
     const at = fixed ?? Date.now();
-    const found = diffFloors(prev.current, floor, at);
-    prev.current = floor;
-    if (found.length > 0) setPulses((list) => freshPulses([...list, ...found], at).slice(-PULSE_KEEP));
+    const found = diffFloors(floorStore.prevFloor, floor, at);
+    floorStore.prevFloor = floor;
+    if (found.length > 0) {
+      const next = freshPulses([...floorStore.pulses, ...found], at).slice(-PULSE_KEEP);
+      floorStore.pulses = next;
+      setPulses(next);
+    }
   }, [floor, fixed]);
   // Pruning: driven by the shared clock so the feed's "12s" labels and its
   // fading stay in step.
   useEffect(() => {
     setPulses((list) => {
       const kept = freshPulses(list, now);
-      return kept.length === list.length ? list : kept;
+      if (kept.length === list.length) return list;
+      floorStore.pulses = kept;
+      return kept;
     });
   }, [now]);
   return pulses;
 }
 
-export default function TeamFloor({ floor, running, events = NO_EVENTS, onTicket, now: fixedNow }: TeamFloorProps) {
+export default function TeamFloor({ floor, running, events = NO_EVENTS, onTicket, now: fixedNow, selection: selectionProp, onSelect: onSelectProp }: TeamFloorProps) {
   const ctx = useContext(AppContext);
+  const toast = useToast();
   const dark = ctx?.dark ?? false;
   const reducedMotion = useReducedMotion();
   const canGL = useMemo(() => webGLAvailable(), []);
   // The user's pick outlives the session: someone on a weak GPU who chose the
-  // flat floor once should not have to choose it on every visit.
-  const [prefer, setPrefer] = usePersistentState<'3d' | 'flat'>('live.floor.mode', '3d');
-  const use3D = canGL && prefer === '3d';
+  // flat floor once should not have to choose it on every visit. With no pick
+  // stored, a touch device starts on the map — orbiting a scene with a thumb
+  // on a phone GPU is not the first thing to offer.
+  const [prefer, setPrefer] = usePersistentState<'3d' | 'flat'>('live.floor.mode', coarsePointer() ? 'flat' : '3d');
+  // A lost WebGL context (a GPU reset, a tab evicted from VRAM) drops the
+  // floor to the map for the rest of this visit rather than leaving a blank
+  // canvas. Choosing 3D again is a retry.
+  const [glLost, setGlLost] = useState(false);
+  const use3D = canGL && prefer === '3d' && !glLost;
+  const onContextLost = useCallback(() => {
+    setGlLost(true);
+    toast.info('The 3D floor lost its graphics context', 'Showing the flat map instead. Pick 3D again to retry.');
+  }, [toast]);
+  const pick = useCallback(
+    (mode: '3d' | 'flat') => {
+      setPrefer(mode);
+      if (mode === '3d') setGlLost(false);
+    },
+    [setPrefer],
+  );
 
-  const [selection, setSelection] = useState<FloorSelection>(null);
-  const onSelect = useCallback((sel: FloorSelection) => setSelection(sel), []);
-  const now = useClock(running || selection !== null, fixedNow);
+  // Selection: the page's when it passes one (kept in the URL), else ours.
+  const [ownSelection, setOwnSelection] = useState<FloorSelection>(null);
+  const controlled = selectionProp !== undefined;
+  const selection = controlled ? selectionProp : ownSelection;
+  const onSelect = useCallback(
+    (sel: FloorSelection) => {
+      if (onSelectProp) onSelectProp(sel);
+      if (!controlled) setOwnSelection(sel);
+    },
+    [controlled, onSelectProp],
+  );
+  // The clock runs while there is something to time: a run, an open dossier,
+  // or pulses still fading — so they drain after a run ends instead of
+  // staying "fresh" until something else happens to tick.
+  const pulsesAlive = useRef(floorStore.pulses.length > 0);
+  const now = useClock(running || selection !== null || pulsesAlive.current, fixedNow);
   const pulses = usePulses(floor, now, fixedNow);
+  pulsesAlive.current = pulses.length > 0;
+  // The feed as a sheet at the bottom on a phone, where the side column has
+  // no room. Closed by default: the floor is what a phone screen is for.
+  const [sheetOpen, setSheetOpen] = useState(false);
+  const freshCount = useMemo(() => freshPulses(pulses, now).length, [pulses, now]);
 
   if (floor.mode === 'idle') {
     return <TeamFloorFlat floor={floor} running={running} onTicket={onTicket} />;
@@ -130,44 +193,72 @@ export default function TeamFloor({ floor, running, events = NO_EVENTS, onTicket
 
   const stageProps = { floor, running, selection, onSelect, pulses, onTicket };
 
+  const toggle = canGL && (
+    <div className="flex overflow-hidden rounded-md border border-gray-200/80 bg-white/80 text-[10px] backdrop-blur dark:border-gray-700/80 dark:bg-gray-900/80" role="group" aria-label="Floor view">
+      <button
+        type="button"
+        onClick={() => pick('3d')}
+        aria-pressed={use3D}
+        title="Walk the floor in 3D — drag to orbit, wheel to zoom"
+        className={clsx('focus-ring inline-flex items-center gap-1 px-2 py-1', use3D ? 'bg-brand-500 text-white' : 'text-gray-600 hover:bg-gray-100 dark:text-gray-300 dark:hover:bg-gray-800')}
+      >
+        <Box size={11} aria-hidden="true" /> 3D
+      </button>
+      <button
+        type="button"
+        onClick={() => pick('flat')}
+        aria-pressed={!use3D}
+        title="The flat map of the same floor — lighter on the GPU"
+        className={clsx('focus-ring inline-flex items-center gap-1 px-2 py-1', !use3D ? 'bg-brand-500 text-white' : 'text-gray-600 hover:bg-gray-100 dark:text-gray-300 dark:hover:bg-gray-800')}
+      >
+        <LayoutTemplate size={11} aria-hidden="true" /> map
+      </button>
+    </div>
+  );
+
   // The stage gets the width minus a fixed column at the right for the
   // 3D/map toggle and the feed: what slides in there never covers a label in
-  // the scene, whatever the camera is doing.
+  // the scene, whatever the camera is doing. Below `sm` that column is gone;
+  // the toggle moves into a strip along the bottom and the feed becomes a
+  // sheet that slides up from it.
   return (
     <div className="relative flex h-full w-full" data-testid="team-floor-shell">
-      <div className="relative min-w-0 flex-1">
-        {use3D ? (
-          <Suspense fallback={<TeamFloorFlat {...stageProps} now={fixedNow} />}>
-            <TeamFloor3D {...stageProps} dark={dark} reducedMotion={reducedMotion} />
-          </Suspense>
-        ) : (
-          <TeamFloorFlat {...stageProps} now={fixedNow} />
-        )}
-        <FloorDossier floor={floor} events={events} selection={selection} running={running} now={now} onSelect={onSelect} onTicket={onTicket} />
+      <div className="relative flex min-w-0 flex-1 flex-col">
+        <div className="relative min-h-0 flex-1">
+          {use3D ? (
+            <Suspense fallback={<TeamFloorFlat {...stageProps} now={fixedNow} />}>
+              <TeamFloor3D {...stageProps} dark={dark} reducedMotion={reducedMotion} onContextLost={onContextLost} />
+            </Suspense>
+          ) : (
+            <TeamFloorFlat {...stageProps} now={fixedNow} />
+          )}
+          <FloorDossier floor={floor} events={events} selection={selection} running={running} now={now} onSelect={onSelect} onTicket={onTicket} />
+        </div>
+        {/* Phone: the controls strip, and the feed as a sheet above it. */}
+        <div className="relative shrink-0 border-t border-gray-200/70 bg-gray-50/80 dark:border-gray-800 dark:bg-gray-950/60 sm:hidden" data-testid="floor-mobile-strip">
+          {sheetOpen && (
+            <div id="floor-sheet" className="max-h-[40vh] overflow-y-auto border-b border-gray-200/70 p-2 dark:border-gray-800" data-testid="floor-sheet">
+              <PulseFeed pulses={pulses} now={now} onSelect={(sel) => { onSelect(sel); setSheetOpen(false); }} running={running} />
+            </div>
+          )}
+          <div className="flex items-center justify-between gap-2 px-2 py-1.5">
+            {toggle || <span />}
+            <button
+              type="button"
+              onClick={() => setSheetOpen((v) => !v)}
+              aria-expanded={sheetOpen}
+              aria-controls="floor-sheet"
+              className="focus-ring inline-flex items-center gap-1 rounded-md border border-gray-200/80 bg-white/80 px-2 py-1 text-[10px] font-semibold text-gray-600 dark:border-gray-700/80 dark:bg-gray-900/80 dark:text-gray-300"
+            >
+              {sheetOpen ? <ChevronDown size={11} aria-hidden="true" /> : <ChevronUp size={11} aria-hidden="true" />}
+              feed
+              {freshCount > 0 && <span className="rounded-full bg-brand-500 px-1.5 text-[9px] text-white">{freshCount}</span>}
+            </button>
+          </div>
+        </div>
       </div>
       <div className="relative hidden w-52 shrink-0 flex-col gap-2 border-l border-gray-200/70 bg-gray-50/60 p-2 dark:border-gray-800 dark:bg-gray-950/40 sm:flex" data-testid="floor-side">
-        {canGL && (
-          <div className="flex self-end overflow-hidden rounded-md border border-gray-200/80 bg-white/80 text-[10px] backdrop-blur dark:border-gray-700/80 dark:bg-gray-900/80">
-          <button
-            type="button"
-            onClick={() => setPrefer('3d')}
-            aria-pressed={prefer === '3d'}
-            title="Walk the floor in 3D — drag to orbit, wheel to zoom"
-            className={clsx('focus-ring inline-flex items-center gap-1 px-2 py-1', prefer === '3d' ? 'bg-brand-500 text-white' : 'text-gray-600 hover:bg-gray-100 dark:text-gray-300 dark:hover:bg-gray-800')}
-          >
-            <Box size={11} aria-hidden="true" /> 3D
-          </button>
-          <button
-            type="button"
-            onClick={() => setPrefer('flat')}
-            aria-pressed={prefer === 'flat'}
-            title="The flat map of the same floor — lighter on the GPU"
-            className={clsx('focus-ring inline-flex items-center gap-1 px-2 py-1', prefer === 'flat' ? 'bg-brand-500 text-white' : 'text-gray-600 hover:bg-gray-100 dark:text-gray-300 dark:hover:bg-gray-800')}
-          >
-            <LayoutTemplate size={11} aria-hidden="true" /> map
-          </button>
-        </div>
-        )}
+        {toggle && <div className="flex self-end">{toggle}</div>}
         <PulseFeed pulses={pulses} now={now} onSelect={onSelect} running={running} />
       </div>
     </div>
diff --git a/web/src/components/Live/floor/TeamFloor3D.tsx b/web/src/components/Live/floor/TeamFloor3D.tsx
index 689d207..d183560 100644
--- a/web/src/components/Live/floor/TeamFloor3D.tsx
+++ b/web/src/components/Live/floor/TeamFloor3D.tsx
@@ -4,8 +4,10 @@ import { Canvas, useFrame, useThree, type ThreeEvent } from '@react-three/fiber'
 import { ContactShadows, Float, Html, OrbitControls, QuadraticBezierLine, RoundedBox, Sparkles } from '@react-three/drei';
 import type { OrbitControls as OrbitControlsImpl } from 'three-stdlib';
 import { teamColor } from '@/components/Board/teamColor';
-import type { FloorAgent, FloorHandoff, FloorModel, FloorPhase, FloorPulse, FloorStageSeat, FloorTeam, FloorTicket, TicketState } from './floorModel';
-import { TICKET_HEX, TICKET_LABEL, glyphFor, seatTitle, type FloorSelection } from './floorShared';
+import { STAGE_GLYPHS } from '@/components/shared/labels';
+import { PULSE_TTL_MS, type FloorAgent, type FloorHandoff, type FloorModel, type FloorPhase, type FloorPulse, type FloorStageSeat, type FloorTeam, type FloorTicket, type TicketState } from './floorModel';
+import { LEGEND_STATES, TICKET_HEX, TICKET_LABEL, glyphFor, seatTitle, type FloorSelection } from './floorShared';
+import { floorStore, rememberCamera, rememberCameraPrefs } from './floorStore';
 
 // ── The team floor, in three dimensions ──────────────────────────────────
 //
@@ -25,7 +27,14 @@ import { TICKET_HEX, TICKET_LABEL, glyphFor, seatTitle, type FloorSelection } fr
 // the wrapper), a table focuses the camera, empty floor clears. The camera is
 // the user's: drag to orbit, wheel to zoom, right-drag to pan, "follow" keeps
 // whoever is working in the middle. Everything animates on the GPU per frame
-// and freezes (frameloop on demand) under prefers-reduced-motion.
+// while there is something to animate — a run, live tickets, fresh pulses,
+// the camera gliding, follow or spin — and the loop drops to on-demand when
+// there is not, and stops when the tab is hidden. Under
+// prefers-reduced-motion nothing moves at all.
+//
+// Per-frame work allocates nothing: the lerps, colours and curve samples go
+// through scratch objects made once, and the wall clock is read once per
+// frame (FrameClock) rather than once per animated thing.
 //
 // All data comes from floorModel; this file only draws it.
 
@@ -38,6 +47,8 @@ export interface TeamFloor3DProps {
   onSelect: (sel: FloorSelection) => void;
   pulses: FloorPulse[];
   onTicket?: (id: string) => void;
+  /** The WebGL context went away; the wrapper falls back to the flat map. */
+  onContextLost?: () => void;
 }
 
 const HEX: Record<string, string> = {
@@ -147,19 +158,93 @@ function layout(teams: FloorTeam[]): Placed[] {
   });
 }
 
-function nowSeconds(): number {
-  return Date.now() / 1000;
+/**
+ * The wall clock, in seconds, read once per frame by FrameClock (which runs
+ * before every other frame callback) and shared by everything that ages a
+ * pulse. Before the first frame it holds the time the module loaded.
+ */
+const frame = { now: Date.now() / 1000 };
+
+function FrameClock() {
+  useFrame(() => {
+    frame.now = Date.now() / 1000;
+  }, -100);
+  return null;
 }
 
-export default function TeamFloor3D({ floor, running, dark, reducedMotion, selection, onSelect, pulses, onTicket }: TeamFloor3DProps) {
+/** Scratch objects for per-frame maths — allocated once, never per frame. */
+const _scale = new THREE.Vector3();
+const _dir = new THREE.Vector3();
+const _goal = new THREE.Vector3();
+const _right = new THREE.Vector3();
+const WHITE = new THREE.Color('#ffffff');
+
+/** Whether the tab is visible; a hidden tab renders nothing. */
+function useDocumentVisible(): boolean {
+  const [visible, setVisible] = useState(() => typeof document === 'undefined' || document.visibilityState !== 'hidden');
+  useEffect(() => {
+    if (typeof document === 'undefined') return undefined;
+    const onChange = () => setVisible(document.visibilityState !== 'hidden');
+    document.addEventListener('visibilitychange', onChange);
+    return () => document.removeEventListener('visibilitychange', onChange);
+  }, []);
+  return visible;
+}
+
+export default function TeamFloor3D({ floor, running, dark, reducedMotion, selection, onSelect, pulses, onTicket, onContextLost }: TeamFloor3DProps) {
   const placed = useMemo(() => layout(floor.teams), [floor.teams]);
   const byID = useMemo(() => new Map(placed.map((p) => [p.team.id, p])), [placed]);
   const [focus, setFocus] = useState<THREE.Vector3 | null>(null);
   const [focusDistance, setFocusDistance] = useState<number | null>(null);
-  const [autoRotate, setAutoRotate] = useState(false);
-  const [follow, setFollow] = useState(false);
-  const [resetKey, setResetKey] = useState(0);
+  // Follow and spin outlive a visit: they are the user's, kept in the floor
+  // store with the camera.
+  const [autoRotate, setAutoRotateState] = useState(() => floorStore.autoRotate);
+  const [follow, setFollowState] = useState(() => floorStore.follow);
+  const setAutoRotate = useCallback((v: boolean) => {
+    setAutoRotateState(v);
+    rememberCameraPrefs({ autoRotate: v });
+  }, []);
+  const setFollow = useCallback((v: boolean) => {
+    setFollowState(v);
+    rememberCameraPrefs({ follow: v });
+  }, []);
+  // "reset view" asks the controls to restore their saved state (home)
+  // instead of remounting the Canvas, which threw away every GPU resource
+  // and the scene's warm state for a camera move.
+  const [resetSignal, setResetSignal] = useState(0);
   const animate = !reducedMotion;
+  const visible = useDocumentVisible();
+
+  // The render loop: 'always' while something moves, 'demand' when the floor
+  // is still (a click, a camera drag or a glide asks for frames as needed),
+  // 'never' while the tab is hidden.
+  const anyLive = useMemo(
+    () => floor.teams.some((t) => t.tickets.some((k) => k.state === 'working' || k.state === 'review')),
+    [floor.teams],
+  );
+  const freshPulse = pulses.length > 0 && Date.now() - pulses[pulses.length - 1].at < PULSE_TTL_MS;
+  const frameloop: 'always' | 'demand' | 'never' = !visible
+    ? 'never'
+    : reducedMotion
+      ? 'demand'
+      : running || autoRotate || follow || anyLive || freshPulse
+        ? 'always'
+        : 'demand';
+
+  // A lost context (GPU reset, VRAM eviction) is reported up; the wrapper
+  // swaps in the flat map and says so. The listener is removed on unmount.
+  const lostRef = useRef<{ el: HTMLCanvasElement; fn: (e: Event) => void } | null>(null);
+  const onContextLostRef = useRef(onContextLost);
+  onContextLostRef.current = onContextLost;
+  useEffect(
+    () => () => {
+      const l = lostRef.current;
+      if (l) l.el.removeEventListener('webglcontextlost', l.fn);
+      lostRef.current = null;
+      document.body.style.cursor = '';
+    },
+    [],
+  );
 
   const width = Math.max(1, placed.length) * TABLE_GAP;
   const hasStage = floor.mode === 'teams' && (floor.stage.length > 0 || !!floor.phase);
@@ -232,18 +317,48 @@ export default function TeamFloor3D({ floor, running, dark, reducedMotion, selec
     onSelect(null);
   };
 
+  // What a keyboard or a screen reader can reach: the same people and
+  // tickets the scene draws, as buttons that open the same dossier.
+  const reachable = useMemo(() => {
+    const out: { key: string; label: string; sel: NonNullable<FloorSelection> }[] = [];
+    for (const t of floor.teams) {
+      for (const a of t.agents) out.push({ key: `${t.id}/${a.id}`, label: `${a.id}, ${seatTitle(a, t)} on ${t.name}${a.active ? ', working' : ''}`, sel: { kind: 'agent', id: a.id, team: t.id } });
+      for (const k of t.tickets) out.push({ key: `${t.id}/${k.id}`, label: `Task ${k.id}, ${TICKET_LABEL[k.state]} on ${t.name}${k.agent ? `, held by ${k.agent}` : ''}`, sel: { kind: 'ticket', id: k.id, team: t.id } });
+    }
+    for (const k of floor.unassigned) out.push({ key: `seam/${k.id}`, label: `Task ${k.id}, ${TICKET_LABEL[k.state]}, no team`, sel: { kind: 'ticket', id: k.id, team: '' } });
+    for (const s of floor.stage) out.push({ key: `stage/${s.id}`, label: `${s.id} on the pipeline stage${s.phase ? `, ${s.phase}` : ''}${s.active ? ', speaking' : ''}`, sel: { kind: 'agent', id: s.id, team: '' } });
+    return out;
+  }, [floor.teams, floor.unassigned, floor.stage]);
+
   return (
-    <div className="relative h-full w-full" data-testid="team-floor-3d">
+    <div
+      className="relative h-full w-full"
+      data-testid="team-floor-3d"
+      // The pointer cursor is set on the body by hovers inside the canvas; a
+      // pointer that leaves the canvas mid-hover must not take it along.
+      onPointerLeave={() => {
+        document.body.style.cursor = '';
+      }}
+    >
       <Canvas
-        key={resetKey}
         shadows={{ type: THREE.PCFShadowMap }}
         dpr={[1, 1.75]}
-        frameloop={reducedMotion ? 'demand' : 'always'}
+        frameloop={frameloop}
         camera={{ position: [home.x, camZ * 0.55, camZ + 1], fov: 44, near: 0.1, far: 200 }}
         gl={{ antialias: true, alpha: true, powerPreference: 'high-performance' }}
         onPointerMissed={clear}
+        onCreated={({ gl }) => {
+          const el = gl.domElement;
+          const fn = (e: Event) => {
+            e.preventDefault();
+            onContextLostRef.current?.();
+          };
+          el.addEventListener('webglcontextlost', fn);
+          lostRef.current = { el, fn };
+        }}
       >
         <Suspense fallback={null}>
+          <FrameClock />
           <Lights dark={dark} />
           <Ground dark={dark} width={width} animate={animate} />
           {floor.links.map((link) => {
@@ -293,23 +408,36 @@ export default function TeamFloor3D({ floor, running, dark, reducedMotion, selec
             <IntegrationPad integration={floor.integration} unassigned={floor.unassigned.length} />
           )}
           <ContactShadows position={[0, 0.01, 0]} opacity={dark ? 0.55 : 0.35} scale={width + 20} blur={2.6} far={5} color={dark ? '#000' : '#4c1d95'} />
-          <CameraRig focus={focus} distance={focusDistance} home={home} homeCam={homeCam} autoRotate={autoRotate && animate} />
+          <CameraRig focus={focus} distance={focusDistance} home={home} homeCam={homeCam} autoRotate={autoRotate && animate} resetSignal={resetSignal} />
         </Suspense>
       </Canvas>
 
+      {/* The scene for a keyboard: every person and ticket as a button that
+          opens the same dossier a click would. Visually hidden; the dossier
+          it opens is not. */}
+      <ul className="sr-only" aria-label="People and tasks on the floor" data-testid="floor-a11y-list">
+        {reachable.map((r) => (
+          <li key={r.key}>
+            <button type="button" onClick={() => onSelect(r.sel)}>
+              {r.label}
+            </button>
+          </li>
+        ))}
+      </ul>
+
       <div className="pointer-events-none absolute inset-x-0 bottom-0 flex flex-wrap items-end justify-between gap-2 p-2">
         <Legend floor={floor} />
         <div className="pointer-events-auto flex items-center gap-1 rounded-md border border-gray-200/80 bg-white/80 p-1 text-[10px] backdrop-blur dark:border-gray-700/80 dark:bg-gray-900/80">
           <button
             type="button"
-            onClick={() => setFollow((v) => !v)}
+            onClick={() => setFollow(!follow)}
             aria-pressed={follow}
             title="Keep the camera on whoever is working"
             className={follow ? 'focus-ring rounded bg-brand-500 px-1.5 py-0.5 text-white' : 'focus-ring rounded px-1.5 py-0.5 hover:bg-gray-100 dark:hover:bg-gray-800'}
           >
             {follow ? 'following' : 'follow'}
           </button>
-          <button type="button" onClick={() => setAutoRotate((v) => !v)} aria-pressed={autoRotate} className="focus-ring rounded px-1.5 py-0.5 hover:bg-gray-100 dark:hover:bg-gray-800">
+          <button type="button" onClick={() => setAutoRotate(!autoRotate)} aria-pressed={autoRotate} className="focus-ring rounded px-1.5 py-0.5 hover:bg-gray-100 dark:hover:bg-gray-800">
             {autoRotate ? 'stop spin' : 'spin'}
           </button>
           <button
@@ -317,7 +445,7 @@ export default function TeamFloor3D({ floor, running, dark, reducedMotion, selec
             onClick={() => {
               clear();
               setFollow(false);
-              setResetKey((k) => k + 1);
+              setResetSignal((k) => k + 1);
             }}
             className="focus-ring rounded px-1.5 py-0.5 hover:bg-gray-100 dark:hover:bg-gray-800"
           >
@@ -412,14 +540,20 @@ function Table({
   const managerSeat = team.agents.find((a) => a.seat === 'manager');
   const managerPos = managerSeat ? seats.get(managerSeat.id) : undefined;
 
-  // Pulses on this table, still fresh enough to draw.
-  const mine = pulses.filter((p) => p.team === team.id || (team.crew && !p.team));
-  const latestByTicket = new Map<string, FloorPulse>();
-  for (const p of mine) if (p.ticket) latestByTicket.set(p.ticket, p);
+  // Pulses on this table, still fresh enough to draw — filtered once per
+  // pulse list, not once per render of every table.
+  const mine = useMemo(() => pulses.filter((p) => p.team === team.id || (team.crew && !p.team)), [pulses, team.id, team.crew]);
+  const latestByTicket = useMemo(() => {
+    const m = new Map<string, FloorPulse>();
+    for (const p of mine) if (p.ticket) m.set(p.ticket, p);
+    return m;
+  }, [mine]);
+  const bursting = useMemo(() => mine.filter((p) => frame.now - p.at / 1000 <= BURST_S), [mine]);
 
   // The board stands behind the head seat; the team's sign hangs above it.
-  const boardDir = managerPos ? managerPos.pos.clone().setY(0).normalize() : new THREE.Vector3(0, 0, -1);
-  const signAt = boardDir.clone().multiplyScalar(BOARD_BACK).setY(BOARD_BOTTOM + BOARD_H + 0.75);
+  const boardDir = useMemo(() => (managerPos ? managerPos.pos.clone().setY(0).normalize() : new THREE.Vector3(0, 0, -1)), [managerPos]);
+  const signAt = useMemo(() => boardDir.clone().multiplyScalar(BOARD_BACK).setY(BOARD_BOTTOM + BOARD_H + 0.75), [boardDir]);
+  const tableCentre = useMemo(() => new THREE.Vector3(0, TABLE_Y + 0.3, 0), []);
 
   return (
     <group position={pos}>
@@ -506,13 +640,11 @@ function Table({
           .map((p, i) => <Dispatch key={p.id} from={managerPos.pos} to={seats.get(p.agent!)!.pos} label={p.ticket ? `${p.agent} ← ${p.ticket}` : `${p.agent}`} at={p.at} slot={i} animate={animate} />)}
 
       {/* Bursts: a ticket finishing, failing, appearing; a gate; a team done. */}
-      {mine.map((p) => {
-        const age = nowSeconds() - p.at / 1000;
-        if (age > BURST_S) return null;
+      {bursting.map((p) => {
         const where = p.ticket ? slots.get(p.ticket) : undefined;
         const big = p.kind === 'gate' || p.kind === 'team-complete';
         if (!where && !big) return null;
-        return <Burst key={`burst-${p.id}`} at={p.at} position={where ?? new THREE.Vector3(0, TABLE_Y + 0.3, 0)} color={TONE_HEX[p.tone]} size={big ? 2.2 : 1} animate={animate} />;
+        return <Burst key={`burst-${p.id}`} at={p.at} position={where ?? tableCentre} color={TONE_HEX[p.tone]} size={big ? 2.2 : 1} animate={animate} />;
       })}
     </group>
   );
@@ -585,20 +717,21 @@ function TicketCard({
   const ring = useRef<THREE.Mesh>(null);
   const [hover, setHover] = useState(false);
   const color = TICKET_HEX[ticket.state];
+  const glow = useMemo(() => new THREE.Color(color), [color]);
   const pulseAt = pulse ? pulse.at / 1000 : -Infinity;
   const spawned = pulse?.kind === 'ticket-new';
 
   useFrame(({ clock }) => {
     const t = clock.getElapsedTime();
-    const age = nowSeconds() - pulseAt;
+    const age = frame.now - pulseAt;
     if (mat.current) {
       // A fresh pulse flashes the card white-hot, then it settles into its
       // state's glow: breathing when live, steady when selected or hovered.
       if (animate && age < FLASH_S) {
-        mat.current.emissive.set('#ffffff');
+        mat.current.emissive.copy(WHITE);
         mat.current.emissiveIntensity = 1.6 * (1 - age / FLASH_S);
       } else {
-        mat.current.emissive.set(color);
+        mat.current.emissive.copy(glow);
         if (selected || hover) mat.current.emissiveIntensity = 0.7;
         else if (live && animate) mat.current.emissiveIntensity = 0.5 + Math.sin(t * 5) * 0.4;
         else mat.current.emissiveIntensity = live ? 0.6 : 0.08;
@@ -714,13 +847,20 @@ function Person({
   const flashStart = useRef<number>(-1);
   const wasActive = useRef(false);
   const [hover, setHover] = useState(false);
+  const invalidate = useThree((s) => s.invalidate);
 
   // A flash ring when this person starts working: the "message received"
   // cue, once per activation.
   useEffect(() => {
     if (active && !wasActive.current) flashStart.current = performance.now();
     wasActive.current = active;
-  }, [active]);
+    invalidate();
+  }, [active, invalidate]);
+  // Hover and selection ease the scale over several frames; on-demand
+  // rendering has to be asked for each of them.
+  useEffect(() => {
+    invalidate();
+  }, [hover, selected, invalidate]);
 
   // Seat faces the table centre: rotate the whole person so its screen is
   // between them and the table.
@@ -743,12 +883,20 @@ function Person({
         body.current.rotation.x = active ? Math.sin(t * 9) * 0.04 : 0;
       }
       const target = hover || selected ? 1.08 : 1;
-      body.current.scale.lerp(new THREE.Vector3(target, target, target), 0.2);
+      if (Math.abs(body.current.scale.x - target) > 0.002) {
+        body.current.scale.lerp(_scale.setScalar(target), 0.2);
+        invalidate();
+      }
     }
     if (head.current) {
       // Idle people glance at whoever is working; the worker watches the screen.
       const want = active ? 0 : headYaw;
-      head.current.rotation.y = animate ? THREE.MathUtils.lerp(head.current.rotation.y, want, 0.06) : want;
+      if (animate && Math.abs(head.current.rotation.y - want) > 0.002) {
+        head.current.rotation.y = THREE.MathUtils.lerp(head.current.rotation.y, want, 0.06);
+        invalidate();
+      } else if (!animate) {
+        head.current.rotation.y = want;
+      }
     }
     if (flash.current) {
       const age = flashStart.current < 0 ? Infinity : (performance.now() - flashStart.current) / 1000;
@@ -758,6 +906,7 @@ function Person({
         const s = 0.6 + age * 2.2;
         flash.current.scale.set(s, s, s);
         (flash.current.material as THREE.MeshBasicMaterial).opacity = Math.max(0, 0.8 - age * 0.7);
+        invalidate();
       }
     }
     if (halo.current) {
@@ -1039,8 +1188,12 @@ function StageFigure({ seat, pos, tall, running, animate, selected, onSelect }:
   const body = useRef<THREE.Group>(null);
   const ring = useRef<THREE.Mesh>(null);
   const [hover, setHover] = useState(false);
+  const invalidate = useThree((s) => s.invalidate);
   const hex = '#8b5cf6';
-  const glyph = ROLE_GLYPH_STAGE[seat.id] ?? ROLE_GLYPH_STAGE[seat.phase ?? ''] ?? '🎓';
+  const glyph = STAGE_GLYPHS[seat.id] ?? STAGE_GLYPHS[seat.phase ?? ''] ?? '🎓';
+  useEffect(() => {
+    invalidate();
+  }, [hover, selected, active, invalidate]);
   useFrame(({ clock }) => {
     const t = clock.getElapsedTime();
     if (body.current) {
@@ -1050,7 +1203,10 @@ function StageFigure({ seat, pos, tall, running, animate, selected, onSelect }:
         body.current.rotation.z = active ? Math.sin(t * 2.5) * 0.05 : 0;
       }
       const target = hover || selected ? 1.08 : 1;
-      body.current.scale.lerp(new THREE.Vector3(target, target, target), 0.2);
+      if (Math.abs(body.current.scale.x - target) > 0.002) {
+        body.current.scale.lerp(_scale.setScalar(target), 0.2);
+        invalidate();
+      }
     }
     if (ring.current) {
       ring.current.visible = active || selected;
@@ -1124,28 +1280,6 @@ function StageFigure({ seat, pos, tall, running, animate, selected, onSelect }:
   );
 }
 
-const ROLE_GLYPH_STAGE: Record<string, string> = {
-  planner: '📋',
-  plan: '📋',
-  splitter: '✂️',
-  split: '✂️',
-  explorer: '🔍',
-  explore: '🔍',
-  architect: '🏗️',
-  coordinator: '🎯',
-  coord: '🎯',
-  docs: '📖',
-  memory: '💾',
-  context: '📝',
-  composer: '🎼',
-  clarify: '💬',
-  skills: '🧰',
-  learn: '🎓',
-  polish: '✨',
-  qa: '🧪',
-  test: '🧪',
-};
-
 /** The team's board on the wall behind the manager: a column per state, a tile per ticket. */
 function WallBoard({ team, hex, dark, dir, running }: { team: FloorTeam; hex: string; dark: boolean; dir: THREE.Vector3; running: boolean }) {
   const columns: [TicketState[], string, string][] = [
@@ -1243,7 +1377,7 @@ function Thread({ from, to, color, live, animate }: { from: THREE.Vector3; to: T
     beads.current.forEach((m, i) => {
       if (!m) return;
       const u = ((t * 0.5 + i / 2) % 1 + 1) % 1;
-      m.position.copy(curve.getPoint(u));
+      curve.getPoint(u, m.position);
     });
   });
   return (
@@ -1271,7 +1405,7 @@ function Dispatch({ from, to, label, at, slot, animate }: { from: THREE.Vector3;
   const grp = useRef<THREE.Group>(null);
   const [alive, setAlive] = useState(true);
   useFrame(() => {
-    const age = nowSeconds() - at / 1000;
+    const age = frame.now - at / 1000;
     if (age > DISPATCH_S) {
       if (alive) setAlive(false);
       return;
@@ -1279,7 +1413,7 @@ function Dispatch({ from, to, label, at, slot, animate }: { from: THREE.Vector3;
     if (dot.current) {
       // The message flies for 1.2s, lands, and dissolves — nothing lingers on the person.
       const flight = animate ? Math.min(1, age / 1.2) : 1;
-      dot.current.position.copy(curve.getPoint(flight));
+      curve.getPoint(flight, dot.current.position);
       const fade = age < 1.2 ? 1 : Math.max(0, 1 - (age - 1.2) / 0.6);
       dot.current.scale.setScalar(fade);
       dot.current.visible = fade > 0;
@@ -1315,7 +1449,7 @@ function Burst({ at, position, color, size, animate }: { at: number; position: T
     [],
   );
   useFrame(() => {
-    const age = nowSeconds() - at / 1000;
+    const age = frame.now - at / 1000;
     if (age > BURST_S || !animate) {
       if (alive) setAlive(false);
       return;
@@ -1365,7 +1499,7 @@ function Conduit({ from, to, label, stalled, running, animate }: { from: Placed;
     packets.current.forEach((m, i) => {
       if (!m) return;
       const u = ((t * speed + i / N) % 1 + 1) % 1;
-      m.position.copy(curve.getPoint(u));
+      curve.getPoint(u, m.position);
       const s = stalled ? 0.9 + Math.sin(t * 8) * 0.3 : 1;
       m.scale.setScalar(s);
     });
@@ -1420,7 +1554,7 @@ function Spark({ handoff, placed, animate }: { handoff: FloorHandoff; placed: Ma
   useFrame(({ clock }) => {
     if (!curve || !dot.current) return;
     const u = animate ? (clock.getElapsedTime() * 0.6) % 1 : 1;
-    dot.current.position.copy(curve.getPoint(u));
+    curve.getPoint(u, dot.current.position);
   });
   if (!curve) return null;
   const mid = curve.getPoint(0.5);
@@ -1469,24 +1603,32 @@ function IntegrationPad({ integration, unassigned }: { integration: NonNullable<
  * beside the dossier, not under it. The glide stops the moment the user takes
  * the camera back (any drag or wheel).
  */
-function CameraRig({ focus, distance, home, homeCam, autoRotate }: { focus: THREE.Vector3 | null; distance: number | null; home: THREE.Vector3; homeCam: THREE.Vector3; autoRotate: boolean }) {
+function CameraRig({ focus, distance, home, homeCam, autoRotate, resetSignal }: { focus: THREE.Vector3 | null; distance: number | null; home: THREE.Vector3; homeCam: THREE.Vector3; autoRotate: boolean; resetSignal: number }) {
   const controls = useRef<OrbitControlsImpl>(null);
   const target = useRef(home.clone());
   const want = useRef<number | null>(null);
   const glide = useRef<THREE.Vector3 | null>(null);
   const { invalidate, camera } = useThree();
+  // A camera the user left on a previous visit: restored on mount, and the
+  // first "re-frame home" below is skipped so it is not undone a frame later.
+  const restoredRef = useRef(false);
+  const skipHomeRef = useRef(floorStore.camera !== null);
   // The floor grew or shrank (a stage appeared, a team joined): re-frame it,
   // unless the user is looking at something in particular.
   useEffect(() => {
     if (focus) return;
+    if (skipHomeRef.current) {
+      skipHomeRef.current = false;
+      return;
+    }
     glide.current = homeCam.clone();
     invalidate();
   }, [homeCam, focus, invalidate]);
   useEffect(() => {
     const t = focus ? focus.clone() : home.clone();
     if (focus && distance !== null && distance < 10) {
-      const right = new THREE.Vector3().setFromMatrixColumn(camera.matrixWorld, 0).setY(0).normalize();
-      t.sub(right.multiplyScalar(distance * 0.28));
+      _right.setFromMatrixColumn(camera.matrixWorld, 0).setY(0).normalize();
+      t.sub(_right.multiplyScalar(distance * 0.28));
     }
     target.current.copy(t);
     want.current = focus ? distance : null;
@@ -1495,13 +1637,54 @@ function CameraRig({ focus, distance, home, homeCam, autoRotate }: { focus: THRE
   useEffect(() => {
     const c = controls.current;
     if (!c) return undefined;
+    // Home is what "reset view" returns to.
+    c.saveState();
+    if (!restoredRef.current) {
+      restoredRef.current = true;
+      const saved = floorStore.camera;
+      if (saved) {
+        camera.position.set(saved.position[0], saved.position[1], saved.position[2]);
+        c.target.set(saved.target[0], saved.target[1], saved.target[2]);
+        target.current.copy(c.target);
+        c.update();
+        invalidate();
+      }
+    }
     const release = () => {
       want.current = null;
       glide.current = null;
     };
+    const remember = () => {
+      rememberCamera({
+        position: [camera.position.x, camera.position.y, camera.position.z],
+        target: [c.target.x, c.target.y, c.target.z],
+      });
+    };
     c.addEventListener('start', release);
-    return () => c.removeEventListener('start', release);
-  }, []);
+    c.addEventListener('end', remember);
+    return () => {
+      c.removeEventListener('start', release);
+      c.removeEventListener('end', remember);
+      // Leaving the page keeps the view for the return, glide or not.
+      remember();
+    };
+  }, [camera, invalidate]);
+  // reset view: back to the saved home, forgetting the remembered camera.
+  const firstReset = useRef(true);
+  useEffect(() => {
+    if (firstReset.current) {
+      firstReset.current = false;
+      return;
+    }
+    const c = controls.current;
+    if (!c) return;
+    want.current = null;
+    glide.current = null;
+    c.reset();
+    target.current.copy(c.target);
+    rememberCamera(null);
+    invalidate();
+  }, [resetSignal, invalidate]);
   useFrame(() => {
     const c = controls.current;
     if (!c) return;
@@ -1520,36 +1703,33 @@ function CameraRig({ focus, distance, home, homeCam, autoRotate }: { focus: THRE
     }
     if (want.current !== null) {
       glide.current = null;
-      const dir = camera.position.clone().sub(c.target);
-      const have = dir.length();
+      _dir.copy(camera.position).sub(c.target);
+      const have = _dir.length();
       if (Math.abs(have - want.current) > 0.05) {
-        const goal = c.target.clone().add(dir.normalize().multiplyScalar(want.current));
-        camera.position.lerp(goal, 0.08);
+        _goal.copy(c.target).add(_dir.normalize().multiplyScalar(want.current));
+        camera.position.lerp(_goal, 0.08);
         moved = true;
       } else {
         want.current = null;
       }
     }
-    if (moved) c.update();
+    if (moved) {
+      c.update();
+      // On-demand rendering: a glide asks for the next frame itself.
+      invalidate();
+    }
   });
   return <OrbitControls ref={controls} makeDefault enableDamping dampingFactor={0.08} minDistance={4} maxDistance={70} maxPolarAngle={Math.PI / 2.05} autoRotate={autoRotate} autoRotateSpeed={0.6} target={[home.x, home.y, home.z]} />;
 }
 
 function Legend({ floor }: { floor: FloorModel }) {
-  const items: [TicketState, string][] = [
-    ['working', 'in progress'],
-    ['review', 'in review'],
-    ['blocked', 'blocked'],
-    ['done', 'done'],
-    ['queued', 'queued'],
-  ];
   return (
     <div className="pointer-events-none flex flex-wrap items-center gap-x-3 gap-y-1 rounded-md bg-white/70 px-2 py-1 text-[10px] text-gray-600 backdrop-blur dark:bg-gray-900/70 dark:text-gray-300">
       <span className="font-semibold uppercase tracking-wider">{floor.summary}</span>
-      {items.map(([state, label]) => (
+      {LEGEND_STATES.map((state) => (
         <span key={state} className="inline-flex items-center gap-1">
           <span className="inline-block h-2 w-3 rounded-sm" style={{ background: TICKET_HEX[state] }} />
-          {label}
+          {TICKET_LABEL[state]}
         </span>
       ))}
     </div>
diff --git a/web/src/components/Live/floor/floorStore.ts b/web/src/components/Live/floor/floorStore.ts
new file mode 100644
index 0000000..c40ef0a
--- /dev/null
+++ b/web/src/components/Live/floor/floorStore.ts
@@ -0,0 +1,99 @@
+import type { FloorModel, FloorPulse } from './floorModel';
+
+// ── What the floor remembers between visits ──────────────────────────────
+//
+// The Live page unmounts when the user goes to the Board and mounts again
+// when they come back, and the floor used to come back blank: no pulses in
+// the feed, the camera at home, follow and spin off, and the first floor it
+// built diffed against nothing — so nothing that happened while they were
+// away was there to be seen. The SELECTION lives in the URL (see LiveView);
+// everything else the scene owns lives here, at module level, for the life
+// of the tab, and the few scalars worth keeping across a reload are mirrored
+// to sessionStorage.
+
+export interface FloorCamera {
+  position: [number, number, number];
+  target: [number, number, number];
+}
+
+interface FloorMemory {
+  /** The changes still worth flashing and listing. */
+  pulses: FloorPulse[];
+  /** The last floor the pulses were diffed against. */
+  prevFloor: FloorModel | null;
+  /** Where the user left the camera; null means home. */
+  camera: FloorCamera | null;
+  follow: boolean;
+  autoRotate: boolean;
+}
+
+const KEY = 'slmcode:floor';
+
+interface Stored {
+  camera?: FloorCamera | null;
+  follow?: boolean;
+  autoRotate?: boolean;
+}
+
+function readStored(): Stored {
+  try {
+    const raw = sessionStorage.getItem(KEY);
+    if (!raw) return {};
+    const parsed = JSON.parse(raw) as Stored;
+    return parsed && typeof parsed === 'object' ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+const stored = readStored();
+
+export const floorStore: FloorMemory = {
+  pulses: [],
+  prevFloor: null,
+  camera: isCamera(stored.camera) ? stored.camera : null,
+  follow: stored.follow === true,
+  autoRotate: stored.autoRotate === true,
+};
+
+function isCamera(c: unknown): c is FloorCamera {
+  if (!c || typeof c !== 'object') return false;
+  const { position, target } = c as FloorCamera;
+  const ok = (v: unknown) => Array.isArray(v) && v.length === 3 && v.every((n) => typeof n === 'number' && Number.isFinite(n));
+  return ok(position) && ok(target);
+}
+
+/** Persist the scalars worth keeping across a reload. */
+export function persistFloorStore(): void {
+  try {
+    const out: Stored = { camera: floorStore.camera, follow: floorStore.follow, autoRotate: floorStore.autoRotate };
+    sessionStorage.setItem(KEY, JSON.stringify(out));
+  } catch {
+    /* private mode — the in-memory copy still serves this tab */
+  }
+}
+
+export function rememberCamera(camera: FloorCamera | null): void {
+  floorStore.camera = camera;
+  persistFloorStore();
+}
+
+export function rememberCameraPrefs(prefs: { follow?: boolean; autoRotate?: boolean }): void {
+  if (prefs.follow !== undefined) floorStore.follow = prefs.follow;
+  if (prefs.autoRotate !== undefined) floorStore.autoRotate = prefs.autoRotate;
+  persistFloorStore();
+}
+
+/** Forget everything — tests, and a new tab's first floor. */
+export function resetFloorStore(): void {
+  floorStore.pulses = [];
+  floorStore.prevFloor = null;
+  floorStore.camera = null;
+  floorStore.follow = false;
+  floorStore.autoRotate = false;
+  try {
+    sessionStorage.removeItem(KEY);
+  } catch {
+    /* ignore */
+  }
+}

From adf1b28ecd139a2314d9b30e8173c24517ceaab3 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 08:49:50 +0000
Subject: [PATCH 14/23] feat(studio): one live board fed by the stream, a
 per-event run derivation, and URL-backed selection
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Board store (hooks/useBoardStore): seeded from GET /api/tasks and
GET /api/squads, updated by the stream's task_update events (data.task
replaced by id), re-read every 30 s as a safety net, on both edges of a
run, on reconnect, and — until the server pushes its first task_update —
shortly after a structural log line, so an older server still feels
live. task_update and review_pending are board events: folded into the
store and the review badge, never rows in the log. The Board, the Live
floor, the ticker and the Teams page read it; their own pollers (3 s,
5 s, 5 s) are gone, as is the Sidebar's second health poll — the review
count comes from the stream's health poll and the review_pending event.
useBoardStore() is exported so the task rail can switch to it.

Run derivation (hooks/runDerived): phases seen, active phase and agent,
task ids, files written, token/cost totals and the newest composition
are folded once per event in the stream hook and published per flush;
LiveView, NowBar and ActivityRail consume it instead of scanning the
whole log. EventLog caches describeEvent/level/signature by event
identity, folds its insight summary incrementally, windows its rows to
the viewport plus a margin while keeping stick-to-bottom, and its agent,
task and file chips are EntityLinks.

URL state: the floor's selection lives in ?task= / ?agent= (&team=), so
a dossier survives navigation and reload and can be linked to; the Board
keeps ?team= and ?column= (a new per-column filter). focusTicket now
passes the id through as focusTaskId to the Tasks rail (LiveTaskPanel
accepts the prop; acting on it is left to its owner).

NowBar derives who is working from the floor model's working set
(readActivity/nowFor, now exported), so the clock stops after agent_end,
and its agent, task and team are links.
---
 web/src/App.tsx                              |  29 ++
 web/src/components/Board/KanbanBoard.tsx     | 184 ++++----
 web/src/components/Live/ActivityRail.tsx     |  21 +-
 web/src/components/Live/EventLog.tsx         | 463 ++++++++++++++-----
 web/src/components/Live/LiveTaskPanel.tsx    |  13 +-
 web/src/components/Live/LiveView.tsx         | 195 ++++----
 web/src/components/Live/NowBar.test.tsx      |  41 ++
 web/src/components/Live/NowBar.tsx           | 200 ++++----
 web/src/components/Live/floor/floorModel.ts  |  22 +-
 web/src/components/Sidebar.tsx               |  43 +-
 web/src/components/Teams/TeamsView.test.tsx  |   9 +-
 web/src/components/Teams/TeamsView.tsx       |  27 +-
 web/src/components/shared/BoardStoreRoot.tsx |  13 +
 web/src/hooks/runDerived.test.ts             |  72 +++
 web/src/hooks/runDerived.ts                  | 148 ++++++
 web/src/hooks/useBoardStore.test.tsx         | 157 +++++++
 web/src/hooks/useBoardStore.ts               | 269 +++++++++++
 web/src/hooks/useLiveStream.test.tsx         |  51 ++
 web/src/hooks/useLiveStream.ts               |  56 ++-
 19 files changed, 1556 insertions(+), 457 deletions(-)
 create mode 100644 web/src/components/shared/BoardStoreRoot.tsx
 create mode 100644 web/src/hooks/runDerived.test.ts
 create mode 100644 web/src/hooks/runDerived.ts
 create mode 100644 web/src/hooks/useBoardStore.test.tsx
 create mode 100644 web/src/hooks/useBoardStore.ts

diff --git a/web/src/App.tsx b/web/src/App.tsx
index de9cd2d..07e52e1 100644
--- a/web/src/App.tsx
+++ b/web/src/App.tsx
@@ -3,6 +3,8 @@ import { Routes, Route } from 'react-router-dom';
 import Layout from './components/Layout';
 import { getHealth, getConfig, errorText } from './api/client';
 import { useLiveStream } from './hooks/useLiveStream';
+import { BoardStoreProvider, useBoardStoreSource } from './hooks/useBoardStore';
+import type { RunDerived } from './hooks/runDerived';
 import { ToastProvider } from './components/ui/Toast';
 import { ConfirmProvider } from './components/ui/Modal';
 import ErrorBoundary from './components/ui/ErrorBoundary';
@@ -46,6 +48,13 @@ export interface AppContextValue {
   askSignal: number;
   /** Accumulated token deltas for the active agent turn. */
   tokenStream: string;
+  /** What the log adds up to, folded once per event — see hooks/runDerived. */
+  liveDerived: RunDerived;
+  /**
+   * Changes awaiting review: from the stream's health poll and the server's
+   * `review_pending` event. Null until either has answered.
+   */
+  pendingReview: number | null;
 }
 
 export const AppContext = React.createContext<AppContextValue | null>(null);
@@ -133,13 +142,27 @@ function AppInner() {
     }
   }, []);
 
+  // The board store is owned here too, beside the stream that feeds it: the
+  // stream hands it every task_update, and it hands the pages one live board
+  // instead of four pollers. See hooks/useBoardStore.
+  const boardEventRef = useRef<(ev: RunEvent) => void>(() => {});
+  const onBoardEvent = useCallback((ev: RunEvent) => boardEventRef.current(ev), []);
+
   const initialEventsRef = useRef<RunEvent[]>(readStoredEvents());
   const stream = useLiveStream({
     initialEvents: initialEventsRef.current,
     initialRunning: readStoredRunning(),
     onEvents: persistEvents,
     onRunning: persistRunning,
+    onBoardEvent,
+  });
+
+  const board = useBoardStoreSource({
+    connection: stream.connection,
+    running: stream.running,
+    lastEvent: stream.derived.last,
   });
+  boardEventRef.current = board.applyEvent;
 
   useEffect(() => {
     if (stream.latest) setLiveResult(stream.latest);
@@ -204,6 +227,8 @@ function AppInner() {
       clearStreamGap: stream.clearGap,
       askSignal: stream.askSignal,
       tokenStream: stream.tokenStream,
+      liveDerived: stream.derived,
+      pendingReview: stream.pendingReview,
     }),
     [
       health,
@@ -223,11 +248,14 @@ function AppInner() {
       stream.clearGap,
       stream.askSignal,
       stream.tokenStream,
+      stream.derived,
+      stream.pendingReview,
     ],
   );
 
   return (
     <AppContext.Provider value={value}>
+      <BoardStoreProvider value={board.store}>
       <ErrorBoundary label="Studio">
         <Suspense fallback={<PageLoading />}>
           <Routes>
@@ -248,6 +276,7 @@ function AppInner() {
           </Routes>
         </Suspense>
       </ErrorBoundary>
+      </BoardStoreProvider>
     </AppContext.Provider>
   );
 }
diff --git a/web/src/components/Board/KanbanBoard.tsx b/web/src/components/Board/KanbanBoard.tsx
index ae3eb54..d9e37d0 100644
--- a/web/src/components/Board/KanbanBoard.tsx
+++ b/web/src/components/Board/KanbanBoard.tsx
@@ -1,4 +1,5 @@
 import { useState, useEffect, useCallback, useMemo, useRef } from 'react';
+import { useSearchParams } from 'react-router-dom';
 import {
   DndContext,
   DragOverlay,
@@ -10,25 +11,15 @@ import {
   type DragEndEvent,
 } from '@dnd-kit/core';
 import { SortableContext, verticalListSortingStrategy } from '@dnd-kit/sortable';
-import { getBoard, getSquads, patchTask, addTask } from '@/api/client';
-import type { Board as BoardType, SquadsView, Task } from '@/types';
+import { patchTask, addTask } from '@/api/client';
+import type { Task } from '@/types';
+import { useBoardStore } from '@/hooks/useBoardStore';
+import { COLUMN_LABELS, COLUMN_ORDER, columnLabel } from '@/components/shared/labels';
 import TaskCard from './TaskCard';
 import TeamStrip, { UNASSIGNED_FILTER } from './TeamStrip';
 import clsx from 'clsx';
 import { Loader2, Plus, RefreshCw, X } from 'lucide-react';
 
-const COLUMN_LABELS: Record<string, string> = {
-  to_scope: 'To Scope',
-  scoped: 'Scoped',
-  ready_to_dev: 'Ready',
-  in_progress: 'In Progress',
-  in_review: 'In Review',
-  blocked: 'Blocked',
-  done: 'Done',
-};
-
-const COLUMN_ORDER = ['to_scope', 'scoped', 'ready_to_dev', 'in_progress', 'in_review', 'blocked', 'done'];
-
 interface NewTaskDraft {
   title: string;
   description: string;
@@ -50,96 +41,84 @@ const EMPTY_DRAFT: NewTaskDraft = {
 };
 
 export default function KanbanBoard() {
-  const [board, setBoard] = useState<BoardType | null>(null);
+  // The board and the org chart come from the shared store — seeded once,
+  // kept current by the stream's task_update events, re-read every 30 s as a
+  // safety net. This page used to poll both every 3 s for as long as it was
+  // open. See hooks/useBoardStore.
+  const board = useBoardStore();
+  const { tasks: allTasks, squads, refresh: fetchBoard, refreshing, upsertTask } = board;
+  const loading = !board.ready;
   const [activeTask, setActiveTask] = useState<Task | null>(null);
-  const [loading, setLoading] = useState(true);
-  const [refreshing, setRefreshing] = useState(false);
   const [showAdd, setShowAdd] = useState(false);
   const [draft, setDraft] = useState<NewTaskDraft>(EMPTY_DRAFT);
   const [savingAdd, setSavingAdd] = useState(false);
   const [addError, setAddError] = useState('');
-  // The org chart this board is executing against. Null on a single-stream run,
-  // which is most of them — the strip hides itself rather than showing an empty
-  // header nobody can act on.
-  const [squads, setSquads] = useState<SquadsView | null>(null);
-  // The org chart's team ids, so a card can be assigned to one.
+  // The org chart's team ids, so a card can be assigned to one. Null on a
+  // single-stream run, which is most of them — the strip hides itself rather
+  // than showing an empty header nobody can act on.
   const teamIDs = useMemo(() => (squads?.ok ? (squads.squads ?? []).map((s) => s.id) : []), [squads]);
-  const [teamFilter, setTeamFilter] = useState('');
+  // Both filters live in the URL (?team, ?column), so a filtered board can be
+  // linked to and survives a reload.
+  const [searchParams, setSearchParams] = useSearchParams();
+  const teamFilter = searchParams.get('team') ?? '';
+  const columnFilter = searchParams.get('column') ?? '';
+  const setParam = useCallback(
+    (key: 'team' | 'column', value: string) => {
+      setSearchParams(
+        (prev) => {
+          const next = new URLSearchParams(prev);
+          if (value) next.set(key, value);
+          else next.delete(key);
+          return next;
+        },
+        { replace: true },
+      );
+    },
+    [setSearchParams],
+  );
+  const setTeamFilter = useCallback((v: string) => setParam('team', v), [setParam]);
+  const setColumnFilter = useCallback((v: string) => setParam('column', v), [setParam]);
   const addTitleRef = useRef<HTMLInputElement>(null);
 
   const sensors = useSensors(
     useSensor(PointerSensor, { activationConstraint: { distance: 5 } }),
   );
 
-  const fetchBoard = useCallback(async () => {
-    try {
-      setRefreshing(true);
-      const b = await getBoard();
-      setBoard(b);
-    } catch (e) {
-      console.error('Failed to load board:', e);
-    } finally {
-      setLoading(false);
-      setRefreshing(false);
-    }
-  }, []);
-
   useEffect(() => {
     if (showAdd) {
       addTitleRef.current?.focus();
     }
   }, [showAdd]);
 
-  // The org chart moves far more slowly than the board — it is written once per
-  // run — so it rides the same poll rather than getting its own timer.
-  const fetchSquads = useCallback(async () => {
-    try {
-      setSquads(await getSquads());
-    } catch {
-      // No org chart is the normal state, not an error.
-      setSquads(null);
-    }
-  }, []);
-
-  useEffect(() => {
-    fetchBoard();
-    void fetchSquads();
-    const interval = setInterval(() => {
-      fetchBoard();
-      void fetchSquads();
-    }, 3000);
-    return () => clearInterval(interval);
-  }, [fetchBoard, fetchSquads]);
-
   const columns = useMemo(() => {
-    const fromBoard = board?.columns?.length ? board.columns : [];
+    const fromBoard = board.columns.length ? board.columns : [];
     return [...new Set([...COLUMN_ORDER, ...fromBoard])];
-  }, [board?.columns]);
+  }, [board.columns]);
+  const shownColumns = useMemo(
+    () => (columnFilter && columns.includes(columnFilter) ? [columnFilter] : columns),
+    [columns, columnFilter],
+  );
 
   // Filtering happens BEFORE grouping, so a filtered column shows its own
   // count rather than the whole board's — "the backend's four, and they are all
   // blocked" is the sentence this page exists to make readable.
   const visibleTasks = useMemo(() => {
-    const all = board?.tasks || [];
-    if (teamFilter === '') return all;
-    if (teamFilter === UNASSIGNED_FILTER) return all.filter((t) => !t.squad);
-    return all.filter((t) => t.squad === teamFilter);
-  }, [board?.tasks, teamFilter]);
+    if (teamFilter === '') return allTasks;
+    if (teamFilter === UNASSIGNED_FILTER) return allTasks.filter((t) => !t.squad);
+    return allTasks.filter((t) => t.squad === teamFilter);
+  }, [allTasks, teamFilter]);
   const byColumn = useMemo(() => groupTasks(visibleTasks, columns), [visibleTasks, columns]);
-  const totalTasks = board?.tasks?.length || 0;
+  const totalTasks = allTasks.length;
 
   const handleDragStart = (event: DragStartEvent) => {
     const taskId = event.active.id as string;
-    if (board) {
-      const task = board.tasks.find((t) => t.id === taskId);
-      setActiveTask(task || null);
-    }
+    setActiveTask(allTasks.find((t) => t.id === taskId) || null);
   };
 
   const handleDragEnd = async (event: DragEndEvent) => {
     setActiveTask(null);
     const { active, over } = event;
-    if (!over || !board) return;
+    if (!over) return;
 
     const taskId = active.id as string;
     const overId = over.id as string;
@@ -149,24 +128,22 @@ export default function KanbanBoard() {
     if (columns.includes(overId)) {
       targetCol = overId;
     } else {
-      const overTask = board.tasks.find((t) => t.id === overId);
+      const overTask = allTasks.find((t) => t.id === overId);
       if (!overTask) return;
       targetCol = overTask.column;
     }
 
-    const task = board.tasks.find((t) => t.id === taskId);
+    const task = allTasks.find((t) => t.id === taskId);
     if (!task || task.column === targetCol) return;
 
-    // Optimistic update
-    const newTasks = board.tasks.map((t) =>
-      t.id === taskId ? { ...t, column: targetCol } : t,
-    );
-    setBoard({ ...board, tasks: newTasks, by_column: groupTasks(newTasks, columns) });
-
+    // Optimistic: paint the move now; the server's task_update (or the
+    // refresh on failure) is the truth.
+    upsertTask({ ...task, column: targetCol });
     try {
-      await patchTask(taskId, { column: targetCol });
+      const saved = await patchTask(taskId, { column: targetCol });
+      if (saved && saved.id) upsertTask(saved);
     } catch {
-      fetchBoard(); // revert
+      void fetchBoard(); // revert
     }
   };
 
@@ -195,10 +172,7 @@ export default function KanbanBoard() {
         acceptance: draft.acceptance.trim(),
         files: splitList(draft.files),
       });
-      if (board) {
-        const tasks = [created, ...(board.tasks || [])];
-        setBoard({ ...board, tasks, by_column: groupTasks(tasks, columns) });
-      }
+      if (created && created.id) upsertTask(created);
       setShowAdd(false);
       setDraft(EMPTY_DRAFT);
       await fetchBoard();
@@ -220,12 +194,15 @@ export default function KanbanBoard() {
     );
   }
 
-  if (!board) {
+  if (board.error && totalTasks === 0) {
     return (
       <div className="flex items-center justify-center h-full">
         <div className="text-center space-y-3">
           <p className="text-gray-400">No board data yet.</p>
-          <p className="text-xs text-gray-500">Run a query to populate the kanban board.</p>
+          <p className="text-xs text-gray-500">{board.error}</p>
+          <button onClick={() => void fetchBoard()} className="btn-secondary h-8 text-xs">
+            Try again
+          </button>
         </div>
       </div>
     );
@@ -243,6 +220,17 @@ export default function KanbanBoard() {
                 {visibleTasks.length} in {teamFilter === UNASSIGNED_FILTER ? 'no team' : teamFilter}
               </span>
             )}
+            {columnFilter !== '' && (
+              <button
+                type="button"
+                onClick={() => setColumnFilter('')}
+                className="badge-brand focus-ring inline-flex items-center gap-1 text-[10px]"
+                title="Show every column"
+              >
+                {columnLabel(columnFilter)} only
+                <X size={10} aria-hidden="true" />
+              </button>
+            )}
           </div>
           {board.plan?.summary && (
             <p className="mt-1 max-w-4xl text-sm text-gray-500 dark:text-gray-400">
@@ -252,7 +240,7 @@ export default function KanbanBoard() {
         </div>
         <div className="flex shrink-0 items-center gap-2">
           <button
-            onClick={fetchBoard}
+            onClick={() => void fetchBoard()}
             disabled={refreshing}
             className="btn-secondary h-9 gap-2 px-3 text-xs"
             title="Refresh board"
@@ -309,7 +297,7 @@ export default function KanbanBoard() {
                 className="input"
               >
                 {columns.map((col) => (
-                  <option key={col} value={col}>{COLUMN_LABELS[col] || col}</option>
+                  <option key={col} value={col}>{columnLabel(col)}</option>
                 ))}
               </select>
             </label>
@@ -383,7 +371,7 @@ export default function KanbanBoard() {
 
       <TeamStrip
         view={squads}
-        tasks={board?.tasks || []}
+        tasks={allTasks}
         filter={teamFilter}
         onFilter={setTeamFilter}
       />
@@ -395,7 +383,7 @@ export default function KanbanBoard() {
         onDragEnd={handleDragEnd}
       >
         <div className="flex min-h-0 flex-1 gap-3 overflow-x-auto pb-4">
-          {columns.map((col) => {
+          {shownColumns.map((col) => {
             const tasks = byColumn[col] || [];
             return (
               <div
@@ -410,14 +398,22 @@ export default function KanbanBoard() {
               >
                 <div className="mb-2 flex items-center justify-between gap-2 px-1">
                   <h3 className={clsx('text-xs font-bold uppercase tracking-wider', `col-${col}`)}>
-                    {COLUMN_LABELS[col] || col}
+                    <button
+                      type="button"
+                      onClick={() => setColumnFilter(columnFilter === col ? '' : col)}
+                      className="focus-ring rounded hover:underline"
+                      aria-pressed={columnFilter === col}
+                      title={columnFilter === col ? 'Show every column' : `Show only ${columnLabel(col)}`}
+                    >
+                      {columnLabel(col)}
+                    </button>
                   </h3>
                   <div className="flex items-center gap-1">
                     <span className="badge-neutral text-[10px]">{tasks.length}</span>
                     <button
                       onClick={() => handleOpenAdd(col)}
                       className="btn-ghost rounded-md p-1"
-                      title={`Add task to ${COLUMN_LABELS[col] || col}`}
+                      title={`Add task to ${columnLabel(col)}`}
                     >
                       <Plus size={12} />
                     </button>
@@ -430,7 +426,7 @@ export default function KanbanBoard() {
                 >
                   <div className="flex-1 space-y-2 overflow-y-auto min-h-[60px]">
                     {tasks.map((task) => (
-                      <TaskCard key={task.id} task={task} columns={columns} columnLabels={COLUMN_LABELS} teams={teamIDs} onUpdate={fetchBoard} />
+                      <TaskCard key={task.id} task={task} columns={columns} columnLabels={COLUMN_LABELS} teams={teamIDs} onUpdate={() => void fetchBoard()} />
                     ))}
                     {tasks.length === 0 && (
                       <div className="flex items-center justify-center h-16 text-[10px] text-gray-400 italic border border-dashed rounded-lg border-gray-300 dark:border-gray-700">
@@ -447,7 +443,7 @@ export default function KanbanBoard() {
         <DragOverlay>
           {activeTask && (
             <div className="opacity-90 rotate-2">
-              <TaskCard task={activeTask} columns={columns} columnLabels={COLUMN_LABELS} teams={teamIDs} onUpdate={fetchBoard} isDragOverlay />
+              <TaskCard task={activeTask} columns={columns} columnLabels={COLUMN_LABELS} teams={teamIDs} onUpdate={() => void fetchBoard()} isDragOverlay />
             </div>
           )}
         </DragOverlay>
diff --git a/web/src/components/Live/ActivityRail.tsx b/web/src/components/Live/ActivityRail.tsx
index e169dbd..52675d0 100644
--- a/web/src/components/Live/ActivityRail.tsx
+++ b/web/src/components/Live/ActivityRail.tsx
@@ -12,6 +12,7 @@ import ResultPanel from './ResultPanel';
 import LiveFeedback from './LiveFeedback';
 import { buildRecovery, recoveryTally } from './recovery';
 import { useStickToBottom } from '@/hooks/useUiState';
+import type { RunDerived } from '@/hooks/runDerived';
 import type { LatestRunResponse, RunEvent } from '@/types';
 
 // ── One column for everything the stage does not draw ────────────────────
@@ -35,25 +36,35 @@ export interface ActivityRailProps {
   onClose?: () => void;
   /** True when the rail is an overlay (narrow viewport), so it shows a close button. */
   overlay?: boolean;
+  /**
+   * The stream's running totals — task and file counts for the chips — so
+   * the rail does not re-scan the log on every flush.
+   */
+  derived?: RunDerived;
+  /** A task the floor asked the Tasks view to scroll to and flash. */
+  focusTaskId?: string;
 }
 
-export default function ActivityRail({ events, running, result, tokenStream, view, onView, onClose, overlay }: ActivityRailProps) {
+export default function ActivityRail({ events, running, result, tokenStream, view, onView, onClose, overlay, derived, focusTaskId }: ActivityRailProps) {
   const logRef = useStickToBottom<HTMLDivElement>(events, view === 'log');
   const fixes = useMemo(() => recoveryTally(buildRecovery(events)), [events]);
   const fixesBadge =
     fixes.needsYou > 0 ? String(fixes.needsYou) : fixes.healing > 0 ? String(fixes.healing) : fixes.resolved > 0 ? String(fixes.resolved) : undefined;
+  // From the accumulator when the page has one; a bare rail (tests) counts.
   const fileCount = useMemo(() => {
+    if (derived) return derived.files.size;
     const set = new Set<string>();
     for (const e of events) {
       if (e.kind === 'file_change' && e.scope) set.add(e.scope);
     }
     return set.size;
-  }, [events]);
+  }, [derived, events]);
   const taskCount = useMemo(() => {
+    if (derived) return derived.taskIds.size;
     const ids = new Set<string>();
     for (const e of events) if (e.task_id) ids.add(e.task_id);
     return ids.size;
-  }, [events]);
+  }, [derived, events]);
 
   return (
     <div className="flex h-full min-h-0 flex-col">
@@ -99,12 +110,12 @@ export default function ActivityRail({ events, running, result, tokenStream, vie
               <div className="space-y-3">
                 <CalibrationBanner events={events} />
                 <TokenStream text={tokenStream} running={running} />
-                <EventLog events={events} />
+                <EventLog events={events} scrollRef={logRef} />
               </div>
             )}
           </div>
         )}
-        {view === 'tasks' && <LiveTaskPanel />}
+        {view === 'tasks' && <LiveTaskPanel focusTaskId={focusTaskId} />}
         {view === 'fixes' && (
           <div className="h-full overflow-auto">
             <RecoveryPanel events={events} />
diff --git a/web/src/components/Live/EventLog.tsx b/web/src/components/Live/EventLog.tsx
index 4ba1ebf..37fe4f3 100644
--- a/web/src/components/Live/EventLog.tsx
+++ b/web/src/components/Live/EventLog.tsx
@@ -1,12 +1,38 @@
-import { memo, useMemo, useState } from 'react';
+import { memo, useEffect, useLayoutEffect, useMemo, useRef, useState } from 'react';
+import type { RefObject } from 'react';
 import type { RunEvent, RunEventSummary } from '@/types';
+import EntityLink from '@/components/shared/EntityLink';
 import clsx from 'clsx';
 
+// ── The log, as rows ─────────────────────────────────────────────────────
+//
+// Two costs used to be paid on every stream flush, for every event in the
+// log: describing it (describeEvent, with its regexes and JSON parsing) and
+// summing it into the insight panel (summarizeEvents). Both are now paid
+// once per event: descriptions are cached by event identity in a WeakMap —
+// an event object never changes once it has arrived — and the summary is an
+// accumulator that folds only the events appended since the last render.
+// Rows are windowed to what is on screen plus a margin, so a two-thousand
+// line log costs the DOM a few dozen rows, while the scroll container's
+// stick-to-bottom keeps working because the spacers keep its height honest.
+
 interface EventLogProps {
   events: RunEvent[];
   summary?: RunEventSummary | null;
+  /**
+   * The scroll container the rows live in, for windowing. Without it every
+   * row renders (tests, a short archived log).
+   */
+  scrollRef?: RefObject<HTMLElement | null>;
 }
 
+/** Below this many rows nothing is windowed; the bookkeeping would cost more than it saves. */
+const WINDOW_FROM = 120;
+/** Rows kept rendered above and below the viewport. */
+const WINDOW_MARGIN = 24;
+/** A first guess at a row's height; measured rows correct it. */
+const ROW_PX_GUESS = 76;
+
 const PHASE_COLORS: Record<string, string> = {
   init: 'text-sky-500',
   skills: 'text-teal-500',
@@ -89,13 +115,14 @@ type EventView = {
   detail?: string;
   preview?: string;
   raw?: string;
-  chips: { label: string; tone?: 'phase' | 'agent' | 'task' | 'file' | 'kind' }[];
+  chips: { label: string; tone?: 'phase' | 'agent' | 'task' | 'file' | 'kind'; id?: string }[];
 };
 
-function EventLog({ events, summary }: EventLogProps) {
+function EventLog({ events, summary, scrollRef }: EventLogProps) {
   const [filter, setFilter] = useState<Filter>('all');
   const [expanded, setExpanded] = useState<Set<string>>(() => new Set());
-  const insightSummary = useMemo(() => summary || summarizeEvents(events), [events, summary]);
+  const folded = useIncrementalSummary(events);
+  const insightSummary = summary || folded;
 
   const counts = useMemo(() => {
     const c = { error: 0, problem: 0, warning: 0, success: 0 };
@@ -115,6 +142,8 @@ function EventLog({ events, summary }: EventLogProps) {
   }, [events, filter]);
 
   const displayEvents = useMemo(() => compactAdjacentEvents(visible), [visible]);
+  const listRef = useRef<HTMLDivElement>(null);
+  const win = useRowWindow(scrollRef, listRef, displayEvents.length);
 
   const toggleExpanded = (key: string) => {
     setExpanded((prev) => {
@@ -169,8 +198,10 @@ function EventLog({ events, summary }: EventLogProps) {
         </span>
       </div>
 
-      <div className="space-y-0.5 font-mono text-xs">
-        {displayEvents.map((item, i) => {
+      <div ref={listRef} className="space-y-0.5 font-mono text-xs" data-testid="event-log-rows" data-window={`${win.start}-${win.end}`}>
+        {win.start > 0 && <div style={{ height: win.top }} aria-hidden="true" />}
+        {displayEvents.slice(win.start, win.end).map((item, k) => {
+          const i = win.start + k;
           const event = item.event;
           const view = item.view;
           const rowKey = `${item.signature}-${event.time}-${i}`;
@@ -180,6 +211,7 @@ function EventLog({ events, summary }: EventLogProps) {
           return (
             <div
               key={rowKey}
+              data-row
               className={clsx(
                 'rounded-lg px-3 py-2 transition-colors hover:bg-gray-50 dark:hover:bg-gray-800/50',
                 style.row,
@@ -214,21 +246,31 @@ function EventLog({ events, summary }: EventLogProps) {
                         repeated x{item.count}
                       </span>
                     )}
-                    {view.chips.map((chip, idx) => (
-                      <span
-                        key={`${chip.label}-${idx}`}
-                        className={clsx(
-                          'rounded px-1.5 py-0.5 font-sans text-[9px] font-semibold',
-                          chip.tone === 'agent' && 'bg-brand-50 text-brand-600 dark:bg-brand-950/40 dark:text-brand-300',
-                          chip.tone === 'task' && 'bg-gray-100 text-gray-500 dark:bg-gray-800 dark:text-gray-400',
-                          chip.tone === 'file' && 'bg-violet-50 text-violet-600 dark:bg-violet-950/40 dark:text-violet-300',
-                          chip.tone === 'kind' && 'bg-sky-50 text-sky-600 dark:bg-sky-950/40 dark:text-sky-300',
-                          (!chip.tone || chip.tone === 'phase') && 'bg-gray-100 text-gray-500 dark:bg-gray-800 dark:text-gray-400',
-                        )}
-                      >
-                        {chip.label}
-                      </span>
-                    ))}
+                    {view.chips.map((chip, idx) =>
+                      // An agent, a task or a file is a place in the studio;
+                      // the chip goes there. A kind or a phase is just a word.
+                      chip.tone === 'agent' || chip.tone === 'task' || chip.tone === 'file' ? (
+                        <EntityLink
+                          key={`${chip.label}-${idx}`}
+                          kind={chip.tone}
+                          id={chip.id ?? chip.label}
+                          label={chip.label}
+                          className="text-[9px]"
+                          bare
+                        />
+                      ) : (
+                        <span
+                          key={`${chip.label}-${idx}`}
+                          className={clsx(
+                            'rounded px-1.5 py-0.5 font-sans text-[9px] font-semibold',
+                            chip.tone === 'kind' && 'bg-sky-50 text-sky-600 dark:bg-sky-950/40 dark:text-sky-300',
+                            (!chip.tone || chip.tone === 'phase') && 'bg-gray-100 text-gray-500 dark:bg-gray-800 dark:text-gray-400',
+                          )}
+                        >
+                          {chip.label}
+                        </span>
+                      ),
+                    )}
                   </div>
 
                   <div className="mt-1 font-sans text-sm font-semibold leading-snug text-gray-800 dark:text-gray-100">
@@ -261,11 +303,115 @@ function EventLog({ events, summary }: EventLogProps) {
             </div>
           );
         })}
+        {win.end < displayEvents.length && <div style={{ height: win.bottom }} aria-hidden="true" />}
       </div>
     </div>
   );
 }
 
+// ── Windowing ────────────────────────────────────────────────────────────
+
+interface RowWindow {
+  start: number;
+  end: number;
+  /** Spacer heights standing in for the rows not rendered, px. */
+  top: number;
+  bottom: number;
+}
+
+/**
+ * useRowWindow picks the slice of rows worth rendering: the ones the scroll
+ * container can show, plus WINDOW_MARGIN either side. Row height starts as a
+ * guess and is corrected from what actually renders. When the container is
+ * at its bottom as rows are appended, the window jumps to the new tail at
+ * once — in a layout effect, before paint — so the stick-to-bottom scroll
+ * that follows lands on real rows rather than on a spacer.
+ */
+function useRowWindow(scrollRef: RefObject<HTMLElement | null> | undefined, listRef: RefObject<HTMLDivElement | null>, count: number): RowWindow {
+  const active = !!scrollRef && count >= WINDOW_FROM;
+  const rowPx = useRef(ROW_PX_GUESS);
+  const atBottom = useRef(true);
+  const [range, setRange] = useState<{ start: number; end: number }>({ start: 0, end: count });
+
+  const measure = (): { start: number; end: number } | null => {
+    const el = scrollRef?.current;
+    const list = listRef.current;
+    if (!el || !list) return null;
+    const listTop = list.getBoundingClientRect().top - el.getBoundingClientRect().top + el.scrollTop;
+    const px = rowPx.current;
+    const first = Math.floor((el.scrollTop - listTop) / px);
+    const last = Math.ceil((el.scrollTop - listTop + el.clientHeight) / px);
+    return {
+      start: Math.max(0, Math.min(count, first - WINDOW_MARGIN)),
+      end: Math.max(0, Math.min(count, last + WINDOW_MARGIN)),
+    };
+  };
+  const measureRef = useRef(measure);
+  measureRef.current = measure;
+
+  // Correct the row estimate from the rows that did render.
+  useLayoutEffect(() => {
+    if (!active) return;
+    const list = listRef.current;
+    if (!list) return;
+    const rows = list.querySelectorAll<HTMLElement>('[data-row]');
+    if (rows.length < 4) return;
+    let sum = 0;
+    rows.forEach((r) => {
+      sum += r.offsetHeight + 2;
+    });
+    const avg = sum / rows.length;
+    if (avg > 8 && Math.abs(avg - rowPx.current) / rowPx.current > 0.1) rowPx.current = avg;
+  });
+
+  // Scroll and resize move the window; both are cheap since the range only
+  // changes state when its bounds do.
+  useEffect(() => {
+    const el = scrollRef?.current;
+    if (!active || !el) return undefined;
+    const apply = () => {
+      atBottom.current = el.scrollHeight - el.scrollTop - el.clientHeight <= 72;
+      const next = measureRef.current();
+      if (!next) return;
+      setRange((prev) => (prev.start === next.start && prev.end === next.end ? prev : next));
+    };
+    apply();
+    el.addEventListener('scroll', apply, { passive: true });
+    const ro = typeof ResizeObserver !== 'undefined' ? new ResizeObserver(apply) : null;
+    ro?.observe(el);
+    return () => {
+      el.removeEventListener('scroll', apply);
+      ro?.disconnect();
+    };
+  }, [active, scrollRef]);
+
+  // New rows: keep the tail in view when the reader is at the bottom.
+  useLayoutEffect(() => {
+    if (!active) return;
+    const el = scrollRef?.current;
+    if (!el) return;
+    if (atBottom.current) {
+      const visibleRows = Math.ceil(el.clientHeight / rowPx.current);
+      const next = { start: Math.max(0, count - visibleRows - WINDOW_MARGIN * 2), end: count };
+      setRange((prev) => (prev.start === next.start && prev.end === next.end ? prev : next));
+    } else {
+      const next = measureRef.current();
+      if (next) setRange((prev) => (prev.start === next.start && prev.end === next.end ? prev : next));
+    }
+  }, [active, count, scrollRef]);
+
+  if (!active) return { start: 0, end: count, top: 0, bottom: 0 };
+  const start = Math.min(range.start, count);
+  const end = Math.min(Math.max(range.end, start), count);
+  return { start, end, top: start * rowPx.current, bottom: (count - end) * rowPx.current };
+}
+
+// ── Per-event work, done once ────────────────────────────────────────────
+
+const VIEW_CACHE = new WeakMap<RunEvent, EventView>();
+const LEVEL_CACHE = new WeakMap<RunEvent, string>();
+const SIGNATURE_CACHE = new WeakMap<RunEvent, string>();
+
 function compactAdjacentEvents(events: RunEvent[]): DisplayEvent[] {
   const out: DisplayEvent[] = [];
   for (const event of events) {
@@ -281,7 +427,16 @@ function compactAdjacentEvents(events: RunEvent[]): DisplayEvent[] {
   return out;
 }
 
-function eventLevel(event: RunEvent) {
+/** The level of an event, computed once per event object. */
+function eventLevel(event: RunEvent): string {
+  const hit = LEVEL_CACHE.get(event);
+  if (hit !== undefined) return hit;
+  const lvl = computeEventLevel(event);
+  LEVEL_CACHE.set(event, lvl);
+  return lvl;
+}
+
+function computeEventLevel(event: RunEvent) {
   const configured = event.level || 'info';
   if (configured !== 'info') return configured;
   const text = `${event.phase || ''} ${event.kind || ''} ${event.message || ''} ${event.output || ''}`.toLowerCase();
@@ -304,7 +459,15 @@ function eventLevel(event: RunEvent) {
   return configured;
 }
 
-function eventSignature(event: RunEvent) {
+function eventSignature(event: RunEvent): string {
+  const hit = SIGNATURE_CACHE.get(event);
+  if (hit !== undefined) return hit;
+  const sig = computeSignature(event);
+  SIGNATURE_CACHE.set(event, sig);
+  return sig;
+}
+
+function computeSignature(event: RunEvent) {
   return [
     event.phase || '',
     event.kind || '',
@@ -317,7 +480,16 @@ function eventSignature(event: RunEvent) {
   ].join('|');
 }
 
+/** The row's description, computed once per event object. */
 function describeEvent(event: RunEvent): EventView {
+  const hit = VIEW_CACHE.get(event);
+  if (hit) return hit;
+  const view = computeView(event);
+  VIEW_CACHE.set(event, view);
+  return view;
+}
+
+function computeView(event: RunEvent): EventView {
   const msg = cleanEventText(event.message || '');
   const output = cleanEventText(event.output || '');
   const lower = `${event.phase || ''} ${event.kind || ''} ${msg} ${output}`.toLowerCase();
@@ -489,9 +661,9 @@ function actorLabel(event: RunEvent) {
 
 function eventChips(event: RunEvent, file?: string) {
   const chips: EventView['chips'] = [];
-  if (event.agent) chips.push({ label: `@${event.agent}`, tone: 'agent' });
-  if (event.task_id) chips.push({ label: `#${event.task_id}`, tone: 'task' });
-  if (file) chips.push({ label: file, tone: 'file' });
+  if (event.agent) chips.push({ label: `@${event.agent}`, tone: 'agent', id: event.agent });
+  if (event.task_id) chips.push({ label: `#${event.task_id}`, tone: 'task', id: event.task_id });
+  if (file) chips.push({ label: file, tone: 'file', id: file });
   if (event.kind && event.kind !== 'phase') chips.push({ label: event.kind, tone: 'kind' });
   return chips.slice(0, 5);
 }
@@ -822,107 +994,174 @@ function TopList({ label, values, empty }: { label: string; values: { name: stri
   );
 }
 
-function summarizeEvents(events: RunEvent[]): RunEventSummary {
-  const phases = new Map<string, number>();
-  const agents = new Map<string, number>();
-  const models = new Map<string, number>();
-  const tasks = new Set<string>();
-  let retries = 0;
-  let replans = 0;
-  let failures = 0;
-  let warnings = 0;
-  let errors = 0;
-  let toolCalls = 0;
-  let shellCalls = 0;
-  let tokens = 0;
-  let costUSD = 0;
-  let first = 0;
-  let last = 0;
-  const insights: RunEventSummary['insights'] = [];
-  const actions: NonNullable<RunEventSummary['actions']> = [];
-  let providerIssue = false;
-  let modelIssue = false;
-  let qaIssue = false;
-  let contextIssue = false;
-  let permissionIssue = false;
+/** The running totals behind the insight panel. Folded per event; finished per render. */
+interface SummaryAcc {
+  count: number;
+  phases: Map<string, number>;
+  agents: Map<string, number>;
+  models: Map<string, number>;
+  tasks: Set<string>;
+  retries: number;
+  replans: number;
+  failures: number;
+  warnings: number;
+  errors: number;
+  toolCalls: number;
+  shellCalls: number;
+  tokens: number;
+  costUSD: number;
+  first: number;
+  last: number;
+  failureInsights: NonNullable<RunEventSummary['insights']>;
+  providerIssue: boolean;
+  modelIssue: boolean;
+  qaIssue: boolean;
+  contextIssue: boolean;
+  permissionIssue: boolean;
+  terminalSuccess: boolean;
+  final: RunEvent | null;
+}
 
-  for (const event of events) {
-    if (event.phase) phases.set(event.phase, (phases.get(event.phase) || 0) + 1);
-    if (event.agent) agents.set(event.agent, (agents.get(event.agent) || 0) + 1);
-    if (event.model) models.set(event.model, (models.get(event.model) || 0) + 1);
-    if (event.task_id) tasks.add(event.task_id);
-    if (typeof event.tokens === 'number' && event.tokens > 0) tokens += event.tokens;
-    if (typeof event.cost_usd === 'number' && event.cost_usd > 0) costUSD += event.cost_usd;
-    const t = Date.parse(event.time || '');
-    if (!Number.isNaN(t)) {
-      if (!first) first = t;
-      last = t;
-    }
-    const text = `${event.phase || ''} ${event.kind || ''} ${event.message || ''} ${event.output || ''}`.toLowerCase();
-    if (text.includes('retry') || text.includes('corrective')) retries += 1;
-    if (text.includes('replan') || text.includes('plan was revised')) replans += 1;
-    if (text.includes('warn') || text.includes('degraded')) warnings += 1;
-    if (text.includes('error') || text.includes('panic') || text.includes('exception')) errors += 1;
-    if ((event.kind || '').includes('tool')) toolCalls += 1;
-    if ((event.kind || '').includes('shell') || text.includes('shell')) shellCalls += 1;
-    providerIssue ||= looksLikeProviderIssue(text);
-    modelIssue ||= looksLikeModelIssue(text);
-    qaIssue ||= looksLikeQAIssue(text);
-    contextIssue ||= looksLikeContextIssue(text);
-    permissionIssue ||= looksLikePermissionIssue(text);
-    if ((event.kind || '').includes('fail') || event.phase === 'error' || text.includes('failed') || text.includes('timeout') || text.includes('blocked')) {
-      failures += 1;
-      if (insights.length < 4) {
-        insights.push({
-          severity: 'error',
-          title: 'Failure event',
-          detail: truncate(event.message || event.output || 'Failure detected in event log.', 220),
-          phase: event.phase,
-          task_id: event.task_id,
-          agent: event.agent,
-          time: event.time,
-        });
-      }
+function newSummaryAcc(): SummaryAcc {
+  return {
+    count: 0,
+    phases: new Map(),
+    agents: new Map(),
+    models: new Map(),
+    tasks: new Set(),
+    retries: 0,
+    replans: 0,
+    failures: 0,
+    warnings: 0,
+    errors: 0,
+    toolCalls: 0,
+    shellCalls: 0,
+    tokens: 0,
+    costUSD: 0,
+    first: 0,
+    last: 0,
+    failureInsights: [],
+    providerIssue: false,
+    modelIssue: false,
+    qaIssue: false,
+    contextIssue: false,
+    permissionIssue: false,
+    terminalSuccess: false,
+    final: null,
+  };
+}
+
+function foldSummary(acc: SummaryAcc, event: RunEvent): void {
+  acc.count += 1;
+  acc.final = event;
+  if (event.phase) acc.phases.set(event.phase, (acc.phases.get(event.phase) || 0) + 1);
+  if (event.agent) acc.agents.set(event.agent, (acc.agents.get(event.agent) || 0) + 1);
+  if (event.model) acc.models.set(event.model, (acc.models.get(event.model) || 0) + 1);
+  if (event.task_id) acc.tasks.add(event.task_id);
+  if (typeof event.tokens === 'number' && event.tokens > 0) acc.tokens += event.tokens;
+  if (typeof event.cost_usd === 'number' && event.cost_usd > 0) acc.costUSD += event.cost_usd;
+  const t = Date.parse(event.time || '');
+  if (!Number.isNaN(t)) {
+    if (!acc.first) acc.first = t;
+    acc.last = t;
+  }
+  const text = `${event.phase || ''} ${event.kind || ''} ${event.message || ''} ${event.output || ''}`.toLowerCase();
+  if (text.includes('retry') || text.includes('corrective')) acc.retries += 1;
+  if (text.includes('replan') || text.includes('plan was revised')) acc.replans += 1;
+  if (text.includes('warn') || text.includes('degraded')) acc.warnings += 1;
+  if (text.includes('error') || text.includes('panic') || text.includes('exception')) acc.errors += 1;
+  if ((event.kind || '').includes('tool')) acc.toolCalls += 1;
+  if ((event.kind || '').includes('shell') || text.includes('shell')) acc.shellCalls += 1;
+  acc.providerIssue ||= looksLikeProviderIssue(text);
+  acc.modelIssue ||= looksLikeModelIssue(text);
+  acc.qaIssue ||= looksLikeQAIssue(text);
+  acc.contextIssue ||= looksLikeContextIssue(text);
+  acc.permissionIssue ||= looksLikePermissionIssue(text);
+  acc.terminalSuccess ||= isTerminalSuccess(event);
+  if ((event.kind || '').includes('fail') || event.phase === 'error' || text.includes('failed') || text.includes('timeout') || text.includes('blocked')) {
+    acc.failures += 1;
+    if (acc.failureInsights.length < 4) {
+      acc.failureInsights.push({
+        severity: 'error',
+        title: 'Failure event',
+        detail: truncate(event.message || event.output || 'Failure detected in event log.', 220),
+        phase: event.phase,
+        task_id: event.task_id,
+        agent: event.agent,
+        time: event.time,
+      });
     }
   }
+}
 
+function finishSummary(acc: SummaryAcc): RunEventSummary {
+  const { retries, replans, count } = acc;
+  const insights: NonNullable<RunEventSummary['insights']> = [...acc.failureInsights];
+  const actions: NonNullable<RunEventSummary['actions']> = [];
   if (replans > 0) insights.push({ severity: 'info', title: 'Plan was revised', detail: `${replans} replan signal${replans === 1 ? '' : 's'} detected.` });
   if (retries >= 3) insights.push({ severity: 'warning', title: 'High retry pressure', detail: `${retries} retry signals detected; consider narrowing scope or using a larger local model.` });
-  if (events.length > 0 && !hasTerminalSuccess(events)) insights.push({ severity: 'warning', title: 'No successful terminal event', detail: 'The visible event window has no clear run_done marker.' });
-  if (providerIssue) actions.push({ title: 'Check the model endpoint', detail: 'The timeline looks like a provider or local runtime connectivity failure.', command: 'slmcode doctor' });
-  if (modelIssue) actions.push({ title: 'Verify the configured model', detail: 'The selected model may not be served by the current endpoint.', command: 'slmcode stack list' });
-  if (contextIssue || retries >= 3) actions.push({ title: 'Shrink the next attempt', detail: 'Use Request Replan or split the request into fewer files/tasks for the local model.' });
-  if (qaIssue) actions.push({ title: 'Run the project QA gate', detail: 'A test/build/lint gate appears to be the blocker.', command: 'slmcode status' });
-  if (permissionIssue) actions.push({ title: 'Review command permissions', detail: 'A shell or filesystem guardrail may have stopped execution.', command: 'slmcode config show' });
-  if (events.length > 0 && !hasTerminalSuccess(events) && actions.length === 0) actions.push({ title: 'Inspect the final phase', detail: 'The run did not record a clean terminal event; open the last error/output row before resuming.' });
-
-  const final = events[events.length - 1];
+  if (count > 0 && !acc.terminalSuccess) insights.push({ severity: 'warning', title: 'No successful terminal event', detail: 'The visible event window has no clear run_done marker.' });
+  if (acc.providerIssue) actions.push({ title: 'Check the model endpoint', detail: 'The timeline looks like a provider or local runtime connectivity failure.', command: 'slmcode doctor' });
+  if (acc.modelIssue) actions.push({ title: 'Verify the configured model', detail: 'The selected model may not be served by the current endpoint.', command: 'slmcode stack list' });
+  if (acc.contextIssue || retries >= 3) actions.push({ title: 'Shrink the next attempt', detail: 'Use Request Replan or split the request into fewer files/tasks for the local model.' });
+  if (acc.qaIssue) actions.push({ title: 'Run the project QA gate', detail: 'A test/build/lint gate appears to be the blocker.', command: 'slmcode status' });
+  if (acc.permissionIssue) actions.push({ title: 'Review command permissions', detail: 'A shell or filesystem guardrail may have stopped execution.', command: 'slmcode config show' });
+  if (count > 0 && !acc.terminalSuccess && actions.length === 0) actions.push({ title: 'Inspect the final phase', detail: 'The run did not record a clean terminal event; open the last error/output row before resuming.' });
+
+  const final = acc.final;
   return {
-    total_events: events.length,
-    started_at: first ? new Date(first).toISOString() : undefined,
-    last_at: last ? new Date(last).toISOString() : undefined,
-    duration_ms: first && last ? last - first : undefined,
+    total_events: count,
+    started_at: acc.first ? new Date(acc.first).toISOString() : undefined,
+    last_at: acc.last ? new Date(acc.last).toISOString() : undefined,
+    duration_ms: acc.first && acc.last ? acc.last - acc.first : undefined,
     final_phase: final?.phase,
     final_kind: final?.kind,
     last_message: final?.message,
-    phases: rankCounts(phases, 16),
-    agents: rankCounts(agents, 12),
-    models: rankCounts(models, 8),
-    tasks: tasks.size,
+    phases: rankCounts(acc.phases, 16),
+    agents: rankCounts(acc.agents, 12),
+    models: rankCounts(acc.models, 8),
+    tasks: acc.tasks.size,
     retries,
     replans,
-    failures,
-    warnings,
-    errors,
-    tool_calls: toolCalls,
-    shell_calls: shellCalls,
-    tokens,
-    cost_usd: costUSD,
+    failures: acc.failures,
+    warnings: acc.warnings,
+    errors: acc.errors,
+    tool_calls: acc.toolCalls,
+    shell_calls: acc.shellCalls,
+    tokens: acc.tokens,
+    cost_usd: acc.costUSD,
     insights: insights.slice(0, 8),
     actions: actions.slice(0, 5),
   };
 }
 
+/**
+ * The log only ever grows by appending (the stream hook trims the head when
+ * it passes its cap, and clears it on run_start), so the summary can fold
+ * just the tail since last time: same first event and no fewer events means
+ * the prefix is what we already counted. Anything else starts over.
+ */
+function useIncrementalSummary(events: RunEvent[]): RunEventSummary {
+  const memo = useRef<{ events: RunEvent[]; acc: SummaryAcc; out: RunEventSummary } | null>(null);
+  return useMemo(() => {
+    const prev = memo.current;
+    if (prev && prev.events === events) return prev.out;
+    let acc: SummaryAcc;
+    let from = 0;
+    const sameHead = prev && prev.events.length > 0 && events.length >= prev.events.length && events[0] === prev.events[0] && events[prev.events.length - 1] === prev.events[prev.events.length - 1];
+    if (prev && sameHead) {
+      acc = prev.acc;
+      from = prev.events.length;
+    } else {
+      acc = newSummaryAcc();
+    }
+    for (let i = from; i < events.length; i++) foldSummary(acc, events[i]);
+    const out = finishSummary(acc);
+    memo.current = { events, acc, out };
+    return out;
+  }, [events]);
+}
+
 function rankCounts(counts: Map<string, number>, limit: number) {
   return [...counts.entries()]
     .map(([name, count]) => ({ name, count }))
@@ -930,8 +1169,8 @@ function rankCounts(counts: Map<string, number>, limit: number) {
     .slice(0, limit);
 }
 
-function hasTerminalSuccess(events: RunEvent[]) {
-  return events.some((event) => event.kind === 'run_done' || event.kind === 'run_end' || (event.phase === 'done' && !String(event.message || '').toLowerCase().includes('stop')));
+function isTerminalSuccess(event: RunEvent) {
+  return event.kind === 'run_done' || event.kind === 'run_end' || (event.phase === 'done' && !String(event.message || '').toLowerCase().includes('stop'));
 }
 
 function looksLikeProviderIssue(text: string) {
diff --git a/web/src/components/Live/LiveTaskPanel.tsx b/web/src/components/Live/LiveTaskPanel.tsx
index ee3e938..1da6809 100644
--- a/web/src/components/Live/LiveTaskPanel.tsx
+++ b/web/src/components/Live/LiveTaskPanel.tsx
@@ -111,8 +111,19 @@ function timeAgo(iso: string): string {
   return `${d}d ago`;
 }
 
+// ── Props ──
+export interface LiveTaskPanelProps {
+  /**
+   * A task the Live floor asked to be shown: the rail should scroll to its
+   * card and flash it. Set by LiveView when a ticket is picked on the floor or
+   * when the page opens with ?task=ID. Accepted and not yet acted on.
+   */
+  focusTaskId?: string;
+}
+
 // ── Component ──
-export default function LiveTaskPanel() {
+export default function LiveTaskPanel({ focusTaskId }: LiveTaskPanelProps = {}) {
+  void focusTaskId;
   // ── App context ──
   const ctx = useContext(AppContext);
   const config = ctx?.config;
diff --git a/web/src/components/Live/LiveView.tsx b/web/src/components/Live/LiveView.tsx
index a97afa8..ea2451c 100644
--- a/web/src/components/Live/LiveView.tsx
+++ b/web/src/components/Live/LiveView.tsx
@@ -1,4 +1,5 @@
-import { useState, useEffect, useRef, useContext, useMemo } from 'react';
+import { useState, useEffect, useRef, useContext, useMemo, useCallback } from 'react';
+import { useSearchParams } from 'react-router-dom';
 import {
   AlertTriangle,
   Bot,
@@ -20,16 +21,12 @@ import {
   getTeams,
   getInterruptedRuns,
   resumeRun,
-  getSquads,
-  getTasks,
 } from '@/api/client';
 import type {
   AgentSpec,
   PipelineView,
   DynamicComposition,
   InterruptedRun,
-  SquadsView,
-  Task,
   TeamSpec,
 } from '@/types';
 import TeamPicker from './TeamPicker';
@@ -41,10 +38,13 @@ import ActivityRail from './ActivityRail';
 import type { RailView } from './ActivityRail';
 import TeamFloor from './floor/TeamFloor';
 import { buildFloor } from './floor/floorModel';
+import type { FloorSelection } from './floor/floorShared';
 import ResizeHandle from '@/components/ui/ResizeHandle';
 import { useToast } from '@/components/ui/Toast';
 import { FOCUS_PROMPT_EVENT } from '@/hooks/useKeyboard';
 import { usePersistentState, useMediaQuery } from '@/hooks/useUiState';
+import { useBoardStore } from '@/hooks/useBoardStore';
+import { EMPTY_DERIVED } from '@/hooks/runDerived';
 import clsx from 'clsx';
 
 /**
@@ -94,6 +94,10 @@ export default function LiveView() {
   // is a pure consumer — it holds no EventSource and no event state of its own,
   // which is what made the log collapse to a single entry before.
   const events = useMemo(() => ctx?.liveEvents ?? [], [ctx?.liveEvents]);
+  // What the log adds up to, folded once per event by the stream hook. This
+  // view used to recompute all of it — phases seen, the active agent, the task
+  // count, the newest composition — with seven scans of the log per flush.
+  const derived = ctx?.liveDerived ?? EMPTY_DERIVED;
   const running = ctx?.liveRunning ?? false;
   const setRunning = ctx?.setLiveRunning ?? (() => {});
   const resetEvents = ctx?.resetLiveEvents ?? (() => {});
@@ -106,15 +110,14 @@ export default function LiveView() {
   const [railView, setRailView] = usePersistentState<RailView>('live.rail.view', 'log');
   const [railWidth, setRailWidth] = usePersistentState('live.rail.width', RAIL_DEFAULT_PX);
   // The org chart and the board, so the floor can draw the teams, their
-  // tickets and which team the running task belongs to. Polled with the run
-  // rather than once: a run that assembles teams does so several phases in,
-  // long after this component mounted, and the board grows with every wave.
-  const [squads, setSquads] = useState<SquadsView | null>(null);
-  const [tasks, setTasks] = useState<Task[]>([]);
-  // True once the org chart and the board have been asked for at least once:
-  // the floor stays empty until then, so the first thing drawn is the real
-  // floor and not a crew table that the teams then replace.
-  const [boardReady, setBoardReady] = useState(false);
+  // tickets and which team the running task belongs to. From the shared board
+  // store: seeded once, kept current by the stream's task_update events, and
+  // refreshed on both edges of a run — this view used to poll both every 5 s.
+  // `ready` is true once both have been asked for at least once: the floor
+  // stays empty until then, so the first thing drawn is the real floor and
+  // not a crew table that the teams then replace.
+  const board = useBoardStore();
+  const { squads, tasks, ready: boardReady } = board;
   // The rail is a column on a wide viewport and a full-height OVERLAY below it,
   // so its default cannot be the same on both: opening it by default on a phone
   // means the first thing a user sees is the task drawer covering the console
@@ -127,6 +130,60 @@ export default function LiveView() {
   useEffect(() => {
     setRailOpen(isWide);
   }, [isWide]);
+
+  // ── What is selected on the floor lives in the URL ──
+  //
+  // ?task=ID opens a ticket's dossier, ?agent=ID a person's, either with an
+  // optional &team=ID. The URL rather than component state so a dossier
+  // survives navigating away and back, survives a reload, and can be linked
+  // to: every task chip in the log, the ticker and the board points here.
+  // Written with `replace`, so clicking around the floor does not fill the
+  // history with one entry per dossier.
+  const [searchParams, setSearchParams] = useSearchParams();
+  const selection = useMemo<FloorSelection>(() => {
+    const task = searchParams.get('task');
+    const agent = searchParams.get('agent');
+    const team = searchParams.get('team') ?? '';
+    if (task) return { kind: 'ticket', id: task, team };
+    if (agent) return { kind: 'agent', id: agent, team };
+    return null;
+  }, [searchParams]);
+  const setSelection = useCallback(
+    (sel: FloorSelection) => {
+      setSearchParams(
+        (prev) => {
+          const next = new URLSearchParams(prev);
+          next.delete('task');
+          next.delete('agent');
+          next.delete('team');
+          if (sel) {
+            next.set(sel.kind === 'ticket' ? 'task' : 'agent', sel.id);
+            if (sel.team) next.set('team', sel.team);
+          }
+          return next;
+        },
+        { replace: true },
+      );
+    },
+    [setSearchParams],
+  );
+  // The task the Tasks rail should scroll to and flash: the selected ticket,
+  // or whatever "open in Tasks" was last pressed for.
+  const [focusTaskId, setFocusTaskId] = useState<string | undefined>(() => searchParams.get('task') ?? undefined);
+  useEffect(() => {
+    if (selection?.kind === 'ticket') setFocusTaskId(selection.id);
+  }, [selection]);
+  // Arriving with ?task=ID in the URL (a link from the board or the log) means
+  // "show me this task": the rail opens on Tasks where there is room for it.
+  const arrivedWithTask = useRef(Boolean(searchParams.get('task')));
+  useEffect(() => {
+    if (!arrivedWithTask.current) return;
+    arrivedWithTask.current = false;
+    if (isWide) {
+      setRailView('tasks');
+      setRailOpen(true);
+    }
+  }, [isWide, setRailView]);
   const [agents, setAgents] = useState<AgentSpec[]>([]);
   const [specialist, setSpecialist] = useState('');
   // Teams for THIS run. Empty means the library decides from the request and
@@ -152,35 +209,6 @@ export default function LiveView() {
     return () => window.removeEventListener(FOCUS_PROMPT_EVENT, focus);
   }, []);
 
-  // The org chart, refreshed while a run is going and once when it stops.
-  //
-  // Polled slowly on purpose: it is written once, at charter, and everything
-  // downstream reads it unchanged. A fast poll would spend a request every
-  // second re-fetching a file that has not moved.
-  useEffect(() => {
-    let alive = true;
-    // Both halves land together: the floor decides between "teams" and
-    // "one crew" from the org chart, so tickets arriving a beat before the
-    // chart would draw every ticket on one crew table for a frame and then
-    // redraw it as teams. One settled pair, one paint.
-    const load = () => {
-      Promise.allSettled([getSquads(), getTasks()]).then(([chart, board]) => {
-        if (!alive) return;
-        // No org chart is the normal state, not an error; an empty board is a fact.
-        if (chart.status === 'fulfilled') setSquads(chart.value);
-        if (board.status === 'fulfilled') setTasks(board.value?.tasks ?? []);
-        setBoardReady(true);
-      });
-    };
-    load();
-    if (!running) return () => { alive = false; };
-    const id = window.setInterval(load, 5000);
-    return () => {
-      alive = false;
-      window.clearInterval(id);
-    };
-  }, [running]);
-
   // Refresh the resumable-run list whenever a run finishes.
   useEffect(() => {
     if (running) return;
@@ -193,13 +221,13 @@ export default function LiveView() {
 
   // A fresh run clears the composition panels; the log itself is reset by the
   // stream hook when the server emits `run_start`.
-  const lastRunStart = events.length > 0 ? events[events.length - 1] : null;
+  const lastEvent = derived.last;
   useEffect(() => {
-    if (lastRunStart?.kind === 'run_start') {
+    if (lastEvent?.kind === 'run_start') {
       setPersistedComposition(null);
       setPersistedCompositionError('');
     }
-  }, [lastRunStart]);
+  }, [lastEvent]);
 
   useEffect(() => {
     getAgents().then(setAgents).catch(() => {});
@@ -320,13 +348,10 @@ export default function LiveView() {
 
   // ── Derived run state ──
 
-  const dynamicComposition = useMemo<DynamicComposition | null>(() => {
-    for (let i = events.length - 1; i >= 0; i--) {
-      const ev = events[i];
-      if (ev.kind === 'composition' && ev.data) return ev.data;
-    }
-    return running ? null : persistedComposition;
-  }, [events, persistedComposition, running]);
+  const dynamicComposition = useMemo<DynamicComposition | null>(
+    () => derived.composition ?? (running ? null : persistedComposition),
+    [derived.composition, persistedComposition, running],
+  );
 
   const shownComposition = dynamicComposition || (!running ? compositionPreview : null);
   const shownCompositionMode: '' | 'runtime' | 'preview' = dynamicComposition
@@ -371,20 +396,8 @@ export default function LiveView() {
     [groups, dynamicPhaseOrder],
   );
 
-  const seenPhases = useMemo(() => {
-    const set = new Set<string>();
-    for (const e of events) {
-      if (e.phase) set.add(e.phase);
-    }
-    return set;
-  }, [events]);
-
-  const activePhase = useMemo(() => {
-    for (let i = events.length - 1; i >= 0; i--) {
-      if (events[i].phase) return events[i].phase;
-    }
-    return null;
-  }, [events]);
+  const seenPhases = derived.phaseSet;
+  const activePhase = derived.activePhase;
 
   const phaseStateMap = useMemo<Record<string, PhaseState>>(() => {
     const map: Record<string, PhaseState> = {};
@@ -405,12 +418,7 @@ export default function LiveView() {
     return map;
   }, [allPhases, activePhase, seenPhases]);
 
-  const activeAgentId = useMemo(() => {
-    for (let i = events.length - 1; i >= 0; i--) {
-      if (events[i].agent) return events[i].agent;
-    }
-    return null;
-  }, [events]);
+  const activeAgentId = derived.activeAgent;
 
   const activeAgentSpec = useMemo(
     () => (activeAgentId ? agents.find((a) => a.id === activeAgentId) || null : null),
@@ -422,13 +430,8 @@ export default function LiveView() {
     [agents, specialist],
   );
 
-  const taskCount = useMemo(() => {
-    const ids = new Set<string>();
-    for (const e of events) {
-      if (e.task_id) ids.add(e.task_id);
-    }
-    return ids.size;
-  }, [events]);
+  const taskCount = derived.taskIds.size;
+  const totals = useMemo(() => ({ tokens: derived.tokens, cost: derived.cost }), [derived.tokens, derived.cost]);
 
   // The floor: everything the stage draws, derived once per change.
   const floor = useMemo(
@@ -439,11 +442,17 @@ export default function LiveView() {
     [boardReady, squads, tasks, events, shownComposition, running],
   );
 
-  // Picking a ticket on the floor opens it in the rail's task list.
-  const focusTicket = () => {
-    setRailView('tasks');
-    setRailOpen(true);
-  };
+  // "Open in Tasks" from a dossier: the rail opens on Tasks, scrolled to the
+  // ticket. The id used to be dropped on the way, so the rail opened on the
+  // top of the list whatever was clicked.
+  const focusTicket = useCallback(
+    (id: string) => {
+      setFocusTaskId(id);
+      setRailView('tasks');
+      setRailOpen(true);
+    },
+    [setRailView],
+  );
 
   return (
     <div className="flex h-full min-h-0 flex-col overflow-hidden bg-gray-50/70 dark:bg-gray-950">
@@ -629,13 +638,21 @@ export default function LiveView() {
       <div className="flex min-h-0 flex-1 overflow-hidden">
         <main className="flex min-h-0 min-w-0 flex-1 flex-col overflow-hidden">
           <div className="relative min-h-0 flex-1">
-            <TeamFloor floor={floor} running={running} events={events} onTicket={focusTicket} />
+            <TeamFloor
+              floor={floor}
+              running={running}
+              events={events}
+              onTicket={focusTicket}
+              selection={selection}
+              onSelect={setSelection}
+            />
           </div>
           {/* What is happening RIGHT NOW, pinned under the floor as a ticker.
               On a local 30B the next log line can be four minutes out, and a
               clock that keeps moving is the difference between "thinking" and
-              "hung". */}
-          <NowBar events={events} running={running} squads={squads} />
+              "hung". Who is working comes from the floor's own reading of the
+              log, so the clock stops when the floor says nobody is. */}
+          <NowBar events={events} running={running} squads={squads} now={floor.now} totals={totals} />
         </main>
 
         {/* The rail is a column at ≥1024px and a full-height OVERLAY below it.
@@ -677,6 +694,8 @@ export default function LiveView() {
                 onView={setRailView}
                 overlay={!isWide}
                 onClose={() => setRailOpen(false)}
+                derived={derived}
+                focusTaskId={focusTaskId}
               />
             </aside>
           </>
diff --git a/web/src/components/Live/NowBar.test.tsx b/web/src/components/Live/NowBar.test.tsx
index 14ae133..a79f00d 100644
--- a/web/src/components/Live/NowBar.test.tsx
+++ b/web/src/components/Live/NowBar.test.tsx
@@ -94,6 +94,47 @@ describe('NowBar', () => {
     expect(screen.getByTitle(/4,600 tokens this run/)).toBeInTheDocument();
   });
 
+  // The clock keys on the floor's working set. A worker whose agent_end has
+  // arrived is finished, whatever the newest line names; the bar says nobody
+  // is working and stops counting, instead of timing a step that is over.
+  it('stops the clock once the working agent has ended', () => {
+    render(
+      <NowBar
+        events={[
+          at(40, { agent: 'go-worker', task_id: 'T1', message: 'writing the handler' }),
+          at(10, { agent: 'go-worker', task_id: 'T1', kind: 'agent_end', message: 'worker finished' }),
+        ]}
+        running
+        squads={null}
+      />,
+    );
+    const bar = screen.getByTestId('now-bar');
+    expect(bar).toHaveAttribute('data-working', 'false');
+    expect(bar).toHaveTextContent(/nobody is working/);
+    expect(screen.queryByTitle(/A local 30B routinely takes minutes/)).not.toBeInTheDocument();
+    expect(screen.queryByText('@go-worker')).not.toBeInTheDocument();
+  });
+
+  // The floor's own reading wins when the page passes it: one read of the log
+  // per flush, and the ticker and the floor never disagree about who is on.
+  it('uses the floor model’s now when given one, and links it', () => {
+    render(
+      <NowBar
+        events={[at(5, { agent: 'planner' })]}
+        running
+        squads={squads}
+        now={{ agent: 'go-worker', task: 'T1', team: 'backend-go', message: 'from the floor', model: 'm', since: Date.now() - 12_000 }}
+        totals={{ tokens: 2500, cost: 0 }}
+      />,
+    );
+    expect(screen.getByText('@go-worker').closest('a')).toHaveAttribute('href', '/?agent=go-worker&team=backend-go');
+    expect(screen.getByText('T1').closest('a')).toHaveAttribute('href', '/?task=T1&team=backend-go');
+    expect(screen.getByText('backend-go').closest('a')).toHaveAttribute('href', '/teams?team=backend-go');
+    expect(screen.getByText('from the floor')).toBeInTheDocument();
+    expect(screen.getByText('12s')).toBeInTheDocument();
+    expect(screen.getByTitle(/2,500 tokens this run/)).toBeInTheDocument();
+  });
+
   // It is an activity indicator, not a summary. A finished run has a result
   // panel; a spinner over it would say the run is still going.
   it('shows nothing when no run is going', () => {
diff --git a/web/src/components/Live/NowBar.tsx b/web/src/components/Live/NowBar.tsx
index 5843e9d..07e4dfe 100644
--- a/web/src/components/Live/NowBar.tsx
+++ b/web/src/components/Live/NowBar.tsx
@@ -1,8 +1,10 @@
 import { useEffect, useMemo, useState } from 'react';
-import { Loader2, Cpu, ListTodo, Users, Clock, Coins } from 'lucide-react';
+import { Loader2, Cpu, Users, Clock, Coins, Hourglass } from 'lucide-react';
 import clsx from 'clsx';
 import { teamColor } from '@/components/Board/teamColor';
+import EntityLink from '@/components/shared/EntityLink';
 import type { RunEvent, SquadsView } from '@/types';
+import { nowFor, readActivity, type FloorNow } from './floor/floorModel';
 
 // ── What is happening RIGHT NOW ──────────────────────────────────────────
 //
@@ -21,147 +23,135 @@ import type { RunEvent, SquadsView } from '@/types';
 // model, and a clock that is still moving. The clock is the point — a number
 // that ticks is the difference between "thinking" and "hung", and no amount of
 // log output provides it.
+//
+// Who is "in flight" is the floor's reading of the log (floorModel's working
+// set): an agent between its agent_start and agent_end, or the newest voice.
+// It used to be "the last line that named an agent", which kept the clock
+// counting on a worker whose agent_end had already arrived — a finished step
+// timed as if it were still going. When nobody is working, the bar says so and
+// the clock stops.
 
 export interface NowBarProps {
   events: RunEvent[];
   running: boolean;
   /** The org chart, so the active task's team can be named and coloured. */
   squads?: SquadsView | null;
+  /**
+   * Who is working, from the floor model. LiveView passes the floor's own so
+   * the log is read once; left undefined, the bar reads the log itself.
+   */
+  now?: FloorNow | null;
+  /** Cumulative tokens and cost for the run, from the stream's accumulator. */
+  totals?: { tokens: number; cost: number };
 }
 
-/** What the stream says is in flight, derived from the tail of the log. */
-interface Now {
-  phase: string;
-  agent: string;
-  taskID: string;
-  message: string;
-  model: string;
-  /** When this activity started, for the elapsed clock. */
-  since: number;
-  /** Cumulative tokens and cost for the run so far. */
-  tokens: number;
-  cost: number;
-}
-
-/**
- * readNow walks the log backwards for the most recent thing that STARTED.
- *
- * Backwards, and stopping at the first agent line, because the log's own order
- * is the only ordering there is — a wave runs several agents and the last one
- * announced is the one the user is waiting on. Totals are summed forward, since
- * every event may carry usage.
- */
-function readNow(events: RunEvent[]): Now | null {
-  if (events.length === 0) return null;
-
-  let tokens = 0;
-  let cost = 0;
-  for (const e of events) {
-    tokens += e.tokens ?? 0;
-    cost += e.cost_usd ?? 0;
-  }
-
-  for (let i = events.length - 1; i >= 0; i--) {
-    const e = events[i];
-    if (!e.agent) continue;
-    return {
-      phase: e.phase || '',
-      agent: e.agent,
-      taskID: e.task_id ?? '',
-      message: e.message ?? '',
-      model: e.model ?? '',
-      since: Date.parse(e.time) || Date.now(),
-      tokens,
-      cost,
-    };
-  }
-
-  const last = events[events.length - 1];
-  return {
-    phase: last.phase || '',
-    agent: '',
-    taskID: last.task_id ?? '',
-    message: last.message ?? '',
-    model: last.model ?? '',
-    since: Date.parse(last.time) || Date.now(),
-    tokens,
-    cost,
-  };
-}
-
-export default function NowBar({ events, running, squads }: NowBarProps) {
-  const now = useMemo(() => readNow(events), [events]);
+export default function NowBar({ events, running, squads, now: nowProp, totals }: NowBarProps) {
+  // The fallback path (no floor to borrow from) reads the log the way the
+  // floor does, so both agree on who is working.
+  const ownNow = useMemo<FloorNow | null>(() => {
+    if (nowProp !== undefined) return null;
+    if (events.length === 0) return null;
+    const activity = readActivity(events);
+    return nowFor(activity, squads?.ok ? (squads.task_teams ?? {}) : {}, Date.now());
+  }, [events, nowProp, squads]);
+  const now = nowProp !== undefined ? nowProp : ownNow;
+
+  const ownTotals = useMemo(() => {
+    if (totals) return null;
+    let tokens = 0;
+    let cost = 0;
+    for (const e of events) {
+      tokens += e.tokens ?? 0;
+      cost += e.cost_usd ?? 0;
+    }
+    return { tokens, cost };
+  }, [events, totals]);
+  const sum = totals ?? ownTotals ?? { tokens: 0, cost: 0 };
+
+  const last = events.length > 0 ? events[events.length - 1] : null;
 
   // A clock that only re-renders when an event arrives is a clock that stops
   // exactly when it matters — during the four-minute gap this bar exists for.
+  // It runs only while someone is working: an idle bar has nothing to time.
+  const ticking = running && !!now;
   const [tick, setTick] = useState(() => Date.now());
   useEffect(() => {
-    if (!running) return undefined;
+    if (!ticking) return undefined;
+    setTick(Date.now());
     const id = window.setInterval(() => setTick(Date.now()), 1000);
     return () => window.clearInterval(id);
-  }, [running]);
+  }, [ticking]);
 
-  if (!running || !now) return null;
+  if (!running || !last) return null;
 
-  const seconds = Math.max(0, Math.round((tick - now.since) / 1000));
-  const team = squads?.ok
-    ? (squads.squads ?? []).find((s) => s.id === teamOfTask(squads, now.taskID))
-    : undefined;
+  const seconds = now ? Math.max(0, Math.round((tick - now.since) / 1000)) : 0;
+  const teamID = now ? now.team || teamOfTask(squads, now.task) : '';
+  const team = squads?.ok && teamID ? (squads.squads ?? []).find((s) => s.id === teamID) : undefined;
   const color = teamColor(team?.id);
+  const phase = now ? '' : last.phase || '';
 
   return (
     <div
       role="status"
       aria-live="polite"
       className="flex shrink-0 flex-wrap items-center gap-x-3 gap-y-1 border-b border-gray-200 bg-brand-50/60 px-3 py-1.5 text-[11px] dark:border-gray-800 dark:bg-brand-950/20 sm:px-4"
+      data-testid="now-bar"
+      data-working={now ? 'true' : 'false'}
     >
-      <Loader2 size={13} className="shrink-0 animate-spin text-brand-500" aria-hidden="true" />
+      {now ? (
+        <Loader2 size={13} className="shrink-0 animate-spin text-brand-500" aria-hidden="true" />
+      ) : (
+        <Hourglass size={13} className="shrink-0 text-gray-400" aria-hidden="true" />
+      )}
 
-      {now.agent && (
-        <span className="inline-flex shrink-0 items-center gap-1 font-semibold text-brand-700 dark:text-brand-300">
-          @{now.agent}
-        </span>
+      {now?.agent && (
+        <EntityLink kind="agent" id={now.agent} label={`@${now.agent}`} params={{ team: teamID || undefined }} title={`Agent ${now.agent} — open on the floor`} />
       )}
 
-      {now.taskID && (
-        <span className="inline-flex shrink-0 items-center gap-1 font-mono text-gray-600 dark:text-gray-300">
-          <ListTodo size={11} aria-hidden="true" />
-          {now.taskID}
-        </span>
+      {now?.task && (
+        <EntityLink kind="task" id={now.task} params={{ team: teamID || undefined }} title={`Task ${now.task} — open on the floor`} />
       )}
 
       {team && (
-        <span
-          className={clsx('inline-flex shrink-0 items-center gap-1 rounded px-1.5 py-0.5 font-mono font-semibold', color.badge)}
+        <EntityLink
+          kind="team"
+          id={team.id}
+          className={clsx('!border-transparent', color.badge)}
           title={`Team ${team.id}${team.manager ? ` · manager ${team.manager}` : ''}`}
-        >
-          <Users size={10} aria-hidden="true" />
-          {team.id}
-        </span>
+          label={
+            <span className="inline-flex items-center gap-1">
+              <Users size={10} aria-hidden="true" />
+              {team.id}
+            </span>
+          }
+          bare
+        />
       )}
 
       {/* The message is the only part allowed to be long, so it is the only
           part allowed to truncate. */}
-      <span className="min-w-0 flex-1 truncate text-gray-600 dark:text-gray-400" title={now.message}>
-        {now.message || `${now.phase} in progress`}
+      <span className="min-w-0 flex-1 truncate text-gray-600 dark:text-gray-400" title={now ? now.message : last.message}>
+        {now ? now.message || 'in progress' : `${phase ? `${phase}: ` : ''}nobody is working — waiting for the next step`}
       </span>
 
       {/* Everything from here is the "is it stuck" evidence. */}
-      <span
-        className={clsx(
-          'inline-flex shrink-0 items-center gap-1 font-mono tabular-nums',
-          // Past two minutes on one step, say so in a colour rather than
-          // leaving the reader to do the arithmetic. Local 30B calls really do
-          // take this long, and a user who knows that is a user who waits.
-          seconds >= 120 ? 'text-amber-600 dark:text-amber-400' : 'text-gray-500',
-        )}
-        title="Time on this step. A local 30B routinely takes minutes per call."
-      >
-        <Clock size={11} aria-hidden="true" />
-        {formatDuration(seconds)}
-      </span>
+      {now && (
+        <span
+          className={clsx(
+            'inline-flex shrink-0 items-center gap-1 font-mono tabular-nums',
+            // Past two minutes on one step, say so in a colour rather than
+            // leaving the reader to do the arithmetic. Local 30B calls really do
+            // take this long, and a user who knows that is a user who waits.
+            seconds >= 120 ? 'text-amber-600 dark:text-amber-400' : 'text-gray-500',
+          )}
+          title="Time on this step. A local 30B routinely takes minutes per call."
+        >
+          <Clock size={11} aria-hidden="true" />
+          {formatDuration(seconds)}
+        </span>
+      )}
 
-      {now.model && (
+      {now?.model && (
         <span
           className="hidden shrink-0 items-center gap-1 font-mono text-gray-400 sm:inline-flex"
           title={`Model: ${now.model}`}
@@ -171,13 +161,13 @@ export default function NowBar({ events, running, squads }: NowBarProps) {
         </span>
       )}
 
-      {now.tokens > 0 && (
+      {sum.tokens > 0 && (
         <span
           className="hidden shrink-0 items-center gap-1 font-mono tabular-nums text-gray-400 md:inline-flex"
-          title={`${now.tokens.toLocaleString()} tokens this run${now.cost > 0 ? ` · $${now.cost.toFixed(4)}` : ''}`}
+          title={`${sum.tokens.toLocaleString()} tokens this run${sum.cost > 0 ? ` · $${sum.cost.toFixed(4)}` : ''}`}
         >
           <Coins size={11} aria-hidden="true" />
-          {compactTokens(now.tokens)}
+          {compactTokens(sum.tokens)}
         </span>
       )}
     </div>
diff --git a/web/src/components/Live/floor/floorModel.ts b/web/src/components/Live/floor/floorModel.ts
index 4f6384d..d175bb1 100644
--- a/web/src/components/Live/floor/floorModel.ts
+++ b/web/src/components/Live/floor/floorModel.ts
@@ -98,6 +98,8 @@ export interface FloorNow {
   task: string;
   team: string;
   message: string;
+  /** The model that agent's line named, when it did. */
+  model: string;
   since: number;
 }
 
@@ -589,7 +591,7 @@ function facts(activity: Activity, agent: string, tickets: Set<string>): Pick<Fl
 
 // ── Reading the log ──────────────────────────────────────────────────────
 
-interface Activity {
+export interface Activity {
   /** task → the agent that most recently started on it. */
   holder: Map<string, string>;
   /** task → every agent that has touched it. */
@@ -598,6 +600,7 @@ interface Activity {
   lastAgent: string;
   lastTask: string;
   lastMessage: string;
+  lastModel: string;
   lastAt: number;
   /** Every agent that has appeared, in first-seen order. */
   speakers: string[];
@@ -614,7 +617,13 @@ interface Activity {
 /** An agent_start with no agent_end for this long is a crash, not work. */
 const WORKING_TTL_MS = 10 * 60_000;
 
-function readActivity(events: RunEvent[]): Activity {
+/**
+ * readActivity is the floor's reading of the log: who is inside an
+ * agent_start … agent_end pair right now, who spoke last, who holds which
+ * ticket. It is exported because the NowBar's clock keys on the same working
+ * set — when nobody is working, nothing is "in progress" to time.
+ */
+export function readActivity(events: RunEvent[]): Activity {
   const holder = new Map<string, string>();
   const touchedBy = new Map<string, Set<string>>();
   const seen = new Set<string>();
@@ -626,6 +635,7 @@ function readActivity(events: RunEvent[]): Activity {
   let lastAgent = '';
   let lastTask = '';
   let lastMessage = '';
+  let lastModel = '';
   let lastAt = 0;
   for (const e of events) {
     const agent = (e.agent ?? '').trim().toLowerCase();
@@ -664,28 +674,32 @@ function readActivity(events: RunEvent[]): Activity {
       if (lastAgent === agent) {
         lastAgent = '';
         lastTask = '';
+        lastModel = '';
       }
       continue;
     }
     lastAgent = agent;
     lastTask = e.task_id ?? '';
     lastMessage = e.message ?? '';
+    lastModel = e.model ?? '';
     lastAt = Date.parse(e.time) || lastAt;
     lastBy.set(agent, { message: lastMessage, at: lastAt, task: lastTask });
   }
   for (const [id, w] of working) {
     if (lastAt - w.at > WORKING_TTL_MS) working.delete(id);
   }
-  return { holder, touchedBy, lastAgent, lastTask, lastMessage, lastAt, speakers, lastBy, working, phase: cur.phase, phaseOf };
+  return { holder, touchedBy, lastAgent, lastTask, lastMessage, lastModel, lastAt, speakers, lastBy, working, phase: cur.phase, phaseOf };
 }
 
-function nowFor(activity: Activity, taskTeams: Record<string, string>, nowMs: number, crewTeam?: string): FloorNow | null {
+/** nowFor is what the floor's ticker says: who is working, on what, since when. */
+export function nowFor(activity: Activity, taskTeams: Record<string, string>, nowMs: number, crewTeam?: string): FloorNow | null {
   if (!activity.lastAgent) return null;
   return {
     agent: activity.lastAgent,
     task: activity.lastTask,
     team: crewTeam ?? (activity.lastTask ? taskTeams[activity.lastTask] ?? '' : ''),
     message: activity.lastMessage,
+    model: activity.lastModel,
     since: activity.lastAt || nowMs,
   };
 }
diff --git a/web/src/components/Sidebar.tsx b/web/src/components/Sidebar.tsx
index fa68f79..ac8e605 100644
--- a/web/src/components/Sidebar.tsx
+++ b/web/src/components/Sidebar.tsx
@@ -1,4 +1,4 @@
-import { useContext, useEffect, useState } from 'react';
+import { useContext, useState } from 'react';
 import { NavLink } from 'react-router-dom';
 import {
   LayoutDashboard,
@@ -21,8 +21,6 @@ import {
 } from 'lucide-react';
 import { AppContext } from '@/App';
 import { useMediaQuery } from '@/hooks/useUiState';
-import { getHealth } from '@/api/client';
-import type { Health } from '@/types';
 import clsx from 'clsx';
 
 interface NavItem {
@@ -55,7 +53,6 @@ const docItems: NavItem[] = [
 
 export default function Sidebar() {
   const ctx = useContext(AppContext);
-  const [liveHealth, setLiveHealth] = useState<Health | null>(null);
 
   const isDesktop = useMediaQuery('(min-width: 1024px)');
 
@@ -86,33 +83,13 @@ export default function Sidebar() {
     });
   };
 
-  // The connection truth lives in App (EventSource state + a 10s health poll);
-  // this only needs the run flag and the pending-review count, and only while
-  // the API is actually reachable.
-  useEffect(() => {
-    if (ctx?.connection === 'down') {
-      setLiveHealth(null);
-      return undefined;
-    }
-    let cancelled = false;
-    const tick = async () => {
-      try {
-        const h = await getHealth();
-        if (!cancelled) setLiveHealth(h);
-      } catch {
-        if (!cancelled) setLiveHealth(null);
-      }
-    };
-    tick();
-    const interval = setInterval(tick, 15000);
-    return () => {
-      cancelled = true;
-      clearInterval(interval);
-    };
-  }, [ctx?.connection]);
-
-  const pendingCount = liveHealth?.pending ?? 0;
-  const online = ctx ? ctx.connection === 'live' : Boolean(liveHealth?.ok);
+  // The connection truth, the run flag and the review count all live in the
+  // stream App owns: its health poll and the server's `review_pending` event.
+  // This used to run a second health poll of its own every 15 s for the same
+  // two numbers.
+  const online = ctx?.connection === 'live';
+  const pendingCount = online ? (ctx?.pendingReview ?? ctx?.health?.pending ?? 0) : 0;
+  const agentRunning = Boolean(ctx?.liveRunning) && online;
 
   const linkClass = ({ isActive }: { isActive: boolean }) =>
     clsx(
@@ -246,7 +223,7 @@ export default function Sidebar() {
           )}
 
           {/* Running indicator */}
-          {liveHealth?.running && (
+          {agentRunning && (
             <div className="flex items-center gap-2 text-xs">
               <Activity size={12} className="text-brand-500 animate-pulse" />
               <span className="text-brand-600 dark:text-brand-400 animate-pulse">
@@ -268,7 +245,7 @@ export default function Sidebar() {
             </span>
           )}
           {/* Running indicator icon only */}
-          {liveHealth?.running && (
+          {agentRunning && (
             <span title="Agent running">
               <Activity size={14} className="text-brand-500 animate-pulse" />
             </span>
diff --git a/web/src/components/Teams/TeamsView.test.tsx b/web/src/components/Teams/TeamsView.test.tsx
index eeb25ac..7e447ab 100644
--- a/web/src/components/Teams/TeamsView.test.tsx
+++ b/web/src/components/Teams/TeamsView.test.tsx
@@ -4,6 +4,7 @@ import { MemoryRouter } from 'react-router-dom';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import TeamsView from './TeamsView';
 import { ApiError } from '@/api/client';
+import BoardStoreRoot from '@/components/shared/BoardStoreRoot';
 import type { SquadsView, TeamActivity, TeamPreselect, TeamSpec, TeamsLibrary } from '@/types';
 
 const getSquads = vi.fn<() => Promise<SquadsView>>();
@@ -40,6 +41,8 @@ vi.mock('@/api/client', async () => {
     getTeamActivity: (...a: unknown[]) => getTeamActivity(...(a as [])),
     createTeamManager: (...a: unknown[]) => createTeamManager(...a),
     getSkills: async () => [],
+    // The org chart rides the board store, which reads the board alongside it.
+    getTasks: async () => ({ plan: null, tasks: [], columns: [], by_column: {} }),
   };
 });
 
@@ -143,9 +146,13 @@ beforeEach(() => {
 });
 
 async function renderPage() {
+  // The page reads the org chart from the shared board store; a test mounts
+  // one of its own the way App does.
   render(
     <MemoryRouter>
-      <TeamsView />
+      <BoardStoreRoot>
+        <TeamsView />
+      </BoardStoreRoot>
     </MemoryRouter>,
   );
   expect(await screen.findByRole('heading', { name: 'Teams' })).toBeInTheDocument();
diff --git a/web/src/components/Teams/TeamsView.tsx b/web/src/components/Teams/TeamsView.tsx
index 22e2af7..11f9b24 100644
--- a/web/src/components/Teams/TeamsView.tsx
+++ b/web/src/components/Teams/TeamsView.tsx
@@ -3,7 +3,6 @@ import type { ReactNode } from 'react';
 import { useNavigate } from 'react-router-dom';
 import { Users, Info } from 'lucide-react';
 import {
-  getSquads,
   getTeams,
   createTeam,
   updateTeam,
@@ -18,6 +17,7 @@ import {
   ApiError,
 } from '@/api/client';
 import { AppContext } from '@/App';
+import { useBoardStore } from '@/hooks/useBoardStore';
 import { useToast } from '@/components/ui/Toast';
 import { useConfirm } from '@/components/ui/Modal';
 import TeamLibrary from './TeamLibrary';
@@ -29,7 +29,6 @@ import ActiveTeams from './ActiveTeams';
 import type {
   DynamicComposition,
   Skill,
-  SquadsView,
   TeamActivity as TeamActivityData,
   TeamPreselect,
   TeamSpec,
@@ -60,7 +59,11 @@ export default function TeamsView() {
   const ctx = useContext(AppContext);
 
   const [library, setLibrary] = useState<TeamsLibrary | null>(null);
-  const [squads, setSquads] = useState<SquadsView | null>(null);
+  // The org chart comes from the shared board store: one copy for the whole
+  // app, refreshed by the stream, rather than this page's own 5 s poll.
+  const board = useBoardStore();
+  const squads = board.squads;
+  const refreshChart = board.refresh;
   const [skills, setSkills] = useState<Skill[]>([]);
   const [loadError, setLoadError] = useState<string | null>(null);
 
@@ -87,17 +90,16 @@ export default function TeamsView() {
   const load = useCallback(async () => {
     try {
       // Both, together: the page is only coherent when the library and the
-      // chart it feeds are from the same moment. Squads is allowed to fail —
-      // "no org chart yet" is the normal state, not an error.
+      // chart it feeds are from the same moment, so the store is asked to
+      // re-read the chart alongside the library.
       // Skills are best-effort: the editor still composes a team without the
       // picker, it just cannot offer what is installed.
-      const [lib, sq, sk] = await Promise.all([
+      const [lib, sk] = await Promise.all([
         getTeams(),
-        getSquads().catch(() => null),
         getSkills().catch(() => [] as Skill[]),
+        refreshChart(),
       ]);
       setLibrary(lib);
-      setSquads(sq);
       setSkills(sk);
       // The saved pin is the starting point, not an override: a user
       // mid-selection must not have their unsaved choices replaced by a reload.
@@ -106,7 +108,7 @@ export default function TeamsView() {
     } catch (err) {
       setLoadError(err instanceof ApiError ? err.displayMessage : 'Could not load the teams.');
     }
-  }, []);
+  }, [refreshChart]);
 
   const loadActivity = useCallback(async () => {
     setActivityLoading(true);
@@ -125,9 +127,9 @@ export default function TeamsView() {
     void loadActivity();
   }, [load, loadActivity]);
 
-  // While a run goes, the org chart and the activity move: poll them slowly.
-  // The chart is written once at charter; the activity grows with every
-  // manager decision. Once the run stops, one last fetch catches the tail.
+  // While a run goes, the activity grows with every manager decision: poll it
+  // slowly. The org chart rides the board store, which the stream keeps
+  // current. Once the run stops, one last fetch catches the tail.
   const wasRunning = useRef(running);
   useEffect(() => {
     if (!running) {
@@ -141,7 +143,6 @@ export default function TeamsView() {
     wasRunning.current = true;
     const id = window.setInterval(() => {
       void loadActivity();
-      getSquads().then(setSquads).catch(() => {});
     }, ACTIVITY_POLL_MS);
     return () => window.clearInterval(id);
   }, [running, load, loadActivity]);
diff --git a/web/src/components/shared/BoardStoreRoot.tsx b/web/src/components/shared/BoardStoreRoot.tsx
new file mode 100644
index 0000000..a551926
--- /dev/null
+++ b/web/src/components/shared/BoardStoreRoot.tsx
@@ -0,0 +1,13 @@
+import type { ReactNode } from 'react';
+import { BoardStoreProvider, useBoardStoreSource, type BoardSourceOptions } from '@/hooks/useBoardStore';
+
+/**
+ * A self-contained board store for a subtree that has no App above it — a
+ * test, a storybook, a page mounted on its own. App itself calls
+ * useBoardStoreSource directly, since it also hands `applyEvent` to the
+ * stream; see hooks/useBoardStore.
+ */
+export default function BoardStoreRoot({ children, ...opts }: BoardSourceOptions & { children: ReactNode }) {
+  const { store } = useBoardStoreSource(opts);
+  return <BoardStoreProvider value={store}>{children}</BoardStoreProvider>;
+}
diff --git a/web/src/hooks/runDerived.test.ts b/web/src/hooks/runDerived.test.ts
new file mode 100644
index 0000000..f99a6f6
--- /dev/null
+++ b/web/src/hooks/runDerived.test.ts
@@ -0,0 +1,72 @@
+import { describe, expect, it } from 'vitest';
+import { createDerived, deriveAll, foldDerived, snapshotDerived } from './runDerived';
+import type { RunEvent } from '@/types';
+
+const T0 = Date.parse('2026-09-10T10:00:00Z');
+const ev = (over: Partial<RunEvent>, s = 0): RunEvent => ({
+  phase: 'execute',
+  kind: 'output',
+  message: '',
+  time: new Date(T0 + s * 1000).toISOString(),
+  ...over,
+});
+
+describe('runDerived', () => {
+  it('folds phases, agents, tasks, files and usage once per event', () => {
+    const acc = createDerived();
+    foldDerived(acc, ev({ phase: 'plan', agent: 'planner', tokens: 100, cost_usd: 0.001, model: 'm1' }, 0));
+    foldDerived(acc, ev({ phase: 'split', agent: 'splitter', task_id: 'T1' }, 1));
+    foldDerived(acc, ev({ phase: 'execute', kind: 'agent_start', agent: 'go-worker', task_id: 'T1', model: 'm2' }, 2));
+    foldDerived(acc, ev({ phase: 'execute', kind: 'file_change', scope: 'cmd/main.go', agent: 'go-worker', task_id: 'T1', tokens: 50 }, 3));
+    foldDerived(acc, ev({ phase: 'execute', kind: 'file_change', scope: 'cmd/main.go', task_id: 'T2' }, 4));
+    foldDerived(acc, ev({ phase: 'execute', kind: 'output', tokens: -5 }, 5));
+
+    const d = snapshotDerived(acc);
+    expect(d.count).toBe(6);
+    expect(d.phases).toEqual(['plan', 'split', 'execute']);
+    expect(d.activePhase).toBe('execute');
+    expect(d.agents).toEqual(['planner', 'splitter', 'go-worker']);
+    expect(d.activeAgent).toBe('go-worker');
+    expect(d.activeModel).toBe('');
+    expect([...d.taskIds]).toEqual(['T1', 'T2']);
+    expect([...d.files]).toEqual(['cmd/main.go']);
+    // Negative or missing usage never subtracts.
+    expect(d.tokens).toBe(150);
+    expect(d.cost).toBeCloseTo(0.001);
+    expect(d.firstAt).toBe(T0);
+    expect(d.lastAt).toBe(T0 + 5000);
+    expect(d.last?.kind).toBe('output');
+  });
+
+  it('remembers the model of the agent line that named it', () => {
+    const acc = createDerived();
+    foldDerived(acc, ev({ agent: 'go-worker', model: 'Qwen3-Coder-30B' }));
+    expect(snapshotDerived(acc).activeModel).toBe('Qwen3-Coder-30B');
+  });
+
+  it('keeps the newest composition event', () => {
+    const acc = createDerived();
+    foldDerived(acc, ev({ kind: 'composition', data: { summary: 'first' } }));
+    foldDerived(acc, ev({ kind: 'composition', data: { summary: 'second' } }));
+    foldDerived(acc, ev({ kind: 'output' }));
+    expect(snapshotDerived(acc).composition?.summary).toBe('second');
+  });
+
+  it('snapshots are independent of later folds', () => {
+    const acc = createDerived();
+    foldDerived(acc, ev({ task_id: 'T1' }));
+    const before = snapshotDerived(acc);
+    foldDerived(acc, ev({ task_id: 'T2' }));
+    const after = snapshotDerived(acc);
+    expect(before.taskIds.size).toBe(1);
+    expect(after.taskIds.size).toBe(2);
+    expect(after).not.toBe(before);
+  });
+
+  it('deriveAll equals folding one by one', () => {
+    const events = [ev({ phase: 'plan', agent: 'planner' }), ev({ phase: 'execute', task_id: 'T1', tokens: 7 })];
+    const acc = createDerived();
+    for (const e of events) foldDerived(acc, e);
+    expect(snapshotDerived(deriveAll(events))).toEqual(snapshotDerived(acc));
+  });
+});
diff --git a/web/src/hooks/runDerived.ts b/web/src/hooks/runDerived.ts
new file mode 100644
index 0000000..20ac4b2
--- /dev/null
+++ b/web/src/hooks/runDerived.ts
@@ -0,0 +1,148 @@
+import type { DynamicComposition, RunEvent } from '@/types';
+
+// ── What the log adds up to, folded once per event ───────────────────────
+//
+// Five components used to answer the same questions by walking the whole log
+// on every stream flush: which phases have been seen, which is current, who
+// spoke last, how many tasks and files the run has touched, what the tokens
+// cost. Seven full scans of up to two thousand events, sixty times a second
+// at the peak of a burst — and every one of them recomputing a number that
+// only the newest event could have changed.
+//
+// This is that arithmetic done once, in the stream hook, as each event lands.
+// The accumulator is mutable and private to the hook; what components see is
+// a snapshot taken at flush time, a new identity whenever the log changed so
+// memoised consumers re-run exactly then.
+
+export interface RunDerived {
+  /** Events folded so far, including any the log has since trimmed. */
+  count: number;
+  /** Phases in first-seen order. */
+  phases: string[];
+  phaseSet: ReadonlySet<string>;
+  /** The phase of the newest event that named one. */
+  activePhase: string | null;
+  /** Agents in first-seen order. */
+  agents: string[];
+  /** The agent of the newest event that named one. */
+  activeAgent: string | null;
+  /** The model that agent's line named, if any. */
+  activeModel: string;
+  taskIds: ReadonlySet<string>;
+  /** Paths the run wrote to (`file_change` scopes). */
+  files: ReadonlySet<string>;
+  tokens: number;
+  cost: number;
+  /** The newest `composition` event's payload. */
+  composition: DynamicComposition | null;
+  last: RunEvent | null;
+  /** Wall-clock bounds of the run, ms; 0 until an event carries a time. */
+  firstAt: number;
+  lastAt: number;
+}
+
+/** The mutable working copy. Never handed to React. */
+export interface RunDerivedAcc {
+  count: number;
+  phases: string[];
+  phaseSet: Set<string>;
+  activePhase: string | null;
+  agents: string[];
+  agentSet: Set<string>;
+  activeAgent: string | null;
+  activeModel: string;
+  taskIds: Set<string>;
+  files: Set<string>;
+  tokens: number;
+  cost: number;
+  composition: DynamicComposition | null;
+  last: RunEvent | null;
+  firstAt: number;
+  lastAt: number;
+}
+
+export function createDerived(): RunDerivedAcc {
+  return {
+    count: 0,
+    phases: [],
+    phaseSet: new Set(),
+    activePhase: null,
+    agents: [],
+    agentSet: new Set(),
+    activeAgent: null,
+    activeModel: '',
+    taskIds: new Set(),
+    files: new Set(),
+    tokens: 0,
+    cost: 0,
+    composition: null,
+    last: null,
+    firstAt: 0,
+    lastAt: 0,
+  };
+}
+
+/** Fold one appended event into the accumulator. Mutates and returns it. */
+export function foldDerived(acc: RunDerivedAcc, ev: RunEvent): RunDerivedAcc {
+  acc.count += 1;
+  acc.last = ev;
+  if (ev.phase) {
+    if (!acc.phaseSet.has(ev.phase)) {
+      acc.phaseSet.add(ev.phase);
+      acc.phases.push(ev.phase);
+    }
+    acc.activePhase = ev.phase;
+  }
+  if (ev.agent) {
+    if (!acc.agentSet.has(ev.agent)) {
+      acc.agentSet.add(ev.agent);
+      acc.agents.push(ev.agent);
+    }
+    acc.activeAgent = ev.agent;
+    acc.activeModel = ev.model ?? '';
+  }
+  if (ev.task_id) acc.taskIds.add(ev.task_id);
+  if (ev.kind === 'file_change' && ev.scope) acc.files.add(ev.scope);
+  if (typeof ev.tokens === 'number' && ev.tokens > 0) acc.tokens += ev.tokens;
+  if (typeof ev.cost_usd === 'number' && ev.cost_usd > 0) acc.cost += ev.cost_usd;
+  if (ev.kind === 'composition' && ev.data && typeof ev.data.summary === 'string') acc.composition = ev.data;
+  const t = Date.parse(ev.time || '');
+  if (!Number.isNaN(t)) {
+    if (!acc.firstAt) acc.firstAt = t;
+    acc.lastAt = t;
+  }
+  return acc;
+}
+
+/** Fold a whole log — the seed from a snapshot or sessionStorage. */
+export function deriveAll(events: readonly RunEvent[]): RunDerivedAcc {
+  const acc = createDerived();
+  for (const ev of events) foldDerived(acc, ev);
+  return acc;
+}
+
+/**
+ * A copy for React: fresh identity, and fresh collections so a consumer that
+ * keys on `derived.taskIds` sees the change too.
+ */
+export function snapshotDerived(acc: RunDerivedAcc): RunDerived {
+  return {
+    count: acc.count,
+    phases: acc.phases.slice(),
+    phaseSet: new Set(acc.phaseSet),
+    activePhase: acc.activePhase,
+    agents: acc.agents.slice(),
+    activeAgent: acc.activeAgent,
+    activeModel: acc.activeModel,
+    taskIds: new Set(acc.taskIds),
+    files: new Set(acc.files),
+    tokens: acc.tokens,
+    cost: acc.cost,
+    composition: acc.composition,
+    last: acc.last,
+    firstAt: acc.firstAt,
+    lastAt: acc.lastAt,
+  };
+}
+
+export const EMPTY_DERIVED: RunDerived = snapshotDerived(createDerived());
diff --git a/web/src/hooks/useBoardStore.test.tsx b/web/src/hooks/useBoardStore.test.tsx
new file mode 100644
index 0000000..31887cf
--- /dev/null
+++ b/web/src/hooks/useBoardStore.test.tsx
@@ -0,0 +1,157 @@
+import { act, renderHook, waitFor } from '@testing-library/react';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { EMPTY_BOARD, foldBoardEvent, isBoardEvent, isStructuralEvent, upsertTaskIn, useBoardStoreSource } from './useBoardStore';
+import type { RunEvent, Task } from '@/types';
+
+const getTasks = vi.fn();
+const getSquads = vi.fn();
+
+vi.mock('@/api/client', async () => {
+  const actual = await vi.importActual<typeof import('@/api/client')>('@/api/client');
+  return {
+    ...actual,
+    getTasks: (...a: unknown[]) => getTasks(...a),
+    getSquads: (...a: unknown[]) => getSquads(...a),
+  };
+});
+
+function task(id: string, over: Partial<Task> = {}): Task {
+  return {
+    id, title: `Task ${id}`, description: '', role: 'worker', assignee: '', column: 'ready_to_dev', status: 'ready',
+    priority: 0, depends_on: [], files: [], acceptance: '', checklist: [], output: '', review: '', retries: 0,
+    error: '', updated_at: '', notes: '', ...over,
+  };
+}
+
+/** A `task_update` frame as the server sends it: the task in `data.task`. */
+function taskUpdate(t: Task): RunEvent {
+  return { phase: 'execute', kind: 'task_update', message: '', task_id: t.id, time: new Date().toISOString(), data: { task: t } as RunEvent['data'] };
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  getTasks.mockResolvedValue({ plan: { summary: 'the plan' }, tasks: [task('T1'), task('T2')], columns: ['to_scope', 'done'], by_column: {} });
+  getSquads.mockResolvedValue({ ok: true, squads: [{ id: 'backend-go', total: 2, done: 0, blocked: 0, in_flight: 0, complete: false, stuck: false }] });
+});
+
+describe('foldBoardEvent', () => {
+  it('replaces a task by id and keeps the order', () => {
+    const snap = { ...EMPTY_BOARD, tasks: [task('T1'), task('T2', { column: 'ready_to_dev' }), task('T3')], columns: ['ready_to_dev'] };
+    const next = foldBoardEvent(snap, taskUpdate(task('T2', { column: 'in_progress', status: 'running' })), 1000);
+    expect(next.tasks.map((t) => t.id)).toEqual(['T1', 'T2', 'T3']);
+    expect(next.tasks[1].column).toBe('in_progress');
+    expect(next.live).toBe(true);
+    expect(next.updatedAt).toBe(1000);
+    // A column the board had not seen joins the list, so the Board can draw it.
+    expect(next.columns).toEqual(['ready_to_dev', 'in_progress']);
+  });
+
+  it('appends a task it has not seen', () => {
+    const next = foldBoardEvent({ ...EMPTY_BOARD, tasks: [task('T1')] }, taskUpdate(task('T9')));
+    expect(next.tasks.map((t) => t.id)).toEqual(['T1', 'T9']);
+  });
+
+  it('ignores everything that is not a task_update with a task', () => {
+    const snap = { ...EMPTY_BOARD, tasks: [task('T1')] };
+    expect(foldBoardEvent(snap, { phase: 'execute', kind: 'task_done', message: 'done', task_id: 'T1', time: '' })).toBe(snap);
+    expect(foldBoardEvent(snap, { phase: 'execute', kind: 'task_update', message: '', time: '' })).toBe(snap);
+    expect(foldBoardEvent(snap, { phase: 'execute', kind: 'review_pending', message: '', time: '', data: { pending: 3 } as RunEvent['data'] })).toBe(snap);
+  });
+
+  it('keeps the array identity when nothing changed', () => {
+    const t = task('T1');
+    const tasks = [t];
+    expect(upsertTaskIn(tasks, t)).toBe(tasks);
+  });
+
+  it('knows which kinds are board bookkeeping and which are structural', () => {
+    expect(isBoardEvent({ kind: 'task_update' })).toBe(true);
+    expect(isBoardEvent({ kind: 'review_pending' })).toBe(true);
+    expect(isBoardEvent({ kind: 'task_done' })).toBe(false);
+    expect(isStructuralEvent({ kind: 'task_done', phase: 'execute' })).toBe(true);
+    expect(isStructuralEvent({ kind: 'output', phase: 'done' })).toBe(true);
+    expect(isStructuralEvent({ kind: 'output', phase: 'execute' })).toBe(false);
+  });
+});
+
+describe('useBoardStoreSource', () => {
+  it('seeds from /api/tasks and /api/squads, then folds task_update events without another request', async () => {
+    const { result } = renderHook(() => useBoardStoreSource());
+    await waitFor(() => expect(result.current.store.ready).toBe(true));
+    expect(result.current.store.tasks.map((t) => t.id)).toEqual(['T1', 'T2']);
+    expect(result.current.store.plan?.summary).toBe('the plan');
+    expect(result.current.store.squads?.ok).toBe(true);
+    expect(result.current.store.live).toBe(false);
+    expect(getTasks).toHaveBeenCalledTimes(1);
+
+    act(() => {
+      result.current.applyEvent(taskUpdate(task('T2', { column: 'done', status: 'done' })));
+      result.current.applyEvent(taskUpdate(task('T3', { title: 'a new one' })));
+    });
+    expect(result.current.store.tasks.map((t) => `${t.id}:${t.column}`)).toEqual(['T1:ready_to_dev', 'T2:done', 'T3:ready_to_dev']);
+    expect(result.current.store.live).toBe(true);
+    // The event was the update; no poll was spent on it.
+    expect(getTasks).toHaveBeenCalledTimes(1);
+  });
+
+  it('paints an optimistic edit and removes a task locally', async () => {
+    const { result } = renderHook(() => useBoardStoreSource());
+    await waitFor(() => expect(result.current.store.ready).toBe(true));
+    act(() => result.current.store.upsertTask(task('T1', { column: 'in_progress' })));
+    expect(result.current.store.tasks[0].column).toBe('in_progress');
+    act(() => result.current.store.removeTask('T2'));
+    expect(result.current.store.tasks.map((t) => t.id)).toEqual(['T1']);
+  });
+
+  it('records a board error without losing the org chart, and refresh() re-reads both', async () => {
+    getTasks.mockRejectedValueOnce(new Error('boom'));
+    const { result } = renderHook(() => useBoardStoreSource());
+    await waitFor(() => expect(result.current.store.ready).toBe(true));
+    expect(result.current.store.error).toMatch(/boom/);
+    expect(result.current.store.squads?.ok).toBe(true);
+
+    await act(async () => {
+      await result.current.store.refresh();
+    });
+    expect(result.current.store.error).toBeNull();
+    expect(result.current.store.tasks).toHaveLength(2);
+    expect(getTasks).toHaveBeenCalledTimes(2);
+  });
+
+  it('coalesces concurrent refreshes into at most one follow-up request', async () => {
+    const { result } = renderHook(() => useBoardStoreSource());
+    await waitFor(() => expect(result.current.store.ready).toBe(true));
+    getTasks.mockClear();
+    await act(async () => {
+      await Promise.all([result.current.store.refresh(), result.current.store.refresh(), result.current.store.refresh()]);
+    });
+    // One in flight, one queued behind it for whatever the first predates.
+    expect(getTasks.mock.calls.length).toBeLessThanOrEqual(2);
+    expect(getTasks.mock.calls.length).toBeGreaterThanOrEqual(1);
+  });
+
+  it('re-reads after a structural log event only until the server pushes task_update', async () => {
+    const { result, rerender } = renderHook((props: { last: RunEvent | null }) => useBoardStoreSource({ lastEvent: props.last }), {
+      initialProps: { last: null as RunEvent | null },
+    });
+    await waitFor(() => expect(result.current.store.ready).toBe(true));
+    getTasks.mockClear();
+
+    rerender({ last: { phase: 'execute', kind: 'task_done', message: 'T1 done', task_id: 'T1', time: new Date().toISOString() } });
+    await waitFor(() => expect(getTasks).toHaveBeenCalledTimes(1), { timeout: 3000 });
+
+    // Once the board is live, a structural line is no longer a cue to poll.
+    act(() => result.current.applyEvent(taskUpdate(task('T1', { column: 'done' }))));
+    getTasks.mockClear();
+    rerender({ last: { phase: 'execute', kind: 'task_start', message: 'T2', task_id: 'T2', time: new Date().toISOString() } });
+    await new Promise((r) => setTimeout(r, 1200));
+    expect(getTasks).not.toHaveBeenCalled();
+  });
+
+  it('does no network work when disabled', async () => {
+    renderHook(() => useBoardStoreSource({ enabled: false }));
+    await new Promise((r) => setTimeout(r, 20));
+    expect(getTasks).not.toHaveBeenCalled();
+    expect(getSquads).not.toHaveBeenCalled();
+  });
+});
diff --git a/web/src/hooks/useBoardStore.ts b/web/src/hooks/useBoardStore.ts
new file mode 100644
index 0000000..cb94b08
--- /dev/null
+++ b/web/src/hooks/useBoardStore.ts
@@ -0,0 +1,269 @@
+import { createContext, useCallback, useContext, useEffect, useMemo, useRef, useState } from 'react';
+import { errorText, getSquads, getTasks } from '@/api/client';
+import type { Plan, RunEvent, SquadsView, Task } from '@/types';
+
+// ── One live board for the whole app ─────────────────────────────────────
+//
+// Four pages used to poll the same two endpoints on four timers: the Board
+// every 3 s forever, the Live floor and the task rail every 5 s while a run
+// went, the Teams page every 5 s for the org chart. Four copies of the board,
+// each a few seconds stale in its own way, and a request every 750 ms on
+// average to a server that already tells us when a task changes.
+//
+// This is the one copy. It is seeded from GET /api/tasks and GET /api/squads,
+// then kept current by the live stream: the server's `task_update` event
+// carries the task exactly as GET /api/tasks would return it, and folding it
+// in is a replace-by-id. Those events never reach the log — one per column
+// move, per assignee change, per retry counter would bury the narrative
+// under bookkeeping, and the log already has task_start / task_done for the
+// story. A slow refresh (30 s) stays as the safety net for a server that does
+// not emit task_update yet, and for the org chart, which has no event of its
+// own; while the server has not yet pushed a single task_update, the store
+// also refreshes shortly after a structural event (a task starting or
+// finishing, a run starting or ending), so the older server still feels live.
+//
+// Pages read it with `useBoardStore()`. Edits go through `upsertTask` /
+// `removeTask` for the optimistic paint and `refresh()` for the truth.
+
+export interface BoardSnapshot {
+  tasks: Task[];
+  /** The board's column ids, in the server's order. */
+  columns: string[];
+  plan: Plan | null;
+  /** The current run's org chart; null when there is none. */
+  squads: SquadsView | null;
+  /** True once both endpoints have been asked at least once. */
+  ready: boolean;
+  /** The last fetch error, or null. */
+  error: string | null;
+  /** When the store last changed, ms since the epoch. */
+  updatedAt: number;
+  /** True once the server has pushed a task_update — the board is live. */
+  live: boolean;
+}
+
+export interface BoardStore extends BoardSnapshot {
+  refreshing: boolean;
+  /** Re-read the board and the org chart from the server. */
+  refresh: () => Promise<void>;
+  /** Paint an edit before the server confirms it (or in place of an event). */
+  upsertTask: (task: Task) => void;
+  removeTask: (id: string) => void;
+}
+
+export const FALLBACK_REFRESH_MS = 30_000;
+/** How long after a structural log event a non-live store waits before re-reading. */
+const STRUCTURAL_REFRESH_DELAY_MS = 800;
+
+/** The kinds the stream folds into the store instead of the log. */
+export function isBoardEvent(ev: Pick<RunEvent, 'kind'>): boolean {
+  return ev.kind === 'task_update' || ev.kind === 'review_pending';
+}
+
+/** Log events after which a board that is not yet pushed to should re-read. */
+const STRUCTURAL_KINDS = new Set(['task_start', 'task_done', 'task_fail', 'wave', 'run_start', 'run_end', 'coord', 'split']);
+
+export function isStructuralEvent(ev: Pick<RunEvent, 'kind' | 'phase'>): boolean {
+  return STRUCTURAL_KINDS.has(ev.kind) || ev.phase === 'done' || ev.phase === 'error';
+}
+
+export const EMPTY_BOARD: BoardSnapshot = {
+  tasks: [],
+  columns: [],
+  plan: null,
+  squads: null,
+  ready: false,
+  error: null,
+  updatedAt: 0,
+  live: false,
+};
+
+/** Replace a task by id, or append it. Order is preserved; identity changes only when something did. */
+export function upsertTaskIn(tasks: Task[], task: Task): Task[] {
+  const i = tasks.findIndex((t) => t.id === task.id);
+  if (i < 0) return [...tasks, task];
+  if (tasks[i] === task) return tasks;
+  const next = tasks.slice();
+  next[i] = task;
+  return next;
+}
+
+/**
+ * Fold one stream event into a snapshot. Returns the same snapshot when the
+ * event is not one the board cares about, so callers can compare identities.
+ */
+export function foldBoardEvent(snap: BoardSnapshot, ev: RunEvent, now = Date.now()): BoardSnapshot {
+  if (ev.kind !== 'task_update') return snap;
+  const task = ev.data?.task;
+  if (!task || typeof task.id !== 'string' || task.id === '') return snap;
+  const tasks = upsertTaskIn(snap.tasks, task);
+  const column = task.column || task.status;
+  const columns = column && !snap.columns.includes(column) ? [...snap.columns, column] : snap.columns;
+  return { ...snap, tasks, columns, updatedAt: now, live: true };
+}
+
+const BoardStoreContext = createContext<BoardStore | null>(null);
+export const BoardStoreProvider = BoardStoreContext.Provider;
+
+const NOOP_STORE: BoardStore = {
+  ...EMPTY_BOARD,
+  refreshing: false,
+  refresh: async () => {},
+  upsertTask: () => {},
+  removeTask: () => {},
+};
+
+/** The live board. Outside the provider (tests, storybook) it is empty and inert. */
+export function useBoardStore(): BoardStore {
+  return useContext(BoardStoreContext) ?? NOOP_STORE;
+}
+
+export interface BoardSourceOptions {
+  /** Disable network work (tests). */
+  enabled?: boolean;
+  /** The stream's connection state; a return to 'live' re-reads the board. */
+  connection?: string;
+  /** Whether a run is going; both edges re-read the board. */
+  running?: boolean;
+  /** The newest log event, for the structural-refresh fallback. */
+  lastEvent?: RunEvent | null;
+}
+
+/**
+ * The store's owner — mounted once, in App. Returns the store for the
+ * provider and `applyEvent`, which the stream hook calls with every board
+ * event it receives.
+ */
+export function useBoardStoreSource(opts: BoardSourceOptions = {}): { store: BoardStore; applyEvent: (ev: RunEvent) => void } {
+  const { enabled = true, connection, running, lastEvent } = opts;
+  const [snap, setSnap] = useState<BoardSnapshot>(EMPTY_BOARD);
+  const [refreshing, setRefreshing] = useState(false);
+  const mountedRef = useRef(true);
+  const inflightRef = useRef<Promise<void> | null>(null);
+  const queuedRef = useRef<Promise<void> | null>(null);
+  const liveRef = useRef(false);
+
+  const fetchOnce = useCallback((): Promise<void> => {
+    setRefreshing(true);
+    const p = Promise.allSettled([getTasks(), getSquads()])
+      .then(([board, chart]) => {
+        if (!mountedRef.current) return;
+        setSnap((prev) => {
+          const next: BoardSnapshot = { ...prev, ready: true, updatedAt: Date.now() };
+          if (board.status === 'fulfilled') {
+            const b = board.value;
+            next.tasks = b?.tasks ?? [];
+            next.columns = b?.columns ?? [];
+            next.plan = b?.plan ?? null;
+            next.error = null;
+          } else {
+            next.error = errorText(board.reason, 'Could not load the board');
+          }
+          // No org chart is the normal state, not an error.
+          next.squads = chart.status === 'fulfilled' ? chart.value : null;
+          return next;
+        });
+      })
+      .finally(() => {
+        inflightRef.current = null;
+        if (mountedRef.current) setRefreshing(false);
+      });
+    inflightRef.current = p;
+    return p;
+  }, []);
+
+  const refresh = useCallback((): Promise<void> => {
+    if (!enabled) return Promise.resolve();
+    // Coalesce: three pages asking at once is one request — but a request
+    // made WHILE one is in flight may be asking about a write that request
+    // predates, so exactly one more follows it.
+    if (inflightRef.current) {
+      if (!queuedRef.current) {
+        queuedRef.current = inflightRef.current.then(() => {
+          queuedRef.current = null;
+          return mountedRef.current ? fetchOnce() : undefined;
+        });
+      }
+      return queuedRef.current;
+    }
+    return fetchOnce();
+  }, [enabled, fetchOnce]);
+
+  const applyEvent = useCallback((ev: RunEvent) => {
+    if (ev.kind !== 'task_update') return;
+    liveRef.current = true;
+    setSnap((prev) => foldBoardEvent(prev, ev));
+  }, []);
+
+  const upsertTask = useCallback((task: Task) => {
+    setSnap((prev) => {
+      const tasks = upsertTaskIn(prev.tasks, task);
+      return tasks === prev.tasks ? prev : { ...prev, tasks, updatedAt: Date.now() };
+    });
+  }, []);
+
+  const removeTask = useCallback((id: string) => {
+    setSnap((prev) => {
+      if (!prev.tasks.some((t) => t.id === id)) return prev;
+      return { ...prev, tasks: prev.tasks.filter((t) => t.id !== id), updatedAt: Date.now() };
+    });
+  }, []);
+
+  // Seed, then the slow safety net.
+  useEffect(() => {
+    mountedRef.current = true;
+    if (!enabled) return undefined;
+    void refresh();
+    const id = window.setInterval(() => void refresh(), FALLBACK_REFRESH_MS);
+    return () => {
+      mountedRef.current = false;
+      window.clearInterval(id);
+    };
+  }, [enabled, refresh]);
+
+  // A reconnect may have missed events; both edges of a run move the board
+  // (tasks appear at split, the org chart at charter, the tail lands at done).
+  const firstRef = useRef(true);
+  useEffect(() => {
+    if (!enabled) return;
+    if (firstRef.current) {
+      firstRef.current = false;
+      return;
+    }
+    if (connection === 'live') void refresh();
+  }, [connection, enabled, refresh]);
+
+  const runningRef = useRef(running);
+  useEffect(() => {
+    if (!enabled) return;
+    if (runningRef.current !== running) {
+      runningRef.current = running;
+      void refresh();
+    }
+  }, [running, enabled, refresh]);
+
+  // The degraded path: no task_update yet, so a structural line in the log is
+  // the cue to re-read — debounced, since a wave starts several tasks at once.
+  const structuralTimer = useRef<number | null>(null);
+  useEffect(() => {
+    if (!enabled || !lastEvent || liveRef.current || !isStructuralEvent(lastEvent)) return undefined;
+    if (structuralTimer.current !== null) window.clearTimeout(structuralTimer.current);
+    structuralTimer.current = window.setTimeout(() => {
+      structuralTimer.current = null;
+      void refresh();
+    }, STRUCTURAL_REFRESH_DELAY_MS);
+    return undefined;
+  }, [lastEvent, enabled, refresh]);
+  useEffect(
+    () => () => {
+      if (structuralTimer.current !== null) window.clearTimeout(structuralTimer.current);
+    },
+    [],
+  );
+
+  const store = useMemo<BoardStore>(
+    () => ({ ...snap, refreshing, refresh, upsertTask, removeTask }),
+    [snap, refreshing, refresh, upsertTask, removeTask],
+  );
+  return { store, applyEvent };
+}
diff --git a/web/src/hooks/useLiveStream.test.tsx b/web/src/hooks/useLiveStream.test.tsx
index efe45c2..0936f92 100644
--- a/web/src/hooks/useLiveStream.test.tsx
+++ b/web/src/hooks/useLiveStream.test.tsx
@@ -175,6 +175,57 @@ describe('useLiveStream — event accumulation', () => {
     expect(onEvents.mock.calls[onEvents.mock.calls.length - 1][0]).toHaveLength(60);
   });
 
+  // Board bookkeeping is folded into the board store, never shown as rows:
+  // one task_update per column move would bury the narrative.
+  it('routes task_update to the board store and keeps it out of the log', async () => {
+    const onBoardEvent = vi.fn();
+    const hook = renderHook(() => useLiveStream({ onBoardEvent }));
+    await waitFor(() => expect(MockEventSource.instances.length).toBeGreaterThan(0));
+    await act(async () => {
+      MockEventSource.last.open();
+    });
+    const task = { id: 'T1', title: 'x', column: 'in_progress', status: 'running' };
+    await act(async () => {
+      MockEventSource.last.emitMessage(ev('a real line'), 1);
+      MockEventSource.last.emitMessage({ ...ev(''), kind: 'task_update', task_id: 'T1', data: { task } }, 2);
+      MockEventSource.last.emitMessage({ ...ev(''), kind: 'task_update', task_id: 'T1', data: { task } }, 2); // replayed
+    });
+    await eventually(() => expect(hook.result.current.events.map((e) => e.message)).toEqual(['a real line']));
+    expect(onBoardEvent).toHaveBeenCalledTimes(1);
+    expect(onBoardEvent.mock.calls[0][0].data.task.id).toBe('T1');
+    // Its seq still advances the resume cursor.
+    await eventually(() => expect(hook.result.current.lastSeq).toBe(2));
+  });
+
+  it('tracks the review queue from the health poll and the review_pending event', async () => {
+    const { result } = await mountStream();
+    await act(async () => {
+      MockEventSource.last.emitMessage({ ...ev(''), kind: 'review_pending', data: { pending: 4 } }, 1);
+    });
+    await eventually(() => expect(result.current.pendingReview).toBe(4));
+    expect(result.current.events).toHaveLength(0);
+  });
+
+  it('exposes the folded derivation, updated per flush and reset per run', async () => {
+    const { result } = await mountStream();
+    await act(async () => {
+      MockEventSource.last.emitMessage(ev('plan', { phase: 'plan', agent: 'planner', tokens: 10 }), 1);
+      MockEventSource.last.emitMessage(ev('go', { phase: 'execute', agent: 'go-worker', task_id: 'T1', tokens: 5 }), 2);
+    });
+    await eventually(() => expect(result.current.derived.count).toBe(2));
+    expect(result.current.derived.phases).toEqual(['plan', 'execute']);
+    expect(result.current.derived.activeAgent).toBe('go-worker');
+    expect([...result.current.derived.taskIds]).toEqual(['T1']);
+    expect(result.current.derived.tokens).toBe(15);
+
+    await act(async () => {
+      MockEventSource.last.emitMessage(ev('run started', { kind: 'run_start', phase: 'init' }), 3);
+    });
+    await eventually(() => expect(result.current.derived.count).toBe(1));
+    expect(result.current.derived.tokens).toBe(0);
+    expect(result.current.derived.phases).toEqual(['init']);
+  });
+
   it('surfaces a gap frame reported by the server', async () => {
     const { result } = await mountStream();
     await act(async () => {
diff --git a/web/src/hooks/useLiveStream.ts b/web/src/hooks/useLiveStream.ts
index 655dc5f..6b49b38 100644
--- a/web/src/hooks/useLiveStream.ts
+++ b/web/src/hooks/useLiveStream.ts
@@ -1,6 +1,8 @@
 import { useCallback, useEffect, useRef, useState } from 'react';
 import { createEventSource, getHealth, getLatestRun } from '@/api/client';
 import type { ConnectionState, LatestRunResponse, RunEvent } from '@/types';
+import { createDerived, deriveAll, foldDerived, snapshotDerived, type RunDerived, type RunDerivedAcc } from './runDerived';
+import { isBoardEvent } from './useBoardStore';
 
 // ── The live event stream ──
 //
@@ -48,6 +50,17 @@ export interface LiveStream {
   askSignal: number;
   /** Concatenated token deltas for the current agent turn (capability B). */
   tokenStream: string;
+  /**
+   * What the log adds up to — phases seen, who is active, tasks and files
+   * touched, token totals — folded once per event rather than re-scanned by
+   * every consumer on every flush. See hooks/runDerived.
+   */
+  derived: RunDerived;
+  /**
+   * The review queue's length: from the health poll, and from the server's
+   * `review_pending` event the moment it changes. Null until either answers.
+   */
+  pendingReview: number | null;
   latest: LatestRunResponse | null;
   setRunning: (running: boolean) => void;
   /** Clear the log — used when a new run starts from this tab. */
@@ -76,6 +89,12 @@ interface StreamOptions {
   /** Persist hook — called with the current log after each batch. */
   onEvents?: (events: RunEvent[]) => void;
   onRunning?: (running: boolean) => void;
+  /**
+   * Receives BOARD events — `task_update`, `review_pending` — which are folded
+   * into the board store and kept out of the log. See hooks/useBoardStore for
+   * why they do not become rows.
+   */
+  onBoardEvent?: (ev: RunEvent) => void;
   /** Disable network work (tests, storybook). */
   enabled?: boolean;
 }
@@ -98,8 +117,11 @@ export function useLiveStream(opts: StreamOptions = {}): LiveStream {
   const tokenDirtyRef = useRef(false);
   const onEventsRef = useRef(opts.onEvents);
   const onRunningRef = useRef(opts.onRunning);
+  const onBoardEventRef = useRef(opts.onBoardEvent);
   onEventsRef.current = opts.onEvents;
   onRunningRef.current = opts.onRunning;
+  onBoardEventRef.current = opts.onBoardEvent;
+  const derivedRef = useRef<RunDerivedAcc>(deriveAll(eventsRef.current));
 
   const [events, setEvents] = useState<RunEvent[]>(eventsRef.current);
   const [running, setRunningState] = useState(runningRef.current);
@@ -108,6 +130,8 @@ export function useLiveStream(opts: StreamOptions = {}): LiveStream {
   const [gap, setGap] = useState<string | null>(null);
   const [askSignal, setAskSignal] = useState(0);
   const [tokenStream, setTokenStream] = useState('');
+  const [derived, setDerived] = useState<RunDerived>(() => snapshotDerived(derivedRef.current));
+  const [pendingReview, setPendingReview] = useState<number | null>(null);
   const [latest, setLatest] = useState<LatestRunResponse | null>(null);
 
   /**
@@ -141,6 +165,7 @@ export function useLiveStream(opts: StreamOptions = {}): LiveStream {
         // A fresh identity is what tells React the log changed; producing one
         // for a token-only frame would re-render EventLog for nothing.
         setEvents(next.slice());
+        setDerived(snapshotDerived(derivedRef.current));
         onEventsRef.current?.(next);
       }
       if (tokenDirtyRef.current) {
@@ -178,12 +203,16 @@ export function useLiveStream(opts: StreamOptions = {}): LiveStream {
     }
     const next = eventsRef.current.concat(ev);
     eventsRef.current = next.length > MAX_EVENTS ? next.slice(next.length - MAX_EVENTS) : next;
+    // The accumulator keeps every event's contribution, trimmed rows included:
+    // the token total of a long run must not shrink when the log rolls over.
+    foldDerived(derivedRef.current, ev);
     return true;
   }, []);
 
   const reset = useCallback(() => {
     eventsRef.current = [];
     tokenRef.current = '';
+    derivedRef.current = createDerived();
     eventsDirtyRef.current = false;
     tokenDirtyRef.current = false;
     // A frame queued by the previous run would repaint its log over the empty
@@ -197,6 +226,7 @@ export function useLiveStream(opts: StreamOptions = {}): LiveStream {
     if (mountedRef.current) {
       setEvents([]);
       setTokenStream('');
+      setDerived(snapshotDerived(derivedRef.current));
     }
     onEventsRef.current?.([]);
   }, []);
@@ -282,6 +312,22 @@ export function useLiveStream(opts: StreamOptions = {}): LiveStream {
         tokenRef.current = '';
         if (mountedRef.current) setTokenStream('');
       }
+      if (isBoardEvent(data)) {
+        // Board bookkeeping: folded into the board store (task_update) or the
+        // review badge (review_pending), never a row in the log.
+        if (seq > 0 && seenRef.current.has(seq)) return;
+        if (seq > 0) {
+          seenRef.current.add(seq);
+          if (seq > lastSeqRef.current) lastSeqRef.current = seq;
+        }
+        if (data.kind === 'review_pending') {
+          const n = data.data?.pending;
+          if (typeof n === 'number' && mountedRef.current) setPendingReview(n);
+        }
+        onBoardEventRef.current?.(data);
+        scheduleFlush();
+        return;
+      }
 
       if (!append(data, seq)) return;
       publish();
@@ -317,7 +363,7 @@ export function useLiveStream(opts: StreamOptions = {}): LiveStream {
         if (esRef.current === es) connect();
       }, delay);
     };
-  }, [append, enabled, publish, publishTokens, reset, setRunning]);
+  }, [append, enabled, publish, publishTokens, reset, scheduleFlush, setRunning]);
 
   const reconnect = useCallback(() => {
     attemptsRef.current = 0;
@@ -347,6 +393,7 @@ export function useLiveStream(opts: StreamOptions = {}): LiveStream {
             if (!isTokenEvent(ev)) kept.push(ev);
           });
           eventsRef.current = kept.slice(-MAX_EVENTS);
+          derivedRef.current = deriveAll(kept);
           publish();
         } else if (typeof r.last_seq === 'number' && r.last_seq > lastSeqRef.current) {
           lastSeqRef.current = r.last_seq;
@@ -398,10 +445,15 @@ export function useLiveStream(opts: StreamOptions = {}): LiveStream {
         if (typeof h.running === 'boolean' && h.running !== runningRef.current) {
           setRunning(h.running);
         }
+        if (typeof h.pending === 'number') setPendingReview(h.pending);
       } catch {
         if (!cancelled && mountedRef.current) setConnection('down');
       }
     };
+    // Once now, for the review badge, then on the interval. The connection
+    // state is only ever promoted from a poll when the EventSource is open,
+    // so an early tick cannot misreport a stream that has not connected.
+    void tick();
     const id = window.setInterval(tick, HEALTH_POLL_MS);
     return () => {
       cancelled = true;
@@ -418,6 +470,8 @@ export function useLiveStream(opts: StreamOptions = {}): LiveStream {
     clearGap,
     askSignal,
     tokenStream,
+    derived,
+    pendingReview,
     latest,
     setRunning,
     reset,

From de0b1aa1c2f4ee92243bf44bebf4c93ace119686 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 08:49:51 +0000
Subject: [PATCH 15/23] docs(studio): the board store, its events, entity links
 and what the floor remembers

---
 docs/studio.md | 67 +++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 66 insertions(+), 1 deletion(-)

diff --git a/docs/studio.md b/docs/studio.md
index 5511040..360080c 100644
--- a/docs/studio.md
+++ b/docs/studio.md
@@ -135,7 +135,72 @@ pipeline*.
 
 Where WebGL is unavailable, or on request (the **3D / map** toggle), the same
 floor is drawn as a flat map with the same dossier and feed. Both honor
-`prefers-reduced-motion`.
+`prefers-reduced-motion`. On a touch device with no stored preference the map
+is the default; below the `sm` breakpoint the toggle sits in a strip under the
+floor and the feed opens from it as a bottom sheet. Every person and ticket in
+the 3D scene is also a visually hidden button, so the floor can be walked with
+a keyboard: a dossier takes focus when it opens and gives it back when it
+closes, and `Esc` closes it unless it was typed into a field.
+
+The scene keeps its state between visits. The **selection** lives in the URL —
+`/?task=T4` opens a ticket's dossier, `/?agent=go-worker` a person's, with an
+optional `&team=` — so a dossier survives navigating away, a reload, and being
+pasted to someone. The camera, **follow**, **spin** and the pulse feed live in
+a module-level store (mirrored to `sessionStorage`), so coming back from the
+Board finds the floor where it was left; **reset view** restores the camera
+through OrbitControls rather than remounting the scene. The render loop runs
+continuously only while something moves (a run, live tickets, fresh pulses,
+follow, spin, a camera glide), drops to on-demand when the floor is still, and
+stops while the tab is hidden. If the browser loses the WebGL context the page
+falls back to the flat map and says so.
+
+## One board, one stream
+
+Every page that shows tasks reads the same **board store** (`web/src/hooks/
+useBoardStore.ts`, provided from `App`): the Board, the Live floor, the ticker
+and the Teams page. It is seeded once from `GET /api/tasks` and
+`GET /api/squads`, then kept current by the live stream, and re-read every
+30 s as a safety net, on both edges of a run, and when the stream reconnects.
+Before the server's first push, a structural log line (a task starting or
+finishing, a run starting or ending) also triggers one debounced re-read, so a
+server without the events below still feels live. Pages call `refresh()`
+after a write and `upsertTask()` for the optimistic paint. Nothing polls on
+its own timer any more; the Sidebar's review badge comes from the stream too.
+
+Two SSE kinds are **board events**: they are folded into the store and never
+become rows in the log, since one row per column move would bury the story
+the log tells with `task_start` / `task_done`:
+
+| Kind | Payload | Effect |
+|---|---|---|
+| `task_update` | `task_id`, `data.task` — the task exactly as `GET /api/tasks` returns it | replaced by id in the store (appended if new); marks the store *live* |
+| `review_pending` | `data.pending` — the review queue's length | updates the Review badge at once |
+
+Their sequence ids still advance the reconnect cursor, and a replayed one is
+dropped like any other duplicate.
+
+The stream also keeps a **running derivation** of the log (`web/src/hooks/
+runDerived.ts`): phases seen, the active phase and agent, task ids, files
+written, token and cost totals, the newest composition — folded once per event
+as it arrives rather than re-scanned by each panel on every flush. The
+ticker's clock keys on the floor model's working set (an agent between its
+`agent_start` and `agent_end`), so it stops when nobody is working.
+
+### Links between pages
+
+Identifiers are chips that go somewhere (`web/src/components/shared/
+EntityLink.tsx`):
+
+| Kind | Goes to |
+|---|---|
+| task | `/?task=ID` — the ticket's dossier on the floor, and the Tasks rail |
+| agent | `/?agent=ID` — the person's dossier |
+| team | `/teams?team=ID` |
+| run | `/runs?run=ID` |
+| file | `/files?file=path` |
+
+The Board keeps its own filters in the URL as well: `?team=ID` (or the
+unassigned lane) and `?column=ID`.
 
 ## The review workflow
 

From da87ae82cfc74d12438fdcf8db596c5e3b5c4253 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 08:55:13 +0000
Subject: [PATCH 16/23] feat(squads): a seam task is handed the whole contract
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

An unassigned task whose files fall in two or more squads' territory used to get no brief at all — BriefFor returned "" for every task without a squad — so the one worker building both sides of the seam was the one building without the interface spec.

BriefFor now resolves the task's files to their owners and, when two or more squads own them, returns a bounded seam brief: the squads spanned and what each owns, then every interface of the frozen contract with its provider, consumers and a clipped spec. Interfaces only, no charters; capped at twelve interfaces and 320 chars of spec each. An unassigned task inside one territory, or outside every territory, still gets nothing.
---
 pkg/squads/board.go     | 42 ++++++++++++++++--
 pkg/squads/render.go    | 58 +++++++++++++++++++++++++
 pkg/squads/seam_test.go | 95 +++++++++++++++++++++++++++++++++++++++++
 3 files changed, 192 insertions(+), 3 deletions(-)
 create mode 100644 pkg/squads/seam_test.go

diff --git a/pkg/squads/board.go b/pkg/squads/board.go
index bf330e4..a60c04e 100644
--- a/pkg/squads/board.go
+++ b/pkg/squads/board.go
@@ -221,12 +221,48 @@ func ForeignPatterns(p *Plan, wave []plan.Task) []string {
 	return out
 }
 
-// BriefFor returns the squad brief for a task, or "" when it has no squad.
+// BriefFor returns the brief a task's worker is handed: its own squad's brief
+// when it has a squad, the seam brief when it has none because its files
+// belong to two or more squads, and "" for an unassigned task that touches no
+// owned territory.
+//
+// The seam case used to return "". A task the router left unassigned BECAUSE
+// it straddles the contract — an API client on the frontend side, a handler
+// on the backend side, one task — is the task that most needs the contract,
+// and it was the one task that got no word of it. The worker on the seam was
+// then the only agent on the run building without the interface spec.
 func BriefFor(p *Plan, t plan.Task) string {
-	if p == nil || t.Squad == "" {
+	if p == nil {
+		return ""
+	}
+	if t.Squad != "" {
+		return p.Brief(t.Squad)
+	}
+	owners := ownersOf(p, t.Files)
+	if len(owners) < 2 {
 		return ""
 	}
-	return p.Brief(t.Squad)
+	return p.SeamBrief(owners)
+}
+
+// ownersOf lists the squads whose territory the files fall in, in plan order.
+func ownersOf(p *Plan, files []string) []string {
+	if p == nil {
+		return nil
+	}
+	seen := map[string]bool{}
+	for _, f := range files {
+		if owner, ok := p.Owner(f); ok {
+			seen[owner] = true
+		}
+	}
+	var out []string
+	for _, s := range p.Squads {
+		if seen[s.ID] {
+			out = append(out, s.ID)
+		}
+	}
+	return out
 }
 
 // ── Contract enforcement ─────────────────────────────────────────────────
diff --git a/pkg/squads/render.go b/pkg/squads/render.go
index 0e40be6..5a8cf8d 100644
--- a/pkg/squads/render.go
+++ b/pkg/squads/render.go
@@ -136,6 +136,64 @@ func (p *Plan) Brief(squadID string) string {
 	return b.String()
 }
 
+// Bounds on the seam brief. It is pasted into a worker prompt on a 30B-class
+// model, where attention is the scarce resource, so it carries the contract
+// and nothing else: no charters, no rosters, a clipped spec per interface and
+// a cap on how many interfaces are spelled out.
+const (
+	maxSeamInterfaces = 12
+	maxSeamSpecChars  = 320
+)
+
+// SeamBrief is the brief for a task that sits on the contract itself: its
+// files belong to two or more of the named squads, so no single squad's brief
+// applies and the whole interface list does. Interfaces only — every ID, its
+// provider and consumers, and a clipped spec — with no squad charter, because
+// the worker is on neither team and needs the seam, not the missions.
+func (p *Plan) SeamBrief(owners []string) string {
+	if p == nil || len(owners) < 2 {
+		return ""
+	}
+	var b strings.Builder
+	fmt.Fprintf(&b, "## Seam task — this work spans squads %s\n\n", strings.Join(owners, " and "))
+	b.WriteString("It is on no single team because its files fall in more than one team's territory. " +
+		"Build BOTH sides to the frozen contract below; do not redesign the interface from either side.\n")
+	for _, id := range owners {
+		if s, ok := p.Squad(id); ok {
+			fmt.Fprintf(&b, "- `%s` owns %s\n", s.ID, joinCode(s.Owns))
+		}
+	}
+	if len(p.Contract.Interfaces) == 0 {
+		b.WriteString("\nThe plan froze no interfaces; keep the two sides agreeing on the shapes you introduce.\n")
+		return b.String()
+	}
+	b.WriteString("\n### The frozen contract (interfaces only)\n\n")
+	for i, in := range p.Contract.Interfaces {
+		if i >= maxSeamInterfaces {
+			fmt.Fprintf(&b, "- … and %d more in `%s`\n", len(p.Contract.Interfaces)-i, ContractFile)
+			break
+		}
+		fmt.Fprintf(&b, "- **%s**", in.ID)
+		if in.Provider != "" {
+			fmt.Fprintf(&b, " (provided by `%s`", in.Provider)
+			if len(in.Consumers) > 0 {
+				fmt.Fprintf(&b, ", consumed by `%s`", strings.Join(in.Consumers, "`, `"))
+			}
+			b.WriteString(")")
+		}
+		if spec := strings.Join(strings.Fields(in.Spec), " "); spec != "" {
+			if len(spec) > maxSeamSpecChars {
+				spec = spec[:maxSeamSpecChars] + "…"
+			}
+			b.WriteString(" — " + spec)
+		}
+		b.WriteString("\n")
+	}
+	fmt.Fprintf(&b, "\nThe full contract is in `%s`. It is frozen: if it is wrong, report that "+
+		"in your output rather than diverging from it.\n", ContractFile)
+	return b.String()
+}
+
 func writeInterface(b *strings.Builder, in Interface) {
 	fmt.Fprintf(b, "- **%s**", in.ID)
 	if in.Spec != "" {
diff --git a/pkg/squads/seam_test.go b/pkg/squads/seam_test.go
new file mode 100644
index 0000000..67fc0c8
--- /dev/null
+++ b/pkg/squads/seam_test.go
@@ -0,0 +1,95 @@
+package squads
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/UnicoLab/slmcode/pkg/plan"
+)
+
+func seamPlan() *Plan {
+	return &Plan{
+		Squads: []Squad{
+			{ID: "backend", Name: "Backend", Charter: "BACKEND CHARTER: own the API", Owns: []string{"cmd/**", "internal/**"}},
+			{ID: "frontend", Name: "Frontend", Charter: "FRONTEND CHARTER: own the SPA", Owns: []string{"web/**"}},
+		},
+		Contract: Contract{Interfaces: []Interface{
+			{ID: "GET /api/todos", Provider: "backend", Consumers: []string{"frontend"}, Spec: "200 [{id,title,done}]"},
+			{ID: "POST /api/todos", Provider: "backend", Consumers: []string{"frontend"}, Spec: "body {title} -> 201 {id}"},
+			{ID: "VITE_API_BASE", Provider: "frontend", Consumers: []string{"backend"}, Spec: "env var the SPA reads"},
+		}},
+	}
+}
+
+// A task the router left unassigned BECAUSE it straddles the seam is the task
+// that most needs the contract. It gets the whole interface list — every ID —
+// and none of the squad charters.
+func TestSeamTaskGetsTheWholeContract(t *testing.T) {
+	p := seamPlan()
+	straddling := plan.Task{ID: "T3", Files: []string{"internal/http/todos.go", "web/src/api.ts"}}
+
+	brief := BriefFor(p, straddling)
+	if brief == "" {
+		t.Fatal("a task spanning two squads' territory got no brief at all")
+	}
+	for _, in := range p.Contract.Interfaces {
+		if !strings.Contains(brief, in.ID) {
+			t.Errorf("seam brief omits interface %q:\n%s", in.ID, brief)
+		}
+	}
+	if strings.Contains(brief, "CHARTER") {
+		t.Errorf("seam brief carries a squad charter — interfaces only:\n%s", brief)
+	}
+	if !strings.Contains(brief, "backend and frontend") {
+		t.Errorf("seam brief must name the squads it spans:\n%s", brief)
+	}
+	if !strings.Contains(brief, "provided by `backend`") || !strings.Contains(brief, "consumed by `frontend`") {
+		t.Errorf("seam brief must say which side owes each interface:\n%s", brief)
+	}
+}
+
+// The other cases are unchanged: an assigned task gets its own squad's brief,
+// and an unassigned task inside one territory (or none) gets nothing.
+func TestBriefForKeepsTheOtherCases(t *testing.T) {
+	p := seamPlan()
+	if got := BriefFor(p, plan.Task{Squad: "backend", Files: []string{"cmd/main.go"}}); !strings.Contains(got, "BACKEND CHARTER") {
+		t.Fatalf("an assigned task must get its squad's brief:\n%s", got)
+	}
+	if got := BriefFor(p, plan.Task{Files: []string{"web/src/App.tsx"}}); got != "" {
+		t.Fatalf("an unassigned task inside one territory got a brief:\n%s", got)
+	}
+	if got := BriefFor(p, plan.Task{Files: []string{"README.md"}}); got != "" {
+		t.Fatalf("an unassigned task outside every territory got a brief:\n%s", got)
+	}
+	if got := BriefFor(nil, plan.Task{Files: []string{"cmd/a.go", "web/b.ts"}}); got != "" {
+		t.Fatal("nil plan must yield no brief")
+	}
+}
+
+// The seam brief is pasted into a small model's prompt: the interface list is
+// capped and each spec clipped.
+func TestSeamBriefIsBounded(t *testing.T) {
+	p := seamPlan()
+	p.Contract.Interfaces = nil
+	long := strings.Repeat("shape ", 200)
+	for i := 0; i < maxSeamInterfaces+5; i++ {
+		p.Contract.Interfaces = append(p.Contract.Interfaces, Interface{
+			ID: "IFACE-" + string(rune('A'+i)), Provider: "backend", Consumers: []string{"frontend"}, Spec: long,
+		})
+	}
+	brief := p.SeamBrief([]string{"backend", "frontend"})
+	if !strings.Contains(brief, "and 5 more") {
+		t.Fatalf("the interface list was not capped:\n%s", brief)
+	}
+	if strings.Contains(brief, long) {
+		t.Fatal("a long spec was pasted whole")
+	}
+	if len(brief) > (maxSeamInterfaces+1)*(maxSeamSpecChars+120) {
+		t.Fatalf("seam brief is %d bytes — not bounded", len(brief))
+	}
+	// A plan with no contract still names the seam and says there is none.
+	p.Contract.Interfaces = nil
+	if got := p.SeamBrief([]string{"backend", "frontend"}); !strings.Contains(got, "froze no interfaces") {
+		t.Fatalf("a contract-less seam brief must say so:\n%s", got)
+	}
+}

From 071940bb1df6ae021b62f5662e9e5ced22f6968d Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 08:55:13 +0000
Subject: [PATCH 17/23] feat(loop): measured per-role budgets and latency
 samples for loop requests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Runner gains two optional hooks: RoleTimeout(ctx, role) returns the measured budget for one request of a role, and OnRoleLatency(role, d, evidence) reports how long each request took. execOne and dispatchWave dispatch on min(callTimeout, RoleTimeout(base role)) — the measured value can only tighten the flat Timeout — and report every request's duration under its base role (an escalation rung shares its base role's series) with the orchestrator's evidence rule: a success or a timeout counts, any other failure does not. reviewSlots sizes the reviewer slot from the same budget.

Workers, reviewers and correctors own most of a run's wall clock and used to run on the flat task_timeout while contributing no latency samples at all; with the hooks unset nothing changes.
---
 pkg/loop/budget.go                  |  78 +++++++++++++++
 pkg/loop/budget_roletimeout_test.go | 145 ++++++++++++++++++++++++++++
 pkg/loop/runner.go                  |  39 +++++++-
 3 files changed, 258 insertions(+), 4 deletions(-)
 create mode 100644 pkg/loop/budget_roletimeout_test.go

diff --git a/pkg/loop/budget.go b/pkg/loop/budget.go
index 232ad85..e901aa5 100644
--- a/pkg/loop/budget.go
+++ b/pkg/loop/budget.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"strings"
 	"sync"
+	"time"
 
 	"github.com/UnicoLab/slmcode/pkg/agents"
 	"github.com/UnicoLab/slmcode/pkg/stream"
@@ -220,6 +221,75 @@ func (r *Runner) budgetExhausted(taskID string) bool {
 	return r != nil && taskID != "" && r.budget().remaining(taskID) == 0
 }
 
+// roleBudget is the measured budget for one request of role, ignoring the
+// run's remaining runway: min(Timeout, RoleTimeout(base role)). It is what a
+// site with no ctx to hand (reviewSlots builds slots before the race starts)
+// uses; requestTimeout is the ctx-aware version every dispatch should use.
+func (r *Runner) roleBudget(role string) time.Duration {
+	if r == nil {
+		return 0
+	}
+	budget := r.Timeout
+	if r.RoleTimeout == nil {
+		return budget
+	}
+	base, _ := agents.BaseRoleID(role)
+	if measured := r.RoleTimeout(nil, base); measured > 0 && (budget <= 0 || measured < budget) {
+		return measured
+	}
+	return budget
+}
+
+// requestTimeout is the budget for one request of role right now:
+// callTimeout (the flat Timeout clamped to the runway) capped by the measured
+// per-role budget. The measured value can only TIGHTEN the flat one — the
+// orchestrator's policy already floors it per role class and ceilings it at
+// task_timeout, so nothing here can hand out more than Timeout.
+func (r *Runner) requestTimeout(ctx context.Context, role string) time.Duration {
+	if r == nil {
+		return 0
+	}
+	budget := r.callTimeout(ctx)
+	if r.RoleTimeout == nil {
+		return budget
+	}
+	base, _ := agents.BaseRoleID(role)
+	if measured := r.RoleTimeout(ctx, base); measured > 0 && (budget <= 0 || measured < budget) {
+		return measured
+	}
+	return budget
+}
+
+// applyRoleTimeout tightens req.Timeout to the measured budget for its role.
+// A request that arrived with no timeout gets the measured one; one that
+// arrived with a larger budget is cut down; a smaller one is left alone.
+func (r *Runner) applyRoleTimeout(ctx context.Context, req *ggagent.SubAgentRequest) {
+	if r == nil || req == nil {
+		return
+	}
+	want := r.requestTimeout(ctx, req.AgentID)
+	if want <= 0 {
+		return
+	}
+	if req.Timeout <= 0 || want < req.Timeout {
+		req.Timeout = want
+	}
+}
+
+// noteRoleLatency reports one request's duration to OnRoleLatency under the
+// BASE role (an escalation rung is the same role on a bigger model, and the
+// budget is looked up under the base too). Evidence follows the orchestrator's
+// rule: a success measures the role, a timeout is a censored lower bound worth
+// keeping, any other failure says nothing about how long the role needs.
+func (r *Runner) noteRoleLatency(role string, d time.Duration, err error, res ggagent.SubAgentResult) {
+	if r == nil || r.OnRoleLatency == nil || d <= 0 {
+		return
+	}
+	base, _ := agents.BaseRoleID(role)
+	failed := err != nil || res.Error != nil
+	r.OnRoleLatency(base, d, !failed || isTimeoutResult(err, res))
+}
+
 // execOne runs a single subagent request under the task's ctx tag, after
 // spending one unit of the task's call budget. It returns ok=false when the
 // budget refused the call — callers must escalate, never retry.
@@ -245,12 +315,20 @@ func (r *Runner) execOne(ctx context.Context, taskID, what string, req ggagent.S
 		return ggagent.SubAgentResult{Error: fmt.Errorf("nil executor")}, true
 	}
 	defer r.streamTokens(req.AgentID, taskID)()
+	// The measured per-role budget, not the flat task ceiling: reviewers and
+	// correctors own most of a run's wall clock and used to be the only roles
+	// that never contributed a latency sample nor received a measured budget.
+	r.applyRoleTimeout(ctx, &req)
+	start := time.Now()
 	res, err := r.Executor.ExecuteSubAgents(r.agentCtx(ctx, taskID, req.AgentID),
 		[]ggagent.SubAgentRequest{req}, r.Shared)
+	elapsed := time.Since(start)
 	if len(res) == 0 {
+		r.noteRoleLatency(req.AgentID, elapsed, err, ggagent.SubAgentResult{Error: err})
 		return ggagent.SubAgentResult{AgentID: req.AgentID, TaskID: taskID, Error: err}, true
 	}
 	out := res[0]
+	r.noteRoleLatency(req.AgentID, elapsed, err, out)
 	if out.Error == nil && err != nil && outputString(out) == "" {
 		out.Error = err
 	}
diff --git a/pkg/loop/budget_roletimeout_test.go b/pkg/loop/budget_roletimeout_test.go
new file mode 100644
index 0000000..458f6b6
--- /dev/null
+++ b/pkg/loop/budget_roletimeout_test.go
@@ -0,0 +1,145 @@
+package loop
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/UnicoLab/slmcode/pkg/agents"
+	"github.com/UnicoLab/slmcode/pkg/plan"
+	ggagent "github.com/piotrlaczkowski/GoLangGraph/pkg/agent"
+)
+
+// budgetTimeoutExec records the timeout each request carries and answers from a
+// script, so the clamp execOne applies is observable at the executor.
+type budgetTimeoutExec struct {
+	mu   sync.Mutex
+	reqs []ggagent.SubAgentRequest
+	err  error
+}
+
+func (e *budgetTimeoutExec) ExecuteSubAgents(_ context.Context, reqs []ggagent.SubAgentRequest,
+	_ *ggagent.SharedState) ([]ggagent.SubAgentResult, error) {
+	e.mu.Lock()
+	e.reqs = append(e.reqs, reqs...)
+	e.mu.Unlock()
+	time.Sleep(time.Millisecond)
+	if e.err != nil {
+		return []ggagent.SubAgentResult{{AgentID: reqs[0].AgentID, Error: e.err}}, e.err
+	}
+	return []ggagent.SubAgentResult{{AgentID: reqs[0].AgentID, TaskID: reqs[0].TaskID, Output: "ok"}}, nil
+}
+
+func (e *budgetTimeoutExec) last() ggagent.SubAgentRequest {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	return e.reqs[len(e.reqs)-1]
+}
+
+type latencyNote struct {
+	role     string
+	d        time.Duration
+	evidence bool
+}
+
+// execOne dispatches on min(callTimeout, RoleTimeout(base role)) and reports
+// every request's duration under the base role with the orchestrator's
+// evidence rule.
+func TestExecOneUsesTheMeasuredRoleBudget(t *testing.T) {
+	exec := &budgetTimeoutExec{}
+	var mu sync.Mutex
+	var notes []latencyNote
+	r := &Runner{
+		Timeout:  8 * time.Minute,
+		Executor: exec,
+		RoleTimeout: func(_ context.Context, role string) time.Duration {
+			if role == plan.RoleReviewer {
+				return time.Minute
+			}
+			return 0 // no measurement: keep the flat budget
+		},
+		OnRoleLatency: func(role string, d time.Duration, evidence bool) {
+			mu.Lock()
+			notes = append(notes, latencyNote{role, d, evidence})
+			mu.Unlock()
+		},
+	}
+	ctx := context.Background()
+
+	// A measured role is tightened to its budget.
+	if _, ok := r.execOne(ctx, "T1", "review", ggagent.SubAgentRequest{
+		AgentID: plan.RoleReviewer, Timeout: r.callTimeout(ctx)}); !ok {
+		t.Fatal("execOne refused the call")
+	}
+	if got := exec.last().Timeout; got != time.Minute {
+		t.Fatalf("reviewer dispatched with %v, want the measured 1m", got)
+	}
+
+	// An unmeasured role keeps the flat budget; an escalation rung is looked
+	// up and recorded under its BASE role.
+	escalated := agents.EscalatedRoleID(plan.RoleWorker, 2)
+	if _, ok := r.execOne(ctx, "T1", "worker", ggagent.SubAgentRequest{
+		AgentID: escalated, Timeout: r.callTimeout(ctx)}); !ok {
+		t.Fatal("execOne refused the call")
+	}
+	if got := exec.last().Timeout; got != 8*time.Minute {
+		t.Fatalf("unmeasured worker dispatched with %v, want the flat 8m", got)
+	}
+
+	// A request that arrived tighter than the measurement stays tight.
+	if _, ok := r.execOne(ctx, "T1", "review", ggagent.SubAgentRequest{
+		AgentID: plan.RoleReviewer, Timeout: 10 * time.Second}); !ok {
+		t.Fatal("execOne refused the call")
+	}
+	if got := exec.last().Timeout; got != 10*time.Second {
+		t.Fatalf("a tighter caller budget was widened to %v", got)
+	}
+
+	// The ctx-less variant used by reviewSlots agrees.
+	if got := r.roleBudget(plan.RoleReviewer); got != time.Minute {
+		t.Fatalf("roleBudget(reviewer) = %v, want 1m", got)
+	}
+	if got := r.roleBudget(escalated); got != 8*time.Minute {
+		t.Fatalf("roleBudget(escalated worker) = %v, want 8m", got)
+	}
+
+	mu.Lock()
+	defer mu.Unlock()
+	if len(notes) != 3 {
+		t.Fatalf("recorded %d latency samples for 3 requests: %+v", len(notes), notes)
+	}
+	if notes[1].role != plan.RoleWorker {
+		t.Fatalf("escalated request recorded under %q, want the base role %q", notes[1].role, plan.RoleWorker)
+	}
+	for _, n := range notes {
+		if !n.evidence || n.d <= 0 {
+			t.Fatalf("a successful call is evidence with a positive duration: %+v", n)
+		}
+	}
+}
+
+// A provider error that returns in two seconds says nothing about how long the
+// role needs: recorded as non-evidence, exactly as the phase roles do.
+func TestExecOneDoesNotCountAProviderErrorAsLatencyEvidence(t *testing.T) {
+	exec := &budgetTimeoutExec{err: errors.New("chat failed: 502")}
+	var got []latencyNote
+	r := &Runner{
+		Timeout:  time.Minute,
+		Executor: exec,
+		OnRoleLatency: func(role string, d time.Duration, evidence bool) {
+			got = append(got, latencyNote{role, d, evidence})
+		},
+	}
+	r.execOne(context.Background(), "T1", "worker", ggagent.SubAgentRequest{AgentID: plan.RoleWorker})
+	if len(got) != 1 || got[0].evidence {
+		t.Fatalf("a provider error was recorded as evidence: %+v", got)
+	}
+	// Without the hooks nothing changes: the request keeps what it came with.
+	bare := &Runner{Timeout: time.Minute, Executor: &budgetTimeoutExec{}}
+	bare.execOne(context.Background(), "T1", "worker", ggagent.SubAgentRequest{AgentID: plan.RoleWorker, Timeout: 30 * time.Second})
+	if got := bare.Executor.(*budgetTimeoutExec).last().Timeout; got != 30*time.Second {
+		t.Fatalf("with no RoleTimeout the request timeout changed to %v", got)
+	}
+}
diff --git a/pkg/loop/runner.go b/pkg/loop/runner.go
index 48c7589..ed03797 100644
--- a/pkg/loop/runner.go
+++ b/pkg/loop/runner.go
@@ -132,6 +132,18 @@ type Runner struct {
 	OnEventFull StructuredEvent
 	OnUsage     UsageEvent
 	BuildInput  BuildInput
+	// RoleTimeout returns the measured per-role budget for one request of
+	// role (an agent id; an escalation rung suffix is stripped before the
+	// lookup). The loop dispatches on min(callTimeout, RoleTimeout), so a
+	// reviewer that answers in 20s is given its measured floor rather than
+	// the whole task_timeout, and a stuck one is cut short accordingly. nil
+	// or a non-positive answer keeps the flat Timeout.
+	RoleTimeout func(ctx context.Context, role string) time.Duration
+	// OnRoleLatency reports how long one request of role took. evidence is
+	// true for a success or a timeout (a censored lower bound), false for
+	// any other failure — the same rule the orchestrator's phase roles use,
+	// so the samples land in the same latency memory on the same footing.
+	OnRoleLatency func(role string, d time.Duration, evidence bool)
 
 	// ── contract with the orchestrator ──────────────────────────────────────
 
@@ -1246,10 +1258,25 @@ func (r *Runner) dispatchWave(ctx context.Context, reqs []ggagent.SubAgentReques
 	if len(reqs) == 0 {
 		return nil, nil
 	}
+	// Each worker request is dispatched on the measured budget for ITS role and
+	// contributes a latency sample under it — the base agent id, so an
+	// escalation rung and the role it escalated from share one measurement.
+	for i := range reqs {
+		r.applyRoleTimeout(ctx, &reqs[i])
+	}
 	if len(reqs) == 1 {
 		defer r.streamTokens(reqs[0].AgentID, reqs[0].TaskID)()
-		return r.Executor.ExecuteSubAgents(
+		start := time.Now()
+		out, err := r.Executor.ExecuteSubAgents(
 			r.agentCtx(ctx, reqs[0].TaskID, reqs[0].AgentID), reqs, r.Shared)
+		var first ggagent.SubAgentResult
+		if len(out) > 0 {
+			first = out[0]
+		} else {
+			first = ggagent.SubAgentResult{Error: err}
+		}
+		r.noteRoleLatency(reqs[0].AgentID, time.Since(start), err, first)
+		return out, err
 	}
 
 	results := make([]ggagent.SubAgentResult, len(reqs))
@@ -1264,14 +1291,16 @@ func (r *Runner) dispatchWave(ctx context.Context, reqs []ggagent.SubAgentReques
 			// exactly what the terminal needs to keep four concurrent workers'
 			// deltas apart.
 			defer r.streamTokens(req.AgentID, req.TaskID)()
+			start := time.Now()
 			out, err := r.Executor.ExecuteSubAgents(
 				r.agentCtx(ctx, req.TaskID, req.AgentID), []ggagent.SubAgentRequest{req}, r.Shared)
 			errs[i] = err
 			if len(out) > 0 {
 				results[i] = out[0]
-				return
+			} else {
+				results[i] = ggagent.SubAgentResult{AgentID: req.AgentID, TaskID: req.TaskID, Error: err}
 			}
-			results[i] = ggagent.SubAgentResult{AgentID: req.AgentID, TaskID: req.TaskID, Error: err}
+			r.noteRoleLatency(req.AgentID, time.Since(start), err, results[i])
 		}(i)
 	}
 	wg.Wait()
@@ -1912,7 +1941,9 @@ func (r *Runner) reviewSlots(current plan.Task, g gateState, baseline map[string
 	base := baseline
 	// Use a shorter reviewer timeout when disk evidence already exists — the
 	// acceptance probe should win quickly; the full 12 min is excessive.
-	revTimeout := r.Timeout
+	// roleBudget is the reviewer's MEASURED budget when one exists (see
+	// Runner.RoleTimeout), the flat Timeout otherwise.
+	revTimeout := r.roleBudget(revRole)
 	if g.hasEvidence() {
 		revTimeout = 3 * time.Minute
 	}

From 4bd18c7beb0ac0b47dc04020ecbe1db393a0b59f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 08:55:13 +0000
Subject: [PATCH 18/23] fix(orchestrator): one run-wide concurrency gate, smoke
 memo, per-run team state, early team gate, fewer idle model calls

One concurrency limit. max_parallel was enforced only in the execute wave; context ran beside explore, architect beside clarify, speculative digs and review races added slots. Every model request now takes a slot of one run-wide weighted semaphore sized max_parallel, acquired in the executor adapter handed to the loop, in runRoleTracked and around the multipass cycle; the phase pairs run sequentially at max_parallel=1. llm_requests counts every assistant turn of a result's transcript instead of one per result, and the multipass passes are counted too.

Measured role timeouts in the loop. buildRunner wires Runner.RoleTimeout to roleTimeoutWithin and Runner.OnRoleLatency to recordRoleLatency, so loop roles are dispatched on their measured budget and finally feed latency memory.

Smoke memo. runSmokeIn remembers each command's result per (command, tree fingerprint) for the run and reuses it until something is written; the fingerprint now carries a write sequence so a rewrite of an already-changed file counts, and the formatter and a dependency install advance it. The pre-test result is handed to runQAGate for round 1; team acceptance and integration check gateRoundAffordable before running. The QA bootstrap is applied once per tree state.

Stale per-run state. Team gates, the squad plan, the single team and the team selection memo are reset at the top of both runSLM and Resume; the squad plan write is locked; restoreSquadPlan restores a one-squad squads.json as the single staffing team. Correction attempts for team tickets are now counted under the key the ticket is stamped with (they were looked up under a key nothing matched, so every ticket was attempt 1).

Model calls with nothing to do. The memory distillation runs single-shot and only when the run left a notable lesson, a changed file or a failed task; the per-wave distillation and after-wave coordinator run only on a wave that failed, escalated or produced a notable lesson; the splitter is skipped for a one-step plan over one or two known files. Every skip is announced as an info event with its reason.

Early team gate. AfterWave proves a team's half as soon as its lane is complete and has changed since it was last proved, so a red half's ticket rides the next wave; a defect is ticketed at most twice per run, then handed to a human.

Team selection is memoized per run so the composer and the charter phase do not both rescan the workspace and reload the block library.
---
 docs/calibration.md                    |  21 ++
 docs/pipeline.md                       |  30 +++
 docs/squads.md                         |  45 ++++
 pkg/orchestrator/compose_teams.go      |  31 +++
 pkg/orchestrator/context_wiring.go     |  58 ++++-
 pkg/orchestrator/earlygate_test.go     | 203 +++++++++++++++++
 pkg/orchestrator/gate.go               | 178 +++++++++++++++
 pkg/orchestrator/gate_test.go          | 296 +++++++++++++++++++++++++
 pkg/orchestrator/gaterunway_test.go    |   2 +-
 pkg/orchestrator/looptimeout_test.go   | 126 +++++++++++
 pkg/orchestrator/orchestrator.go       | 125 +++++++++--
 pkg/orchestrator/parallel.go           |  34 +++
 pkg/orchestrator/plansplit.go          |  54 ++++-
 pkg/orchestrator/qagate.go             | 140 +++++++++++-
 pkg/orchestrator/qagate_cancel_test.go |   4 +-
 pkg/orchestrator/resume.go             |  84 +++++--
 pkg/orchestrator/runner.go             |  39 +++-
 pkg/orchestrator/skips_test.go         | 166 ++++++++++++++
 pkg/orchestrator/smokememo_test.go     | 184 +++++++++++++++
 pkg/orchestrator/squads.go             |   7 +
 pkg/orchestrator/teamgate.go           | 288 +++++++++++++++++++-----
 pkg/orchestrator/teamstate_test.go     | 147 ++++++++++++
 22 files changed, 2152 insertions(+), 110 deletions(-)
 create mode 100644 pkg/orchestrator/earlygate_test.go
 create mode 100644 pkg/orchestrator/gate.go
 create mode 100644 pkg/orchestrator/gate_test.go
 create mode 100644 pkg/orchestrator/looptimeout_test.go
 create mode 100644 pkg/orchestrator/skips_test.go
 create mode 100644 pkg/orchestrator/smokememo_test.go
 create mode 100644 pkg/orchestrator/teamstate_test.go

diff --git a/docs/calibration.md b/docs/calibration.md
index 7fb14a6..01aec23 100644
--- a/docs/calibration.md
+++ b/docs/calibration.md
@@ -170,6 +170,27 @@ That last one is the delicate one, so it has three guardrails:
   The seed can only ever tighten a budget for a model fast enough that a role
   provably does not need the whole ceiling.
 
+Where the two numbers are enforced:
+
+* **`max_parallel` is one run-wide limit.** Every model request the harness
+  makes — the phase roles, the execute loop's workers, reviewers and
+  correctors, self-critique, triage, the speculative review race, the planner's
+  multipass cycle — takes a slot of a single gate sized `max_parallel`. It used
+  to bound only the execute wave, while context ran beside explore and a review
+  race added slots of its own, so a `max_parallel: 1` endpoint still saw two or
+  three requests queue on each other and every measured role timeout was
+  inflated by queueing the harness itself created. At `max_parallel: 1` the
+  phase pairs also run sequentially instead of racing for the one slot.
+* **Role latency memory covers the execute loop too.** The measured budget
+  (`p95 × 1.5`, floored per role class, capped at `task_timeout`) used to apply
+  only to the phase roles; workers, reviewers and correctors ran on the flat
+  `task_timeout` and recorded no samples, so `reviewer` had none after a
+  hundred runs. Each loop request is now dispatched on
+  `min(task_timeout clamped to the runway, measured budget)` and records a
+  sample under its base role (an escalation rung shares its base role's
+  series). A reviewer measured at 20s is given its 60s floor, not the whole
+  ceiling.
+
 ## Commands
 
 ```
diff --git a/docs/pipeline.md b/docs/pipeline.md
index 57cf7c9..389f647 100644
--- a/docs/pipeline.md
+++ b/docs/pipeline.md
@@ -192,6 +192,36 @@ Custom presets can be created as YAML blocks — see [🧱 Blocks](blocks.md).
 
 ---
 
+## What a run skips, and why
+
+A phase that is *enabled* still only runs when it has something to do. Every
+skip is announced as an info event in the phase's own lane, so the Live view
+and the CLI show the reason rather than a phase that silently did not happen.
+
+| Phase | Runs when | Skipped with |
+|-------|-----------|--------------|
+| `split` (the splitter) | the plan has two or more steps, or one step over more than two known files, or no known file at all | `splitter skipped — a 1-step plan over N known file(s) is one task; building the board directly`. The board is built from the plan's one step with the known files as its scope. |
+| per-wave coordinator (`coord @after-wave`) | the wave that just finished failed a task, escalated one, or produced a lesson worth keeping — a failure lesson or an honored human note; the routine "this task passed its acceptance" lessons every green task yields do not count | `coordinator @after-wave skipped — all N task(s) finished green with no failure, escalation or new lesson` |
+| per-wave distillation (`learn`, `think_passes >= 2`) | same rule as the coordinator | `wave distillation skipped — …` |
+| `memory` (end-of-run distillation) | the run left a lesson worth keeping (same notion), changed a file, or failed a task | `memory distillation skipped — nothing to distill: no lessons, no changed files, no failed tasks`. The distiller is a single call now, not a multipass cycle. |
+
+Two more things the pipeline no longer repeats:
+
+- **One concurrency limit for the whole run.** `max_parallel` used to bound only
+  the execute wave; context ran beside explore, architect beside clarify,
+  speculative digs and review races added slots on top. Every model request —
+  phase roles, workers, reviewers, correctors, critique, triage, the planner's
+  multipass cycle — now takes a slot of one run-wide gate sized `max_parallel`,
+  and at `max_parallel: 1` the phase pairs run one after another.
+- **The objective command runs once per tree state.** The deterministic
+  pre-test, each team's acceptance, the integration command and the QA gate's
+  first round all ask the same question of the same tree; a result is
+  remembered per (command, tree fingerprint) and reused until something is
+  written — an agent write, a rewrite of an already-changed file, a formatter
+  pass or a dependency install all count.
+
+---
+
 ## Related
 
 - [Blocks](blocks.md) — building blocks system + marketplace
diff --git a/docs/squads.md b/docs/squads.md
index 2e8f934..cfe6e37 100644
--- a/docs/squads.md
+++ b/docs/squads.md
@@ -257,6 +257,15 @@ stay **unassigned**, exactly as before:
   A file nobody owns cannot go to a piece, and dropping it would silently narrow
   the work, so the whole task is left alone.
 
+A task that stays unassigned **because** it straddles is still handed the
+contract. It used to get no brief at all — a worker on no team got no squad
+brief, and the one agent on the run building both sides of the seam was the one
+building without the interface spec. It now gets a **seam brief**: the squads it
+spans and what each owns, then every interface of the frozen contract with its
+provider, consumers and a clipped spec. Interfaces only, no charters — the
+worker is on neither team and needs the seam, not the missions — capped at a
+dozen interfaces so it stays a brief on a 30B-class prompt.
+
 ### 3d. The halves stop waiting on each other
 
 Letting both teams build **at once** is the point of freezing the seam. The
@@ -501,6 +510,42 @@ nothing:
 The result is on the board, per team: **proved green**, **half is red**, or
 **unverified** with the reason.
 
+### A lane is proved the moment it finishes
+
+The finish path proves every half once the *whole* board has drained. On a
+two-team run that is late: the backend can finish in wave 1 with a broken build
+and sit green-on-the-board for every wave the frontend still needs, its ticket
+raised only after the frontend's last task — a whole extra wave the run may no
+longer have time for. So a half is also proved **between waves**, as soon as
+`squads.Progress` reports its lane complete and the run has written inside its
+territory since it was last proved:
+
+```text
+verify  team backend-go finished its lane — proving its half before the next wave
+verify  team backend-go is RED — its own half does not pass: FAIL: TestMain
+verify  raised a correction ticket for team backend-go
+verify  team backend-go's correction ticket rides the next wave
+```
+
+Three rules keep this cheap and bounded:
+
+- **Once per lane state.** A team is re-proved only when *its own* changed files
+  moved (a rewrite of an already-changed file counts; the other team's writes do
+  not). Nothing written in its territory yet means nothing to prove yet.
+- **Once per tree state, across every gate.** Command results are remembered per
+  (command, tree fingerprint) for the run, so the finish-path gate on a tree
+  nothing has touched since costs no second run — nor does the QA gate's first
+  round after the pre-test, nor the integration command after the halves.
+- **Two tickets per defect, then a human.** The same acceptance failing again
+  after its ticket was worked to done is a defect the team cannot fix alone;
+  a third ticket is refused and said so. Without the cap a half that stays red
+  would be ticketed on every wave until the run hit its ceiling.
+
+A gate that would not fit in the time left is skipped with a reason and the half
+reported UNVERIFIED, for the between-wave gate, the finish-path gate and the
+integration command alike — overrunning the report is worse than one unproved
+half.
+
 ### A failing run says which halves were proved
 
 A task that escalates fails the whole run — the escalation is exactly the signal
diff --git a/pkg/orchestrator/compose_teams.go b/pkg/orchestrator/compose_teams.go
index 780c4b1..8698e0c 100644
--- a/pkg/orchestrator/compose_teams.go
+++ b/pkg/orchestrator/compose_teams.go
@@ -119,8 +119,34 @@ func (o *Orchestrator) decideTeams(query string, inventory []string, pins []stri
 	}
 }
 
+// teamPick is one run's library team selection, computed once.
+//
+// decideTeams (the composer) and teamsFromLibrary (the charter phase) both
+// used to call preselectTeams, and each call listed up to 2000 workspace
+// files and reloaded the block library to reach the same deterministic
+// answer. The selection is a pure function of the query, the tree and the
+// pins, none of which change between those two phases, so it is memoized
+// for the run and cleared with the rest of the team state.
+type teamPick struct {
+	query  string
+	sel    teams.Selection
+	roster []teams.Team
+}
+
 // preselectTeamsWith is preselectTeams with the run-level pin overridden.
+//
+// Only the run path (pins == nil) is memoized: a preview asks about pins the
+// run does not have, and must not be answered from the run's cache nor
+// pollute it.
 func (o *Orchestrator) preselectTeamsWith(query string, inventory []string, pins []string) (teams.Selection, []teams.Team) {
+	if pins == nil {
+		o.mu.Lock()
+		cached := o.teamPick
+		o.mu.Unlock()
+		if cached != nil && cached.query == query {
+			return cached.sel, cached.roster
+		}
+	}
 	roster := o.teamRoster()
 	if len(roster) == 0 {
 		return teams.Selection{}, nil
@@ -132,6 +158,11 @@ func (o *Orchestrator) preselectTeamsWith(query string, inventory []string, pins
 	sel := teams.Select(roster, teams.Signals{Query: query, Files: files}, teams.Options{
 		Pinned: o.pinnedTeamsWith(pins),
 	})
+	if pins == nil {
+		o.mu.Lock()
+		o.teamPick = &teamPick{query: query, sel: sel, roster: roster}
+		o.mu.Unlock()
+	}
 	return sel, roster
 }
 
diff --git a/pkg/orchestrator/context_wiring.go b/pkg/orchestrator/context_wiring.go
index dfc7981..1c6dcb6 100644
--- a/pkg/orchestrator/context_wiring.go
+++ b/pkg/orchestrator/context_wiring.go
@@ -177,14 +177,19 @@ func (o *Orchestrator) noteChangedFiles(paths ...string) {
 	o.mu.Lock()
 	defer o.mu.Unlock()
 	if o.changedFiles == nil {
-		o.changedFiles = map[string]bool{}
+		o.changedFiles = map[string]int{}
 	}
 	for _, p := range paths {
 		rel := strings.TrimSpace(p)
 		if rel == "" {
 			continue
 		}
-		o.changedFiles[rel] = true
+		// Every write advances the sequence and the path's own count, a
+		// rewrite of an already-changed file included: the path SET is what
+		// the formatter needs, the counts are what "has this moved since"
+		// needs — for the whole tree (writeSeq) and for one team's lane.
+		o.writeSeq++
+		o.changedFiles[rel]++
 	}
 }
 
@@ -209,6 +214,53 @@ func (o *Orchestrator) resetChangedFiles() {
 		return
 	}
 	o.mu.Lock()
-	o.changedFiles = map[string]bool{}
+	o.changedFiles = map[string]int{}
+	o.writeSeq = 0
+	o.mu.Unlock()
+}
+
+// changedFileWrites returns, for each changed path, how many times the run
+// has written it. Sorted by path.
+func (o *Orchestrator) changedFileWrites() []fileWrites {
+	if o == nil {
+		return nil
+	}
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	out := make([]fileWrites, 0, len(o.changedFiles))
+	for p, n := range o.changedFiles {
+		out = append(out, fileWrites{Path: p, Writes: n})
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Path < out[j].Path })
+	return out
+}
+
+// fileWrites is one changed path and its write count.
+type fileWrites struct {
+	Path   string
+	Writes int
+}
+
+// writeSequence is how many writes the run has recorded so far.
+func (o *Orchestrator) writeSequence() int {
+	if o == nil {
+		return 0
+	}
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	return o.writeSeq
+}
+
+// noteTreeMutation records that something OTHER than an agent write changed
+// the tree or its ability to run — the formatter rewriting changed files, a
+// dependency install — so a command result taken before it is not reused
+// after it. It adds no path to the changed set: those passes touch nothing
+// the run should be asked to format again.
+func (o *Orchestrator) noteTreeMutation() {
+	if o == nil {
+		return
+	}
+	o.mu.Lock()
+	o.writeSeq++
 	o.mu.Unlock()
 }
diff --git a/pkg/orchestrator/earlygate_test.go b/pkg/orchestrator/earlygate_test.go
new file mode 100644
index 0000000..0247f01
--- /dev/null
+++ b/pkg/orchestrator/earlygate_test.go
@@ -0,0 +1,203 @@
+package orchestrator
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/UnicoLab/slmcode/pkg/loop"
+	"github.com/UnicoLab/slmcode/pkg/plan"
+	"github.com/UnicoLab/slmcode/pkg/quality"
+	ggagent "github.com/piotrlaczkowski/GoLangGraph/pkg/agent"
+)
+
+// laneExec is a worker that writes each task's file and reports the write the
+// way the tool layer would, so the team's lane fingerprint moves.
+type laneExec struct {
+	root    string
+	files   map[string]string // task id → the file it writes
+	onWrite func(path string)
+}
+
+func (e *laneExec) ExecuteSubAgents(_ context.Context, reqs []ggagent.SubAgentRequest,
+	_ *ggagent.SharedState) ([]ggagent.SubAgentResult, error) {
+	out := make([]ggagent.SubAgentResult, 0, len(reqs))
+	for _, req := range reqs {
+		if strings.Contains(req.AgentID, "review") {
+			out = append(out, ggagent.SubAgentResult{AgentID: req.AgentID, TaskID: req.TaskID,
+				Output: `{"approved":true,"score":90,"summary":"ok","issues":[]}`})
+			continue
+		}
+		rel, ok := e.files[req.TaskID]
+		if !ok {
+			// A correction ticket: it works the backend's file again.
+			rel = "cmd/main.go"
+		}
+		full := filepath.Join(e.root, filepath.FromSlash(rel))
+		_ = os.MkdirAll(filepath.Dir(full), 0o755)
+		_ = os.WriteFile(full, []byte("package main\n// "+req.TaskID+"\n"), 0o600)
+		if e.onWrite != nil {
+			e.onWrite(rel)
+		}
+		out = append(out, ggagent.SubAgentResult{AgentID: req.AgentID, TaskID: req.TaskID,
+			Output: fmt.Sprintf("Observation: ws_edit edited %s (1 replacement(s))\n", rel) +
+				fmt.Sprintf(`{"status":"done","summary":"done","files_changed":[%q]}`, rel)})
+	}
+	return out, nil
+}
+
+// A two-team board. The backend finishes its lane in wave 1 with a failing
+// acceptance command. Its correction ticket must exist BEFORE wave 2 is
+// announced, so the fix rides the next wave rather than waiting for the finish
+// path — where it used to be raised only after the frontend's last task.
+func TestARedHalfIsTicketedBeforeTheNextWave(t *testing.T) {
+	var mu sync.Mutex
+	var timeline []string
+	note := func(s string) {
+		mu.Lock()
+		timeline = append(timeline, s)
+		mu.Unlock()
+	}
+	o, _ := gateOrchestrator(t, func(cmd string) quality.SmokeResult {
+		if strings.HasPrefix(cmd, "go test") {
+			return quality.SmokeResult{Ran: true, OK: false, Command: cmd,
+				Summary: "FAIL: TestMain", Output: "--- FAIL: TestMain\ncmd/main.go:3: boom\nFAIL"}
+		}
+		return quality.SmokeResult{Ran: true, OK: true, Command: cmd, Summary: "ok"}
+	})
+	o.onEvent = func(e Event) { note("event: " + e.Message) }
+	exec := &laneExec{root: o.cfg.Root, onWrite: func(p string) { o.noteChangedFiles(p) },
+		files: map[string]string{"T1": "cmd/main.go", "T2": "web/App.tsx"}}
+
+	r := loop.NewRunner(exec, ggagent.NewSharedState())
+	r.Root = o.cfg.Root
+	r.MaxParallel = 1 // one task per wave: backend first, frontend after
+	r.MaxRetries = 0
+	r.MaxWaves = 3
+	r.IdleWait = time.Millisecond
+	r.Timeout = 5 * time.Second
+	r.PostWorkerSmoke = false
+	r.RequireSmoke = false
+	r.StaticQuality = false
+	r.ClaimsGate = false
+	r.WorkerCritique = false
+	r.ReviewParallel = false
+	r.Squads = o.squadPlanNow()
+	r.Log = func(format string, args ...interface{}) {
+		if msg := fmt.Sprintf(format, args...); strings.HasPrefix(msg, "wave:") {
+			note("log: " + msg)
+		}
+	}
+	// Exactly what buildRunner installs.
+	r.AfterWave = func(ctx context.Context, board *plan.Board, _ []plan.Task) { o.earlyTeamGate(ctx, board) }
+
+	board := &plan.Board{QueryID: "run-teams", Query: "build both halves", Tasks: []plan.Task{
+		{ID: "T1", Title: "backend handler", Squad: "backend", Role: plan.RoleWorker, Column: plan.ColReadyToDev,
+			Description: "write cmd/main.go", Acceptance: "compiles", Files: []string{"cmd/main.go"}},
+		{ID: "T2", Title: "frontend page", Squad: "frontend", Role: plan.RoleWorker, Column: plan.ColReadyToDev,
+			Description: "write web/App.tsx", Acceptance: "renders", Files: []string{"web/App.tsx"}},
+	}}
+	if err := r.RunBoard(context.Background(), board); err != nil {
+		t.Fatalf("RunBoard: %v", err)
+	}
+
+	mu.Lock()
+	tl := append([]string(nil), timeline...)
+	mu.Unlock()
+	ticketAt, wave2At, waves := -1, -1, 0
+	for i, s := range tl {
+		if strings.HasPrefix(s, "log: wave:") {
+			waves++
+			if waves == 2 && wave2At < 0 {
+				wave2At = i
+			}
+		}
+		if ticketAt < 0 && strings.Contains(s, "raised a correction ticket for team backend") {
+			ticketAt = i
+		}
+	}
+	if ticketAt < 0 {
+		t.Fatalf("no correction ticket was raised for the red backend half:\n%s", strings.Join(tl, "\n"))
+	}
+	if wave2At < 0 {
+		t.Fatalf("the board never announced a second wave:\n%s", strings.Join(tl, "\n"))
+	}
+	if ticketAt > wave2At {
+		t.Fatalf("the backend ticket (line %d) was raised AFTER wave 2 was announced (line %d):\n%s",
+			ticketAt, wave2At, strings.Join(tl, "\n"))
+	}
+
+	var ticket *plan.Task
+	for i := range board.Tasks {
+		if board.Tasks[i].Squad == "backend" && board.Tasks[i].ID != "T1" {
+			ticket = &board.Tasks[i]
+		}
+	}
+	if ticket == nil {
+		t.Fatalf("the ticket is not on the board: %+v", board.Tasks)
+	}
+	// The gate is on the record, red, for the UI.
+	var backend TeamGate
+	for _, g := range o.TeamGates() {
+		if g.Team == "backend" {
+			backend = g
+		}
+	}
+	if !backend.Ran || backend.OK {
+		t.Fatalf("backend gate = %+v, want proved RED", backend)
+	}
+}
+
+// The between-wave gate proves a lane once per state of that lane: not before
+// the team wrote anything in its territory, not again while nothing in it has
+// moved, and not for a team whose lane is still open.
+func TestEarlyTeamGateProvesEachLaneStateOnce(t *testing.T) {
+	var ran []string
+	o, _ := gateOrchestrator(t, func(cmd string) quality.SmokeResult {
+		ran = append(ran, cmd)
+		return quality.SmokeResult{Ran: true, OK: true, Command: cmd, Summary: "ok"}
+	})
+	ctx := context.Background()
+	board := &plan.Board{Tasks: []plan.Task{
+		{ID: "T1", Squad: "backend", Column: plan.ColDone, Status: "done", Files: []string{"cmd/main.go"}},
+		{ID: "T2", Squad: "frontend", Column: plan.ColReadyToDev, Files: []string{"web/App.tsx"}},
+	}}
+
+	// Complete, but nothing written in its territory yet: nothing to prove.
+	o.earlyTeamGate(ctx, board)
+	if len(ran) != 0 {
+		t.Fatalf("proved a lane the run never wrote to: %v", ran)
+	}
+
+	o.noteChangedFiles("cmd/main.go")
+	o.earlyTeamGate(ctx, board)
+	o.earlyTeamGate(ctx, board)
+	if len(ran) != 1 || ran[0] != "go test ./..." {
+		t.Fatalf("backend proved %d time(s) on one lane state (%v), want once", len(ran), ran)
+	}
+
+	// The frontend's lane is still open: never proved early.
+	o.noteChangedFiles("web/App.tsx")
+	o.earlyTeamGate(ctx, board)
+	if len(ran) != 1 {
+		t.Fatalf("a team with open work was proved: %v", ran)
+	}
+
+	// The backend lane moved: proved again — through the memo, so the
+	// finish-path gate on the same tree costs no further run.
+	o.noteChangedFiles("cmd/other.go")
+	o.earlyTeamGate(ctx, board)
+	if len(ran) != 2 {
+		t.Fatalf("a moved lane was not re-proved: %v", ran)
+	}
+	board.Tasks[1].Column, board.Tasks[1].Status = plan.ColDone, "done"
+	o.runTeamAcceptance(ctx, board)
+	if len(ran) != 3 { // backend from the memo, frontend for the first time
+		t.Fatalf("finish path ran %d command(s) in total, want 3: %v", len(ran), ran)
+	}
+}
diff --git a/pkg/orchestrator/gate.go b/pkg/orchestrator/gate.go
new file mode 100644
index 0000000..62af837
--- /dev/null
+++ b/pkg/orchestrator/gate.go
@@ -0,0 +1,178 @@
+package orchestrator
+
+import (
+	"context"
+	"strings"
+
+	"github.com/UnicoLab/slmcode/pkg/loop"
+	ggagent "github.com/piotrlaczkowski/GoLangGraph/pkg/agent"
+)
+
+// ── One run-wide concurrency limit ───────────────────────────────────────
+//
+// max_parallel is the measured concurrency knee of the model endpoint
+// (calibration, docs/calibration.md), and for the fastest local models it is
+// often 1: a second in-flight request does not run alongside the first, it
+// queues behind it and inflates BOTH latencies. The knee used to be enforced in
+// exactly one place — the execute wave — while everything else fanned out on
+// its own: context ran beside explore, architect beside clarify, the explore
+// phase's speculative digs added slots, review races added slots, and a wave's
+// reviews multiplied them. On a max_parallel=1 endpoint that is not a
+// throughput loss, it is a latency loss on every request the harness makes,
+// and the measured role timeouts were then blown by queueing the harness
+// itself created.
+//
+// The gate is a weighted semaphore of max_parallel slots, acquired in the ONE
+// adapter every model request passes through: runRoleTracked (phase roles),
+// the executor handed to loop.NewRunner (workers, reviewers, correctors,
+// critique, triage, speculative reviews) and the multipass runner (planner
+// and splitter). Phase pairs that used to be unconditionally parallel also
+// run sequentially when max_parallel is 1 — see runPhases.
+
+// runGate is the run-wide semaphore. A nil gate admits everything.
+type runGate struct {
+	slots chan struct{}
+	size  int
+}
+
+// newRunGate sizes the gate. n < 1 is normalized to 1: a zero-valued limit
+// must mean "one at a time", never "nothing may run".
+func newRunGate(n int) *runGate {
+	if n < 1 {
+		n = 1
+	}
+	return &runGate{slots: make(chan struct{}, n), size: n}
+}
+
+// acquire takes weight slots, clamped to [1, size] so a batch larger than the
+// gate cannot deadlock on itself, and returns the matching release. It
+// returns ctx.Err() when the run is canceled while waiting, in which case
+// nothing is held and release is a no-op.
+func (g *runGate) acquire(ctx context.Context, weight int) (release func(), err error) {
+	if g == nil {
+		return func() {}, nil
+	}
+	if weight < 1 {
+		weight = 1
+	}
+	if weight > g.size {
+		weight = g.size
+	}
+	held := 0
+	release = func() {
+		for ; held > 0; held-- {
+			<-g.slots
+		}
+	}
+	for held < weight {
+		if ctx == nil {
+			g.slots <- struct{}{}
+			held++
+			continue
+		}
+		select {
+		case g.slots <- struct{}{}:
+			held++
+		case <-ctx.Done():
+			release()
+			return func() {}, ctx.Err()
+		}
+	}
+	return release, nil
+}
+
+// runGateFor returns this run's gate, building it from max_parallel on first
+// use. Run and Resume rebuild it at their start so a config patch between runs
+// (Studio, stacks) takes effect; tests that call role helpers directly get a
+// lazily built one.
+func (o *Orchestrator) runGateFor() *runGate {
+	if o == nil {
+		return nil
+	}
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	if o.gate == nil {
+		o.gate = newRunGate(o.maxParallelLocked())
+	}
+	return o.gate
+}
+
+// resetRunGate rebuilds the gate for a new run. o.mu must NOT be held.
+func (o *Orchestrator) resetRunGate() {
+	if o == nil {
+		return
+	}
+	o.mu.Lock()
+	o.gate = newRunGate(o.maxParallelLocked())
+	o.mu.Unlock()
+}
+
+// maxParallelLocked is the configured knee, floored at 1. o.mu held or not
+// held both work: it reads config only.
+func (o *Orchestrator) maxParallelLocked() int {
+	if o == nil || o.cfg == nil || o.cfg.MaxParallel < 1 {
+		return 1
+	}
+	return o.cfg.MaxParallel
+}
+
+// gatedExecutor is the adapter every loop-side model request passes through:
+// it holds one gate slot per request for the duration of the call and folds
+// the real number of LLM round-trips each result represents into the run's
+// llm_requests tally.
+type gatedExecutor struct {
+	inner loop.SubAgentRunner
+	gate  *runGate
+	// onRequests receives the number of LLM round-trips one result stood for.
+	onRequests func(n int)
+}
+
+// ExecuteSubAgents implements loop.SubAgentRunner.
+func (e *gatedExecutor) ExecuteSubAgents(ctx context.Context, reqs []ggagent.SubAgentRequest,
+	shared *ggagent.SharedState) ([]ggagent.SubAgentResult, error) {
+	release, err := e.gate.acquire(ctx, len(reqs))
+	if err != nil {
+		return nil, err
+	}
+	defer release()
+	res, err := e.inner.ExecuteSubAgents(ctx, reqs, shared)
+	if e.onRequests != nil {
+		for _, r := range res {
+			e.onRequests(llmRequestsIn(r))
+		}
+	}
+	return res, err
+}
+
+// gatedExecutor returns the run-gated view of the orchestrator's executor, or
+// a nil interface when there is no executor at all (the loop treats a nil
+// Executor as "nothing can be dispatched", and a non-nil wrapper around nil
+// would turn that into a panic).
+func (o *Orchestrator) gatedExecutor() loop.SubAgentRunner {
+	if o == nil || o.executor == nil {
+		return nil
+	}
+	return &gatedExecutor{inner: o.executor, gate: o.runGateFor(), onRequests: o.bumpLLMCalls}
+}
+
+// llmRequestsIn counts the LLM round-trips one sub-agent result cost: every
+// assistant turn of its ReAct transcript is one request to the model. A result
+// with no transcript (a fake, a provider that returns none) counts as one, so
+// the tally can only ever be corrected upward from the old one-per-result.
+//
+// This is the number the operator waited on. One worker result used to be
+// counted as ONE call while its transcript held eight tool turns, so a run
+// that made 200 requests reported 40 and the queueing math in the calibration
+// report was off by the same factor.
+func llmRequestsIn(res ggagent.SubAgentResult) int {
+	n := 0
+	for _, m := range res.Messages {
+		if strings.EqualFold(strings.TrimSpace(m.Role), "assistant") {
+			n++
+		}
+	}
+	if n < 1 {
+		return 1
+	}
+	return n
+}
diff --git a/pkg/orchestrator/gate_test.go b/pkg/orchestrator/gate_test.go
new file mode 100644
index 0000000..a1dc637
--- /dev/null
+++ b/pkg/orchestrator/gate_test.go
@@ -0,0 +1,296 @@
+package orchestrator
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/UnicoLab/slmcode/pkg/config"
+	ggagent "github.com/piotrlaczkowski/GoLangGraph/pkg/agent"
+	"github.com/piotrlaczkowski/GoLangGraph/pkg/llm"
+)
+
+func llmMessage(role string) llm.Message { return llm.Message{Role: role, Content: "x"} }
+
+// inflightExec is a fake model endpoint that measures the one thing the run
+// gate exists to bound: how many requests are in flight AT ONCE. It answers
+// every role the pipeline drives so a whole run can pass through it, and the
+// worker really writes its file so the loop's evidence gates let the task
+// finish.
+type inflightExec struct {
+	root string
+	mu   sync.Mutex
+	now  int
+	max  int
+	seen int
+}
+
+func (e *inflightExec) ExecuteSubAgents(ctx context.Context, reqs []ggagent.SubAgentRequest,
+	_ *ggagent.SharedState) ([]ggagent.SubAgentResult, error) {
+	e.mu.Lock()
+	e.now += len(reqs)
+	e.seen += len(reqs)
+	if e.now > e.max {
+		e.max = e.now
+	}
+	e.mu.Unlock()
+	defer func() {
+		e.mu.Lock()
+		e.now -= len(reqs)
+		e.mu.Unlock()
+	}()
+	// Long enough that two concurrent requests overlap; short enough that a
+	// whole run is still fast.
+	select {
+	case <-time.After(3 * time.Millisecond):
+	case <-ctx.Done():
+	}
+	out := make([]ggagent.SubAgentResult, 0, len(reqs))
+	for _, req := range reqs {
+		out = append(out, ggagent.SubAgentResult{AgentID: req.AgentID, TaskID: req.TaskID,
+			Output: e.answer(req)})
+	}
+	return out, nil
+}
+
+func (e *inflightExec) stats() (max, seen int) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	return e.max, e.seen
+}
+
+func (e *inflightExec) answer(req ggagent.SubAgentRequest) string {
+	role := strings.ToLower(req.AgentID)
+	switch {
+	case strings.Contains(role, "explorer"):
+		return `{"summary":"tiny go module","relevant_files":["go.mod"],"key_symbols":[],"risks":[],"notes":""}`
+	case strings.Contains(role, "planner"):
+		return `{"summary":"two files","steps":["Create hello.go with func Hello","Create world.go with func World"],` +
+			`"goals":[],"assumptions":[],"risks":[]}`
+	case strings.Contains(role, "splitter"):
+		return `{"tasks":[` +
+			`{"id":"T1","title":"create hello.go","description":"Create hello.go with func Hello() string.",` +
+			`"role":"worker","files":["hello.go"],"acceptance":"hello.go exists","depends_on":[]},` +
+			`{"id":"T2","title":"create world.go","description":"Create world.go with func World() string.",` +
+			`"role":"worker","files":["world.go"],"acceptance":"world.go exists","depends_on":[]}]}`
+	case strings.Contains(role, "reviewer"):
+		return `{"approved":true,"score":92,"summary":"file present","issues":[]}`
+	case strings.Contains(role, "tester"):
+		return "Observation: ws_shell `ls` exit status 0\n" +
+			`{"passed":true,"commands":["ls"],"summary":"files present","failures":[]}`
+	case strings.Contains(role, "architect"):
+		return `{"approach":"two files","components":["hello.go"],"interfaces":[],"risks":[],"non_goals":[]}`
+	case strings.Contains(role, "worker"), strings.Contains(role, "corrector"),
+		strings.Contains(role, "deep"), strings.Contains(role, "editor"):
+		name := "hello.go"
+		fn := "Hello"
+		if strings.EqualFold(req.TaskID, "T2") {
+			name, fn = "world.go", "World"
+		}
+		if e.root != "" {
+			_ = os.WriteFile(filepath.Join(e.root, name),
+				[]byte("package main\n\nfunc "+fn+"() string { return \"hi\" }\n"), 0o600)
+		}
+		return "Observation: ws_write wrote " + name + "\n" +
+			`{"status":"done","summary":"created ` + name + `","files_changed":["` + name + `"],"notes":""}`
+	}
+	return "- The project is a tiny Go module.\n"
+}
+
+// The gate itself: N slots, never more than N holders, cancellation releases.
+func TestRunGateBoundsInFlightHolders(t *testing.T) {
+	g := newRunGate(2)
+	var mu sync.Mutex
+	now, max := 0, 0
+	var wg sync.WaitGroup
+	for i := 0; i < 8; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			release, err := g.acquire(context.Background(), 1)
+			if err != nil {
+				t.Error(err)
+				return
+			}
+			defer release()
+			mu.Lock()
+			now++
+			if now > max {
+				max = now
+			}
+			mu.Unlock()
+			time.Sleep(2 * time.Millisecond)
+			mu.Lock()
+			now--
+			mu.Unlock()
+		}()
+	}
+	wg.Wait()
+	if max > 2 {
+		t.Fatalf("%d holders at once through a 2-slot gate", max)
+	}
+
+	// A batch wider than the gate is clamped, not deadlocked.
+	release, err := g.acquire(context.Background(), 5)
+	if err != nil {
+		t.Fatal(err)
+	}
+	release()
+
+	// Waiting on a full gate honors cancellation and holds nothing after.
+	hold, _ := g.acquire(context.Background(), 2)
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Millisecond)
+	defer cancel()
+	if _, err := g.acquire(ctx, 1); !errors.Is(err, context.DeadlineExceeded) {
+		t.Fatalf("acquire on a full gate returned %v, want the ctx deadline", err)
+	}
+	hold()
+	release, err = g.acquire(context.Background(), 2)
+	if err != nil {
+		t.Fatalf("gate did not recover its slots after a canceled wait: %v", err)
+	}
+	release()
+
+	// A nil gate admits everything.
+	var none *runGate
+	if _, err := none.acquire(context.Background(), 3); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// The phase pairs used to spawn one goroutine per phase unconditionally. At
+// max_parallel=1 they run one after another, in order.
+func TestPhasePairsRunSequentiallyAtMaxParallelOne(t *testing.T) {
+	var mu sync.Mutex
+	now, max := 0, 0
+	var order []string
+	phase := func(name string) func() phaseResult {
+		return func() phaseResult {
+			mu.Lock()
+			now++
+			if now > max {
+				max = now
+			}
+			order = append(order, name)
+			mu.Unlock()
+			time.Sleep(2 * time.Millisecond)
+			mu.Lock()
+			now--
+			mu.Unlock()
+			return phaseResult{name: name}
+		}
+	}
+
+	o := testOrch(t, func(c *config.Config) { c.SetMaxParallel(1) })
+	res := o.runPhases(context.Background(), phase("context"), phase("explore"))
+	if len(res) != 2 || res["context"].err != nil || res["explore"].err != nil {
+		t.Fatalf("results = %+v", res)
+	}
+	if max != 1 {
+		t.Fatalf("%d phases in flight at once with max_parallel=1", max)
+	}
+	if strings.Join(order, ",") != "context,explore" {
+		t.Fatalf("order = %v, want the phases in the order given", order)
+	}
+
+	// Canceled before the second phase: reported under a stable key.
+	ctx, cancel := context.WithCancel(context.Background())
+	res = o.runPhases(ctx, func() phaseResult { cancel(); return phaseResult{name: "first"} }, phase("second"))
+	if r, ok := res["canceled-1"]; !ok || r.err == nil {
+		t.Fatalf("a phase that never started must be reported as canceled: %+v", res)
+	}
+}
+
+// The headline: a WHOLE run — context, explore with its speculative digs,
+// architect, plan, split, the execute waves with their reviews, the tester,
+// memory — never has more requests in flight than max_parallel. Measured at
+// the executor, which is where the endpoint would see them.
+func TestFullRunNeverExceedsMaxParallel(t *testing.T) {
+	for _, par := range []int{1, 2} {
+		par := par
+		t.Run(map[int]string{1: "max_parallel=1", 2: "max_parallel=2"}[par], func(t *testing.T) {
+			home := t.TempDir()
+			t.Setenv("HOME", home)
+			t.Setenv("USERPROFILE", home)
+			t.Setenv("XDG_CONFIG_HOME", filepath.Join(home, ".config"))
+
+			root := t.TempDir()
+			if err := os.WriteFile(filepath.Join(root, "go.mod"), []byte("module demo\n\ngo 1.22\n"), 0o600); err != nil {
+				t.Fatal(err)
+			}
+			cfg := config.Default(root)
+			// InitWorkspace applies the Go language pack, which turns the QA
+			// gate and the per-task smoke ON; the knobs below are set after
+			// it so this run never shells out to a real toolchain.
+			if err := InitWorkspace(root, cfg); err != nil {
+				t.Fatal(err)
+			}
+			cfg.StructuredDecoding = "off"
+			cfg.DynamicPipeline = false
+			cfg.Squads = false
+			cfg.ClarifyMode = "off"
+			cfg.PlanApprove = "auto"
+			cfg.ContinueAsk = "off"
+			cfg.EscalateAsk = "off"
+			cfg.QAGate = false
+			cfg.PostWorkerSmoke = false
+			cfg.RequireSmoke = false
+			cfg.ScopeJudge = false
+			cfg.PlaceholderPass = false
+			// think_passes=2 turns ON the paths that used to add slots: the
+			// speculative explore digs, the plan critique, the per-wave
+			// coordinator and distillation.
+			cfg.ThinkPasses = 2
+			cfg.MaxRetries = 1
+			cfg.TaskTimeout = 30 * time.Second
+			cfg.SetMaxParallel(par)
+			cfg.Normalize()
+			o, err := New(cfg)
+			if err != nil {
+				t.Fatal(err)
+			}
+			exec := &inflightExec{root: root}
+			o.executor = exec
+			// The multipass runner talks to the provider directly; with no
+			// provider in this fixture the planner and splitter take the
+			// single-shot path, which routes them through exec like every
+			// other role. The multipass path holds a gate slot of its own.
+			o.think = nil
+
+			ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second)
+			defer cancel()
+			res, err := o.Run(ctx, "Create hello.go and world.go with one function each")
+			if err != nil {
+				t.Fatalf("run: %v", err)
+			}
+			max, seen := exec.stats()
+			t.Logf("%d requests, max %d in flight, success=%v: %s", seen, max, res.Success, res.Summary)
+			if seen < 6 {
+				t.Fatalf("only %d requests reached the executor — this did not exercise a full run", seen)
+			}
+			if max > par {
+				t.Fatalf("%d requests in flight at once with max_parallel=%d", max, par)
+			}
+		})
+	}
+}
+
+// llm_requests counts round-trips, not results: a worker whose ReAct loop made
+// eight model calls is eight requests.
+func TestLLMRequestsCountAssistantTurns(t *testing.T) {
+	if n := llmRequestsIn(ggagent.SubAgentResult{}); n != 1 {
+		t.Fatalf("a result with no transcript counts as %d, want 1", n)
+	}
+	res := ggagent.SubAgentResult{}
+	for _, role := range []string{"system", "user", "assistant", "tool", "assistant", "assistant"} {
+		res.Messages = append(res.Messages, llmMessage(role))
+	}
+	if n := llmRequestsIn(res); n != 3 {
+		t.Fatalf("counted %d requests over three assistant turns", n)
+	}
+}
diff --git a/pkg/orchestrator/gaterunway_test.go b/pkg/orchestrator/gaterunway_test.go
index e8b2319..ebe422f 100644
--- a/pkg/orchestrator/gaterunway_test.go
+++ b/pkg/orchestrator/gaterunway_test.go
@@ -112,7 +112,7 @@ func TestGateSaysWhyItStoppedEarly(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 40*time.Second)
 	defer cancel()
 
-	_ = o.runQAGate(ctx, "implement the thing", midBoard())
+	_ = o.runQAGate(ctx, "implement the thing", midBoard(), preTest{})
 
 	joined := strings.Join(events, "\n")
 	if !strings.Contains(joined, "not enough time left") {
diff --git a/pkg/orchestrator/looptimeout_test.go b/pkg/orchestrator/looptimeout_test.go
new file mode 100644
index 0000000..860c3fa
--- /dev/null
+++ b/pkg/orchestrator/looptimeout_test.go
@@ -0,0 +1,126 @@
+package orchestrator
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/UnicoLab/slmcode/pkg/plan"
+	ggagent "github.com/piotrlaczkowski/GoLangGraph/pkg/agent"
+)
+
+// budgetExec records the timeout every request arrives with, writes the
+// worker's file so the loop's evidence gates let the task finish, and takes a
+// measurable moment per call so the latency it produces is a real sample.
+type budgetExec struct {
+	root string
+	mu   sync.Mutex
+	reqs []ggagent.SubAgentRequest
+}
+
+func (e *budgetExec) ExecuteSubAgents(_ context.Context, reqs []ggagent.SubAgentRequest,
+	_ *ggagent.SharedState) ([]ggagent.SubAgentResult, error) {
+	e.mu.Lock()
+	e.reqs = append(e.reqs, reqs...)
+	e.mu.Unlock()
+	time.Sleep(2 * time.Millisecond)
+	out := make([]ggagent.SubAgentResult, 0, len(reqs))
+	for _, req := range reqs {
+		reply := `{"approved":true,"score":90,"summary":"looks good","issues":[]}`
+		if !strings.Contains(req.AgentID, "review") {
+			name := strings.ToLower(req.TaskID) + ".go"
+			_ = os.WriteFile(filepath.Join(e.root, name), []byte("package main\n"), 0o600)
+			reply = "Observation: ws_edit edited " + name + " (1 replacement(s))\n" +
+				`{"status":"done","summary":"done","files_changed":["` + name + `"]}`
+		}
+		out = append(out, ggagent.SubAgentResult{AgentID: req.AgentID, TaskID: req.TaskID, Output: reply})
+	}
+	return out, nil
+}
+
+func (e *budgetExec) timeoutsFor(role string) []time.Duration {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	var out []time.Duration
+	for _, r := range e.reqs {
+		if r.AgentID == role {
+			out = append(out, r.Timeout)
+		}
+	}
+	return out
+}
+
+// The execute loop's workers, reviewers and correctors own most of a run's
+// wall clock, and they used to run on the flat task_timeout while contributing
+// no latency samples at all. buildRunner now hands the loop the same measured
+// policy the phase roles use, and the loop reports back.
+func TestLoopRolesUseMeasuredBudgetsAndRecordLatency(t *testing.T) {
+	const ceiling = 12 * time.Minute
+	o := newTimeoutFixture(t, "qwen2.5-coder:14b", ceiling)
+	o.cfg.PostWorkerSmoke = false
+	o.cfg.RequireSmoke = false
+	o.cfg.StaticQuality = false
+	o.cfg.ClaimsGate = false
+	o.cfg.WorkerCritique = false
+	o.cfg.MaxRetries = 0
+	o.cfg.SetMaxParallel(1)
+	o.boardStore = plan.NewLiveStore(o.cfg.SlmDir())
+	o.shared = ggagent.NewSharedState()
+	exec := &budgetExec{root: o.cfg.Root}
+	o.executor = exec
+	o.buildPackers(nil, 32768)
+
+	// Three reviewer observations at 20s: p95 × 1.5 = 30s, floored to the
+	// light-role floor of 60s. The worker has no samples and keeps the ceiling.
+	o.seedLatency(t, plan.RoleReviewer, 3, 20*time.Second)
+
+	r := o.buildRunner("implement the thing", "run-budget", "")
+	r.IdleWait = time.Millisecond
+	r.Log = func(string, ...interface{}) {}
+	if r.RoleTimeout == nil || r.OnRoleLatency == nil {
+		t.Fatal("buildRunner did not wire RoleTimeout / OnRoleLatency")
+	}
+	ctx := context.Background()
+	if got := r.RoleTimeout(ctx, plan.RoleReviewer); got != roleFloorLight {
+		t.Fatalf("reviewer budget = %v, want the %v floor rather than the %v task_timeout", got, roleFloorLight, ceiling)
+	}
+	if got := r.RoleTimeout(ctx, plan.RoleWorker); got != ceiling {
+		t.Fatalf("cold worker budget = %v, want the full %v", got, ceiling)
+	}
+
+	st := o.latencyStore()
+	if _, before := st.P95(plan.RoleWorker, o.modelFamily()); before != 0 {
+		t.Fatalf("worker already has %d samples before the wave", before)
+	}
+
+	board := &plan.Board{QueryID: "run-budget", Query: "implement the thing", Tasks: []plan.Task{{
+		ID: "T1", Title: "build t1", Role: plan.RoleWorker, Column: plan.ColReadyToDev,
+		Description: "write t1.go", Acceptance: "file written", Files: []string{"t1.go"},
+	}}}
+	if err := o.boardStore.Replace(*board); err != nil {
+		t.Fatal(err)
+	}
+	if err := r.RunBoard(ctx, board); err != nil {
+		t.Fatalf("RunBoard: %v", err)
+	}
+
+	if _, after := st.P95(plan.RoleWorker, o.modelFamily()); after < 1 {
+		t.Fatalf("the wave recorded %d worker samples — the loop is still not feeding latency memory", after)
+	}
+	// Every reviewer request the wave issued was dispatched on the measured
+	// budget, never on the task_timeout.
+	for _, to := range exec.timeoutsFor(plan.RoleReviewer) {
+		if to != roleFloorLight {
+			t.Fatalf("a reviewer request went out with timeout %v, want the measured %v", to, roleFloorLight)
+		}
+	}
+	for _, to := range exec.timeoutsFor(plan.RoleWorker) {
+		if to != ceiling {
+			t.Fatalf("a cold worker request went out with timeout %v, want the %v ceiling", to, ceiling)
+		}
+	}
+}
diff --git a/pkg/orchestrator/orchestrator.go b/pkg/orchestrator/orchestrator.go
index 30d13e2..589c0e7 100644
--- a/pkg/orchestrator/orchestrator.go
+++ b/pkg/orchestrator/orchestrator.go
@@ -129,6 +129,13 @@ type Orchestrator struct {
 	// never written into squads.json — that file is the org chart the next run
 	// inherits, not a record of what this one proved.
 	teamGates teamGates
+	// gate is the run-wide concurrency limit every model request passes
+	// through (see gate.go). Rebuilt per run from max_parallel; guarded by mu.
+	gate *runGate
+	// teamPick memoizes the library team selection for this run so the
+	// composer and the charter phase do not each rescan the workspace and
+	// reload the block library to reach the same answer. Guarded by mu.
+	teamPick *teamPick
 
 	// workspace / repoMap / tracker come from the tool layer so the
 	// orchestrator can reset the per-task loop guard and seed focus discovery.
@@ -208,7 +215,15 @@ type Orchestrator struct {
 	// changedFiles is the set of workspace paths this run has written, fed by
 	// the tool layer's OnFileChange hook. The QA gate formats exactly these —
 	// quality.FormatChangedFiles refuses to format anything else.
-	changedFiles map[string]bool
+	changedFiles map[string]int
+	// writeSeq counts every recorded write this run, so a fingerprint of the
+	// tree changes when an already-changed file is written again. Guarded by
+	// mu; see changedFingerprint.
+	writeSeq int
+	// smokeMemo remembers what each command answered on each tree state this
+	// run, so the objective/acceptance command is not re-run against a tree
+	// nothing has touched since. Guarded by mu; see runSmokeIn.
+	smokeMemo map[string]quality.SmokeResult
 
 	// qaSmoke executes the QA/acceptance command. Nil in production, where
 	// every call falls through to quality.RunSmoke; tests inject a fake so the
@@ -654,6 +669,7 @@ func (o *Orchestrator) Run(ctx context.Context, query string) (*Result, error) {
 	}
 	o.resetChangedFiles()
 	o.resetObjectiveProbes()
+	o.resetRunGate()
 	// Learn whether the objective command already passes, concurrently with the
 	// context/explore/plan phases that follow. This is the fact that decides
 	// whether a green result at the end is evidence or a coincidence, and it
@@ -1037,6 +1053,13 @@ func (o *Orchestrator) runSpecialist(ctx context.Context, runID, query string, s
 }
 
 func (o *Orchestrator) runSLM(ctx context.Context, runID, query, skillPack string, start time.Time) (*Result, error) {
+	// Team state is per run, and the orchestrator outlives a run in a
+	// long-lived Studio process: cleared before anything below can set it.
+	// This used to happen halfway down, after explore — and never on Resume —
+	// which is how one run's green team gates survived into the next run's
+	// verdict (see resetTeamState).
+	o.resetTeamState()
+
 	// 0 Auto-load AGENTS.md / CLAUDE.md / PROJECT instructions (Claude Code style).
 	//
 	// These used to be appended to SCRATCH.md — a write-only sink, written in 25
@@ -1083,7 +1106,7 @@ func (o *Orchestrator) runSLM(ctx context.Context, runID, query, skillPack strin
 	// context is fast (≤400 words CONTEXT.md); explore does a codebase deep-dive.
 	var exploreOut, archOut, docsOut string
 
-	parResults := runPhaseParallel(ctx,
+	parResults := o.runPhases(ctx,
 		func() phaseResult {
 			// --- 1 Context ---
 			if err := o.runPipelineSlots(ctx, "context", "before", query, "", ""); err != nil {
@@ -1212,12 +1235,6 @@ func (o *Orchestrator) runSLM(ctx context.Context, runID, query, skillPack strin
 		return nil, r.err
 	}
 
-	// Team state is per run, and the orchestrator outlives a run in a
-	// long-lived Studio process: cleared before anything below can set it.
-	o.mu.Lock()
-	o.squadPlan, o.singleTeam = nil, nil
-	o.mu.Unlock()
-
 	// 2a Dynamic pipeline composition (optional): the composer specialist assembles
 	// a task-specific pipeline (phases, team, tools, skills) before design/plan.
 	if o.cfg.DynamicPipeline {
@@ -1230,7 +1247,12 @@ func (o *Orchestrator) runSLM(ctx context.Context, runID, query, skillPack strin
 	// returns nil — meaning "one stream" — for every single-domain query and
 	// every failure mode.
 	if o.cfg.Squads {
-		o.squadPlan = o.assembleSquads(ctx, query, inventory, exploreOut, archOut)
+		// Under the lock: staffingPlan and the Studio poll read it there, and
+		// the explore phase's speculative digs may still be draining.
+		p := o.assembleSquads(ctx, query, inventory, exploreOut, archOut)
+		o.mu.Lock()
+		o.squadPlan = p
+		o.mu.Unlock()
 	}
 
 	// 2b+2c Architect + Clarify run in parallel after explore.
@@ -1239,7 +1261,7 @@ func (o *Orchestrator) runSLM(ctx context.Context, runID, query, skillPack strin
 	var clarify plan.ClarifyResult
 	var prd plan.ScopePRD
 
-	archClarifyResults := runPhaseParallel(ctx,
+	archClarifyResults := o.runPhases(ctx,
 		func() phaseResult {
 			// --- 2b Architect (skip if already ran in speculative digs) ---
 			archWhen := o.Pipeline().PhaseWhen("architect")
@@ -1605,12 +1627,20 @@ func (o *Orchestrator) runRoleTracked(ctx context.Context, role, taskID, input s
 		o.emit(role, fmt.Sprintf("fallback role %s → %s (agent not registered)", role, execRole), "")
 	}
 	o.emitFull(execRole, stream.KindAgentStart, execRole, taskID, "started", scopeFromInput(input), "")
-	o.bumpLLMCalls(1)
 	start := time.Now()
 	timeout := o.roleTimeoutWithin(ctx, execRole)
 	rctx, cancel := context.WithTimeout(ctx, timeout)
 	defer cancel()
-	results, err := o.executor.ExecuteSubAgents(rctx, []ggagent.SubAgentRequest{{
+	// Through the run gate, not o.executor directly: this is the one place a
+	// phase role reaches the model, and the gate is what keeps a phase pair, a
+	// speculative dig and a review race from exceeding max_parallel together.
+	// The gate also counts the request toward llm_requests.
+	exec := o.gatedExecutor()
+	if exec == nil {
+		o.emitFullL(execRole, stream.KindAgentEnd, execRole, taskID, "no executor", "", "", stream.LevelError)
+		return "", fmt.Errorf("no executor configured for %s", execRole)
+	}
+	results, err := exec.ExecuteSubAgents(rctx, []ggagent.SubAgentRequest{{
 		AgentID: execRole, Input: input, Timeout: timeout, ShareState: true,
 	}}, o.shared)
 	elapsed := time.Since(start)
@@ -1716,6 +1746,9 @@ func (o *Orchestrator) runRoleMultipassTracked(ctx context.Context, role, taskID
 	}
 	o.think.SetPassTimeout(pass).SetBudget(budget).SetFactory(o.factory.Create)
 	o.think.OnCall = func(ci multipass.CallInfo) {
+		// Every pass is one real round-trip; the multipass runner bypasses the
+		// gated executor, so it is counted here.
+		o.bumpLLMCalls(1)
 		// Same evidence rule as the single-shot path: the per-call budget here
 		// IS roleTimeout(execRole), so these samples are directly comparable.
 		o.recordRoleLatency(execRole, ci.Elapsed, ci.Err == nil || isTimeoutError(ci.Err))
@@ -1731,6 +1764,16 @@ func (o *Orchestrator) runRoleMultipassTracked(ctx context.Context, role, taskID
 		scopeFromInput(input), "")
 	rctx, cancel := context.WithTimeout(ctx, budget)
 	defer cancel()
+	// The passes run one after another, so the whole cycle holds ONE slot of
+	// the run gate: a planner refining its draft is still one request in
+	// flight at the endpoint, and it must count against max_parallel like the
+	// single-shot roles it runs beside.
+	release, gerr := o.runGateFor().acquire(rctx, 1)
+	if gerr != nil {
+		o.emitFullL(execRole, stream.KindAgentEnd, execRole, taskID, "canceled before start", "", "", stream.LevelError)
+		return "", gerr
+	}
+	defer release()
 	start := time.Now()
 	// ExecuteRole caches and resets the agent instead of rebuilding it: a
 	// rebuild re-resolves the provider, tools and profile caps every call.
@@ -1900,6 +1943,52 @@ func (o *Orchestrator) applyCoordinatorActions(board *plan.Board, raw string) {
 	}
 }
 
+// waveEventful reports whether a finished wave gives the after-wave model
+// passes (memory distillation, the coordinator) anything to act on: a task
+// that failed, one that was escalated to a human, or a lesson worth a model's
+// attention. A wave of plain green tasks with nothing learned is not
+// eventful, and the reason is returned in words so the skip can be shown
+// rather than silently taken.
+func waveEventful(wave []plan.Task) (bool, string) {
+	if len(wave) == 0 {
+		return false, "the wave finished no tasks"
+	}
+	failed, escalated, lessons := 0, 0, 0
+	for _, t := range wave {
+		t.Normalize()
+		switch {
+		case t.Column == plan.ColBlocked || t.Status == plan.StatusFailed ||
+			(t.Error != "" && t.Column != plan.ColDone):
+			failed++
+		case taskEscalated(t):
+			escalated++
+		}
+		lessons += notableLessons(t)
+	}
+	if failed == 0 && escalated == 0 && lessons == 0 {
+		return false, fmt.Sprintf("all %d task(s) finished green with no failure, escalation or new lesson", len(wave))
+	}
+	return true, fmt.Sprintf("%d failed, %d escalated, %d lesson(s)", failed, escalated, lessons)
+}
+
+// notableLessons counts the lessons on a task that are worth a model pass: a
+// failure lesson, or a human note the task honored. learning.Extract also
+// emits a "success" lesson from every done task's output and a "convention"
+// one from its acceptance text; those are routine — every green task has them
+// — and counting them would make every wave "eventful" and the skip a no-op.
+func notableLessons(t plan.Task) int {
+	n := 0
+	for _, l := range learning.Extract(t) {
+		if l.Kind == "failure" {
+			n++
+		}
+	}
+	if t.Column == plan.ColDone && strings.TrimSpace(plan.PromptNotes(t.Notes)) != "" {
+		n++
+	}
+	return n
+}
+
 // evolveAfterWave updates CONTEXT + MEMORY from wave results and refreshes
 // pending task packs so later specialists see evolving project knowledge.
 func (o *Orchestrator) evolveAfterWave(ctx context.Context, query, skillPack string, board *plan.Board, wave []plan.Task) {
@@ -1916,8 +2005,16 @@ func (o *Orchestrator) evolveAfterWave(ctx context.Context, query, skillPack str
 	}
 	md := learning.RenderMarkdown(lessons)
 
-	// Optional SLM distillation of the wave (cheap when think_passes>=2)
-	if o.cfg.ThinkPasses >= 2 && len(wave) > 0 {
+	// Optional SLM distillation of the wave (think_passes>=2) — and only of a
+	// wave that produced something to distill. A wave whose tasks all went
+	// green with no lesson extracted used to buy a memory round-trip that
+	// returned nothing new; on a local model that is a minute per wave for
+	// no information.
+	eventful, why := waveEventful(wave)
+	if o.cfg.ThinkPasses >= 2 && len(wave) > 0 && !eventful {
+		o.emit("learn", "wave distillation skipped — "+why, "")
+	}
+	if o.cfg.ThinkPasses >= 2 && len(wave) > 0 && eventful {
 		var brief strings.Builder
 		brief.WriteString("Wave results for learning:\n")
 		for _, t := range wave {
diff --git a/pkg/orchestrator/parallel.go b/pkg/orchestrator/parallel.go
index 1b3838b..615b9bd 100644
--- a/pkg/orchestrator/parallel.go
+++ b/pkg/orchestrator/parallel.go
@@ -52,6 +52,40 @@ func runPhaseParallel(ctx context.Context, phases ...func() phaseResult) map[str
 	return results
 }
 
+// runPhasesSequential is runPhaseParallel one phase at a time, in the order
+// given, with the same result map and the same cancellation folding.
+func runPhasesSequential(ctx context.Context, phases ...func() phaseResult) map[string]phaseResult {
+	results := make(map[string]phaseResult, len(phases))
+	for i, f := range phases {
+		var r phaseResult
+		if err := ctx.Err(); err != nil {
+			r = phaseResult{name: fmt.Sprintf("canceled-%d", i), err: err}
+		} else {
+			r = f()
+			if r.err == nil {
+				if err := ctx.Err(); err != nil {
+					r.err = err
+				}
+			}
+		}
+		results[r.name] = r
+	}
+	return results
+}
+
+// runPhases runs a pair of independent phases as the endpoint can bear:
+// concurrently when max_parallel allows a second in-flight request, one after
+// another when it does not. Every model call inside a phase still passes
+// through the run gate, so this is not what enforces the limit — it is what
+// stops the harness from spawning goroutines whose only effect at
+// max_parallel=1 would be to queue on it in a nondeterministic order.
+func (o *Orchestrator) runPhases(ctx context.Context, phases ...func() phaseResult) map[string]phaseResult {
+	if o != nil && o.maxParallelLocked() <= 1 {
+		return runPhasesSequential(ctx, phases...)
+	}
+	return runPhaseParallel(ctx, phases...)
+}
+
 // canceledPhase returns the first cancellation error in a parallel result set —
 // but only when the RUN's context is actually gone. A phase that failed with an
 // error whose text mentions a cancellation, while the run itself is healthy, is
diff --git a/pkg/orchestrator/plansplit.go b/pkg/orchestrator/plansplit.go
index 7cd2e50..d4716cf 100644
--- a/pkg/orchestrator/plansplit.go
+++ b/pkg/orchestrator/plansplit.go
@@ -194,12 +194,32 @@ func (o *Orchestrator) runSplitPhase(ctx context.Context, in planSplitInput, pl
 		return nil, err
 	}
 	splitAgent := o.phaseAgent("split", "splitter")
+	// Discovery first: it does not depend on the splitter, and whether the
+	// splitter is worth a model call depends on it.
+	discovered := plan.DiscoverRelevantFiles(o.cfg.Root, in.Query, in.ExploreOut)
+	if len(in.Discovered) > 0 {
+		discovered = plan.ReconcileFiles(o.cfg.Root, append(discovered, in.Discovered...), in.Inventory)
+	}
+	if rm := o.repoMapNow(); rm != nil {
+		// The ranked symbol index finds targets that filename matching misses.
+		discovered = plan.FilterExisting(o.cfg.Root,
+			mergeUnique(discovered, rm.RankFilesFor(in.Query, 8)))
+	}
 	var tasksOut string
+	trivial := false
 	if o.Pipeline().HasReplace("split") {
 		if err := o.runPipelineSlots(ctx, "split", "replace", in.Query, in.ExploreOut, planOut); err != nil {
 			return nil, err
 		}
 		tasksOut = `{"tasks":[]}`
+	} else if o.phaseEnabled("split") && trivialPlan(pl, discovered) {
+		// A one-step plan over one or two known files has nothing to split.
+		// The splitter is the slowest role after the planner (a multipass
+		// call), and on this input it returns the plan's one step back as one
+		// task — the board fallbackTasks builds deterministically.
+		trivial = true
+		o.emit("split", fmt.Sprintf("splitter skipped — a %d-step plan over %d known file(s) is one task; "+
+			"building the board directly", len(pl.Steps), len(discovered)), "")
 	} else if o.phaseEnabled("split") {
 		o.emitAgent("split", splitAgent, "", "atomic task split", "", "")
 		splitPrompt := o.buildSplitterPrompt(in.Query, splitAgent, planOut, in.PRD, in.Clarify, replanNotes)
@@ -220,15 +240,18 @@ func (o *Orchestrator) runSplitPhase(ctx context.Context, in planSplitInput, pl
 	tasks, err := plan.ParseTasksJSON(tasksOut)
 	if err != nil || len(tasks) == 0 {
 		tasks = fallbackTasks(pl)
-	}
-	discovered := plan.DiscoverRelevantFiles(o.cfg.Root, in.Query, in.ExploreOut)
-	if len(in.Discovered) > 0 {
-		discovered = plan.ReconcileFiles(o.cfg.Root, append(discovered, in.Discovered...), in.Inventory)
-	}
-	if rm := o.repoMapNow(); rm != nil {
-		// The ranked symbol index finds targets that filename matching misses.
-		discovered = plan.FilterExisting(o.cfg.Root,
-			mergeUnique(discovered, rm.RankFilesFor(in.Query, 8)))
+		if trivial {
+			// The known files ARE the scope, and a scoped task is ready:
+			// fallbackTasks marks its tasks pending (→ to_scope, human
+			// scoping) because it normally has no idea where they land. Here
+			// it does. Without this the splitter skip would park the one task
+			// it was meant to save.
+			for i := range tasks {
+				tasks[i].Files = append([]string(nil), discovered...)
+				tasks[i].Column = plan.ColReadyToDev
+				tasks[i].Status = plan.StatusReady
+			}
+		}
 	}
 	tasks = plan.SanitizeTasksIn(tasks, in.ExploreOut+"\n"+strings.Join(discovered, "\n"), in.Query, o.cfg.Root)
 	tasks = plan.EnsureTaskPRDs(tasks, in.PRD, in.Query)
@@ -289,6 +312,19 @@ func (o *Orchestrator) runSplitPhase(ctx context.Context, in planSplitInput, pl
 	return board, nil
 }
 
+// maxTrivialPlanFiles is the most discovered files a plan may involve and still
+// be split deterministically: with one step and at most two files the split is
+// the step itself, and the splitter can only return it or invent scope.
+const maxTrivialPlanFiles = 2
+
+// trivialPlan reports whether the plan needs no splitter: at most one step and
+// between one and maxTrivialPlanFiles known target files. With NO known file
+// the splitter is still asked — it may resolve a target discovery missed, and
+// a task with no scope would only be parked for human scoping.
+func trivialPlan(pl plan.Plan, discovered []string) bool {
+	return len(pl.Steps) <= 1 && len(discovered) >= 1 && len(discovered) <= maxTrivialPlanFiles
+}
+
 // blockUnscopedTask parks a task whose targets could not be resolved.
 func blockUnscopedTask(t *plan.Task) {
 	if t == nil {
diff --git a/pkg/orchestrator/qagate.go b/pkg/orchestrator/qagate.go
index d544d9c..2eb381c 100644
--- a/pkg/orchestrator/qagate.go
+++ b/pkg/orchestrator/qagate.go
@@ -81,17 +81,103 @@ func (o *Orchestrator) runSmoke(ctx context.Context, cmd string) quality.SmokeRe
 
 // runSmokeIn is runSmoke with an explicit timeout (the build preflight uses a
 // much shorter one than a whole test suite).
+//
+// It is the ONE choke point every harness-run command passes through — the
+// deterministic pre-test, each team's acceptance, the integration command,
+// the QA gate's rounds, the objective probes, the bootstrap install — and so
+// it is where the run's smoke memo lives. A command asked of a tree nothing
+// has written to since it last answered gets that answer back instead of a
+// second run. Measured live, the objective command ran up to FOUR times per
+// finish on an unchanged tree (pre-test, team gate, QA round 1, final check);
+// on a suite that takes minutes that was most of the finish path's wall clock
+// spent re-proving one fact.
 func (o *Orchestrator) runSmokeIn(ctx context.Context, cmd string, timeout time.Duration) quality.SmokeResult {
+	sr, _ := o.runSmokeMemo(ctx, cmd, timeout)
+	return sr
+}
+
+// runSmokeMemo is runSmokeIn reporting whether the answer came from the memo.
+func (o *Orchestrator) runSmokeMemo(ctx context.Context, cmd string, timeout time.Duration) (quality.SmokeResult, bool) {
 	root := ""
 	if o != nil && o.cfg != nil {
 		root = o.cfg.Root
 	}
+	key, before := o.smokeMemoKey(cmd)
+	if sr, ok := o.memoizedSmoke(key); ok {
+		if o != nil {
+			o.emitFull("test", stream.KindDebug, "qa", "",
+				"reusing the last result of `"+truncate(cmd, 80)+"` — nothing has been written since it ran", "", "")
+		}
+		return sr, true
+	}
+	var sr quality.SmokeResult
 	if o != nil && o.qaSmoke != nil {
-		return o.qaSmoke(ctx, root, cmd, timeout)
+		sr = o.qaSmoke(ctx, root, cmd, timeout)
+	} else {
+		sr = quality.RunSmoke(ctx, root, cmd, timeout)
 	}
-	return quality.RunSmoke(ctx, root, cmd, timeout)
+	o.rememberSmoke(key, before, timeout, sr)
+	return sr, false
 }
 
+// smokeMemoKey keys a command by what it was run against: the command text
+// and the tree fingerprint at the moment it started.
+func (o *Orchestrator) smokeMemoKey(cmd string) (key, fingerprint string) {
+	fingerprint = o.changedFingerprint()
+	return strings.TrimSpace(cmd) + "\x00" + fingerprint, fingerprint
+}
+
+// memoizedSmoke returns the remembered answer for key, if any.
+func (o *Orchestrator) memoizedSmoke(key string) (quality.SmokeResult, bool) {
+	if o == nil {
+		return quality.SmokeResult{}, false
+	}
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	sr, ok := o.smokeMemo[key]
+	return sr, ok
+}
+
+// rememberSmoke stores a result worth reusing: one that actually ran, did not
+// hit its timeout (a killed command answers "it took at least this long", not
+// "it fails"), and whose tree did not move WHILE it ran — the baseline probe
+// runs alongside the first waves, and a result taken across a write describes
+// no tree the run will ever see again.
+func (o *Orchestrator) rememberSmoke(key, before string, timeout time.Duration, sr quality.SmokeResult) {
+	if o == nil || !sr.Ran {
+		return
+	}
+	if timeout > 0 && sr.Duration >= timeout {
+		return
+	}
+	if o.changedFingerprint() != before {
+		return
+	}
+	o.mu.Lock()
+	if o.smokeMemo == nil {
+		o.smokeMemo = map[string]quality.SmokeResult{}
+	}
+	o.smokeMemo[key] = sr
+	o.mu.Unlock()
+}
+
+// hasMemoizedSmoke reports whether key has a remembered answer.
+func (o *Orchestrator) hasMemoizedSmoke(key string) bool {
+	_, ok := o.memoizedSmoke(key)
+	return ok
+}
+
+// rememberSmokeNow stores sr against the tree AS IT IS NOW — for a command
+// that itself changed the tree (a dependency install), whose answer belongs
+// to the state it produced rather than the one it started from.
+func (o *Orchestrator) rememberSmokeNow(cmd string, sr quality.SmokeResult) {
+	key, fp := o.smokeMemoKey(cmd)
+	o.rememberSmoke(key, fp, 0, sr)
+}
+
+// resetSmokeMemo forgets every remembered command result. o.mu must be held.
+func (o *Orchestrator) resetSmokeMemoLocked() { o.smokeMemo = nil }
+
 // objectiveGate is ONE evaluation of the project's objective: the same command
 // runQAGate iterates, run once, classified the same way.
 //
@@ -314,6 +400,8 @@ func (o *Orchestrator) resetObjectiveProbes() {
 	// an empty changed-file set, so even the fingerprint guard would agree they
 	// describe "the same" tree.
 	o.objectiveShell = nil
+	// Same argument for remembered command results.
+	o.resetSmokeMemoLocked()
 }
 
 // objectiveProbesSpent reports how many probes this run has used.
@@ -734,7 +822,13 @@ func (o *Orchestrator) objectiveMetBetweenWaves(ctx context.Context, board *plan
 // runQAGate iterates a project test/smoke command until green or max rounds.
 // On failure it asks the tester/corrector specialists to fix, then re-runs.
 // Returns true when the gate ends red (caller should rewrite plan/tasks).
-func (o *Orchestrator) runQAGate(ctx context.Context, query string, board *plan.Board) bool {
+//
+// pre is the deterministic pre-test's run of the same command, handed over so
+// round 1 reuses it when the tree has not moved since (its Fingerprint says
+// what it was taken against). The smoke memo would answer the same way; the
+// explicit hand-off makes the reuse visible in the gate's own events rather
+// than only in a debug line.
+func (o *Orchestrator) runQAGate(ctx context.Context, query string, board *plan.Board, pre preTest) bool {
 	if o == nil || o.cfg == nil || !o.cfg.QAGate {
 		return false
 	}
@@ -778,7 +872,13 @@ func (o *Orchestrator) runQAGate(ctx context.Context, query string, board *plan.
 
 		o.emitFull("test", stream.KindAgentStart, "qa", "",
 			fmt.Sprintf("qa_gate %d/%d: %s", round, max, cmd), "", "")
-		sr := o.runSmoke(ctx, cmd)
+		var sr quality.SmokeResult
+		if round == 1 && pre.reusableFor(cmd, o.changedFingerprint()) {
+			o.emit("test", "qa_gate: reusing the pre-test's run of "+cmd+" — nothing has been written since", "")
+			sr = *pre.Smoke
+		} else {
+			sr = o.runSmoke(ctx, cmd)
+		}
 		// classifySmoke, not a second opinion: the finish path and the mid-run
 		// early-finish check must agree about what green means.
 		v := classifySmoke(cmd, sr)
@@ -925,11 +1025,16 @@ func (o *Orchestrator) qaGateNoVerdict(cmd string) bool {
 	return false
 }
 
-// changedFingerprint identifies the set of files the run has written so far.
-// Two equal fingerprints mean no write happened in between, so any command that
-// was already run against the tree would answer the same way again.
+// changedFingerprint identifies what the run has written so far: the write
+// sequence and the set of files. Two equal fingerprints mean no write happened
+// in between, so any command that was already run against the tree would
+// answer the same way again.
+//
+// The sequence is part of it on purpose. A path set alone reads a corrector
+// rewriting an already-changed file as "wrote nothing", which is how a fix
+// pass that did fix something was scored as a stall.
 func (o *Orchestrator) changedFingerprint() string {
-	return strings.Join(o.changedFilesSnapshot(), "\n")
+	return fmt.Sprintf("%d\n%s", o.writeSequence(), strings.Join(o.changedFilesSnapshot(), "\n"))
 }
 
 // qaCommand resolves the project's test/smoke command.
@@ -997,6 +1102,9 @@ func (o *Orchestrator) formatWaveChanges(ctx context.Context) {
 	})
 	if fixOut != "" {
 		o.emit("test", "qa_gate: formatted changed files: "+truncate(fixOut, 200), "")
+		// The formatter rewrote files outside the tool layer's hook: a
+		// command result remembered before it must not be reused after it.
+		o.noteTreeMutation()
 	}
 }
 
@@ -1026,6 +1134,14 @@ func (o *Orchestrator) runQABootstrap(ctx context.Context, cmd string) {
 	o.emit("test", "qa_gate bootstrap: "+truncate(bp.Command, 120)+
 		" (policy="+string(bp.Policy)+")", "")
 
+	// Once per tree state. The pre-test and the QA gate both bootstrap, and
+	// the second install on a tree nothing has written to since is the same
+	// install; the memo entry below is what says it already happened.
+	if key, _ := o.smokeMemoKey(bp.Command); o.hasMemoizedSmoke(key) {
+		o.emitFull("test", stream.KindDebug, "qa", "",
+			"qa_gate bootstrap already applied to this tree — not re-running "+truncate(bp.Command, 80), "", "")
+		return
+	}
 	var sr quality.SmokeResult
 	if bp.NeedsApproval {
 		o.emitWarn("test", truncate(bp.Reason, 240), "")
@@ -1035,6 +1151,14 @@ func (o *Orchestrator) runQABootstrap(ctx context.Context, cmd string) {
 		// exactly as quality.RunAcceptanceSmokeWithPolicy does for Run plans.
 		sr = o.runSmoke(ctx, bp.Command)
 	}
+	if sr.Ran {
+		// Dependencies landed outside the tool layer's hook: whatever the
+		// objective command answered BEFORE them no longer describes this
+		// tree. The install itself is remembered against the tree it
+		// produced, so it is not taken again for the same reason.
+		o.noteTreeMutation()
+		o.rememberSmokeNow(bp.Command, sr)
+	}
 	_ = o.store.Append(contextstore.DocScratch, "QA bootstrap",
 		fmt.Sprintf("cmd: %s\npolicy: %s\nran=%v ok=%v\n\n%s",
 			bp.Command, bp.Policy, sr.Ran, sr.OK, quality.FailureExcerpt(sr.Output, 2000)))
diff --git a/pkg/orchestrator/qagate_cancel_test.go b/pkg/orchestrator/qagate_cancel_test.go
index 8e84f14..b4143be 100644
--- a/pkg/orchestrator/qagate_cancel_test.go
+++ b/pkg/orchestrator/qagate_cancel_test.go
@@ -27,7 +27,7 @@ func TestCanceledQAGateReportsNoVerdict(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel() // the run is over before the gate starts
 
-	failed := o.runQAGate(ctx, "implement the thing", board)
+	failed := o.runQAGate(ctx, "implement the thing", board, preTest{})
 
 	if failed {
 		t.Fatal("a canceled gate reported QAFailed=true, which fabricates a " +
@@ -71,7 +71,7 @@ func TestStalledFixPassStopsInsteadOfReRunningAnUnchangedTree(t *testing.T) {
 		t.Skipf("qa_gate_rounds is %d — this test needs room for a second round", rounds)
 	}
 
-	failed := o.runQAGate(context.Background(), "implement the thing", midBoard())
+	failed := o.runQAGate(context.Background(), "implement the thing", midBoard(), preTest{})
 
 	if !failed {
 		t.Fatal("a red gate that stalled must still report red — stopping early " +
diff --git a/pkg/orchestrator/resume.go b/pkg/orchestrator/resume.go
index 945ff95..c7d4d6b 100644
--- a/pkg/orchestrator/resume.go
+++ b/pkg/orchestrator/resume.go
@@ -10,6 +10,7 @@ import (
 	"time"
 
 	"github.com/UnicoLab/slmcode/pkg/agents"
+	"github.com/UnicoLab/slmcode/pkg/composer"
 	contextstore "github.com/UnicoLab/slmcode/pkg/context"
 	"github.com/UnicoLab/slmcode/pkg/knowledge"
 	"github.com/UnicoLab/slmcode/pkg/learning"
@@ -62,6 +63,12 @@ func (o *Orchestrator) Resume(ctx context.Context, turnID string) (*Result, erro
 	o.decisions = nil
 	o.gates = nil
 	o.mu.Unlock()
+	// Same per-run resets as Run. The team state in particular: Resume used
+	// to restore the saved plan OVER whatever the previous run left, so a
+	// Studio process that resumed after a two-team run kept that run's team
+	// gates and could report halves proved that this run never touched.
+	o.resetTeamState()
+	o.resetRunGate()
 	o.restoreSquadPlan(&board)
 	defer func() {
 		o.mu.Lock()
@@ -246,7 +253,7 @@ func (o *Orchestrator) finalizeAfterExecute(ctx context.Context, runID, query, s
 		return o.finishObjectiveMet(ctx, runID, query, skillPack, board, g, "after the corrective wave", start)
 	}
 
-	gate := o.runQualityGates(ctx, query, board, runner, testerRejected)
+	gate := o.runQualityGates(ctx, query, board, runner, testerRejected, pre)
 	board = gate.Board
 	testerRejected = gate.TesterRejected
 
@@ -298,6 +305,17 @@ type preTest struct {
 	// run of the objective command instead of paying for an identical second
 	// one. Nil when the pre-test did not run.
 	Smoke *quality.SmokeResult
+	// Fingerprint is the tree fingerprint the command was run against, so a
+	// later consumer (the QA gate's first round) can tell whether Smoke still
+	// describes the tree in front of it.
+	Fingerprint string
+}
+
+// reusableFor reports whether this pre-test's result can stand in for a run
+// of cmd against a tree whose fingerprint is now fp.
+func (p preTest) reusableFor(cmd, fp string) bool {
+	return p.Smoke != nil && p.Smoke.Ran && p.Ran &&
+		strings.TrimSpace(p.Cmd) == strings.TrimSpace(cmd) && p.Fingerprint == fp
 }
 
 func (o *Orchestrator) runDeterministicPreTest(ctx context.Context) preTest {
@@ -314,6 +332,7 @@ func (o *Orchestrator) runDeterministicPreTest(ctx context.Context) preTest {
 	// the permission layer, auto installs. A manifest the worker wrote moments
 	// ago is not consent to execute its install scripts.
 	o.runQABootstrap(ctx, cmd)
+	pt.Fingerprint = o.changedFingerprint()
 	sr := o.runSmoke(ctx, cmd)
 	sr.Command = cmd // the reuse check matches on it; RunSmoke sets it too
 	pt.Ran = true
@@ -626,7 +645,7 @@ type gateOutcome struct {
 // runQualityGates runs placeholder fill, the reference-bar completeness check
 // and the QA gate, then decides what a green gate is allowed to clear.
 func (o *Orchestrator) runQualityGates(ctx context.Context, query string, board *plan.Board,
-	runner *loop.Runner, testerRejected bool) gateOutcome {
+	runner *loop.Runner, testerRejected bool, pre preTest) gateOutcome {
 
 	out := gateOutcome{Board: board, TesterRejected: testerRejected}
 	// Keep the run's mirrored verdict in step with whatever these gates decide.
@@ -690,7 +709,7 @@ func (o *Orchestrator) runQualityGates(ctx context.Context, query string, board
 	}
 
 	out.QACmd = o.qaCommand()
-	qaFailed := o.runQAGate(ctx, query, out.Board)
+	qaFailed := o.runQAGate(ctx, query, out.Board, pre)
 	out.QAFailed = qaFailed || integrationFailed
 	if out.QAFailed {
 		out.TesterRejected = true
@@ -813,12 +832,27 @@ func (o *Orchestrator) completeRun(ctx context.Context, runID, query, skillPack
 	session.SetPhase(o.cfg.SlmDir(), o.turn(), session.PhaseMemory)
 	// pipeline gate: phaseEnabled("memory") — when=never skips distillation
 	var lessonsMD string
-	if o.phaseEnabled("memory") {
+	// The distiller runs only when the run left something to distill: a
+	// lesson worth keeping (a failure, an honored human note — see
+	// notableLessons), a file the run changed, or a task that failed. A run
+	// that drained its board green without writing anything — an inquiry, a
+	// no-op, a rerun — used to spend a model call to be told there was nothing
+	// to remember.
+	var allLessons []learning.Lesson
+	notable := 0
+	for _, t := range board.Tasks {
+		allLessons = append(allLessons, learning.Extract(t)...)
+		notable += notableLessons(t)
+	}
+	changedN := len(o.changedFilesSnapshot())
+	failedN := board.FailedCount()
+	switch {
+	case !o.phaseEnabled("memory"):
+		o.emit("memory", "phase disabled — skipping memory distillation", "")
+	case notable == 0 && changedN == 0 && failedN == 0:
+		o.emit("memory", "memory distillation skipped — nothing to distill: no lessons, no changed files, no failed tasks", "")
+	default:
 		o.emitAgent("memory", "memory", "", "distilling long-term memory", "", "")
-		var allLessons []learning.Lesson
-		for _, t := range board.Tasks {
-			allLessons = append(allLessons, learning.Extract(t)...)
-		}
 		lessonsMD = learning.RenderMarkdown(allLessons)
 		if lessonsMD != "" {
 			_ = o.store.Append(contextstore.DocMemory, "Auto-lessons", lessonsMD)
@@ -842,8 +876,11 @@ func (o *Orchestrator) completeRun(ctx context.Context, runID, query, skillPack
 			memSkills = strings.TrimSpace(memSkills + "\n\n" + extra)
 		}
 		memPack, _ := o.packBuild("memory", query, contextstore.DefaultDocsForRole("memory"), nil, memSkills)
-		memOut, _ := o.runRoleMultipassTracked(ctx, "memory", "", memPack.Render()+fmt.Sprintf(
-			"\nFailed: %d\nWrite ≤8 durable bullets under ## Lessons (conventions, pitfalls, paths).", board.FailedCount()))
+		// Single-shot. Distillation is a summary, not a plan: the critique and
+		// refine passes of the multipass cycle spent up to three more model
+		// calls polishing eight bullets.
+		memOut, _ := o.runRoleTracked(ctx, "memory", "", memPack.Render()+fmt.Sprintf(
+			"\nFailed: %d\nWrite ≤8 durable bullets under ## Lessons (conventions, pitfalls, paths).", failedN))
 		if strings.TrimSpace(memOut) != "" {
 			_ = o.store.Append(contextstore.DocMemory, "Session distillation", memOut)
 			lessonsMD = strings.TrimSpace(lessonsMD + "\n" + memOut)
@@ -859,8 +896,6 @@ func (o *Orchestrator) completeRun(ctx context.Context, runID, query, skillPack
 		// stays the human mirror; this is what gives a lesson confidence,
 		// contradiction handling, provenance and a prune policy.
 		o.recordLessonFacts(allLessons)
-	} else {
-		o.emit("memory", "phase disabled — skipping memory distillation", "")
 	}
 
 	o.emit("skills", "evolving SKILLS.md + learned skill", "")
@@ -1434,7 +1469,7 @@ func (o *Orchestrator) restoreSquadPlan(board *plan.Board) {
 		o.emitWarn("init", "could not read the saved team plan ("+err.Error()+") — resuming as a single stream", "")
 		return
 	}
-	if !ok || !p.Enabled() {
+	if !ok || len(p.Squads) == 0 {
 		return
 	}
 	stamped := false
@@ -1447,8 +1482,31 @@ func (o *Orchestrator) restoreSquadPlan(board *plan.Board) {
 	if !stamped {
 		return
 	}
+	// One squad in squads.json is a run a single library team STAFFED: its
+	// manager triages the resumed board's rejected work, exactly as it did
+	// before the interruption. It is not a squad plan — Enabled() needs two —
+	// so it is restored as the single team, not as o.squadPlan.
+	if !p.Enabled() {
+		st := teamChoiceFromSquad(p.Squads[0])
+		o.mu.Lock()
+		o.singleTeam = &st
+		o.mu.Unlock()
+		o.emit("init", "restored the staffing team for this run: "+st.ID, "")
+		return
+	}
 	o.mu.Lock()
 	o.squadPlan = &p
 	o.mu.Unlock()
 	o.emit("init", "restored the team plan for this run: "+p.Summarize(), "")
 }
+
+// teamChoiceFromSquad is the inverse of singleTeamPlan: the saved one-squad
+// plan read back as the composition's team choice.
+func teamChoiceFromSquad(s squads.Squad) composer.TeamChoice {
+	return composer.TeamChoice{
+		ID: s.ID, Name: s.Name, Charter: s.Charter, Owns: append([]string(nil), s.Owns...),
+		Acceptance: s.Acceptance, Worker: s.Worker, Reviewer: s.Reviewer, Tester: s.Tester,
+		Manager: s.Manager, Agents: append([]string(nil), s.Agents...),
+		Skills: append([]string(nil), s.Skills...),
+	}
+}
diff --git a/pkg/orchestrator/runner.go b/pkg/orchestrator/runner.go
index 317e4be..38c51bf 100644
--- a/pkg/orchestrator/runner.go
+++ b/pkg/orchestrator/runner.go
@@ -23,7 +23,12 @@ import (
 // (Resume never got OnOverflowCompact's ReactCompact notice, for one). One
 // constructor, two callers, one behavior.
 func (o *Orchestrator) buildRunner(query, runID, skillPack string) *loop.Runner {
-	runner := loop.NewRunner(o.executor, o.shared)
+	// The GATED executor: every worker, reviewer, corrector, critique, triage
+	// and speculative-review request the loop makes takes a slot of the same
+	// run-wide max_parallel gate the phase roles use (see gate.go). The wave
+	// is still capped at MaxParallel by the loop; the gate is what stops a
+	// wave's review race plus a phase still draining from exceeding it.
+	runner := loop.NewRunner(o.gatedExecutor(), o.shared)
 	runner.Root = o.cfg.Root
 	runner.SlmDir = o.cfg.SlmDir()
 	runner.Feedback = o.LiveFeedback
@@ -40,6 +45,15 @@ func (o *Orchestrator) buildRunner(query, runID, skillPack string) *loop.Runner
 	runner.MaxParallel = o.cfg.MaxParallel
 	runner.ReviewParallel = o.cfg.MaxParallel >= 2
 	runner.Timeout = o.cfg.TaskTimeout
+	// Measured role budgets INSIDE the loop. Timeout above is the ceiling;
+	// each worker/reviewer/corrector request is dispatched on
+	// min(ceiling clamped to runway, p95 × 1.5 floored per role class), and
+	// each one records a sample, so the roles that own most of a run's wall
+	// clock finally feed the latency memory the phase roles have used since
+	// roletimeout.go was written. Before this, `reviewer` had zero samples
+	// after a hundred runs and every reviewer call got the whole task_timeout.
+	runner.RoleTimeout = o.roleTimeoutWithin
+	runner.OnRoleLatency = o.recordRoleLatency
 	runner.ReviewerRole = o.reviewStrictnessRole(o.Pipeline().Execute.Reviewer)
 	runner.CorrectorRole = o.Pipeline().Execute.Corrector
 	runner.DefaultRole = o.Pipeline().Execute.DefaultRole
@@ -123,9 +137,11 @@ func (o *Orchestrator) buildRunner(query, runID, skillPack string) *loop.Runner
 	runner.OnEscalate = func(ctx context.Context, board *plan.Board, t plan.Task, detail string) {
 		o.runEscalateAsk(ctx, board, t, detail)
 	}
+	// Usage only. The request COUNT is folded in by the gated executor, which
+	// sees the transcript and counts every assistant turn — one result used
+	// to be tallied as one call while its ReAct loop had made eight.
 	runner.OnUsage = func(u llm.Usage, estimated bool, _, _ string) {
 		o.recordUsage(u, estimated)
-		o.bumpLLMCalls(1)
 	}
 	runner.OnOverflowCompact = func(ctx context.Context) error {
 		_, err := o.CompactContextNow()
@@ -152,12 +168,27 @@ func (o *Orchestrator) buildRunner(query, runID, skillPack string) *loop.Runner
 		runner.Triage = o.triageRejectedDelivery
 	}
 	runner.AfterWave = func(ctx context.Context, board *plan.Board, wave []plan.Task) {
+		// What the wave produced decides what runs after it. A wave whose
+		// tasks all went green with nothing to learn from used to buy a
+		// memory distillation AND a coordinator call — two model round-trips
+		// on a board nothing had happened to. Both now run only on a wave
+		// that failed, escalated or taught something; the reason is said so
+		// the Live view can show why a phase did not run.
+		eventful, why := waveEventful(wave)
 		o.evolveAfterWave(ctx, query, skillPack, board, wave)
 		o.maybeCompactContext(ctx)
-		o.coordinate(ctx, query, board, "after-wave")
+		if eventful {
+			o.coordinate(ctx, query, board, "after-wave")
+		} else {
+			o.emitFull("coord", stream.KindCoord, "coordinator", "",
+				"coordinator @after-wave skipped — "+why, "", "")
+		}
 		// Per-squad progress and cross-team stalls. An aggregate task count
 		// hides one team finishing while the other sits blocked.
-		o.reportSquadProgress(o.squadPlan, board)
+		o.reportSquadProgress(o.squadPlanNow(), board)
+		// A team whose lane just finished is proved NOW, so a red half's
+		// ticket rides the next wave instead of waiting for the finish path.
+		o.earlyTeamGate(ctx, board)
 	}
 	// The objective gate, asked BETWEEN waves rather than only after the board
 	// drains. A board that keeps rejecting one task never drains, so the
diff --git a/pkg/orchestrator/skips_test.go b/pkg/orchestrator/skips_test.go
new file mode 100644
index 0000000..7d01f23
--- /dev/null
+++ b/pkg/orchestrator/skips_test.go
@@ -0,0 +1,166 @@
+package orchestrator
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/UnicoLab/slmcode/pkg/pipeline"
+	"github.com/UnicoLab/slmcode/pkg/plan"
+	"github.com/UnicoLab/slmcode/pkg/stream"
+)
+
+// agentStarts lists the agents a recorder saw start.
+func (r *recorder) agentStarts() []string {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	var out []string
+	for _, e := range r.events {
+		if e.Kind == stream.KindAgentStart {
+			out = append(out, e.Agent)
+		}
+	}
+	return out
+}
+
+func containsAgent(starts []string, name string) bool {
+	for _, s := range starts {
+		if strings.Contains(s, name) {
+			return true
+		}
+	}
+	return false
+}
+
+// A run whose board drained with no lessons, no changed files and no failed
+// tasks has nothing for the distiller to distill — and says so instead of
+// spending a model call to be told the same.
+func TestMemoryPhaseIsSkippedWhenThereIsNothingToDistill(t *testing.T) {
+	exec := &countingExec{}
+	o := objectiveOrch(t, &fakeGate{ok: true}, exec, nil)
+	o.pipe.Phases["memory"] = pipeline.PhaseSpec{When: pipeline.WhenAlways}
+	o.resetChangedFiles() // the fixture pretends a file changed; this run wrote nothing
+	rec := &recorder{}
+	o.onEvent = rec.handle
+
+	run := func() {
+		t.Helper()
+		if _, err := o.completeRun(context.Background(), "run-objective", "implement the thing",
+			"", doneBoard(), "", false, false, objectiveCmd, time.Now()); err != nil {
+			t.Fatalf("completeRun: %v", err)
+		}
+	}
+
+	run()
+	if containsAgent(rec.agentStarts(), "memory") {
+		t.Fatalf("memory agent started on a run with nothing to distill: %v", rec.agentStarts())
+	}
+	if exec.n() != 0 {
+		t.Fatalf("%d model call(s) were spent: %s", exec.n(), exec.roles())
+	}
+	if !strings.Contains(rec.text(), "memory distillation skipped") {
+		t.Fatal("the skip must be announced so the Live view can show it")
+	}
+
+	// The same run with one changed file has something to remember.
+	o.noteChangedFiles("stats.go")
+	run()
+	if !containsAgent(rec.agentStarts(), "memory") {
+		t.Fatalf("memory agent did not start once a file had changed: %v", rec.agentStarts())
+	}
+	if !strings.Contains(exec.roles(), "memory") {
+		t.Fatalf("the distiller was announced but never called: %s", exec.roles())
+	}
+}
+
+// A one-step plan over one known file is one task: the splitter — the slowest
+// role after the planner — is skipped and the board is built directly, with
+// the known file as the task's scope.
+func TestOneStepPlanSkipsTheSplitter(t *testing.T) {
+	exec := &countingExec{}
+	o := objectiveOrch(t, &fakeGate{ok: true}, exec, nil)
+	if err := os.WriteFile(filepath.Join(o.cfg.Root, "stats.go"), []byte("package main\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	rec := &recorder{}
+	o.onEvent = rec.handle
+	in := planSplitInput{
+		RunID: "run-objective", Query: "add a greeting to stats.go",
+		Inventory: []string{"stats.go"}, Discovered: []string{"stats.go"},
+	}
+
+	board, err := o.runSplitPhase(context.Background(), in,
+		plan.Plan{Summary: "greet", Steps: []string{"Add a greeting to stats.go"}}, `{"steps":["x"]}`, nil)
+	if err != nil {
+		t.Fatalf("runSplitPhase: %v", err)
+	}
+	if containsAgent(rec.agentStarts(), "splitter") || exec.n() != 0 {
+		t.Fatalf("the splitter ran on a one-step plan: starts=%v calls=%s", rec.agentStarts(), exec.roles())
+	}
+	if !strings.Contains(rec.text(), "splitter skipped") {
+		t.Fatal("the skip must be announced so the Live view can show it")
+	}
+	if len(board.Tasks) != 1 {
+		t.Fatalf("board has %d task(s), want the plan's one step: %+v", len(board.Tasks), board.Tasks)
+	}
+	got := board.Tasks[0]
+	if got.Column != plan.ColReadyToDev || strings.Join(got.Files, ",") != "stats.go" {
+		t.Fatalf("the one task must be ready with the known file as scope, got column=%q files=%v notes=%q",
+			got.Column, got.Files, got.Notes)
+	}
+
+	// Two steps are a real split: the splitter is asked.
+	rec2 := &recorder{}
+	o.onEvent = rec2.handle
+	if _, err := o.runSplitPhase(context.Background(), in,
+		plan.Plan{Summary: "two", Steps: []string{"one", "two"}}, `{"steps":["one","two"]}`, nil); err != nil {
+		t.Fatalf("runSplitPhase: %v", err)
+	}
+	if !containsAgent(rec2.agentStarts(), "splitter") {
+		t.Fatalf("a two-step plan must still be split by the splitter: %v", rec2.agentStarts())
+	}
+}
+
+// After a wave, the coordinator and the wave distiller run only when the wave
+// gave them something: a failure, an escalation or a lesson.
+func TestQuietWavesAreNotEventful(t *testing.T) {
+	// Realistic green tasks: an acceptance and an output, which the extractor
+	// turns into routine "success"/"convention" lessons that must NOT count.
+	quiet := []plan.Task{
+		{ID: "T1", Title: "a", Column: plan.ColDone, Status: "done", Acceptance: "file exists",
+			Output: `{"status":"done","summary":"wrote a.go","files_changed":["a.go"]}`},
+		{ID: "T2", Title: "b", Column: plan.ColDone, Status: "done", Acceptance: "tests pass",
+			Output: `{"status":"done","summary":"wrote b.go","files_changed":["b.go"]}`},
+	}
+	if ok, why := waveEventful(quiet); ok || !strings.Contains(why, "green") {
+		t.Fatalf("a green wave with nothing learned is eventful: %v %q", ok, why)
+	}
+	if ok, _ := waveEventful(nil); ok {
+		t.Fatal("an empty wave is eventful")
+	}
+	failed := append([]plan.Task{}, quiet...)
+	failed = append(failed, plan.Task{ID: "T3", Column: plan.ColBlocked, Error: "build failed"})
+	if ok, _ := waveEventful(failed); !ok {
+		t.Fatal("a wave with a blocked task is not eventful")
+	}
+	escalated := append([]plan.Task{}, quiet...)
+	escalated = append(escalated, plan.Task{ID: "T4", Column: plan.ColToScope, Notes: "escalated after max retries"})
+	if ok, _ := waveEventful(escalated); !ok {
+		t.Fatal("a wave with an escalated task is not eventful")
+	}
+	// A human note the task honored is worth remembering; a harness
+	// bookkeeping marker in Notes is not.
+	learned := []plan.Task{{ID: "T5", Title: "c", Column: plan.ColDone, Status: "done",
+		Notes: "Keep the encoder order: set Content-Type before writing the body."}}
+	if ok, _ := waveEventful(learned); !ok {
+		t.Fatal("a wave that honored a human note is not eventful")
+	}
+	bookkeeping := []plan.Task{{ID: "T6", Title: "d", Column: plan.ColDone, Status: "done",
+		Notes: "correction-key: tester|x|a.go\ncorrection-attempt: 1"}}
+	if ok, _ := waveEventful(bookkeeping); ok {
+		t.Fatal("harness bookkeeping in Notes made a wave eventful")
+	}
+}
diff --git a/pkg/orchestrator/smokememo_test.go b/pkg/orchestrator/smokememo_test.go
new file mode 100644
index 0000000..407d589
--- /dev/null
+++ b/pkg/orchestrator/smokememo_test.go
@@ -0,0 +1,184 @@
+package orchestrator
+
+import (
+	"context"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/UnicoLab/slmcode/pkg/quality"
+	ggagent "github.com/piotrlaczkowski/GoLangGraph/pkg/agent"
+)
+
+// The memo: a command asked of a tree nothing has written to since it last
+// answered is answered from memory; any write — a NEW file or a REWRITE of one
+// already changed — or a non-agent mutation invalidates it.
+func TestSmokeMemoAnswersAnUnchangedTreeOnce(t *testing.T) {
+	o := testOrch(t, nil)
+	var mu sync.Mutex
+	runs := map[string]int{}
+	o.qaSmoke = func(_ context.Context, _, cmd string, _ time.Duration) quality.SmokeResult {
+		mu.Lock()
+		runs[cmd]++
+		mu.Unlock()
+		return quality.SmokeResult{Ran: true, OK: true, Command: cmd, Output: "ok", Duration: time.Second}
+	}
+	count := func(cmd string) int {
+		mu.Lock()
+		defer mu.Unlock()
+		return runs[cmd]
+	}
+	ctx := context.Background()
+	const cmd = "go test ./..."
+
+	o.runSmoke(ctx, cmd)
+	o.runSmoke(ctx, cmd)
+	o.runSmokeIn(ctx, cmd, 30*time.Second) // a different timeout is the same question
+	if n := count(cmd); n != 1 {
+		t.Fatalf("unchanged tree: command ran %d time(s), want 1", n)
+	}
+
+	o.noteChangedFiles("x.go")
+	o.runSmoke(ctx, cmd)
+	if n := count(cmd); n != 2 {
+		t.Fatalf("after a write: %d run(s), want 2", n)
+	}
+
+	// A rewrite of the SAME file is a change: the path set is unchanged, the
+	// write sequence is not.
+	o.noteChangedFiles("x.go")
+	o.runSmoke(ctx, cmd)
+	if n := count(cmd); n != 3 {
+		t.Fatalf("after a rewrite of an already-changed file: %d run(s), want 3", n)
+	}
+
+	// A mutation outside the tool layer (formatter, dependency install).
+	o.noteTreeMutation()
+	o.runSmoke(ctx, cmd)
+	if n := count(cmd); n != 4 {
+		t.Fatalf("after a tree mutation: %d run(s), want 4", n)
+	}
+
+	// Another command is another question.
+	o.runSmoke(ctx, "npm test")
+	o.runSmoke(ctx, "npm test")
+	if n := count("npm test"); n != 1 {
+		t.Fatalf("second command ran %d time(s), want 1", n)
+	}
+	if n := count(cmd); n != 4 {
+		t.Fatalf("the first command's memo was disturbed by the second: %d", n)
+	}
+
+	// A new run forgets everything.
+	o.resetObjectiveProbes()
+	o.runSmoke(ctx, cmd)
+	if n := count(cmd); n != 5 {
+		t.Fatalf("after a run reset: %d run(s), want 5", n)
+	}
+}
+
+// What is NOT remembered: a command that could not start, and one that hit
+// its timeout — the second answers "at least this long", not "it fails".
+func TestSmokeMemoRefusesUnusableResults(t *testing.T) {
+	o := testOrch(t, nil)
+	var mu sync.Mutex
+	n := 0
+	var result quality.SmokeResult
+	o.qaSmoke = func(_ context.Context, _, cmd string, _ time.Duration) quality.SmokeResult {
+		mu.Lock()
+		n++
+		mu.Unlock()
+		r := result
+		r.Command = cmd
+		return r
+	}
+	ctx := context.Background()
+
+	result = quality.SmokeResult{Ran: false, Summary: "npm: not found"}
+	o.runSmoke(ctx, "npm test")
+	o.runSmoke(ctx, "npm test")
+	if n != 2 {
+		t.Fatalf("a result that never ran was remembered: %d run(s)", n)
+	}
+
+	result = quality.SmokeResult{Ran: true, OK: false, Duration: 30 * time.Second, Summary: "killed"}
+	o.runSmokeIn(ctx, "slow", 30*time.Second)
+	o.runSmokeIn(ctx, "slow", 30*time.Second)
+	if n != 4 {
+		t.Fatalf("a timed-out result was remembered: %d run(s)", n)
+	}
+}
+
+// passingExec is a countingExec whose tester PASSES with shell evidence, so a
+// run can travel the whole finish path without a corrective wave.
+type passingExec struct{ countingExec }
+
+func (p *passingExec) ExecuteSubAgents(ctx context.Context, reqs []ggagent.SubAgentRequest,
+	shared *ggagent.SharedState) ([]ggagent.SubAgentResult, error) {
+	out, err := p.countingExec.ExecuteSubAgents(ctx, reqs, shared)
+	for i, r := range reqs {
+		if strings.Contains(r.AgentID, "tester") {
+			out[i].Output = "Observation: ws_shell `" + objectiveCmd + "` exit status 0\nok\tstats\t0.2s\n" +
+				`{"passed":true,"commands":["` + objectiveCmd + `"],"summary":"green","failures":[]}`
+		}
+	}
+	return out, err
+}
+
+// The finish path used to run the objective command up to four times on an
+// unchanged tree: the pre-test, the team gate, QA round 1, the final check.
+// With nothing written after the pre-test, it runs ONCE.
+//
+// The baseline is marked green so the early finish does not take the short
+// way out (a green that was green before verifies nothing): the run has to go
+// through the tester, the quality gates and the QA gate's first round, which
+// is exactly the stretch where the repeated runs used to happen.
+func TestFinishPathRunsTheObjectiveCommandOnceOnAnUnchangedTree(t *testing.T) {
+	gate := &fakeGate{ok: true, out: "ok\tstats\t0.2s\n"}
+	exec := &passingExec{}
+	o := objectiveOrch(t, gate, exec, nil)
+	o.mu.Lock()
+	o.objective.baselineKnown, o.objective.baselineGreen = true, true
+	o.mu.Unlock()
+
+	res := finalize(t, o, doneBoard())
+
+	if n := gate.count(objectiveCmd); n != 1 {
+		t.Fatalf("objective command ran %d time(s) through the finish path on an unchanged tree, want exactly 1",
+			n)
+	}
+	if o.lastRunner().CorrectiveRuns() != 0 {
+		t.Fatalf("a passing tester still scheduled corrective waves: %s", res.Summary)
+	}
+}
+
+// The QA gate's first round says, in its own events, that it reused the
+// pre-test — and re-runs when the tree moved in between.
+func TestQAGateFirstRoundReusesThePreTest(t *testing.T) {
+	gate := &fakeGate{ok: true, out: "ok\tstats\t0.2s\n"}
+	o := objectiveOrch(t, gate, &countingExec{}, nil)
+	rec := &recorder{}
+	o.onEvent = rec.handle
+
+	pre := o.runDeterministicPreTest(context.Background())
+	if !pre.Ran || pre.Fingerprint == "" {
+		t.Fatalf("pre-test did not run or carries no fingerprint: %+v", pre)
+	}
+	if red := o.runQAGate(context.Background(), "implement the thing", doneBoard(), pre); red {
+		t.Fatal("a green pre-test made the QA gate red")
+	}
+	if n := gate.count(objectiveCmd); n != 1 {
+		t.Fatalf("QA round 1 re-ran the command (%d total) instead of reusing the pre-test", n)
+	}
+	if !strings.Contains(rec.text(), "reusing the pre-test") {
+		t.Fatal("the reuse is not visible in the gate's events")
+	}
+
+	// The tree moved: the pre-test no longer describes it.
+	o.noteChangedFiles("stats.go")
+	_ = o.runQAGate(context.Background(), "implement the thing", doneBoard(), pre)
+	if n := gate.count(objectiveCmd); n != 2 {
+		t.Fatalf("after a write the gate still reused the stale pre-test (%d runs)", n)
+	}
+}
diff --git a/pkg/orchestrator/squads.go b/pkg/orchestrator/squads.go
index 866779e..0883cd5 100644
--- a/pkg/orchestrator/squads.go
+++ b/pkg/orchestrator/squads.go
@@ -287,6 +287,13 @@ func (o *Orchestrator) runSquadIntegration(ctx context.Context, board *plan.Boar
 		return false
 	}
 
+	// The join is a command run on the finish path, and the finish path has a
+	// reserve to keep. Skipping with a reason beats overrunning the report.
+	if !o.gateRoundAffordable(ctx, 2) {
+		o.emitWarn("integrate", "integration skipped — not enough time left to run "+gate.Command+
+			" and still report", "")
+		return false
+	}
 	o.emit("integrate", "every squad is green — joining the halves: "+gate.Command, "")
 	res := o.runSmoke(ctx, gate.Command)
 	if !res.Ran {
diff --git a/pkg/orchestrator/teamgate.go b/pkg/orchestrator/teamgate.go
index 7663fec..9e92f94 100644
--- a/pkg/orchestrator/teamgate.go
+++ b/pkg/orchestrator/teamgate.go
@@ -68,6 +68,29 @@ func (g TeamGate) Verified() bool { return g.Ran }
 type teamGates struct {
 	mu sync.RWMutex
 	by map[string]TeamGate
+	// lane records, per team, the fingerprint of the team's own changed files
+	// at the moment its half was last proved. The between-wave gate re-proves
+	// a half only when this differs — see earlyTeamGate.
+	lane map[string]string
+}
+
+// provedOn records the lane fingerprint a team's gate was taken against.
+func (t *teamGates) provedOn(team, fingerprint string) {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	if t.lane == nil {
+		t.lane = map[string]string{}
+	}
+	t.lane[team] = fingerprint
+}
+
+// lastLane returns the lane fingerprint the team was last proved against and
+// whether it was ever proved this run.
+func (t *teamGates) lastLane(team string) (string, bool) {
+	t.mu.RLock()
+	defer t.mu.RUnlock()
+	fp, ok := t.lane[team]
+	return fp, ok
 }
 
 func (t *teamGates) set(g TeamGate) {
@@ -79,6 +102,36 @@ func (t *teamGates) set(g TeamGate) {
 	t.by[g.Team] = g
 }
 
+// reset forgets every result. Called at the start of a run: a gate is evidence
+// about THIS run's tree, and the orchestrator outlives a run.
+func (t *teamGates) reset() {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	t.by = nil
+	t.lane = nil
+}
+
+// resetTeamState clears every piece of per-run team state — the squad plan,
+// the single staffing team and the team gates — under the lock.
+//
+// Why all three, and why at the START of both Run and Resume: the squad plan
+// used to be cleared halfway through runSLM and never on Resume, and the
+// gates were never cleared at all. runTeamAcceptance skips teams with no work
+// (Total == 0), so a previous run's green gate for a team that sits idle in
+// this run survived, and allHalvesProved then read two green gates on a run
+// that proved one half — upgrading a failed run's verdict on stale evidence.
+func (o *Orchestrator) resetTeamState() {
+	if o == nil {
+		return
+	}
+	o.mu.Lock()
+	o.squadPlan = nil
+	o.singleTeam = nil
+	o.teamPick = nil
+	o.mu.Unlock()
+	o.teamGates.reset()
+}
+
 func (t *teamGates) snapshot() []TeamGate {
 	t.mu.RLock()
 	defer t.mu.RUnlock()
@@ -109,17 +162,18 @@ func (o *Orchestrator) TeamGates() []TeamGate {
 // build` writing dist/ while another's `go test` reads the same tree produces a
 // failure neither team caused.
 func (o *Orchestrator) runTeamAcceptance(ctx context.Context, board *plan.Board) []string {
-	if o == nil || o.squadPlan == nil || board == nil || len(o.squadPlan.Squads) < 2 {
+	p := o.squadPlanNow()
+	if o == nil || p == nil || board == nil || len(p.Squads) < 2 {
 		return nil
 	}
 
 	progress := map[string]squads.Status{}
-	for _, st := range squads.Progress(o.squadPlan, board.Tasks) {
+	for _, st := range squads.Progress(p, board.Tasks) {
 		progress[st.ID] = st
 	}
 
 	var failed []string
-	for _, s := range o.squadPlan.Squads {
+	for _, s := range p.Squads {
 		st := progress[s.ID]
 		// A team with no work did nothing to prove. Running its acceptance
 		// would report on the state of the repository, not on this run.
@@ -129,67 +183,176 @@ func (o *Orchestrator) runTeamAcceptance(ctx context.Context, board *plan.Board)
 		if ctx.Err() != nil {
 			return failed
 		}
-
-		cmd := strings.TrimSpace(s.Acceptance)
-		if cmd == "" {
-			o.teamGates.set(TeamGate{Team: s.ID, Summary: "no acceptance command — this half was never proved"})
-			o.emitWarn("verify", "team "+s.ID+" has no acceptance command — its half is unproved, "+
-				"so a break in it can only surface at integration", "")
+		// Each half is a command run, and the finish path has a reserve to
+		// keep: a run that cannot afford another command run must say so
+		// rather than overrun on the way to its own report.
+		if !o.gateRoundAffordable(ctx, 2) {
+			o.emitWarn("verify", "team "+s.ID+": not enough time left to run its acceptance and still report — "+
+				"its half is UNVERIFIED", "")
+			o.teamGates.set(TeamGate{Team: s.ID, Command: strings.TrimSpace(s.Acceptance),
+				Summary: "not run — out of time"})
 			continue
 		}
-
-		// The team is not wrong about wanting its half to compile, only about
-		// what THIS project calls that. A shipped team declares
-		// `npm --prefix web run build`; a scaffold may name it `compile`, or
-		// have only `typecheck`. Resolving it is the difference between the
-		// half being proved and being permanently grey.
-		root := ""
-		if o.cfg != nil {
-			root = o.cfg.Root
-		}
-		if resolved, note := quality.ResolveScriptCommand(root, cmd); note != "" {
-			o.emit("verify", "team "+s.ID+": "+note, "")
-			cmd = resolved
+		if g, red := o.proveHalf(ctx, board, p, s); red {
+			failed = append(failed, g.Team)
 		}
+	}
+	return failed
+}
+
+// squadPlanNow reads the run's squad plan under the lock.
+func (o *Orchestrator) squadPlanNow() *squads.Plan {
+	if o == nil {
+		return nil
+	}
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	return o.squadPlan
+}
 
-		o.emit("verify", "team "+s.ID+": proving its half alone — "+cmd, "")
-		res := o.runSmoke(ctx, cmd)
-		g := TeamGate{Team: s.ID, Command: cmd, Ran: res.Ran, OK: res.OK, Summary: res.Summary}
+// proveHalf runs ONE team's acceptance command, records the gate and raises the
+// team's ticket when its half is red. red is true only for a verdict that RAN
+// and failed; an unrunnable check is UNVERIFIED and never red.
+//
+// The command goes through runSmoke, so a half already proved on this exact
+// tree — by the between-wave gate, say — is answered from the run's smoke memo
+// rather than by running the suite again.
+func (o *Orchestrator) proveHalf(ctx context.Context, board *plan.Board, p *squads.Plan, s squads.Squad) (TeamGate, bool) {
+	lane := o.laneFingerprint(p, s.ID)
+	cmd := strings.TrimSpace(s.Acceptance)
+	if cmd == "" {
+		g := TeamGate{Team: s.ID, Summary: "no acceptance command — this half was never proved"}
 		o.teamGates.set(g)
+		o.teamGates.provedOn(s.ID, lane)
+		o.emitWarn("verify", "team "+s.ID+" has no acceptance command — its half is unproved, "+
+			"so a break in it can only surface at integration", "")
+		return g, false
+	}
 
-		// A check that never ran is a fact about the MACHINE or the project,
-		// not about the code. `npm run build` with node_modules never
-		// installed, or with no build script in package.json, exits non-zero
-		// and says nothing whatsoever about what the team wrote — scoring that
-		// red sends a corrector to rewrite source that was never at fault,
-		// burns the retry budget, and shows the user a red team for something
-		// no model can fix. Both were measured live; the second is why this
-		// asks CheckDidNotRun rather than ToolingMissing alone.
-		if why := quality.CheckDidNotRun(cmd, res.Output); res.Ran && !res.OK && why != "" {
-			g.Ran = false
-			g.Summary = why + ": " + res.Summary
-			o.teamGates.set(g)
+	// The team is not wrong about wanting its half to compile, only about
+	// what THIS project calls that. A shipped team declares
+	// `npm --prefix web run build`; a scaffold may name it `compile`, or
+	// have only `typecheck`. Resolving it is the difference between the
+	// half being proved and being permanently grey.
+	root := ""
+	if o.cfg != nil {
+		root = o.cfg.Root
+	}
+	if resolved, note := quality.ResolveScriptCommand(root, cmd); note != "" {
+		o.emit("verify", "team "+s.ID+": "+note, "")
+		cmd = resolved
+	}
+
+	o.emit("verify", "team "+s.ID+": proving its half alone — "+cmd, "")
+	res := o.runSmoke(ctx, cmd)
+	g := TeamGate{Team: s.ID, Command: cmd, Ran: res.Ran, OK: res.OK, Summary: res.Summary}
+	o.teamGates.set(g)
+	o.teamGates.provedOn(s.ID, lane)
+
+	// A check that never ran is a fact about the MACHINE or the project,
+	// not about the code. `npm run build` with node_modules never
+	// installed, or with no build script in package.json, exits non-zero
+	// and says nothing whatsoever about what the team wrote — scoring that
+	// red sends a corrector to rewrite source that was never at fault,
+	// burns the retry budget, and shows the user a red team for something
+	// no model can fix. Both were measured live; the second is why this
+	// asks CheckDidNotRun rather than ToolingMissing alone.
+	if why := quality.CheckDidNotRun(cmd, res.Output); res.Ran && !res.OK && why != "" {
+		g.Ran = false
+		g.Summary = why + ": " + res.Summary
+		o.teamGates.set(g)
+	}
+
+	switch {
+	case !g.Ran:
+		// A missing runner is a fact about the machine. Failing a team for
+		// it turns a working run red for a reason the model cannot fix.
+		o.emitWarn("verify", "team "+s.ID+": acceptance could not run ("+g.Summary+
+			") — its half is UNVERIFIED, not broken", "")
+		return g, false
+	case res.OK:
+		o.emit("verify", "team "+s.ID+" is green: "+cmd, "")
+		o.recordGate("team:"+s.ID, true, "")
+		return g, false
+	default:
+		o.emitWarn("verify", "team "+s.ID+" is RED — its own half does not pass: "+res.Summary, res.Output)
+		o.recordGate("team:"+s.ID, false, res.Summary)
+		o.raiseTeamTicket(board, s, cmd, res.Summary, res.Output)
+		return g, true
+	}
+}
+
+// laneFingerprint identifies what this run has written INSIDE one team's
+// territory: the changed files the plan says the team owns, each with its
+// write count so a rewrite of an already-changed file counts. Two equal
+// fingerprints mean the team's half has not moved since — and the OTHER
+// team's writes do not move it, which is what lets a finished lane stay
+// proved while its neighbour keeps working.
+func (o *Orchestrator) laneFingerprint(p *squads.Plan, team string) string {
+	if o == nil || p == nil {
+		return ""
+	}
+	var mine []string
+	for _, fw := range o.changedFileWrites() {
+		if owner, ok := p.Owner(fw.Path); ok && owner == team {
+			mine = append(mine, fmt.Sprintf("%s:%d", fw.Path, fw.Writes))
 		}
+	}
+	return strings.Join(mine, "\n")
+}
 
-		switch {
-		case !g.Ran:
-			// A missing runner is a fact about the machine. Failing a team for
-			// it turns a working run red for a reason the model cannot fix.
-			o.emitWarn("verify", "team "+s.ID+": acceptance could not run ("+g.Summary+
-				") — its half is UNVERIFIED, not broken", "")
-		case res.OK:
-			o.emit("verify", "team "+s.ID+" is green: "+cmd, "")
-			o.recordGate("team:"+s.ID, true, "")
-		default:
-			failed = append(failed, s.ID)
-			o.emitWarn("verify", "team "+s.ID+" is RED — its own half does not pass: "+res.Summary, res.Output)
-			o.recordGate("team:"+s.ID, false, res.Summary)
-			o.raiseTeamTicket(board, s, cmd, res.Summary, res.Output)
+// earlyTeamGate proves a half the moment its lane finishes, between waves.
+//
+// The finish path proves every half once the WHOLE board has drained. On a
+// two-team run that is late: the backend can finish in wave 1 with a broken
+// build and sit green-on-the-board for every wave the frontend still needs,
+// its ticket raised only after the last frontend task — at which point the fix
+// is a whole extra wave the run may no longer have time for. Proving a lane
+// when it completes puts the ticket on the board for the NEXT wave.
+//
+// A team is proved here when squads.Progress says it is Complete and its lane
+// has changed since it was last proved (or was never proved this run). A team
+// that never wrote inside its own territory is not proved: its acceptance
+// would report on the repository, not on this run. Commands go through the
+// smoke memo, so the finish-path gate re-runs nothing the tree has not moved
+// under since.
+func (o *Orchestrator) earlyTeamGate(ctx context.Context, board *plan.Board) {
+	p := o.squadPlanNow()
+	if o == nil || p == nil || board == nil || len(p.Squads) < 2 || ctx.Err() != nil {
+		return
+	}
+	for _, st := range squads.Progress(p, board.Tasks) {
+		if !st.Complete {
+			continue
+		}
+		s, ok := p.Squad(st.ID)
+		if !ok {
+			continue
+		}
+		lane := o.laneFingerprint(p, s.ID)
+		if lane == "" {
+			// Nothing written in this team's territory: nothing to prove yet.
+			continue
+		}
+		if last, proved := o.teamGates.lastLane(s.ID); proved && last == lane {
+			continue
+		}
+		if !o.gateRoundAffordable(ctx, 2) {
+			o.emit("verify", "team "+s.ID+" finished its lane, but there is not enough time left to prove "+
+				"it between waves — deferring to the finish path", "")
+			return
+		}
+		o.emit("verify", "team "+s.ID+" finished its lane — proving its half before the next wave", "")
+		if g, red := o.proveHalf(ctx, board, p, s); red {
+			o.emit("verify", "team "+g.Team+"'s correction ticket rides the next wave", "")
 		}
 	}
-	return failed
 }
 
+// maxTeamTicketsPerDefect bounds how many times ONE failing acceptance is
+// ticketed to its team per run: the first ticket and one retry.
+const maxTeamTicketsPerDefect = 2
+
 // raiseTeamTicket turns a red half into a ticket the owning team can work.
 //
 // Scoped to the team's own lane. A ticket for a broken Go build must not name
@@ -208,7 +371,7 @@ func (o *Orchestrator) raiseTeamTicket(board *plan.Board, s squads.Squad, cmd, s
 	// and half of that can belong to the other side of the seam.
 	var mine []string
 	for _, path := range squads.PathsIn(output) {
-		if owner, ok := o.squadPlan.Owner(path); ok && owner == s.ID {
+		if owner, ok := o.squadPlanNow().Owner(path); ok && owner == s.ID {
 			mine = append(mine, path)
 		}
 	}
@@ -221,17 +384,30 @@ func (o *Orchestrator) raiseTeamTicket(board *plan.Board, s squads.Squad, cmd, s
 		Output:   output,
 		Files:    limitList(mine, 6),
 		Squad:    s.ID,
-		Attempt: board.CorrectionAttempts(plan.CorrectionKey(plan.CorrectionInput{
-			Source: plan.SourceTester, Command: cmd, Squad: s.ID,
-		})),
 	}
 	key := plan.CorrectionKey(in)
+	// Counted under the SAME key the ticket is stamped with. It used to be
+	// looked up under a reduced key (source, command, squad) that no stamped
+	// ticket ever matched, so every ticket announced itself as attempt 1 and
+	// nothing could tell a first ticket from a tenth.
+	in.Attempt = board.CorrectionAttempts(key)
 	// The same red half on a second pass is the SAME defect. A second ticket
 	// would make the board look like it is losing ground while one unresolved
 	// break stacks tickets on every gate run.
 	if board.NoteRepeatedRejection(key) > 0 {
 		return
 	}
+	// And the same defect, ticketed, worked to done, and red AGAIN, is a
+	// defect the team cannot fix on its own. The finish-path gate ran once
+	// and was bounded by that; the between-wave gate is not, and without this
+	// cap a half that stays red would be ticketed on every wave until the run
+	// hit its ceiling — measured at 200 tickets in a test before the cap
+	// existed. Two attempts per defect, then a human.
+	if in.Attempt >= maxTeamTicketsPerDefect {
+		o.emitWarn("verify", fmt.Sprintf("team %s is still RED after %d correction ticket(s) for the same "+
+			"failure — not raising another; this half needs a human", s.ID, in.Attempt), "")
+		return
+	}
 	nt := plan.NewCorrectionTicket(in, hasRole)
 	plan.StampCorrectionKey(&nt, key)
 	plan.StampCorrectionAttempt(&nt, in.Attempt+1)
diff --git a/pkg/orchestrator/teamstate_test.go b/pkg/orchestrator/teamstate_test.go
new file mode 100644
index 0000000..f7db704
--- /dev/null
+++ b/pkg/orchestrator/teamstate_test.go
@@ -0,0 +1,147 @@
+package orchestrator
+
+import (
+	"context"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/UnicoLab/slmcode/pkg/config"
+	"github.com/UnicoLab/slmcode/pkg/plan"
+	"github.com/UnicoLab/slmcode/pkg/quality"
+	"github.com/UnicoLab/slmcode/pkg/squads"
+)
+
+// Two runs on one Orchestrator. The first proves two halves green; the second
+// has one team idle. Its verdict must NOT read the first run's gate for the
+// idle team — which is exactly what happened when the gates were never reset:
+// runTeamAcceptance skips Total==0 teams, so the stale green survived and
+// allHalvesProved upgraded a run that proved one half.
+func TestTeamGatesDoNotSurviveIntoTheNextRun(t *testing.T) {
+	o, _ := gateOrchestrator(t, func(cmd string) quality.SmokeResult {
+		return quality.SmokeResult{Ran: true, OK: true, Command: cmd, Summary: "ok"}
+	})
+
+	// Run 1: both halves have work, both prove green.
+	o.runTeamAcceptance(context.Background(), boardWithBothHalves())
+	if !o.allHalvesProved() {
+		t.Fatal("run 1: two green halves must count as proved")
+	}
+
+	// Run 2 begins the way runSLM and Resume begin.
+	o.resetTeamState()
+	if o.squadPlanNow() != nil || len(o.TeamGates()) != 0 {
+		t.Fatalf("reset left team state behind: plan=%v gates=%+v", o.squadPlanNow(), o.TeamGates())
+	}
+	o.mu.Lock()
+	o.squadPlan = twoTeams()
+	o.mu.Unlock()
+	oneHalf := &plan.Board{Tasks: []plan.Task{
+		{ID: "T1", Squad: "backend", Column: plan.ColDone, Status: "done", Files: []string{"cmd/main.go"}},
+	}}
+	o.runTeamAcceptance(context.Background(), oneHalf)
+
+	if gates := o.TeamGates(); len(gates) != 1 || gates[0].Team != "backend" {
+		t.Fatalf("run 2 gates = %+v, want only the team that had work", gates)
+	}
+	if o.allHalvesProved() {
+		t.Fatal("run 2 proved ONE half and reported both — the previous run's gate leaked in")
+	}
+}
+
+// The reset must happen at the top of both entry points, before anything can
+// read or set team state. Pinned on the source so a refactor that moves it
+// back below the charter phase, or drops it from Resume, fails here.
+func TestBothRunEntryPointsResetTeamStateFirst(t *testing.T) {
+	body := func(file, fn string) string {
+		t.Helper()
+		src, err := os.ReadFile(file)
+		if err != nil {
+			t.Fatal(err)
+		}
+		i := strings.Index(string(src), fn)
+		if i < 0 {
+			t.Fatalf("%s not found in %s", fn, file)
+		}
+		return string(src[i:])
+	}
+	run := body("orchestrator.go", "func (o *Orchestrator) runSLM(")
+	reset, assemble := strings.Index(run, "o.resetTeamState()"), strings.Index(run, "o.assembleSquads(")
+	if reset < 0 || assemble < 0 || reset > assemble {
+		t.Fatalf("runSLM must reset team state before the charter phase (reset at %d, assemble at %d)", reset, assemble)
+	}
+	resume := body("resume.go", "func (o *Orchestrator) Resume(")
+	reset, restore := strings.Index(resume, "o.resetTeamState()"), strings.Index(resume, "o.restoreSquadPlan(")
+	if reset < 0 || restore < 0 || reset > restore {
+		t.Fatalf("Resume must reset team state before restoring the saved plan (reset at %d, restore at %d)", reset, restore)
+	}
+}
+
+// squads.json holding ONE squad is a run a single library team staffed. Resume
+// restores it as the staffing team — its manager triages the resumed board's
+// rejected work — rather than dropping it because one squad is not a plan.
+func TestRestoreSquadPlanRestoresASingleStaffingTeam(t *testing.T) {
+	o := testOrch(t, func(c *config.Config) { c.Squads = true })
+	one := squads.Plan{Squads: []squads.Squad{{
+		ID: "backend-go", Name: "Backend", Owns: []string{"cmd/**"}, Acceptance: "go test ./...",
+		Manager: "manager", Worker: "go-worker",
+	}}}
+	if err := squads.Save(o.cfg.SlmDir(), one); err != nil {
+		t.Fatal(err)
+	}
+	board := &plan.Board{Tasks: []plan.Task{
+		{ID: "T1", Squad: "backend-go", Column: plan.ColReadyToDev, Files: []string{"cmd/main.go"}},
+	}}
+
+	o.restoreSquadPlan(board)
+
+	if o.squadPlanNow() != nil {
+		t.Fatal("one squad was restored as a squad PLAN — Enabled() needs two")
+	}
+	st := o.singleTeamStaffing()
+	if st.Squad != "backend-go" || st.Manager != "manager" {
+		t.Fatalf("staffing after restore = %+v, want the saved team and its manager", st)
+	}
+
+	// A board no team touched gets nothing, as before.
+	o.resetTeamState()
+	o.restoreSquadPlan(&plan.Board{Tasks: []plan.Task{{ID: "T1", Column: plan.ColReadyToDev}}})
+	if o.singleTeamStaffing().Squad != "" {
+		t.Fatal("a board with no stamped task must not restore a team")
+	}
+}
+
+// The team library selection is computed once per run and cleared with the
+// rest of the team state.
+func TestTeamSelectionIsMemoizedPerRun(t *testing.T) {
+	o := testOrch(t, nil)
+	o.cfg.TeamLibrary = true
+	sel1, _ := o.preselectTeamsWith("add a Go API endpoint", nil, nil)
+	o.mu.Lock()
+	pick := o.teamPick
+	o.mu.Unlock()
+	if len(o.teamRoster()) > 0 && pick == nil {
+		t.Fatal("the run's selection was not memoized")
+	}
+	sel2, _ := o.preselectTeamsWith("add a Go API endpoint", nil, nil)
+	if strings.Join(sel1.IDs(), ",") != strings.Join(sel2.IDs(), ",") {
+		t.Fatalf("memoized selection differs: %v vs %v", sel1.IDs(), sel2.IDs())
+	}
+	// A preview with explicit pins never reads or writes the run's cache.
+	o.preselectTeamsWith("add a Go API endpoint", nil, []string{"frontend-react"})
+	o.mu.Lock()
+	same := o.teamPick == pick
+	o.mu.Unlock()
+	if !same {
+		t.Fatal("a pinned preview overwrote the run's memoized selection")
+	}
+	o.resetTeamState()
+	o.mu.Lock()
+	cleared := o.teamPick == nil
+	o.mu.Unlock()
+	if !cleared {
+		t.Fatal("resetTeamState left the previous run's selection behind")
+	}
+	_ = time.Now()
+}

From d68469c9aa4ed544b8c62d9ec48cee99ad755a76 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 09:07:16 +0000
Subject: [PATCH 19/23] backends: make the slow-endpoint probe test independent
 of machine load

The test slept 100ms on every request against a 150ms probe budget, so a
busy test run could make the very first request miss the window and fail
the guard for the wrong reason. The first request now answers at once and
only the later ones sleep past the deadline, which is the shape the test
describes.
---
 pkg/backends/probetimeout_test.go | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/pkg/backends/probetimeout_test.go b/pkg/backends/probetimeout_test.go
index 562c1b1..7f3c2ed 100644
--- a/pkg/backends/probetimeout_test.go
+++ b/pkg/backends/probetimeout_test.go
@@ -25,20 +25,25 @@ import (
 // structured role on that endpoint degraded to prompt-only + repair for a week.
 func TestSlowEndpointDoesNotPoisonCapabilitiesForAWeek(t *testing.T) {
 	var calls int64
-	// Every request costs 100ms — a stand-in for a model still loading weights.
-	// The first one fits inside the budget and succeeds; the rest cannot.
+	restore := ProbeTimeout
+	ProbeTimeout = 150 * time.Millisecond
+	defer func() { ProbeTimeout = restore }()
+
+	// The first request answers at once — it must succeed whatever the load on
+	// the test machine — and every later one sleeps past the shared deadline: a
+	// stand-in for a model that answered the plain probe and then went off to
+	// load weights. (An earlier version slept 100ms on every request against
+	// the 150ms budget; under a busy `go test ./...` the first request alone
+	// could miss the window and the test failed for the wrong reason.)
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		atomic.AddInt64(&calls, 1)
-		time.Sleep(100 * time.Millisecond)
+		if atomic.AddInt64(&calls, 1) > 1 {
+			time.Sleep(2 * ProbeTimeout)
+		}
 		w.Header().Set("Content-Type", "application/json")
 		_, _ = w.Write([]byte(`{"choices":[{"message":{"content":"ok"}}]}`))
 	}))
 	defer srv.Close()
 
-	restore := ProbeTimeout
-	ProbeTimeout = 150 * time.Millisecond
-	defer func() { ProbeTimeout = restore }()
-
 	// runProbe directly: Probe() memoises per key and would hide a second call.
 	got := runProbe(context.Background(), "omlx", srv.URL, "slow-model", "k")
 

From 861ed6fec569b69402238d64754ea870c288680e Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 09:22:33 +0000
Subject: [PATCH 20/23] fix(server,session): run lifecycle races, lock-free
 latest-run snapshot, buffered event log; Studio task/review/history API

Server lifecycle:
- POST /api/runs/stop no longer flips running to false while the run goroutine
  is still unwinding. It sets stopping, cancels the run's own context and lets
  finishRun clear running when the goroutine exits, so a following POST
  /api/runs is a 409 until then. finishRun only touches shared state when its
  run generation is still current, so a stale goroutine can never clear the
  live run's flag, restore its options or publish over its result.
- hitl.ClearAll runs after the running check: a second click on Run (a 409)
  no longer deletes the in-flight run's open shell ask.
- The SSE ring is not cleared per run (subscribers were mid-stream on it);
  /api/runs/latest and the current-run activity view scope by runStartSeq.
- handleLatestRun copies under s.mu and encodes after release: the engine
  emits synchronously into Server.emit, so a stalled browser fetch used to
  block a worker mid tool-call.
- /api/runs/latest and /api/status report stopping.

Studio API:
- task_update events: every board task change (plan.AddBoardHook) is
  published with phase = current run phase or "board", task_id, message
  "<id> -> <column>" and data {"task": <task as GET /api/tasks renders it>}.
- POST /api/tasks/{id}/retry: ready_to_dev, retries reset, error cleared,
  "retried from Studio" appended to attempt_log, persisted, task_update
  emitted; 409 without a board, 404 for an unknown id.
- GET /api/queries items carry duration_ms, tokens, cost_usd, tasks_total,
  tasks_done, failed_tasks and teams; token/cost totals are cached per
  (id, size, mtime) of the event log.
- GET /api/teams/activity?query= caches the derived timeline per
  (query, size, mtime) instead of re-parsing the log on every visit.

Session event log:
- One buffered appender per run instead of open/write/close per event under a
  global mutex. Token deltas are not persisted; structural kinds flush on
  write; chatty kinds flush on a 500ms timer; run_end/run_stop and the turn's
  end (WriteTurnSummary) flush, fsync and close. ReadEvents flushes first so a
  live run's tail is always visible.
---
 pkg/server/run_lifecycle_test.go    | 261 +++++++++++++++++++++
 pkg/server/server.go                | 345 +++++++++++++++++++++++-----
 pkg/server/studio_api_test.go       | 217 +++++++++++++++++
 pkg/server/team_activity.go         |  97 ++++++--
 pkg/session/events.go               | 228 ++++++++++++++++--
 pkg/session/events_appender_test.go |  87 +++++++
 pkg/session/turn.go                 |   2 +
 7 files changed, 1143 insertions(+), 94 deletions(-)
 create mode 100644 pkg/server/run_lifecycle_test.go
 create mode 100644 pkg/server/studio_api_test.go
 create mode 100644 pkg/session/events_appender_test.go

diff --git a/pkg/server/run_lifecycle_test.go b/pkg/server/run_lifecycle_test.go
new file mode 100644
index 0000000..8a7de77
--- /dev/null
+++ b/pkg/server/run_lifecycle_test.go
@@ -0,0 +1,261 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/UnicoLab/slmcode/pkg/hitl"
+	"github.com/UnicoLab/slmcode/pkg/orchestrator"
+	"github.com/UnicoLab/slmcode/pkg/plan"
+	"github.com/UnicoLab/slmcode/pkg/workspace"
+)
+
+// blockingRun is a fake engine: it blocks until its context is canceled or
+// release is closed, then returns the given result.
+func blockingRun(release <-chan struct{}, res *orchestrator.Result) func(context.Context, string) (*orchestrator.Result, error) {
+	return func(ctx context.Context, _ string) (*orchestrator.Result, error) {
+		select {
+		case <-ctx.Done():
+		case <-release:
+		}
+		return res, nil
+	}
+}
+
+func latest(t *testing.T, s *Server) map[string]any {
+	t.Helper()
+	rec := httptest.NewRecorder()
+	s.Handler().ServeHTTP(rec, newAPIRequest(http.MethodGet, "/api/runs/latest", nil))
+	if rec.Code != 200 {
+		t.Fatalf("latest status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	var out map[string]any
+	if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
+		t.Fatal(err)
+	}
+	return out
+}
+
+func startRun(t *testing.T, s *Server) int {
+	t.Helper()
+	rec := httptest.NewRecorder()
+	s.Handler().ServeHTTP(rec, newAPIRequest(http.MethodPost, "/api/runs", strings.NewReader(`{"query":"do a thing"}`)))
+	return rec.Code
+}
+
+func waitFor(t *testing.T, what string, cond func() bool) {
+	t.Helper()
+	deadline := time.Now().Add(5 * time.Second)
+	for time.Now().Before(deadline) {
+		if cond() {
+			return
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	t.Fatalf("timed out waiting for %s", what)
+}
+
+// Stop → Start used to race: handleStopRun cleared running while the old run
+// goroutine was still unwinding, so a following POST /api/runs started a new
+// run, and the OLD goroutine then cleared the new run's running flag,
+// restored its options and published its own result over the new run's.
+func TestStopThenStartDoesNotLeakOldRunState(t *testing.T) {
+	t.Setenv("SLMCODE_NO_CALIBRATE", "1") // the fake engine must not wait behind a model probe
+	h := newHarness(t)
+	s := New(h, nil)
+	defer func() { _ = s.Shutdown(context.Background()) }()
+
+	// Run 1 blocks until stopped. The fake never observes the orchestrator's
+	// own cancel, so a stop that reaches it proves the per-run context works.
+	s.runFn = blockingRun(nil, &orchestrator.Result{Summary: "first"})
+	if code := startRun(t, s); code != 200 {
+		t.Fatalf("start #1 status=%d", code)
+	}
+	if l := latest(t, s); l["running"] != true || l["stopping"] != false {
+		t.Fatalf("after start: %v", l)
+	}
+
+	// While run 1 is up, starting again is a conflict.
+	if code := startRun(t, s); code != http.StatusConflict {
+		t.Fatalf("concurrent start status=%d, want 409", code)
+	}
+
+	rec := httptest.NewRecorder()
+	s.Handler().ServeHTTP(rec, newAPIRequest(http.MethodPost, "/api/runs/stop", nil))
+	if rec.Code != 200 {
+		t.Fatalf("stop status=%d", rec.Code)
+	}
+	// running stays true until the goroutine exits; the fake returns as soon
+	// as its context is canceled, so this resolves quickly.
+	waitFor(t, "run 1 to unwind", func() bool {
+		s.mu.Lock()
+		defer s.mu.Unlock()
+		return !s.running
+	})
+	if l := latest(t, s); l["running"] != false || l["stopping"] != false {
+		t.Fatalf("after stop unwound: %v", l)
+	}
+	res1, _ := latest(t, s)["result"].(map[string]any)
+	if res1 == nil || res1["summary"] != "first" {
+		t.Fatalf("run 1 result not published: %v", res1)
+	}
+
+	// Run 2 blocks on its own release channel and must own the state.
+	release2 := make(chan struct{})
+	s.runFn = blockingRun(release2, &orchestrator.Result{Summary: "second"})
+	if code := startRun(t, s); code != 200 {
+		t.Fatalf("start #2 status=%d", code)
+	}
+	l := latest(t, s)
+	if l["running"] != true {
+		t.Fatalf("run 2 not running: %v", l)
+	}
+	// The snapshot is scoped to run 2: exactly one run_start, no run_end yet.
+	starts, ends := 0, 0
+	for _, ev := range l["events"].([]any) {
+		switch ev.(map[string]any)["kind"] {
+		case "run_start":
+			starts++
+		case "run_end", "run_stop":
+			ends++
+		}
+	}
+	if starts != 1 || ends != 0 {
+		t.Fatalf("snapshot not scoped to the current run: starts=%d ends=%d", starts, ends)
+	}
+
+	// A goroutine from a STALE generation finishing late must not touch the
+	// live run: running stays true, the result is not replaced, run_end is
+	// not emitted.
+	before := len(latest(t, s)["events"].([]any))
+	s.finishRun(1, &orchestrator.Result{Summary: "stale"}, nil, savedRunOptions{}, "finished")
+	l = latest(t, s)
+	if l["running"] != true {
+		t.Fatal("stale finishRun cleared running of the live run")
+	}
+	if res, _ := l["result"].(map[string]any); res != nil && res["summary"] == "stale" {
+		t.Fatal("stale finishRun published its result over the live run")
+	}
+	if len(l["events"].([]any)) != before {
+		t.Fatal("stale finishRun emitted run_end into the live run's stream")
+	}
+
+	close(release2)
+	waitFor(t, "run 2 to finish", func() bool {
+		s.mu.Lock()
+		defer s.mu.Unlock()
+		return !s.running
+	})
+	res2, _ := latest(t, s)["result"].(map[string]any)
+	if res2 == nil || res2["summary"] != "second" {
+		t.Fatalf("run 2 result: %v", res2)
+	}
+}
+
+// A second click on Run while a run is in flight is a 409 — and must not
+// sweep the in-flight run's pending asks. hitl.ClearAll used to run BEFORE
+// the running check.
+func TestStartConflictKeepsPendingAsks(t *testing.T) {
+	t.Setenv("SLMCODE_NO_CALIBRATE", "1") // the fake engine must not wait behind a model probe
+	h := newHarness(t)
+	s := New(h, nil)
+	defer func() { _ = s.Shutdown(context.Background()) }()
+	slm := h.Config.SlmDir()
+
+	release := make(chan struct{})
+	defer close(release)
+	s.runFn = blockingRun(release, nil)
+	if code := startRun(t, s); code != 200 {
+		t.Fatalf("start status=%d", code)
+	}
+	ask := workspace.ShellAsk{ID: "shell-7", Kind: "shell", Command: "go test ./...", TimeoutS: 120,
+		CreatedAt: time.Now().UTC().Format(time.RFC3339)}
+	if err := hitl.WriteAskID(slm, "shell", ask.ID, ask); err != nil {
+		t.Fatal(err)
+	}
+	planAsk := plan.BuildPlanApproveAsk("ship it", &plan.Board{Tasks: []plan.Task{{ID: "T1", Title: "main"}}})
+	if err := hitl.WriteAsk(slm, "plan", planAsk); err != nil {
+		t.Fatal(err)
+	}
+
+	if code := startRun(t, s); code != http.StatusConflict {
+		t.Fatalf("conflicting start status=%d, want 409", code)
+	}
+	if ids, _ := hitl.ListAskIDs(slm, "shell"); len(ids) != 1 {
+		t.Fatalf("shell ask swept by the refused start: %v", ids)
+	}
+	if ok, _ := hitl.ReadAsk(slm, "plan", &plan.PlanApproveAsk{}); !ok {
+		t.Fatal("plan ask swept by the refused start")
+	}
+	rec := httptest.NewRecorder()
+	s.Handler().ServeHTTP(rec, newAPIRequest(http.MethodGet, "/api/shell/pending", nil))
+	var pending struct {
+		Pending bool                 `json:"pending"`
+		Ask     workspace.ShellAsk   `json:"ask"`
+		Asks    []workspace.ShellAsk `json:"asks"`
+		Count   int                  `json:"count"`
+	}
+	_ = json.Unmarshal(rec.Body.Bytes(), &pending)
+	if !pending.Pending || pending.Ask.ID != "shell-7" || pending.Count != 1 || len(pending.Asks) != 1 {
+		t.Fatalf("shell pending shape: %s", rec.Body.String())
+	}
+}
+
+// blockingWriter stalls on the first Write until released, standing in for a
+// browser that opened GET /api/runs/latest and stopped reading.
+type blockingWriter struct {
+	hdr     http.Header
+	release chan struct{}
+	once    sync.Once
+	started chan struct{}
+}
+
+func (w *blockingWriter) Header() http.Header { return w.hdr }
+func (w *blockingWriter) WriteHeader(int)     {}
+func (w *blockingWriter) Write(p []byte) (int, error) {
+	w.once.Do(func() { close(w.started) })
+	<-w.release
+	return len(p), nil
+}
+
+// handleLatestRun used to encode while holding s.mu; the orchestrator emits
+// synchronously into Server.emit, which takes s.mu, so a stalled fetch blocked
+// a worker mid tool-call.
+func TestLatestRunDoesNotBlockEmit(t *testing.T) {
+	t.Setenv("SLMCODE_NO_CALIBRATE", "1") // the fake engine must not wait behind a model probe
+	h := newHarness(t)
+	s := New(h, nil)
+	defer func() { _ = s.Shutdown(context.Background()) }()
+	for i := 0; i < 50; i++ {
+		s.emit(orchestrator.Event{Phase: "execute", Kind: "output", Message: strings.Repeat("x", 512), Time: time.Now()})
+	}
+	bw := &blockingWriter{hdr: http.Header{}, release: make(chan struct{}), started: make(chan struct{})}
+	done := make(chan struct{})
+	go func() {
+		s.handleLatestRun(bw, newAPIRequest(http.MethodGet, "/api/runs/latest", nil))
+		close(done)
+	}()
+	select {
+	case <-bw.started:
+	case <-time.After(5 * time.Second):
+		t.Fatal("handler never started writing")
+	}
+	emitted := make(chan struct{})
+	go func() {
+		s.emit(orchestrator.Event{Phase: "execute", Kind: "output", Message: "while stalled", Time: time.Now()})
+		close(emitted)
+	}()
+	select {
+	case <-emitted:
+	case <-time.After(2 * time.Second):
+		t.Fatal("emit blocked behind a stalled /api/runs/latest writer")
+	}
+	close(bw.release)
+	<-done
+}
diff --git a/pkg/server/server.go b/pkg/server/server.go
index 610cbfb..d409538 100644
--- a/pkg/server/server.go
+++ b/pkg/server/server.go
@@ -1,6 +1,8 @@
 package server
 
 import (
+	"bufio"
+	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
@@ -86,6 +88,13 @@ type Server struct {
 	// when it still matches, so a goroutine from a stopped run that finishes
 	// late cannot clobber the state of the run that replaced it.
 	runGen uint64
+	// runStartSeq is the sequence number of the current run's first event.
+	// /api/runs/latest and the current-run activity view scope their snapshot
+	// to it; the ring itself is never cleared, so SSE replay by Last-Event-ID
+	// keeps working across a stop → start.
+	runStartSeq uint64
+	// runCancel cancels the current run's context (POST /api/runs/stop).
+	runCancel context.CancelFunc
 	// lastPhase is the most recent phase seen on a structural event; the
 	// task_update events synthesized from the board hook carry it because the
 	// board itself does not know which phase moved the task.
@@ -95,6 +104,15 @@ type Server struct {
 	// hookRemovers undo the package-level change hooks installed by
 	// installChangeHooks; run in Shutdown.
 	hookRemovers []func()
+	// activityCache memoizes past runs' derived team timelines by event-log
+	// identity (see team_activity.go); activityOrder is insertion order for
+	// eviction.
+	activityMu    sync.Mutex
+	activityCache map[string]*activityCacheEntry
+	activityOrder []string
+	// usageCache memoizes per-query token/cost totals for GET /api/queries.
+	usageMu    sync.Mutex
+	usageCache map[string]usageCacheEntry
 	// runFn / resumeFn are the engine entry points POST /api/runs and
 	// /api/runs/resume drive. They default to the harness and are swappable so
 	// lifecycle tests can run a controllable fake instead of a model.
@@ -464,6 +482,7 @@ func (s *Server) routes() {
 	s.mux.HandleFunc("POST /api/tasks", s.handleAddTask)
 	s.mux.HandleFunc("PATCH /api/tasks/{id}", s.handlePatchTask)
 	s.mux.HandleFunc("DELETE /api/tasks/{id}", s.handleDeleteTask)
+	s.mux.HandleFunc("POST /api/tasks/{id}/retry", s.handleRetryTask)
 	s.mux.HandleFunc("GET /api/board", s.handleGetBoard)
 	s.mux.HandleFunc("GET /api/columns", s.handleColumns)
 	s.mux.HandleFunc("GET /api/skills", s.handleSkills)
@@ -892,6 +911,56 @@ func (s *Server) handleDeleteTask(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, map[string]string{"ok": "true"})
 }
 
+// errNoBoard is the 409 of POST /api/tasks/{id}/retry when nothing is loaded.
+var errNoBoard = errors.New("no board loaded")
+
+// handleRetryTask — POST /api/tasks/{id}/retry
+//
+// Puts a task back in front of the workers: column ready_to_dev, the ladder
+// retry counter reset, the error cleared, and "retried from Studio" appended
+// to attempt_log so the next attempt is told this is a retry. The board is
+// persisted through the live store and the change is published as a
+// task_update event through the board hook. 409 when no board is loaded, 404
+// for an unknown id. Responds with the task as GET /api/tasks renders it.
+func (s *Server) handleRetryTask(w http.ResponseWriter, r *http.Request) {
+	id := strings.TrimSpace(r.PathValue("id"))
+	o := s.orch()
+	if o == nil || o.Board() == nil {
+		http.Error(w, errNoBoard.Error(), http.StatusConflict)
+		return
+	}
+	store := o.Board()
+	_ = store.Load()
+	if snap := store.Snapshot(); len(snap.Tasks) == 0 {
+		http.Error(w, errNoBoard.Error(), http.StatusConflict)
+		return
+	}
+	var out plan.Task
+	err := store.Update(func(b *plan.Board) error {
+		t, ok := b.Get(id)
+		if !ok {
+			return os.ErrNotExist
+		}
+		t.MoveTo(plan.ColReadyToDev)
+		t.Retries = 0
+		t.Error = ""
+		t.AttemptLog = append(t.AttemptLog, "retried from Studio")
+		t.Normalize()
+		b.UpdateTask(t)
+		out = t
+		return nil
+	})
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			http.Error(w, "task not found: "+id, http.StatusNotFound)
+			return
+		}
+		http.Error(w, err.Error(), 500)
+		return
+	}
+	writeJSON(w, out)
+}
+
 func (s *Server) handleSkills(w http.ResponseWriter, r *http.Request) {
 	list, err := s.orch().Skills().List()
 	if err != nil {
@@ -987,16 +1056,15 @@ func (s *Server) handleStartRun(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "query required", 400)
 		return
 	}
-	hitl.ClearAll(s.slmDir())
-	s.mu.Lock()
-	if s.running {
-		s.mu.Unlock()
+	gen, ctx, ok := s.beginRun()
+	if !ok {
 		http.Error(w, "run already in progress", http.StatusConflict)
 		return
 	}
-	s.running = true
-	s.events = nil
-	s.mu.Unlock()
+	// Pending asks belong to the previous run and are swept only once THIS
+	// run owns the slot. Sweeping before the running check meant a second
+	// click on Run — a 409 — deleted the in-flight run's open shell ask.
+	hitl.ClearAll(s.slmDir())
 
 	// Per-run engine/specialist/skill selection. These belong on the Run call
 	// (see runOptions / "wiring required"), but until orchestrator.Run accepts
@@ -1014,8 +1082,6 @@ func (s *Server) handleStartRun(w http.ResponseWriter, r *http.Request) {
 	s.runWG.Add(1)
 	go func() {
 		defer s.runWG.Done()
-		defer s.restoreRunOptions(saved)
-		ctx := s.runContext()
 		// Calibrate FIRST, because the model may have changed since the server
 		// started. Studio is where models get switched, and a switch that lands
 		// between launch and the first run would otherwise be governed by the
@@ -1027,25 +1093,80 @@ func (s *Server) handleStartRun(w http.ResponseWriter, r *http.Request) {
 		// cold model can take a minute to measure, and that minute belongs in
 		// the event stream where the user can watch it, not in a hung request.
 		s.ensureCalibrated(ctx)
-		res, err := s.h.Run(ctx, query)
-		s.mu.Lock()
+		res, err := s.run(ctx, query)
+		s.finishRun(gen, res, err, saved, "finished")
+	}()
+
+	writeJSON(w, map[string]string{"status": "started", "query": req.Query})
+}
+
+// run / resume are the engine entry points, overridable for tests.
+func (s *Server) run(ctx context.Context, query string) (*orchestrator.Result, error) {
+	if s.runFn != nil {
+		return s.runFn(ctx, query)
+	}
+	return s.h.Run(ctx, query)
+}
+
+func (s *Server) resume(ctx context.Context, id string) (*orchestrator.Result, error) {
+	if s.resumeFn != nil {
+		return s.resumeFn(ctx, id)
+	}
+	return s.h.Resume(ctx, id)
+}
+
+// beginRun claims the run slot. It returns the run's generation and context,
+// or ok=false when a run is in progress (including one that is still
+// unwinding after a stop). The event ring is NOT cleared: subscribers are
+// mid-stream on it, and /api/runs/latest scopes its snapshot by runStartSeq
+// instead.
+func (s *Server) beginRun() (gen uint64, ctx context.Context, ok bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.running {
+		return 0, nil, false
+	}
+	s.running = true
+	s.stopping = false
+	s.runGen++
+	s.runStartSeq = s.seq + 1
+	s.lastPhase = ""
+	ctx, s.runCancel = context.WithCancel(s.runContext())
+	return s.runGen, ctx, true
+}
+
+// finishRun is the tail of every run goroutine. Only the goroutine whose
+// generation is still current may clear running, publish the result, restore
+// the per-run options and emit run_end: a goroutine from a stopped run that
+// unwinds late would otherwise clobber the run that replaced it.
+func (s *Server) finishRun(gen uint64, res *orchestrator.Result, err error, saved savedRunOptions, doneMsg string) {
+	s.mu.Lock()
+	current := s.runGen == gen
+	if current {
 		s.running = false
+		s.stopping = false
+		if s.runCancel != nil {
+			s.runCancel()
+			s.runCancel = nil
+		}
 		if res != nil {
 			s.lastRes = res
 		}
-		s.mu.Unlock()
-		phase := "done"
-		msg := "finished"
-		if err != nil {
-			phase = "error"
-			msg = err.Error()
-		} else if res != nil {
-			msg = res.Summary
-		}
-		s.emit(orchestrator.Event{Phase: phase, Kind: "run_end", Message: msg, Time: time.Now()})
-	}()
-
-	writeJSON(w, map[string]string{"status": "started", "query": req.Query})
+	}
+	s.mu.Unlock()
+	if !current {
+		return
+	}
+	s.restoreRunOptions(saved)
+	phase := "done"
+	msg := doneMsg
+	if err != nil {
+		phase = "error"
+		msg = err.Error()
+	} else if res != nil {
+		msg = res.Summary
+	}
+	s.emit(orchestrator.Event{Phase: phase, Kind: "run_end", Message: msg, Time: time.Now()})
 }
 
 // runOptions carries the per-run overrides Studio sends with POST /api/runs.
@@ -1180,15 +1301,14 @@ func (s *Server) handleResumeRun(w http.ResponseWriter, r *http.Request) {
 		_ = json.NewDecoder(r.Body).Decode(&req)
 	}
 	id := strings.TrimSpace(req.ID)
-	s.mu.Lock()
-	if s.running {
-		s.mu.Unlock()
+	// ctx derives from runContext(), NOT context.Background(): a resumed run
+	// used to be invisible to Shutdown, so Ctrl-C returned to the shell while
+	// the agent kept writing files.
+	gen, ctx, ok := s.beginRun()
+	if !ok {
 		http.Error(w, "run already in progress", http.StatusConflict)
 		return
 	}
-	s.running = true
-	s.events = nil
-	s.mu.Unlock()
 
 	s.wireOrchestratorEvents()
 	s.emit(orchestrator.Event{
@@ -1197,26 +1317,8 @@ func (s *Server) handleResumeRun(w http.ResponseWriter, r *http.Request) {
 	s.runWG.Add(1)
 	go func() {
 		defer s.runWG.Done()
-		// runContext(), NOT context.Background(): a resumed run used to be
-		// invisible to Shutdown, so Ctrl-C returned to the shell while the
-		// agent kept writing files.
-		ctx := s.runContext()
-		res, err := s.h.Resume(ctx, id)
-		s.mu.Lock()
-		s.running = false
-		if res != nil {
-			s.lastRes = res
-		}
-		s.mu.Unlock()
-		phase := "done"
-		msg := "resumed"
-		if err != nil {
-			phase = "error"
-			msg = err.Error()
-		} else if res != nil {
-			msg = res.Summary
-		}
-		s.emit(orchestrator.Event{Phase: phase, Kind: "run_end", Message: msg, Time: time.Now()})
+		res, err := s.resume(ctx, id)
+		s.finishRun(gen, res, err, savedRunOptions{}, "resumed")
 	}()
 
 	writeJSON(w, map[string]string{"status": "started", "id": id})
@@ -1791,12 +1893,27 @@ func (s *Server) handleClearFeedback(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, map[string]any{"ok": true})
 }
 
+// handleStopRun — POST /api/runs/stop
+//
+// Stopping is a REQUEST: the engine is told to unwind and the run's context
+// is canceled, but running stays true (with stopping set) until the run
+// goroutine actually exits and finishRun clears it. Flipping running to false
+// here let a following POST /api/runs start a new run on top of the old one's
+// teardown, and the old goroutine then cleared the new run's state.
 func (s *Server) handleStopRun(w http.ResponseWriter, r *http.Request) {
-	s.orch().Stop()
+	if orch := s.orch(); orch != nil {
+		orch.Stop()
+	}
 	s.mu.Lock()
-	was := s.running
-	s.running = false
+	was := s.running && !s.stopping
+	if s.running {
+		s.stopping = true
+	}
+	cancel := s.runCancel
 	s.mu.Unlock()
+	if cancel != nil {
+		cancel()
+	}
 	if was {
 		s.emit(orchestrator.Event{
 			Phase: "done", Kind: "run_stop", Message: "run stopped by user", Time: time.Now(),
@@ -1805,25 +1922,38 @@ func (s *Server) handleStopRun(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, map[string]string{"status": "stopping"})
 }
 
+// handleLatestRun — GET /api/runs/latest
+//
+// The snapshot is COPIED under s.mu and encoded after it is released. The
+// orchestrator emits synchronously into Server.emit, which takes s.mu, so
+// encoding while holding the lock let one stalled browser fetch block a
+// worker mid-tool-call. Events are scoped to the current (or most recent)
+// run by sequence number; the ring itself is never cleared, so SSE
+// subscribers keep their replay window across runs.
 func (s *Server) handleLatestRun(w http.ResponseWriter, r *http.Request) {
 	s.mu.Lock()
-	defer s.mu.Unlock()
 	events := make([]orchestrator.Event, 0, len(s.events))
 	seqs := make([]uint64, 0, len(s.events))
 	for _, se := range s.events {
+		if se.Seq < s.runStartSeq {
+			continue
+		}
 		events = append(events, se.Event)
 		seqs = append(seqs, se.Seq)
 	}
-	writeJSON(w, map[string]interface{}{
-		"running": s.running,
-		"result":  s.lastRes,
-		"events":  events,
+	snapshot := map[string]interface{}{
+		"running":  s.running,
+		"stopping": s.stopping,
+		"result":   s.lastRes,
+		"events":   events,
 		// event_seqs[i] is the SSE id of events[i]; the client uses the last
 		// one as its Last-Event-ID baseline so a snapshot + stream never
 		// double-renders.
 		"event_seqs": seqs,
 		"last_seq":   s.seq,
-	})
+	}
+	s.mu.Unlock()
+	writeJSON(w, snapshot)
 }
 
 // handleSSE streams run events.
@@ -1992,6 +2122,7 @@ func (s *Server) handleStatus(w http.ResponseWriter, r *http.Request) {
 	}
 	s.mu.Lock()
 	running := s.running
+	stopping := s.stopping
 	s.mu.Unlock()
 	skillCount := s.skillCount()
 	comp, ok, compErr := composer.LoadDynamic(s.slmDir())
@@ -2009,6 +2140,7 @@ func (s *Server) handleStatus(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, map[string]any{
 		"text":              st,
 		"running":           running,
+		"stopping":          stopping,
 		"readiness":         ready,
 		"composition":       s.savedCompositionView(compPtr),
 		"composition_error": compErrText,
@@ -2580,6 +2712,16 @@ func (s *Server) handleListQueries(w http.ResponseWriter, r *http.Request) {
 		Interrupted bool   `json:"interrupted,omitempty"`
 		Phase       string `json:"phase,omitempty"`
 		ResumeFrom  string `json:"resume_from,omitempty"`
+		// Cheap per-run figures for the history list: wall time from the
+		// turn's timestamps, task counts from the stored board, team names
+		// from the tasks' squads, tokens/cost from a cached scan of the log.
+		DurationMS  int64    `json:"duration_ms"`
+		Tokens      int      `json:"tokens"`
+		CostUSD     float64  `json:"cost_usd"`
+		TasksTotal  int      `json:"tasks_total"`
+		TasksDone   int      `json:"tasks_done"`
+		FailedTasks int      `json:"failed_tasks"`
+		Teams       []string `json:"teams"`
 	}
 	var out []item
 	for _, e := range entries {
@@ -2590,11 +2732,35 @@ func (s *Server) handleListQueries(w http.ResponseWriter, r *http.Request) {
 		if err != nil {
 			continue
 		}
-		out = append(out, item{
+		it := item{
 			ID: t.ID, Query: t.Query, Success: t.Success,
 			Summary: t.Summary, UpdatedAt: t.UpdatedAt,
 			Interrupted: t.Interrupted, Phase: t.Phase, ResumeFrom: t.ResumeFrom,
-		})
+			Teams: []string{},
+		}
+		if created, ok := parseAskCreatedAt(t.CreatedAt); ok {
+			if updated, ok := parseAskCreatedAt(t.UpdatedAt); ok && updated.After(created) {
+				it.DurationMS = updated.Sub(created).Milliseconds()
+			}
+		}
+		teams := map[string]bool{}
+		for _, task := range t.Board.Tasks {
+			task.Normalize()
+			it.TasksTotal++
+			switch {
+			case task.Column == plan.ColDone:
+				it.TasksDone++
+			case task.Column == plan.ColBlocked || task.Status == plan.StatusFailed || task.Error != "":
+				it.FailedTasks++
+			}
+			if sq := strings.TrimSpace(task.Squad); sq != "" && !teams[sq] {
+				teams[sq] = true
+				it.Teams = append(it.Teams, sq)
+			}
+		}
+		sort.Strings(it.Teams)
+		it.Tokens, it.CostUSD = s.queryUsage(t.ID)
+		out = append(out, it)
 	}
 	sort.Slice(out, func(i, j int) bool { return out[i].UpdatedAt > out[j].UpdatedAt })
 	if out == nil {
@@ -2603,6 +2769,63 @@ func (s *Server) handleListQueries(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, out)
 }
 
+// usageCacheEntry memoizes one query's token/cost totals by log identity.
+type usageCacheEntry struct {
+	size    int64
+	modTime time.Time
+	tokens  int
+	cost    float64
+}
+
+// queryUsage sums tokens and cost_usd over a query's event log. The scan is
+// cached per (id, size, mtime), and only lines that can carry a figure are
+// decoded, so listing the history does not re-parse every token delta of
+// every past run on each request.
+func (s *Server) queryUsage(id string) (int, float64) {
+	path := session.EventsPath(s.slmDir(), id)
+	info, err := os.Stat(path)
+	if err != nil {
+		return 0, 0
+	}
+	s.usageMu.Lock()
+	if e, ok := s.usageCache[id]; ok && e.size == info.Size() && e.modTime.Equal(info.ModTime()) {
+		s.usageMu.Unlock()
+		return e.tokens, e.cost
+	}
+	s.usageMu.Unlock()
+
+	tokens, cost := 0, 0.0
+	if f, err := os.Open(path); err == nil { //nolint:gosec // harness state under SlmDir
+		sc := bufio.NewScanner(f)
+		sc.Buffer(make([]byte, 0, 64*1024), 8*1024*1024)
+		for sc.Scan() {
+			line := sc.Bytes()
+			if !bytes.Contains(line, []byte(`"tokens"`)) && !bytes.Contains(line, []byte(`"cost_usd"`)) {
+				continue
+			}
+			var rec struct {
+				Tokens  int     `json:"tokens"`
+				CostUSD float64 `json:"cost_usd"`
+			}
+			if json.Unmarshal(line, &rec) == nil {
+				tokens += rec.Tokens
+				cost += rec.CostUSD
+			}
+		}
+		_ = f.Close()
+	}
+	s.usageMu.Lock()
+	if s.usageCache == nil {
+		s.usageCache = map[string]usageCacheEntry{}
+	}
+	if len(s.usageCache) > 256 {
+		s.usageCache = map[string]usageCacheEntry{}
+	}
+	s.usageCache[id] = usageCacheEntry{size: info.Size(), modTime: info.ModTime(), tokens: tokens, cost: cost}
+	s.usageMu.Unlock()
+	return tokens, cost
+}
+
 func (s *Server) handleGetQuery(w http.ResponseWriter, r *http.Request) {
 	id := filepath.Base(r.PathValue("id"))
 	if id == "." || id == ".." || id == "" {
diff --git a/pkg/server/studio_api_test.go b/pkg/server/studio_api_test.go
new file mode 100644
index 0000000..c16f476
--- /dev/null
+++ b/pkg/server/studio_api_test.go
@@ -0,0 +1,217 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/UnicoLab/slmcode/pkg/orchestrator"
+	"github.com/UnicoLab/slmcode/pkg/plan"
+	"github.com/UnicoLab/slmcode/pkg/session"
+)
+
+func apiCall(t *testing.T, s *Server, method, path, body string) *httptest.ResponseRecorder {
+	t.Helper()
+	rec := httptest.NewRecorder()
+	var rd *strings.Reader
+	if body != "" {
+		rd = strings.NewReader(body)
+	} else {
+		rd = strings.NewReader("")
+	}
+	s.Handler().ServeHTTP(rec, newAPIRequest(method, path, rd))
+	return rec
+}
+
+// taskUpdateEvents returns every task_update event in the ring, oldest first.
+func taskUpdateEvents(s *Server) []orchestrator.Event {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	var out []orchestrator.Event
+	for _, se := range s.events {
+		if se.Event.Kind == "task_update" {
+			out = append(out, se.Event)
+		}
+	}
+	return out
+}
+
+// B1: every board task change is published as a task_update event carrying
+// the full task under data.task, exactly as GET /api/tasks renders it.
+func TestBoardChangesEmitTaskUpdateEvents(t *testing.T) {
+	h := newHarness(t)
+	s := New(h, nil)
+	defer func() { _ = s.Shutdown(context.Background()) }()
+
+	if rec := apiCall(t, s, http.MethodPost, "/api/tasks", `{"id":"T1","title":"main","column":"ready_to_dev"}`); rec.Code != 200 {
+		t.Fatalf("add task: %d %s", rec.Code, rec.Body.String())
+	}
+	if rec := apiCall(t, s, http.MethodPatch, "/api/tasks/T1", `{"column":"in_progress"}`); rec.Code != 200 {
+		t.Fatalf("patch task: %d %s", rec.Code, rec.Body.String())
+	}
+	evs := taskUpdateEvents(s)
+	if len(evs) == 0 {
+		t.Fatal("no task_update event emitted for a board change")
+	}
+	ev := evs[len(evs)-1]
+	if ev.Phase != "board" || ev.TaskID != "T1" || ev.Message != "T1 -> in_progress" {
+		t.Fatalf("event shape: phase=%q task=%q msg=%q", ev.Phase, ev.TaskID, ev.Message)
+	}
+	// Serialize exactly as SSE / /api/runs/latest do and compare with GET /api/tasks.
+	raw, _ := json.Marshal(ev.Data)
+	var data struct {
+		Task plan.Task `json:"task"`
+	}
+	if err := json.Unmarshal(raw, &data); err != nil || data.Task.ID != "T1" || data.Task.Column != "in_progress" || data.Task.Status != plan.StatusRunning {
+		t.Fatalf("data.task: %s (err=%v)", raw, err)
+	}
+	var board plan.Board
+	_ = json.Unmarshal(apiCall(t, s, http.MethodGet, "/api/tasks", "").Body.Bytes(), &board)
+	if len(board.Tasks) != 1 || board.Tasks[0].Column != data.Task.Column || board.Tasks[0].Title != data.Task.Title {
+		t.Fatalf("event task differs from GET /api/tasks: %+v vs %+v", data.Task, board.Tasks)
+	}
+	// Replayed like any other event.
+	if !strings.Contains(apiCall(t, s, http.MethodGet, "/api/runs/latest", "").Body.String(), `"kind": "task_update"`) {
+		t.Fatal("task_update not in the replay buffer")
+	}
+	// The phase follows the run once one is known.
+	s.emit(orchestrator.Event{Phase: "execute", Kind: "phase", Message: "wave 1", Time: time.Now()})
+	apiCall(t, s, http.MethodPatch, "/api/tasks/T1", `{"column":"in_review"}`)
+	evs = taskUpdateEvents(s)
+	if got := evs[len(evs)-1].Phase; got != "execute" {
+		t.Fatalf("phase not taken from the run: %q", got)
+	}
+	// A removed task is reported with an empty column ("-> removed").
+	apiCall(t, s, http.MethodDelete, "/api/tasks/T1", "")
+	evs = taskUpdateEvents(s)
+	if last := evs[len(evs)-1]; last.Message != "T1 -> removed" {
+		t.Fatalf("removal event: %q", last.Message)
+	}
+}
+
+// B2: POST /api/tasks/{id}/retry.
+func TestRetryTaskEndpoint(t *testing.T) {
+	h := newHarness(t)
+	s := New(h, nil)
+	defer func() { _ = s.Shutdown(context.Background()) }()
+
+	// No board loaded → 409.
+	if rec := apiCall(t, s, http.MethodPost, "/api/tasks/T1/retry", ""); rec.Code != http.StatusConflict {
+		t.Fatalf("no board: %d %s", rec.Code, rec.Body.String())
+	}
+	board := plan.Board{Tasks: []plan.Task{{
+		ID: "T1", Title: "main", Column: plan.ColBlocked, Retries: 3, GateRetries: 1,
+		Error: "tests failed", AttemptLog: []string{"attempt 1 failed because X"},
+		Criteria: []plan.Criterion{{ID: "c1", Text: "builds"}},
+	}}}
+	raw, _ := json.Marshal(board)
+	if rec := apiCall(t, s, http.MethodPut, "/api/tasks", string(raw)); rec.Code != 200 {
+		t.Fatalf("put board: %d %s", rec.Code, rec.Body.String())
+	}
+	// Unknown id → 404.
+	if rec := apiCall(t, s, http.MethodPost, "/api/tasks/T9/retry", ""); rec.Code != http.StatusNotFound {
+		t.Fatalf("unknown id: %d %s", rec.Code, rec.Body.String())
+	}
+	rec := apiCall(t, s, http.MethodPost, "/api/tasks/T1/retry", "")
+	if rec.Code != 200 {
+		t.Fatalf("retry: %d %s", rec.Code, rec.Body.String())
+	}
+	var got plan.Task
+	if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil {
+		t.Fatal(err)
+	}
+	if got.Column != plan.ColReadyToDev || got.Status != plan.StatusReady || got.Retries != 0 || got.Error != "" {
+		t.Fatalf("task after retry: %+v", got)
+	}
+	if len(got.AttemptLog) != 2 || got.AttemptLog[1] != "retried from Studio" {
+		t.Fatalf("attempt_log: %v", got.AttemptLog)
+	}
+	if got.GateRetries != 1 || len(got.Criteria) != 1 {
+		t.Fatalf("unrelated fields disturbed: %+v", got)
+	}
+	// Persisted, and exposed by GET /api/tasks with the fields Studio needs.
+	body := apiCall(t, s, http.MethodGet, "/api/tasks", "").Body.String()
+	for _, key := range []string{`"attempt_log"`, `"gate_retries"`, `"criteria"`, `"retried from Studio"`} {
+		if !strings.Contains(body, key) {
+			t.Fatalf("GET /api/tasks lacks %s: %s", key, body)
+		}
+	}
+	// And published as a task_update.
+	evs := taskUpdateEvents(s)
+	if len(evs) == 0 || evs[len(evs)-1].Message != "T1 -> ready_to_dev" {
+		t.Fatalf("retry did not emit task_update: %+v", evs)
+	}
+}
+
+// B3: GET /api/queries carries per-run figures computed from stored state.
+func TestListQueriesCarriesRunFigures(t *testing.T) {
+	h := newHarness(t)
+	s := New(h, nil)
+	slm := h.Config.SlmDir()
+	turn, err := session.BeginTurn(slm, "run-1", "add a thing")
+	if err != nil {
+		t.Fatal(err)
+	}
+	turn.CreatedAt = time.Now().Add(-90 * time.Second).UTC().Format(time.RFC3339)
+	board := plan.Board{Tasks: []plan.Task{
+		{ID: "T1", Title: "a", Column: plan.ColDone, Squad: "backend"},
+		{ID: "T2", Title: "b", Column: plan.ColBlocked, Squad: "frontend"},
+		{ID: "T3", Title: "c", Column: plan.ColReadyToDev, Squad: "backend"},
+	}}
+	if err := session.SaveTurnBoard(slm, turn, board); err != nil {
+		t.Fatal(err)
+	}
+	for _, rec := range []session.EventRecord{
+		{Phase: "plan", Kind: "usage", Tokens: 1200, CostUSD: 0.002},
+		{Phase: "execute", Kind: "token", Message: "delta"},
+		{Phase: "execute", Kind: "usage", Tokens: 800, CostUSD: 0.001},
+	} {
+		if err := session.AppendEvent(slm, "run-1", rec); err != nil {
+			t.Fatal(err)
+		}
+	}
+	session.FlushEventLogs()
+
+	rec := apiCall(t, s, http.MethodGet, "/api/queries", "")
+	if rec.Code != 200 {
+		t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	var items []struct {
+		ID          string   `json:"id"`
+		DurationMS  int64    `json:"duration_ms"`
+		Tokens      int      `json:"tokens"`
+		CostUSD     float64  `json:"cost_usd"`
+		TasksTotal  int      `json:"tasks_total"`
+		TasksDone   int      `json:"tasks_done"`
+		FailedTasks int      `json:"failed_tasks"`
+		Teams       []string `json:"teams"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &items); err != nil {
+		t.Fatal(err)
+	}
+	if len(items) != 1 {
+		t.Fatalf("items: %s", rec.Body.String())
+	}
+	it := items[0]
+	if it.ID != "run-1" || it.TasksTotal != 3 || it.TasksDone != 1 || it.FailedTasks != 1 {
+		t.Fatalf("task figures: %+v", it)
+	}
+	if it.Tokens != 2000 || it.CostUSD < 0.0029 || it.CostUSD > 0.0031 {
+		t.Fatalf("usage figures: %+v", it)
+	}
+	if it.DurationMS < 80_000 || it.DurationMS > 200_000 {
+		t.Fatalf("duration_ms: %d", it.DurationMS)
+	}
+	if len(it.Teams) != 2 || it.Teams[0] != "backend" || it.Teams[1] != "frontend" {
+		t.Fatalf("teams: %v", it.Teams)
+	}
+	// Second listing is served from the usage cache (same figures).
+	rec = apiCall(t, s, http.MethodGet, "/api/queries", "")
+	if !strings.Contains(rec.Body.String(), `"tokens": 2000`) {
+		t.Fatalf("cached listing: %s", rec.Body.String())
+	}
+}
diff --git a/pkg/server/team_activity.go b/pkg/server/team_activity.go
index 821da43..99cd497 100644
--- a/pkg/server/team_activity.go
+++ b/pkg/server/team_activity.go
@@ -2,6 +2,7 @@ package server
 
 import (
 	"net/http"
+	"os"
 	"regexp"
 	"sort"
 	"strconv"
@@ -368,24 +369,36 @@ func (s *Server) handleTeamActivity(w http.ResponseWriter, r *http.Request) {
 	}
 	var sources []activitySource
 	queryID := strings.TrimSpace(r.URL.Query().Get("query"))
+	var cached *activityCacheEntry
 	if queryID != "" {
-		// ReadEvents keeps the FIRST n records; a run that streamed tokens
-		// has tens of thousands, and the gates and late triage that matter
-		// most sit at the end. Read the whole log.
-		recs, err := session.ReadEvents(s.slmDir(), queryID, pastRunEventCap)
-		if err != nil {
-			http.Error(w, err.Error(), http.StatusInternalServerError)
-			return
-		}
-		for _, rec := range recs {
-			sources = append(sources, activitySource{
-				Time: rec.Time, Phase: rec.Phase, Kind: rec.Kind, Agent: rec.Agent,
-				TaskID: rec.TaskID, Message: rec.Message,
-			})
+		// A past run's log is immutable once the run ended, and Studio
+		// re-requests this view on every Teams-page visit. The derived
+		// timeline is cached per (query, size, mtime) of the log so the
+		// second visit is a map lookup, not a re-parse of a 250k-line file.
+		if entry, ok := s.cachedActivity(queryID); ok {
+			cached = entry
+		} else {
+			// ReadEvents keeps the FIRST n records; a run that streamed tokens
+			// has tens of thousands, and the gates and late triage that matter
+			// most sit at the end. Read the whole log.
+			recs, err := session.ReadEvents(s.slmDir(), queryID, pastRunEventCap)
+			if err != nil {
+				http.Error(w, err.Error(), http.StatusInternalServerError)
+				return
+			}
+			for _, rec := range recs {
+				sources = append(sources, activitySource{
+					Time: rec.Time, Phase: rec.Phase, Kind: rec.Kind, Agent: rec.Agent,
+					TaskID: rec.TaskID, Message: rec.Message,
+				})
+			}
 		}
 	} else {
 		s.mu.Lock()
 		for _, se := range s.events {
+			if se.Seq < s.runStartSeq {
+				continue // previous run; the ring is no longer cleared per run
+			}
 			sources = append(sources, activitySource{
 				Time: se.Event.Time.Format(time.RFC3339Nano), Phase: se.Event.Phase, Kind: se.Event.Kind,
 				Level: se.Event.Level, Agent: se.Event.Agent, TaskID: se.Event.TaskID, Message: se.Event.Message,
@@ -411,7 +424,15 @@ func (s *Server) handleTeamActivity(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	entries := deriveTeamActivity(sources, planPtr, taskTeams)
+	var entries []ActivityEntry
+	if cached != nil {
+		entries = cached.entries
+	} else {
+		entries = deriveTeamActivity(sources, planPtr, taskTeams)
+		if queryID != "" {
+			s.storeActivity(queryID, entries)
+		}
+	}
 	if len(entries) > limit {
 		entries = entries[len(entries)-limit:]
 	}
@@ -442,6 +463,54 @@ func (s *Server) handleTeamActivity(w http.ResponseWriter, r *http.Request) {
 // pastRunEventCap bounds a past run's event log read for the timeline.
 const pastRunEventCap = 250000
 
+// activityCacheEntry is one derived timeline keyed by the event log's identity.
+type activityCacheEntry struct {
+	size    int64
+	modTime time.Time
+	entries []ActivityEntry
+}
+
+// maxActivityCache bounds the per-query cache; past this the oldest entry by
+// insertion is dropped (a re-derive, exactly today's cost).
+const maxActivityCache = 32
+
+// cachedActivity returns the derived timeline for queryID when the event log
+// still has the size and mtime it was derived from.
+func (s *Server) cachedActivity(queryID string) (*activityCacheEntry, bool) {
+	info, err := os.Stat(session.EventsPath(s.slmDir(), queryID))
+	if err != nil {
+		return nil, false
+	}
+	s.activityMu.Lock()
+	defer s.activityMu.Unlock()
+	e, ok := s.activityCache[queryID]
+	if !ok || e.size != info.Size() || !e.modTime.Equal(info.ModTime()) {
+		return nil, false
+	}
+	return e, true
+}
+
+func (s *Server) storeActivity(queryID string, entries []ActivityEntry) {
+	info, err := os.Stat(session.EventsPath(s.slmDir(), queryID))
+	if err != nil {
+		return
+	}
+	s.activityMu.Lock()
+	defer s.activityMu.Unlock()
+	if s.activityCache == nil {
+		s.activityCache = map[string]*activityCacheEntry{}
+		s.activityOrder = nil
+	}
+	if _, exists := s.activityCache[queryID]; !exists {
+		s.activityOrder = append(s.activityOrder, queryID)
+		for len(s.activityOrder) > maxActivityCache {
+			delete(s.activityCache, s.activityOrder[0])
+			s.activityOrder = s.activityOrder[1:]
+		}
+	}
+	s.activityCache[queryID] = &activityCacheEntry{size: info.Size(), modTime: info.ModTime(), entries: entries}
+}
+
 // planBelongsToBoard says whether the saved org chart is the one this board
 // was built under.
 //
diff --git a/pkg/session/events.go b/pkg/session/events.go
index 3eb05da..e1e7e6b 100644
--- a/pkg/session/events.go
+++ b/pkg/session/events.go
@@ -1,7 +1,9 @@
 package session
 
 import (
+	"bufio"
 	"encoding/json"
+	"errors"
 	"os"
 	"path/filepath"
 	"strings"
@@ -26,18 +28,154 @@ type EventRecord struct {
 	Model   string  `json:"model,omitempty"`
 }
 
-var eventMu sync.Mutex
-
 // EventsPath returns .slmcode/queries/<runID>/events.jsonl
 func EventsPath(slmDir, runID string) string {
 	return filepath.Join(TurnDir(slmDir, runID), "events.jsonl")
 }
 
+// ── Buffered per-run appender ─────────────────────────────────────────────
+//
+// AppendEvent used to open, write, fsync-maybe and close the log file for
+// EVERY event under one global mutex — token deltas included, which arrive
+// at decode speed and are by far the most numerous kind. A streaming worker
+// therefore paid an open/close pair per token, serialized against every other
+// worker's events. The log is now written through one open file per run with
+// a bufio.Writer:
+//
+//   - token deltas are not persisted at all (they are a live-view concern; the
+//     usage event that follows carries the numbers that matter afterwards);
+//   - structural kinds flush immediately, so a crash loses at most the chatty
+//     tail; run_end / run_stop flush, fsync and close;
+//   - a timer flushes the chatty kinds within eventFlushInterval regardless;
+//   - the turn's end (WriteTurnSummary) closes the appender; an appender idle
+//     for eventIdleClose is closed by the timer so a run that never reports an
+//     end does not pin a descriptor forever.
+//
+// ReadEvents flushes the run's appender first, so a reader (Studio replaying
+// the current run) never observes a torn tail.
+
+const (
+	eventFlushInterval = 500 * time.Millisecond
+	eventIdleClose     = 30 * time.Second
+	eventBufferBytes   = 64 * 1024
+)
+
+// eventLogSkipKinds are never persisted to the JSONL log.
+var eventLogSkipKinds = map[string]bool{"token": true, "delta": true}
+
+// eventChattyKinds are buffered and flushed by the timer; everything else is
+// structural and flushed on write.
+var eventChattyKinds = map[string]bool{
+	"output": true, "tool_call": true, "tool_result": true, "tool": true,
+	"usage": true, "calibration": true, "progress": true,
+}
+
+type eventAppender struct {
+	mu       sync.Mutex
+	f        *os.File
+	w        *bufio.Writer
+	timer    *time.Timer
+	lastUsed time.Time
+	closed   bool
+}
+
+var (
+	appendersMu sync.Mutex
+	appenders   = map[string]*eventAppender{}
+)
+
+func appenderKey(slmDir, runID string) string { return slmDir + "\x00" + runID }
+
+// appenderFor returns the open appender for the run, creating it on first use.
+func appenderFor(slmDir, runID string) (*eventAppender, error) {
+	key := appenderKey(slmDir, runID)
+	appendersMu.Lock()
+	defer appendersMu.Unlock()
+	if a, ok := appenders[key]; ok && !a.closed {
+		return a, nil
+	}
+	dir := TurnDir(slmDir, runID)
+	// Session state is local to the invoking user; keep it out of reach of
+	// other accounts on shared machines.
+	if err := os.MkdirAll(dir, 0o750); err != nil {
+		return nil, err
+	}
+	f, err := os.OpenFile(EventsPath(slmDir, runID), os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o600)
+	if err != nil {
+		return nil, err
+	}
+	a := &eventAppender{f: f, w: bufio.NewWriterSize(f, eventBufferBytes), lastUsed: time.Now()}
+	a.timer = time.AfterFunc(eventFlushInterval, func() { a.tick(key) })
+	appenders[key] = a
+	return a, nil
+}
+
+// tick is the timer callback: flush what is buffered, close when idle,
+// otherwise re-arm.
+func (a *eventAppender) tick(key string) {
+	a.mu.Lock()
+	if a.closed {
+		a.mu.Unlock()
+		return
+	}
+	_ = a.w.Flush()
+	idle := time.Since(a.lastUsed) > eventIdleClose
+	if idle {
+		a.closeLocked(false)
+		a.mu.Unlock()
+		appendersMu.Lock()
+		if cur, ok := appenders[key]; ok && cur == a {
+			delete(appenders, key)
+		}
+		appendersMu.Unlock()
+		return
+	}
+	a.timer.Reset(eventFlushInterval)
+	a.mu.Unlock()
+}
+
+func (a *eventAppender) write(line []byte, structural bool) error {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	if a.closed {
+		return os.ErrClosed
+	}
+	a.lastUsed = time.Now()
+	if _, err := a.w.Write(line); err != nil {
+		return err
+	}
+	if structural {
+		return a.w.Flush()
+	}
+	return nil
+}
+
+func (a *eventAppender) flushLocked() error { return a.w.Flush() }
+
+// closeLocked flushes, optionally fsyncs, and closes the file.
+func (a *eventAppender) closeLocked(sync bool) {
+	if a.closed {
+		return
+	}
+	_ = a.w.Flush()
+	if sync {
+		_ = a.f.Sync()
+	}
+	_ = a.f.Close()
+	if a.timer != nil {
+		a.timer.Stop()
+	}
+	a.closed = true
+}
+
 // AppendEvent appends one JSON line to the turn event log (best-effort).
 func AppendEvent(slmDir, runID string, rec EventRecord) error {
 	if slmDir == "" || runID == "" {
 		return nil
 	}
+	if eventLogSkipKinds[rec.Kind] {
+		return nil
+	}
 	if rec.Time == "" {
 		rec.Time = time.Now().Format(time.RFC3339Nano)
 	}
@@ -47,41 +185,93 @@ func AppendEvent(slmDir, runID string, rec EventRecord) error {
 	if err != nil {
 		return err
 	}
-	eventMu.Lock()
-	defer eventMu.Unlock()
-	dir := TurnDir(slmDir, runID)
-	// Session state is local to the invoking user; keep it out of reach of
-	// other accounts on shared machines.
-	if err := os.MkdirAll(dir, 0o750); err != nil {
-		return err
-	}
-	f, err := os.OpenFile(EventsPath(slmDir, runID), os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o600)
+	a, err := appenderFor(slmDir, runID)
 	if err != nil {
 		return err
 	}
-	// A close error here can't be surfaced to the caller once the write
-	// below has already reported success/failure; append is best-effort.
-	defer func() { _ = f.Close() }()
-	if _, err := f.Write(append(b, '\n')); err != nil {
-		return err
+	structural := !eventChattyKinds[rec.Kind]
+	if err := a.write(append(b, '\n'), structural); err != nil {
+		if errors.Is(err, os.ErrClosed) {
+			// Closed by the idle timer between lookup and write: reopen once.
+			if a, err = appenderFor(slmDir, runID); err == nil {
+				err = a.write(append(b, '\n'), structural)
+			}
+		}
+		if err != nil {
+			return err
+		}
 	}
 	if shouldSyncEvent(rec) {
-		return f.Sync()
+		CloseEventLog(slmDir, runID)
 	}
 	return nil
 }
 
+// shouldSyncEvent names the kinds after which the log must be durable and
+// the appender can be released: the run is over (or paused for a human).
 func shouldSyncEvent(rec EventRecord) bool {
 	switch rec.Kind {
-	case "ask_answered", "run_start", "run_end", "run_stop":
+	case "run_end", "run_stop":
 		return true
 	default:
 		return false
 	}
 }
 
-// ReadEvents loads all event records (capped).
+// FlushEventLog flushes the run's buffered events to the OS (no fsync).
+func FlushEventLog(slmDir, runID string) {
+	appendersMu.Lock()
+	a, ok := appenders[appenderKey(slmDir, runID)]
+	appendersMu.Unlock()
+	if !ok {
+		return
+	}
+	a.mu.Lock()
+	if !a.closed {
+		_ = a.flushLocked()
+	}
+	a.mu.Unlock()
+}
+
+// FlushEventLogs flushes every open appender.
+func FlushEventLogs() {
+	appendersMu.Lock()
+	all := make([]*eventAppender, 0, len(appenders))
+	for _, a := range appenders {
+		all = append(all, a)
+	}
+	appendersMu.Unlock()
+	for _, a := range all {
+		a.mu.Lock()
+		if !a.closed {
+			_ = a.flushLocked()
+		}
+		a.mu.Unlock()
+	}
+}
+
+// CloseEventLog flushes, fsyncs and closes the run's appender. Called at the
+// end of a turn; a later AppendEvent for the same run simply reopens.
+func CloseEventLog(slmDir, runID string) {
+	key := appenderKey(slmDir, runID)
+	appendersMu.Lock()
+	a, ok := appenders[key]
+	if ok {
+		delete(appenders, key)
+	}
+	appendersMu.Unlock()
+	if !ok {
+		return
+	}
+	a.mu.Lock()
+	a.closeLocked(true)
+	a.mu.Unlock()
+}
+
+// ReadEvents loads all event records (capped). The run's appender is flushed
+// first so a live run's tail is visible.
 func ReadEvents(slmDir, runID string, limit int) ([]EventRecord, error) {
+	FlushEventLog(slmDir, runID)
 	b, err := os.ReadFile(EventsPath(slmDir, runID))
 	if err != nil {
 		if os.IsNotExist(err) {
diff --git a/pkg/session/events_appender_test.go b/pkg/session/events_appender_test.go
new file mode 100644
index 0000000..e0c7ad1
--- /dev/null
+++ b/pkg/session/events_appender_test.go
@@ -0,0 +1,87 @@
+package session
+
+import (
+	"os"
+	"strings"
+	"testing"
+)
+
+// The event log is written through one buffered appender per run: token
+// deltas are not persisted, chatty kinds are buffered until a structural kind
+// or the timer flushes them, and run_end closes the file.
+func TestEventAppenderBuffersAndSkipsTokens(t *testing.T) {
+	slm := t.TempDir()
+	const run = "run-buf"
+	for _, rec := range []EventRecord{
+		{Phase: "execute", Kind: "output", Message: "chatty one"},
+		{Phase: "execute", Kind: "token", Message: "d"},
+		{Phase: "execute", Kind: "token", Message: "e"},
+		{Phase: "execute", Kind: "output", Message: "chatty two"},
+	} {
+		if err := AppendEvent(slm, run, rec); err != nil {
+			t.Fatal(err)
+		}
+	}
+	// Chatty kinds sit in the buffer; a reader through ReadEvents sees them
+	// because it flushes first, and no token delta was persisted.
+	recs, err := ReadEvents(slm, run, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(recs) != 2 || recs[0].Message != "chatty one" || recs[1].Message != "chatty two" {
+		t.Fatalf("records after flush: %+v", recs)
+	}
+	raw, _ := os.ReadFile(EventsPath(slm, run))
+	if strings.Contains(string(raw), `"token"`) {
+		t.Fatalf("token deltas were persisted: %s", raw)
+	}
+
+	// A structural kind flushes on write: the file grows without ReadEvents.
+	before := len(raw)
+	if err := AppendEvent(slm, run, EventRecord{Phase: "execute", Kind: "phase", Message: "wave 1"}); err != nil {
+		t.Fatal(err)
+	}
+	raw, _ = os.ReadFile(EventsPath(slm, run))
+	if len(raw) <= before || !strings.Contains(string(raw), "wave 1") {
+		t.Fatalf("structural kind not flushed immediately: %s", raw)
+	}
+	appendersMu.Lock()
+	_, open := appenders[appenderKey(slm, run)]
+	appendersMu.Unlock()
+	if !open {
+		t.Fatal("appender should stay open between structural events")
+	}
+
+	// run_end flushes, syncs and closes the appender.
+	if err := AppendEvent(slm, run, EventRecord{Phase: "done", Kind: "run_end", Message: "finished"}); err != nil {
+		t.Fatal(err)
+	}
+	appendersMu.Lock()
+	_, open = appenders[appenderKey(slm, run)]
+	appendersMu.Unlock()
+	if open {
+		t.Fatal("run_end did not close the appender")
+	}
+	recs, _ = ReadEvents(slm, run, 0)
+	if len(recs) != 4 || recs[3].Kind != "run_end" {
+		t.Fatalf("records after run_end: %+v", recs)
+	}
+	// A later append for the same run reopens transparently.
+	if err := AppendEvent(slm, run, EventRecord{Phase: "done", Kind: "note", Message: "late"}); err != nil {
+		t.Fatal(err)
+	}
+	CloseEventLog(slm, run)
+	recs, _ = ReadEvents(slm, run, 0)
+	if len(recs) != 5 || recs[4].Message != "late" {
+		t.Fatalf("records after reopen: %+v", recs)
+	}
+}
+
+func BenchmarkAppendEventChatty(b *testing.B) {
+	slm := b.TempDir()
+	b.ReportAllocs()
+	for i := 0; i < b.N; i++ {
+		_ = AppendEvent(slm, "bench", EventRecord{Phase: "execute", Kind: "output", Message: "tool output line"})
+	}
+	CloseEventLog(slm, "bench")
+}
diff --git a/pkg/session/turn.go b/pkg/session/turn.go
index f9acd3d..778ba63 100644
--- a/pkg/session/turn.go
+++ b/pkg/session/turn.go
@@ -125,6 +125,8 @@ func WriteTurnSummary(slmDir string, t *Turn, board plan.Board, extraNotes strin
 		return "", err
 	}
 	_ = appendSummariesIndex(slmDir, t, body)
+	// The turn is over: make its event log durable and release the appender.
+	CloseEventLog(slmDir, t.ID)
 	return path, nil
 }
 

From 8b98ce7ee290284720ba651bc023ab98dec6bdec Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 09:22:57 +0000
Subject: [PATCH 21/23] fix(backends,cli,workspace): retry streamed calls
 before the first delta, restore the gate terminal on cancel, keep evolve
 informed of in-tool repairs; docs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- retryProvider.CompleteStream / CompleteStreamWithMode now go through
  retryDo. The ReAct loop takes the streaming path whenever a token sink is
  attached (TUI, Studio), so a 429 or a connection refused by a model server
  that was still loading got zero attempts exactly when someone was watching.
  A callback wrapper tracks whether a delta was delivered: a failure before
  any delta is retried like a failed Complete (fresh deadline per attempt,
  the caller's callback only sees the successful attempt's deltas); once a
  delta reached the callback the error is surfaced as-is, since a partial
  stream cannot be replayed.
- TerminalGateHost.AskGate restores the terminal on the ctx.Done branch. The
  read goroutine owned raw mode and stayed blocked in ReadKey, so a gate
  abandoned by a stop or shutdown left the shell without echo. The
  goroutine's own release skips the restore when a newer gate has since taken
  the terminal.
- A ws_edit/ws_patch call whose ws_read gutter was stripped in-tool is still
  presented to the tool observer as the refusal it would have been, followed
  by a repaired retry that landed, without a second edit — so the failure is
  fingerprinted, the memory rule credited and the metrics row moves.
- docs: tools.md, troubleshooting.md (aliases, empty-content refusal, gutter
  stripping, ws_patch insertion/bare-form/prose semantics), studio.md (review
  kinds and stamps, task_update / review_pending events, retry endpoint,
  queries fields, shell pending list, stopping), permissions.md (kind-aware
  apply, per-ask shell files).
---
 docs/permissions.md               |   6 ++
 docs/studio.md                    |  42 +++++++--
 docs/tools.md                     |  25 +++--
 docs/troubleshooting.md           |  25 ++++-
 pkg/backends/retry.go             |  69 ++++++++++++--
 pkg/backends/retry_stream_test.go | 151 ++++++++++++++++++++++++++++++
 pkg/cli/gateprompt.go             |  56 ++++++++++-
 pkg/workspace/observer.go         |  60 ++++++++++++
 8 files changed, 405 insertions(+), 29 deletions(-)
 create mode 100644 pkg/backends/retry_stream_test.go

diff --git a/docs/permissions.md b/docs/permissions.md
index e62e577..b56b2c6 100644
--- a/docs/permissions.md
+++ b/docs/permissions.md
@@ -19,6 +19,12 @@ Aliases accepted: `allow`/`yes` → `auto`; `dryrun`/`dry` → `dry-run`; `ask`/
 In `review` mode, a tool result reads
 `review: staged pkg/foo/bar.go → 1712…_edit_pkg__foo__bar.go.patch.json (run \`slmcode apply\`)`.
 
+Each queue entry records its `kind` (`write`/`edit`/`patch`/`delete`/`mv`) and, when known, the
+`from` path of a move plus the `task_id`, `agent` and `query_id` that produced it. Both appliers
+act on the kind: a `delete` removes the file, an `mv` moves the source, and a shell approval is
+never a queue entry at all (it is answered through `slmcode`'s shell-ask prompt or Studio, one file
+per ask under `.slmcode/shell/asks/`).
+
 ```bash
 slmcode config set permission review
 slmcode apply             # interactive per-file review
diff --git a/docs/studio.md b/docs/studio.md
index 5511040..82fa8cf 100644
--- a/docs/studio.md
+++ b/docs/studio.md
@@ -147,20 +147,37 @@ slmcode run "add JWT validation"
 ```
 
 Each proposal is a `.slmcode/pending/<nano>_<kind>_<mangled-path>.patch.json` holding
-`{path, kind, content}`. Studio's **Review** page lists them with both sides of the diff and
-per-file apply/reject; the same queue is available from the terminal with `slmcode apply` and
-`slmcode reject`.
+`{path, kind, content}` plus, when the workspace knew them at record time, `from` (the source of a
+`ws_mv`), `task_id`, `agent` and `query_id`. Studio's **Review** page lists them with both sides of
+the diff and per-file apply/reject; the same queue is available from the terminal with
+`slmcode apply` and `slmcode reject`.
+
+**Apply honors the kind.** `write`/`edit`/`patch` write the content; `delete` removes the file;
+`mv` moves the source to the destination (falling back to writing the recorded content if the
+source is gone). Stale `shell` entries from older builds are never files: they are hidden from the
+listing, skipped by `{all: true}` and refused by id.
 
 | Endpoint | Purpose |
 |---|---|
-| `GET /api/review/pending?hunks=1&context=3` | list pending changes, optionally with hunks |
-| `GET /api/review/pending/{id}` | one change with its diff |
-| `POST /api/review/apply` | `{ids}` / `{id}` / `{all: true}` |
-| `POST /api/review/reject` | same shape |
+| `GET /api/review/pending?hunks=1&context=3` | list pending changes, optionally with hunks. Items carry `kind`, `from`, `task_id`, `agent`, `query_id` (empty when unknown) |
+| `GET /api/review/pending/{id}` | one change with its diff (a `delete` diffs to empty; an `mv` diffs source → content at the destination path) |
+| `POST /api/review/apply` | `{ids}` / `{id}` / `{all: true}` — emits `review_pending` |
+| `POST /api/review/reject` | same shape — emits `review_pending` |
 
 The queue id is a bare file name and is validated as one — a traversal attempt is rejected rather
 than resolved.
 
+### Board, tasks and history
+
+| Endpoint | Purpose |
+|---|---|
+| `GET /api/tasks` | the live board; each task includes `attempt_log`, `gate_retries` and `criteria` when set |
+| `POST /api/tasks/{id}/retry` | move a task back to `ready_to_dev`, reset `retries`, clear `error`, append `"retried from Studio"` to `attempt_log`, persist, emit `task_update`. Returns the task. `409` when no board is loaded, `404` for an unknown id |
+| `GET /api/queries` | run history; every item also carries `duration_ms`, `tokens`, `cost_usd`, `tasks_total`, `tasks_done`, `failed_tasks` and `teams` (string list), computed from the stored turn, board and event log (usage totals are cached per log size/mtime) |
+| `GET /api/shell/pending` | `{pending, ask, asks: [...], count}` — `ask` is the oldest open shell ask (the shape the UI was built on); `asks` lists every open one, since a parallel wave can raise several |
+| `POST /api/shell/approve` | `{ask_id, decision: "approve" \| "deny"}` — `ask_id` picks which pending ask; it may be omitted only when exactly one is pending |
+| `POST /api/runs/stop` | asks the run to unwind. `running` stays `true` (with `stopping: true` in `/api/runs/latest` and `/api/status`) until the run goroutine has exited, so a new run cannot start on top of the old one's teardown |
+
 ---
 
 ## Live events (SSE)
@@ -174,6 +191,17 @@ than resolved.
 - When events genuinely could not be replayed, an explicit `event: gap` frame is emitted with
   `{from, to}`, so the UI can say *"events N–M were dropped"* instead of quietly showing an
   incomplete run. A slow consumer is flagged rather than silently dropped.
+- The ring is **not** cleared when a run starts. `GET /api/runs/latest` scopes its snapshot to the
+  current run by sequence number, while a reconnecting stream can still replay across a
+  stop → start.
+
+Two kinds are synthesized by the server itself rather than emitted by the engine, and they sit in
+the ring and replay like every other event:
+
+| Kind | When | Shape |
+|---|---|---|
+| `task_update` | after any board task change (worker moves, a `PATCH /api/tasks/{id}`, a retry) | `phase` = the run's current phase, or `"board"` when no run is active; `task_id`; `message` = `"<id> -> <column>"` (`"<id> -> removed"` for a deletion); `data` = `{"task": {…task exactly as GET /api/tasks renders it…}}` |
+| `review_pending` | after a proposal is recorded by a running agent, and after every apply/reject | `phase` = `"review"`; `data` = `{"pending": N}` — the number of applicable entries in the queue |
 
 `GET /api/queries/{id}/events` replays a recorded run's log, and `GET /api/queries/{id}/trace`
 groups it into contiguous phase segments with totals — the numbers that matter when tuning a
diff --git a/docs/tools.md b/docs/tools.md
index d30cc69..9effafa 100644
--- a/docs/tools.md
+++ b/docs/tools.md
@@ -70,8 +70,11 @@ Next page: ws_read {"path":"pkg/foo/bar.go","offset":121,"limit":120}. To jump s
 ```
 
 The `   42|` gutter is **display only**. Including it in `old_str` is the single most common
-small-model edit failure, so `ws_edit` detects and rejects it by name rather than reporting a
-generic miss.
+small-model edit failure. When **every** non-blank line of `old_str` (or of a `ws_patch` body)
+carries the gutter the intent is unambiguous: `ws_edit`/`ws_patch` strip it, apply the edit, and
+append `[stripped ws_read line numbers from old_str — do not include them]` to the result so the
+drift stays visible to `pkg/evolve`. A gutter on only *some* lines is not a paste and is still
+refused by name.
 
 Failure messages point at the recovery tool: a missing path suggests `ws_glob`/`ws_list`, a
 directory suggests `ws_list`, an out-of-range offset gives the valid range.
@@ -120,10 +123,13 @@ and how `pkg/evolve` learns which drift your model has.
 | Situation | Response |
 |---|---|
 | `old_str` empty or whitespace-only | Refused. Empty search used to pass `strings.Contains` and silently prepend. The message names the three real intents: create → `ws_write`; append → anchor on the last 2–3 lines; insert → repeat the anchor in `new_str`. |
-| `old_str` carries the `   42\|` gutter | Refused by name, with a before/after example. |
+| `old_str` carries the `   42\|` gutter on **every** line | Stripped and applied; the result ends with `[stripped ws_read line numbers from old_str — do not include them]`. |
+| `old_str` carries the gutter on only **some** lines | Refused by name, with a before/after example. |
 | `old_str == new_str` | `No-op edit refused — old_str and new_str are identical.` |
 | Exact match found N>1 times | `old_str found N times … pass replace_all:true, or include more surrounding context … Do NOT use ws_write.` |
-| A ladder strategy matched N>1 times | `Ambiguous edit refused — the search text matches N places … (strategy) match.` |
+| A ladder strategy matched N>1 times | `Ambiguous edit refused — the search text matches N places … (strategy) match.` With `replace_all:true` every span of that strategy is replaced instead (`edited … (N replacement(s)) [matched …]`). |
+| Argument spelled `old_string`/`search`/`old`, `new_string`/`replace`/`new` | Accepted as aliases of `old_str`/`new_str` (canonical key wins when both are present). `ws_write` likewise reads `contents`/`text`/`body`, `ws_patch` reads `diff`/`hunk`. |
+| `ws_write` with empty `content` on a new file | `Write refused — content is empty, so this would create <path> as a 0-byte file.` The message names the accepted body keys and any unrecognized key in the call. Emptying an existing file needs `allow_shrink:true`. |
 | No strategy matched | Not-found guidance plus a fuzzy hint at the closest span. |
 | Whole-file-style rewrite through `ws_edit` | Refused by the over-edit guard (`over_edit_guard`). |
 
@@ -135,8 +141,15 @@ Success: `edited pkg/foo/bar.go (1 replacement(s))` plus any strategy note and s
 {"path": "pkg/foo/bar.go", "patch": "@@ -10,3 +10,4 @@\n …"}
 ```
 
-Accepts a unified diff with `@@` hunks, a `<<<<<<< SEARCH / ======= / >>>>>>> REPLACE` block, or
-a bare `-`/`+` block treated as one anchorless hunk.
+Accepts a unified diff with `@@` hunks, a `<<<<<<< SEARCH / ======= / >>>>>>> REPLACE` block, the
+same block **without** the conflict markers (`SEARCH` / `=======` / `REPLACE` header lines, or just
+a bare `=======` separator), or a bare `-`/`+` block treated as one anchorless hunk.
+
+A pure-insertion hunk (`@@ -N,0 +M,K @@`, nothing removed) inserts **after** line N, as every
+unified-diff consumer does (`-0,0` means the top of the file). Trailing prose after a hunk ("This
+adds the check.") and Markdown fences around the diff are dropped rather than being read as
+context lines that can never match; an unprefixed line that is *followed* by a diff line is still
+treated as context the model forgot to prefix.
 
 Multi-hunk diffs are applied **hunk by hunk**, each anchored on its `@@` line numbers within a
 ±20-line window (`AnchorWindowLines`), with earlier hunks' line delta carried forward. The same
diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
index c7e9c42..0050762 100644
--- a/docs/troubleshooting.md
+++ b/docs/troubleshooting.md
@@ -36,11 +36,18 @@ slmcode doctor --json
 These arrive **in-band**, as the tool result the model sees. They are also what you will see in
 the Live view and the run trace.
 
+### `[stripped ws_read line numbers from old_str — do not include them]`
+
+The commonest small-model failure, now handled in-band. `ws_read` renders a `   42|` gutter for
+navigation; it is not in the file. When **every** non-blank line of `old_str` (or a `ws_patch`
+body) carries it, the gutter is stripped, the edit is applied, and this note is appended to the
+result so the drift stays visible. `pkg/evolve` ships a rule
+(`transform_args: strip_line_number_prefix`) keyed on it that stops the model doing it again.
+
 ### `Edit refused — old_str still contains ws_read's line-number prefix (like `   42|`)`
 
-The commonest small-model failure. `ws_read` renders a `   42|` gutter for navigation; it is not
-in the file. The message shows a before/after. `pkg/evolve` ships a rule
-(`transform_args: strip_line_number_prefix`) that fixes this automatically after the first time.
+Only **some** lines carry the gutter, so this was not a paste from `ws_read` and cannot be fixed
+by stripping. The message shows a before/after; copy the span again without the numbers.
 
 ### `Edit refused — old_str is empty (or only whitespace)`
 
@@ -48,6 +55,18 @@ An empty search used to pass `strings.Contains` and silently prepend `new_str`.
 the three real intents: create → `ws_write`; append → anchor on the last 2–3 lines; insert →
 repeat the anchor at the end of `new_str`.
 
+### `Write refused — content is empty, so this would create <path> as a 0-byte file`
+
+`ws_write` reads the file body from `content` (also `contents` / `text` / `body`). The usual cause is
+the text sitting under a key the tool does not read (`code`, `source`, …) — the message lists any
+unrecognized key in the call. Truncating an *existing* file to zero bytes needs `allow_shrink: true`.
+
+### `old_str is required` after a call that clearly had one
+
+Older builds matched argument names exactly. `ws_edit` now also accepts `old_string` / `search` /
+`old` and `new_string` / `replace` / `new`; `ws_patch` accepts `diff` / `hunk`. The canonical key
+wins when both are present.
+
 ### `old_str found N times in <path>`
 
 The search text is not unique. Add 2–3 surrounding lines, or pass `replace_all: true` if you
diff --git a/pkg/backends/retry.go b/pkg/backends/retry.go
index bd04494..ec1d868 100644
--- a/pkg/backends/retry.go
+++ b/pkg/backends/retry.go
@@ -12,6 +12,7 @@ import (
 	"strconv"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/piotrlaczkowski/GoLangGraph/pkg/llm"
@@ -107,6 +108,12 @@ func Classify(err error) Classification {
 	if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
 		return Classification{Class: ClassCanceled}
 	}
+	// A stream that already delivered output cannot be replayed: whatever the
+	// underlying failure was, another attempt would show the prefix twice.
+	var pse *partialStreamError
+	if errors.As(err, &pse) {
+		return Classification{Class: ClassPermanent}
+	}
 	var he *HTTPError
 	if errors.As(err, &he) {
 		return classifyStatus(he.Status, he.Body, he.RetryAfter)
@@ -547,18 +554,64 @@ func (p *retryProvider) CompleteWithMode(ctx context.Context, req llm.Completion
 	})
 }
 
-// CompleteStream is not retried: a partially delivered stream cannot be
-// replayed without the callback seeing the prefix twice.
+// CompleteStream retries exactly like Complete UNTIL the first delta reaches
+// the callback. It used to bypass retryDo entirely, on the grounds that a
+// partially delivered stream cannot be replayed — true, but the ReAct loop
+// takes this path whenever a token sink is attached (TUI, Studio), so a 429
+// or a connection refused by a model server that was still loading got zero
+// attempts precisely when someone was watching. A failure before any delta is
+// indistinguishable from a failed Complete and is retried the same way; once
+// a delta has been delivered the error is surfaced as-is.
 func (p *retryProvider) CompleteStream(ctx context.Context, req llm.CompletionRequest, cb llm.StreamCallback) error {
-	cctx, cancel := p.callCtx(ctx, req)
-	defer cancel()
-	return p.inner.CompleteStream(cctx, req, cb)
+	return p.streamWithRetry(ctx, req, cb, func(c context.Context, wrapped llm.StreamCallback) error {
+		return p.inner.CompleteStream(c, req, wrapped)
+	})
 }
 
 func (p *retryProvider) CompleteStreamWithMode(ctx context.Context, req llm.CompletionRequest, cb llm.StreamCallback, mode llm.StreamMode) error {
-	cctx, cancel := p.callCtx(ctx, req)
-	defer cancel()
-	return p.inner.CompleteStreamWithMode(cctx, req, cb, mode)
+	return p.streamWithRetry(ctx, req, cb, func(c context.Context, wrapped llm.StreamCallback) error {
+		return p.inner.CompleteStreamWithMode(c, req, wrapped, mode)
+	})
+}
+
+// partialStreamError marks a failure that happened after at least one delta
+// was delivered. Classify treats it as permanent so retryDo surfaces it
+// immediately; Unwrap keeps the original error visible to callers.
+type partialStreamError struct{ err error }
+
+func (e *partialStreamError) Error() string { return e.err.Error() }
+func (e *partialStreamError) Unwrap() error { return e.err }
+
+// streamWithRetry drives one streaming call per attempt through retryDo. Each
+// attempt gets a fresh deadline (callCtx) and a fresh delivered flag; the
+// caller's callback only ever sees deltas from the attempt that produced
+// output, so nothing is replayed.
+func (p *retryProvider) streamWithRetry(
+	ctx context.Context, req llm.CompletionRequest, cb llm.StreamCallback,
+	call func(ctx context.Context, cb llm.StreamCallback) error,
+) error {
+	_, err := retryDo(ctx, p.policy, func(ctx context.Context, _ int) (struct{}, error) {
+		cctx, cancel := p.callCtx(ctx, req)
+		defer cancel()
+		var delivered atomic.Bool
+		wrapped := func(chunk llm.CompletionResponse) error {
+			delivered.Store(true)
+			if cb == nil {
+				return nil
+			}
+			return cb(chunk)
+		}
+		err := call(cctx, wrapped)
+		if err != nil && delivered.Load() {
+			return struct{}{}, &partialStreamError{err: err}
+		}
+		return struct{}{}, err
+	})
+	var pse *partialStreamError
+	if errors.As(err, &pse) {
+		return pse.err
+	}
+	return err
 }
 
 func (p *retryProvider) IsHealthy(ctx context.Context) error      { return p.inner.IsHealthy(ctx) }
diff --git a/pkg/backends/retry_stream_test.go b/pkg/backends/retry_stream_test.go
new file mode 100644
index 0000000..d274258
--- /dev/null
+++ b/pkg/backends/retry_stream_test.go
@@ -0,0 +1,151 @@
+package backends
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/UnicoLab/slmcode/pkg/workspace"
+	"github.com/piotrlaczkowski/GoLangGraph/pkg/llm"
+)
+
+// flakyStreamProvider fails its first failBefore stream calls with failErr
+// BEFORE delivering anything, and (when failAfterDelta is set) fails every
+// call with failErr right AFTER delivering one delta.
+type flakyStreamProvider struct {
+	fakeStreamProvider
+	failBefore     int
+	failAfterDelta bool
+	failErr        error
+	mu2            sync.Mutex
+	calls          int
+}
+
+func (p *flakyStreamProvider) CompleteStream(ctx context.Context, req llm.CompletionRequest, cb llm.StreamCallback) error {
+	p.mu2.Lock()
+	p.calls++
+	n := p.calls
+	p.mu2.Unlock()
+	if n <= p.failBefore {
+		return p.failErr
+	}
+	if p.failAfterDelta {
+		_ = cb(llm.CompletionResponse{Model: p.model,
+			Choices: []llm.Choice{{Delta: llm.Message{Role: "assistant", Content: "partial"}}}})
+		return p.failErr
+	}
+	return p.fakeStreamProvider.CompleteStream(ctx, req, cb)
+}
+
+func (p *flakyStreamProvider) CompleteStreamWithMode(ctx context.Context, req llm.CompletionRequest, cb llm.StreamCallback, _ llm.StreamMode) error {
+	return p.CompleteStream(ctx, req, cb)
+}
+
+func (p *flakyStreamProvider) CompleteWithMode(ctx context.Context, req llm.CompletionRequest, mode llm.StreamMode) (*llm.CompletionResponse, error) {
+	if mode == llm.StreamModeNone {
+		return p.Complete(ctx, req)
+	}
+	return llm.CollectStream(ctx, p.CompleteStream, req)
+}
+
+func (p *flakyStreamProvider) streamCallCount() int {
+	p.mu2.Lock()
+	defer p.mu2.Unlock()
+	return p.calls
+}
+
+func fastPolicy() RetryPolicy {
+	return RetryPolicy{MaxAttempts: 3, BaseDelay: time.Millisecond, MaxDelay: 2 * time.Millisecond}
+}
+
+// A transient failure BEFORE any delta is retried on the streaming path, the
+// one the ReAct loop takes whenever a token sink (TUI/Studio) is attached.
+func TestStreamRetriesTransientFailureBeforeFirstDelta(t *testing.T) {
+	inner := &flakyStreamProvider{
+		fakeStreamProvider: fakeStreamProvider{name: "fake", model: "m", chunks: []string{"hel", "lo"}},
+		failBefore:         2,
+		failErr:            errors.New("error, status code: 429, message: rate limit"),
+	}
+	p := NewRetryProvider(inner, "fake", "m", fastPolicy())
+
+	var got strings.Builder
+	err := p.CompleteStream(context.Background(), llm.CompletionRequest{Model: "m"}, func(c llm.CompletionResponse) error {
+		for _, ch := range c.Choices {
+			got.WriteString(ch.Delta.Content)
+		}
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("stream failed after retries: %v", err)
+	}
+	if inner.streamCallCount() != 3 {
+		t.Fatalf("stream attempts = %d, want 3 (two 429s then success)", inner.streamCallCount())
+	}
+	if got.String() != "hello" {
+		t.Fatalf("callback saw %q — deltas must come from the successful attempt only", got.String())
+	}
+
+	// Through the tee (the real stack: tee over retry), with a sink attached.
+	inner2 := &flakyStreamProvider{
+		fakeStreamProvider: fakeStreamProvider{name: "fake", model: "m", chunks: []string{"a", "b"}},
+		failBefore:         1,
+		failErr:            errors.New("dial tcp 127.0.0.1:8080: connect: connection refused"),
+	}
+	stack := newStreamTee(NewRetryProvider(inner2, "fake", "m", fastPolicy()), "worker")
+	rec := &recorder{}
+	unregister := RegisterTokenSink("worker", "T1", rec.sink)
+	defer unregister()
+	ctx := workspace.WithTaskID(context.Background(), "T1")
+	resp, err := stack.CompleteWithMode(ctx, llm.CompletionRequest{Model: "m", Stream: true}, llm.StreamModeForced)
+	if err != nil {
+		t.Fatalf("teed stream failed after retry: %v", err)
+	}
+	if inner2.streamCallCount() != 2 {
+		t.Fatalf("teed stream attempts = %d, want 2", inner2.streamCallCount())
+	}
+	if resp == nil || len(resp.Choices) == 0 || resp.Choices[0].Message.Content != "ab" {
+		t.Fatalf("teed response: %+v", resp)
+	}
+	if joined := rec.text(); joined != "ab" {
+		t.Fatalf("sink saw %q, want the successful attempt's deltas only", joined)
+	}
+}
+
+// Once a delta has been delivered the stream cannot be replayed: the error is
+// surfaced as-is, with no second attempt.
+func TestStreamDoesNotRetryAfterFirstDelta(t *testing.T) {
+	failErr := errors.New("error, status code: 503, message: upstream reset")
+	inner := &flakyStreamProvider{
+		fakeStreamProvider: fakeStreamProvider{name: "fake", model: "m", chunks: []string{"x"}},
+		failAfterDelta:     true,
+		failErr:            failErr,
+	}
+	p := NewRetryProvider(inner, "fake", "m", fastPolicy())
+	deltas := 0
+	err := p.CompleteStream(context.Background(), llm.CompletionRequest{Model: "m"}, func(llm.CompletionResponse) error {
+		deltas++
+		return nil
+	})
+	if err == nil || !errors.Is(err, failErr) {
+		t.Fatalf("error after partial stream: %v (want the original)", err)
+	}
+	if inner.streamCallCount() != 1 {
+		t.Fatalf("stream attempts = %d, want 1 (no replay after a delivered delta)", inner.streamCallCount())
+	}
+	if deltas != 1 {
+		t.Fatalf("callback saw %d deltas, want exactly the one delivered", deltas)
+	}
+	// Permanent failures before any delta are still tried once.
+	inner3 := &flakyStreamProvider{
+		fakeStreamProvider: fakeStreamProvider{name: "fake", model: "m", chunks: []string{"x"}},
+		failBefore:         5,
+		failErr:            errors.New("error, status code: 400, message: bad request"),
+	}
+	_ = NewRetryProvider(inner3, "fake", "m", fastPolicy()).CompleteStream(context.Background(), llm.CompletionRequest{Model: "m"}, nil)
+	if inner3.streamCallCount() != 1 {
+		t.Fatalf("permanent failure attempts = %d, want 1", inner3.streamCallCount())
+	}
+}
diff --git a/pkg/cli/gateprompt.go b/pkg/cli/gateprompt.go
index eb41519..9cf7a8f 100644
--- a/pkg/cli/gateprompt.go
+++ b/pkg/cli/gateprompt.go
@@ -43,6 +43,10 @@ type TerminalGateHost struct {
 	// and in raw mode a fast typist could lose a keystroke the same way. One
 	// decoder for the whole terminal keeps every unconsumed byte in one place.
 	keys *KeyReader
+	// raw is the terminal mode handle held while read() is waiting for a key,
+	// so AskGate can restore the terminal when ctx ends before an answer.
+	rawMu sync.Mutex
+	raw   *RawMode
 }
 
 // NewTerminalGateHost returns a host bound to the process terminal.
@@ -144,11 +148,49 @@ func (h *TerminalGateHost) AskGate(ctx context.Context, g Gate) (GateAnswer, boo
 		}
 		return r.ans, r.ok
 	case <-ctx.Done():
+		// The read goroutine still owns the terminal: it put stdin into raw
+		// mode and is blocked in ReadKey. Returning without restoring left
+		// the shell in raw mode (no echo, no line editing) whenever a gate
+		// was abandoned by a stop or a shutdown rather than answered. Restore
+		// here; the goroutine's own Restore is idempotent.
+		h.restoreRaw()
 		write("\n")
 		return GateAnswer{}, false
 	}
 }
 
+// setRaw / restoreRaw track the RawMode handle held by the read goroutine so
+// the ctx.Done branch of AskGate can return the terminal to cooked mode.
+func (h *TerminalGateHost) setRaw(rm *RawMode) {
+	h.rawMu.Lock()
+	h.raw = rm
+	h.rawMu.Unlock()
+}
+
+func (h *TerminalGateHost) restoreRaw() {
+	h.rawMu.Lock()
+	rm := h.raw
+	h.raw = nil
+	h.rawMu.Unlock()
+	rm.Restore() // nil-safe
+}
+
+// releaseRaw is the read goroutine's own restore. A reader that was abandoned
+// by ctx.Done and wakes up only after a NEWER gate has put the terminal into
+// raw mode must not put it back into cooked mode under that gate, so it only
+// restores when its handle is still the current one (or already released).
+func (h *TerminalGateHost) releaseRaw(rm *RawMode) {
+	h.rawMu.Lock()
+	superseded := h.raw != nil && h.raw != rm
+	if h.raw == rm {
+		h.raw = nil
+	}
+	h.rawMu.Unlock()
+	if !superseded {
+		rm.Restore()
+	}
+}
+
 // reader returns the host's single key decoder, creating it on first use.
 //
 // Callers hold h.mu (AskGate is the only path in), so no extra locking.
@@ -168,29 +210,33 @@ func (h *TerminalGateHost) read(g Gate) (GateAnswer, bool) {
 	if err != nil || rm == nil {
 		return h.readLine(g, "")
 	}
+	// Published so AskGate's ctx.Done branch can restore the terminal while
+	// this goroutine is still blocked in ReadKey; restoreRaw is idempotent
+	// with the Restore calls below.
+	h.setRaw(rm)
 	kr := h.reader()
 	for {
 		k, kerr := kr.ReadKey()
 		if kerr != nil {
-			rm.Restore()
+			h.releaseRaw(rm)
 			return GateAnswer{}, false
 		}
 		switch k.Type {
 		case KeyCtrlC, KeyCtrlD, KeyEscape:
-			rm.Restore()
+			h.releaseRaw(rm)
 			return GateAnswer{Value: GateInterrupted}, true
 		case KeyEnter:
-			rm.Restore()
+			h.releaseRaw(rm)
 			return h.readLine(g, "")
 		}
 		if ans, ok := g.ResolveKey(k); ok {
-			rm.Restore()
+			h.releaseRaw(rm)
 			return ans, true
 		}
 		// A key that belongs to a freeform option, or any other printable
 		// character, starts a typed answer with that character already in.
 		if k.Type == KeyRune {
-			rm.Restore()
+			h.releaseRaw(rm)
 			_, _ = io.WriteString(h.out(), string(k.Rune))
 			return h.readLine(g, string(k.Rune))
 		}
diff --git a/pkg/workspace/observer.go b/pkg/workspace/observer.go
index 8c2c5a5..2e05ca8 100644
--- a/pkg/workspace/observer.go
+++ b/pkg/workspace/observer.go
@@ -108,6 +108,30 @@ func (w *Workspace) observed(name string, fn tools.ToolExecutor) tools.ToolExecu
 		if obs == nil {
 			return out, err
 		}
+		if rep, ok := selfRepaired(name, args, resultString(out), err); ok {
+			// The tool repaired the call itself (a ws_read gutter stripped
+			// from old_str). The self-improvement engine must still see the
+			// drift exactly as it would have before — a refusal, then a
+			// repaired retry that landed — so the failure is fingerprinted,
+			// the memory rule is credited and the metrics row moves. What
+			// must NOT happen is a second edit: the file already changed, so
+			// the observer's retry is reported, not re-run.
+			d := time.Since(start)
+			adv := obs(ctx, ToolCall{Tool: name, Args: args, Result: rep.refusal, Duration: d})
+			retryArgs := adv.RetryArgs
+			if len(retryArgs) == 0 {
+				retryArgs = rep.args
+			}
+			retry := ToolCall{Tool: name, Args: retryArgs, Result: resultString(out), Duration: d, Retried: true}
+			adv2 := obs(ctx, retry)
+			if sink != nil && len(adv.RetryArgs) > 0 {
+				sink(adv.RetryArgs, true, retry.Result)
+			}
+			if adv2.Guidance != "" {
+				return appendGuidance(retry.Result, adv2.Guidance), nil
+			}
+			return out, err
+		}
 		call := ToolCall{
 			Tool:     name,
 			Args:     args,
@@ -157,6 +181,42 @@ func (w *Workspace) observed(name string, fn tools.ToolExecutor) tools.ToolExecu
 	}
 }
 
+// selfRepair describes a call the tool layer fixed on its own: the refusal it
+// would have produced before it learned to, and the arguments as repaired.
+type selfRepair struct {
+	refusal string
+	args    map[string]interface{}
+}
+
+// selfRepaired recognises a result produced by an in-tool repair. Today that
+// is the ws_read gutter stripped from ws_edit/ws_patch input, marked by
+// GutterStrippedNote on the result.
+func selfRepaired(name string, args map[string]interface{}, result string, err error) (selfRepair, bool) {
+	if err != nil || !strings.Contains(result, GutterStrippedNote) {
+		return selfRepair{}, false
+	}
+	repaired := make(map[string]interface{}, len(args)+2)
+	for k, v := range args {
+		repaired[k] = v
+	}
+	switch name {
+	case "ws_edit":
+		if s, ok := stripReadGutter(strArgAny(args, oldStrKeys...)); ok {
+			repaired["old_str"] = s
+		}
+		if s, ok := stripReadGutter(strArgAny(args, newStrKeys...)); ok {
+			repaired["new_str"] = s
+		}
+	case "ws_patch":
+		if s, ok := stripReadGutterPatch(strArgAny(args, patchKeys...)); ok {
+			repaired["patch"] = s
+		}
+	default:
+		return selfRepair{}, false
+	}
+	return selfRepair{refusal: LineNumberedOldStrReason(strArg(args, "path")), args: repaired}, true
+}
+
 // resultString renders a tool result as the agent would see it.
 func resultString(out interface{}) string {
 	if s, ok := out.(string); ok {

From e5b6ce4a4e0d5ed6fa37684b1a1eebc13a9973e6 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 09:32:38 +0000
Subject: [PATCH 22/23] docs: changelog for the efficiency, robustness and
 Studio round; board store also refreshes on agent_end

The engine emits no task_start/task_done kinds of its own, so on a server
without task_update events the store's structural cue is the end of the
role that worked the task.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011RfCkcsbJZgHoQLzwkqFUL
---
 docs/changelog.md              | 111 +++++++++++++++++++++++++++++++++
 web/src/hooks/useBoardStore.ts |   4 +-
 2 files changed, 114 insertions(+), 1 deletion(-)

diff --git a/docs/changelog.md b/docs/changelog.md
index c039793..a030f9e 100644
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -85,6 +85,117 @@ run happens to assemble some — and the Live view shows them working.
 - A run started after `squads` was switched off in a long-lived Studio
   process could inherit the previous run's org chart.
 
+### Efficiency — fewer, shorter, better-aimed model calls
+
+A review of where a run's wall clock and tokens actually went, then the fixes.
+The execute loop owns most of both, so most of this is there.
+
+- **One reviewer per review.** The review used to be a race: a local
+  "acceptance" probe, the reviewer and a strict second reviewer all dispatched
+  at once, the strict verdict then discarded unless the first came back empty.
+  Now the fast path decides what it can, hard gates that already failed reject
+  without a model, one reviewer is asked, and the strict opinion is sought
+  only when the first answer is unreadable. The acceptance probe could also
+  approve a task with an unverified must-criterion and no reviewer; it is gone.
+- **The corrector sees why it was rejected.** Its prompt head-clipped the
+  worker's output, so a long reasoning trace hid the failing command and its
+  output appended at the end. It now keeps the harness evidence whole and
+  carries the focus files, acceptance and language, the same split the
+  reviewer already had.
+- **The worker prompt puts the stable pack first** and the task header just
+  before the instructions, so every task in a wave shares the packed prefix
+  and the server's KV cache is reused instead of re-prefilled per task.
+- **Old tool results are elided on live requests.** A worker's transcript
+  re-sent every `ws_read` verbatim on every later turn; a deterministic wrapper
+  now keeps the last five tool results and elides the rest, per request,
+  without touching the system message or the tool-call pairs.
+  `react_compact` is finally what the docs said it was.
+- **One run-wide concurrency limit.** The measured knee (`max_parallel`) was
+  enforced only in the execute wave; prepare phases, speculation, reviews and
+  critique all ran past it. One gate at the executor boundary now covers every
+  model call, and paired phases run sequentially at `max_parallel: 1`.
+- **Measured role budgets reach the loop.** Workers, reviewers and correctors
+  ran on the flat `task_timeout`; they now get the per-role p95 budget the
+  phase roles already had, and their latencies feed the same store.
+- **The acceptance command runs once per tree state.** A finish used to re-run
+  it up to four times on an unchanged tree (pre-test, team gates, integration,
+  QA round one); a per-run memo keyed by the tree fingerprint answers the
+  repeats, and team and integration commands check the runway first.
+- **Phases with nothing to do are skipped**, and say so: the memory
+  distillation with no lessons, no changes and no failures; the per-wave
+  distill and coordinator after an uneventful wave; the splitter for a
+  one-step plan.
+- A finished team is proved as soon as it finishes, between waves, so its
+  correction ticket rides the next wave instead of waiting for the whole
+  board. A seam task that straddles two teams is handed the whole contract.
+- Every dispatch path honors the run's remaining runway; an explicitly set
+  temperature of 0 is sent rather than treated as unset; the steer a resumed
+  worker is given reaches the model even when its checkpoint ends on pending
+  tool calls.
+
+### Robustness
+
+- **A reviewer that times out or errors no longer blocks the task** and every
+  task behind it. The gathered evidence is judged, the reviewer is re-asked
+  once when the budget allows, and only then is the task parked for a person.
+- **A worker that times out is resumed, not parked**, from its checkpoint,
+  until the attempt ceiling; transient provider errors get one bounded retry
+  honoring `Retry-After`, on the streaming path too (which never retried
+  while someone was watching).
+- **The path jail held for symlinks but not dangling ones.** A link whose
+  target did not exist passed the check and the write followed it outside the
+  workspace. Refused now.
+- Studio's Run and Stop no longer race: a stop leaves the run marked as
+  stopping until it has really exited, a new run cannot inherit or clobber the
+  old one's state, and a second click on Run cannot delete a pending ask.
+- `slmcode apply` and the Review page apply proposals by kind: a proposed
+  delete deletes (it used to truncate the file to nothing), a move moves, and
+  shell approvals are no longer written to the tree as `shell.sh`.
+- Parallel workers asking for shell approval each get their own ask and answer
+  file; one used to overwrite the other and the loser deleted the winner's
+  answer.
+- `ws_edit`/`ws_write` are kinder to small models: `old_string`/`search`,
+  `new_string`/`replace` and `contents`/`text` are accepted; a `ws_read` line
+  gutter in `old_str` is stripped and noted instead of refused; writing a new
+  file with no content is refused with the accepted keys named;
+  `replace_all` works on drifted matches. `ws_patch` inserts a pure-addition
+  hunk after the line it names (it landed one line early), the bare
+  `SEARCH/=======/REPLACE` form works, and trailing prose is ignored.
+- Team gates, the squad plan and the single team are reset per run; a
+  long-lived Studio process could carry a green gate into the next run's
+  verdict.
+- The event log is written through one buffered appender per run and token
+  deltas are not persisted; `/api/runs/latest` no longer encodes under the
+  lock that the run's own emits need; the syntax guard runs one checker per
+  edit, not two.
+
+### Studio
+
+- **The board is live.** `task_update` and `review_pending` stream events
+  replace the four pollers; the Board, the floor, the Teams page and the Review
+  badge change the moment a task moves.
+- **Everything links.** Task, agent, team, run and file identifiers are one
+  chip everywhere and lead to the same place: a task or a person opens on the
+  Live floor with its dossier (`?task=`, `?agent=`), and the selection survives
+  navigation and reload. Board filters live in the URL too.
+- **A stuck task tells its story**: attempts, the reviewer's verdict and the
+  criteria, with Retry (`POST /api/tasks/{id}/retry`), Send back to Ready,
+  Reassign and Steer. Blocked and Failed counters are filters.
+- **A run's end is a beginning**: Resume, open the blocked tasks, review the
+  pending changes, or run again; a toast, a title flash and (when granted) a
+  notification if you are on another page; a short celebration on green.
+- Saves and loads that used to fail silently (Settings during a run, docs,
+  agents, skills, pipeline, files) now say what happened and offer a retry.
+  Dialogs trap focus and close on Esc; tabs roam with the arrow keys; the 3D
+  floor can be walked by keyboard and reads out its people and tickets.
+- The floor remembers its camera, follow and pulses across pages, renders on
+  demand when nothing moves, allocates nothing per frame, falls back to the
+  map if WebGL is lost, and fits a phone. The log is windowed and the run's
+  derived state is folded per event, so a two-hour run stays smooth.
+- Keyboard: `g t` for Teams, `⌘/Ctrl+Enter` to run and `⌘/Ctrl+.` to stop
+  from the prompt, `⌘/Ctrl+K` command palette. The Runs list shows duration,
+  tokens, cost, tasks and teams; Review shows who proposed each change.
+
 ## v0.24.0 — 2026-09-01
 
 Ten defects found by running v0.23.0 against a local 30B, thirteen times. Nearly
diff --git a/web/src/hooks/useBoardStore.ts b/web/src/hooks/useBoardStore.ts
index cb94b08..9d29ea8 100644
--- a/web/src/hooks/useBoardStore.ts
+++ b/web/src/hooks/useBoardStore.ts
@@ -61,7 +61,9 @@ export function isBoardEvent(ev: Pick<RunEvent, 'kind'>): boolean {
 }
 
 /** Log events after which a board that is not yet pushed to should re-read. */
-const STRUCTURAL_KINDS = new Set(['task_start', 'task_done', 'task_fail', 'wave', 'run_start', 'run_end', 'coord', 'split']);
+// agent_end is in the set because the engine emits no task_start/task_done of
+// its own: a task changes column when the role working on it finishes.
+const STRUCTURAL_KINDS = new Set(['task_start', 'task_done', 'task_fail', 'agent_end', 'wave', 'run_start', 'run_end', 'coord', 'split']);
 
 export function isStructuralEvent(ev: Pick<RunEvent, 'kind' | 'phase'>): boolean {
   return STRUCTURAL_KINDS.has(ev.kind) || ev.phase === 'done' || ev.phase === 'error';

From 55a07c8df59ee8de2afab47142c96742f4aa1193 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 09:38:08 +0000
Subject: [PATCH 23/23] review applier refuses paths outside the project;
 annotate sanitized-id stats for the newer gosec

CI's golangci-lint 2.13.1 carries gosec's taint analysis (G703). The
review applier now checks every pending path against the project root
before touching it, which is a real guarantee rather than a comment; the
two os.Stat calls in the team-activity cache are annotated, since
session.TurnDir already reduces the id to [A-Za-z0-9_-].

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011RfCkcsbJZgHoQLzwkqFUL
---
 cmd/slmcode/cmd_review.go   | 20 +++++++++++++++++++-
 pkg/server/team_activity.go |  4 ++--
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/cmd/slmcode/cmd_review.go b/cmd/slmcode/cmd_review.go
index 4b14a37..189c06d 100644
--- a/cmd/slmcode/cmd_review.go
+++ b/cmd/slmcode/cmd_review.go
@@ -135,6 +135,12 @@ func loadPending(slmDir string) ([]pendingPatch, error) {
 // behind, and wrote a literal shell.sh for a shell approval.
 func writePatch(root string, p pendingPatch) error {
 	abs := p.abs(root)
+	if !underRoot(root, abs) {
+		return fmt.Errorf("refusing %s: the path resolves outside the project", p.Path)
+	}
+	if p.Kind == pendingKindMove && p.From != "" && !underRoot(root, filepath.Join(root, p.From)) {
+		return fmt.Errorf("refusing %s: the source resolves outside the project", p.From)
+	}
 	switch p.Kind {
 	case pendingKindShell:
 		return errors.New("shell approvals are not file changes; reject the entry instead")
@@ -173,7 +179,7 @@ func writePatch(root string, p pendingPatch) error {
 		if m, ok := fileMode(src); ok {
 			mode = m
 		}
-		if err := os.WriteFile(abs, data, mode); err != nil {
+		if err := os.WriteFile(abs, data, mode); err != nil { //nolint:gosec // abs is checked against root above; a project source file
 			return err
 		}
 		return os.Remove(src)
@@ -868,3 +874,15 @@ func matchesAnyPrefix(rel string, prefixes []string) bool {
 	}
 	return false
 }
+
+// underRoot reports whether abs lies inside root (lexically: no ".." escape).
+// The pending entries are written by the tool layer, which already jails
+// paths; this is the applier's own guarantee that a hand-edited entry cannot
+// point it elsewhere.
+func underRoot(root, abs string) bool {
+	rel, err := filepath.Rel(root, abs)
+	if err != nil {
+		return false
+	}
+	return rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator))
+}
diff --git a/pkg/server/team_activity.go b/pkg/server/team_activity.go
index 99cd497..134478c 100644
--- a/pkg/server/team_activity.go
+++ b/pkg/server/team_activity.go
@@ -477,7 +477,7 @@ const maxActivityCache = 32
 // cachedActivity returns the derived timeline for queryID when the event log
 // still has the size and mtime it was derived from.
 func (s *Server) cachedActivity(queryID string) (*activityCacheEntry, bool) {
-	info, err := os.Stat(session.EventsPath(s.slmDir(), queryID))
+	info, err := os.Stat(session.EventsPath(s.slmDir(), queryID)) //nolint:gosec // session.TurnDir sanitizes the id; the path cannot leave the queries dir
 	if err != nil {
 		return nil, false
 	}
@@ -491,7 +491,7 @@ func (s *Server) cachedActivity(queryID string) (*activityCacheEntry, bool) {
 }
 
 func (s *Server) storeActivity(queryID string, entries []ActivityEntry) {
-	info, err := os.Stat(session.EventsPath(s.slmDir(), queryID))
+	info, err := os.Stat(session.EventsPath(s.slmDir(), queryID)) //nolint:gosec // session.TurnDir sanitizes the id; the path cannot leave the queries dir
 	if err != nil {
 		return
 	}