santos/dev: crew family, Pareto crewing and the Model Pool, custom connections

[santoshkumarradha]

Integration branch santos/dev into dev. Draft: it is the running index of what the branch carries, and it stays a draft until the worker harness is complete, the independent end-to-end pass on Spark is green, and Santosh has tested it himself.

State

• Level with dev. Everything through docs: what the audit check seat can execute, and where that boundary is set #1192 already reached dev as santos/dev lands on dev: crew family, Pareto crewing, the Model Pool, custom connections (#1108) #1194 on 2026-09-18, and dev has been merged back each time it moved (ci: Model Pool mirror workflow (signed index onto the model-pool branch) #1116 mirror workflow, chat: the unconnected custom row on /connect keeps its vendored name #1195 /connect custom row, docs/changes: v0.3.0 rolled up into CHANGELOG.md #1196 v0.3.0 changelog).
• Every landing below is a squash gated by a full make check on Spark, fresh clone, on the exact commit. The check has cross-compiled every release target since build: cross-compile the shipped platforms in make check #1254.
• The worker harness is off unless CODEAF_TASK_BELT=bash is set, so the default road does not move.

The worker harness

One loop under /task and codeaf do, with a plan store per run, a plan seat, a work seat, a check seat, and a review round after each piece of work (#1109).

• One way to put work out. A typed /task, codeaf do, and a task the chat starts by itself all take the same road; a landing wakes no model turn, and a reply comes only when an answer is owed (The chat's role: a landing speaks only when an answer is owed #1205).
• A copy of its own for every run. A hand-off no longer works in the person's folder; the work comes home as one commit when the run ends (session: a run works in a copy of its own, and its work comes home when it ends #1232).
• The review contract. A worker declares its own checks; a holds verdict rests on a recorded, zero-exit run of every declared command, and the basis is kept with the task (run: declared checks are the review contract, judged by observable properties, with the verdict basis recorded #1220, replaces review conclusions require an executed Checks: command #1206). A review is seated on the crew's checking seat, resolved from --check-model, CODEAF_CHECK_MODEL, a pinned seat, then the profile (a belt check runs on the crew checking seat, not the thinking seat #1207). A declared check is read the way a shell reads its quotes (session: a check is one command as the shell reads its quotes, its refusal says what passes, and side-by-side calls are one attempt #1215).
• No lost or doubled work. A run's result is read from the store when the root's worker returns late (run: a run's result is read from the store when the root's worker returns after the run ended #1210); a dispatch pass no longer reclaims the leaf it just released (fix(resident): a dispatch pass does not reclaim the leaf it just released #1225); a codeaf do run whose root finished itself still gets its review (fix(run): a self-finished codeaf do run seats its review before it ends #1233, run: regression test for seating the check after a self-finished worker returns #1243); a parked task is finished only by a worker woken for it (A parked task is finished only by a worker woken for it #1271).
• Conversations keep their tasks. A reopened conversation reads back tasks born from a run's plan, never overwrites a checkpoint it could not read, never reuses an id (session: a reopened conversation keeps its tasks: a plan-born node reads back, and a refused checkpoint is never overwritten #1213); every run a conversation made stays readable (session: every run a conversation has made stays readable #1234); the tasks tool reads a run's tasks from the run's own record (session: the conversation's tasks tool reads a run's tasks from the run's own record #1222).
• No done before the review. A run counts a piece of work as finished when its worker's return has been taken in, not when its row says done, so every finished piece gets its review round before the run answers, whatever order the workers came home in. A review that cannot be seated ends the run as incomplete instead of being skipped (run: no run answers done while a finished piece of work has had no review #1275, with the store's half in A parked task is finished only by a worker woken for it #1271).
• A quoted check is read as the one command it is. One quote scanner sits under both check readers; an escaped character inside double quotes is text, and any shape the scanner cannot settle is refused (approval: a backslash pair inside double quotes is text, read by one scanner under both readers #1273).
• A long declared check says why it was refused. A check over 1000 bytes is refused with its cause and its own measured length; the limit governs admission only, so a check already recorded stays on the checker's door (session: a check refused for its length says so, and says how long it is #1283).
• Proposals and endings. A refused proposal is told every problem at once (session: a proposal learns every problem in one refusal, and a task stands where its brief plainly says #1214); a landing's report counts as evidence the ask is finished (session: a landing's report is evidence to the completion check, and a check refused for its cd says the form that passes #1212).

Stopping and limits

• A person's stop reaches a run. The stop ends the run's task and everything open under it in one write, cuts the run's context, keeps the work on the run's own branch, puts nothing into the person's folder, and buys no model turn; ctrl+c is read above a page that is loading or open (fix: a person's stop reaches a run #1250). A stopped task reads stopped wherever its state word is drawn (fix: a task you stopped reads stopped wherever its state word is drawn #1258).

• A time limit ends a run. A run is handed what is left of the conversation's time; work in flight is ended and its endings are absorbed (run: a time limit a person sets ends a run by the same road as the cost limit #1262).

• A dollar limit holds while a worker is still working. A worker tells its run what it has banked as each call is paid for, without ever waiting on the run; a dollar is counted once, and what a run counts as spent never goes down (A run's dollar limit holds while a worker is still working #1268).

• A run's dollars reach the conversation's total. The run hands its owner its running total whenever it rises, with or without a dollar limit, and the conversation closes on the run's final figure before any ending splits off, so every ending counts once (session, run: a run's dollars reach the conversation's own total #1280).

• An ending a person caused is not a fault. A run ended by a limit says which one, a time limit you set stopped it or a dollar limit you set stopped it, with no fault colouring; the first limit reached names the ending, the tasks that ending cut read the same way, and a task that failed by itself keeps its own reason (run, session: an ending a person caused is not a fault, and it names the limit that caused it #1279).

• A run is handed what is left. A run's dollar ceiling is the smaller of the conversation's dollar limits, including one typed on the command line, less what the conversation has already spent, so a second run gets the remainder after the first (session: a run is handed what is left of every dollar limit #1281).

• A cancelled command is ended by the call that ran it. A cancel that arrived as a command started could leave it running under no parent; the cancel arm now sends the kill itself unless the call was adopted or already reaped (exec/bare: the arm that ends a cancelled call's wait ends its command #1282).

• A worker that has stopped making progress is told once, then ended. The same command coming back with the same answer, with nothing moving under the worker's own task, brings one note from the belt saying what the worker can do; three more identical steps end the task with a reason a person can read. A task blocked on another task is parked, not ended (run: a worker that has stopped making progress ends, by an observable property #1266).

The task page and the rail

• The plan as a tree on the rail, a line saying what is happening now, a bounded read-only question about a run, a work tab that lists runs (The work tree: the plan drawn as a tree, and the work tab #1204); a task's page opens from its row, and a run has a row of its own with its parts under it (tui3: a task's page opens with the task, and a run's rows on the rail open their pages #1231).
• A conversation whose engine runs in another process, which is the default, reads and steers its run over the wire (remote, tui3: a hosted conversation reads and steers its run #1230).
• Step rows show the work: the run's bookkeeping is left out, commands are cut by byte span and never retyped, rows keep their recorded numbers (fix: a run's step rows show the work, cut from the commands as they ran #1257); numbers continue across a wake (run: a task's step numbers continue across a wake #1261); a call that never ran has no row, and a refused action is one dim line (tui3, run: a call that did not run is not a step; a refused action is one line #1260); the dim line under a row is only ever the row's own (tui3: the dim line under a step row is only ever the row's own #1265).
• Speed: a press on a run's row opens its page in under 0.2 seconds (fix: a gesture never waits behind a run's summary, and an open page reads on a beat #1251); a slow connection to the engine no longer freezes the screen (fix: no frame reads a run's rows, whatever made the read due #1255); a stalled stream paints at the spinner's pace (tui3: a wait whose stream has stopped arriving paints at the spinner cadence, and the harness that measured it #1235).
• Typing on a task's page goes to that task, never to the model as a message (tui3: what is typed after a press on a run's row goes to its page, never the conversation #1244); a letter typed into a note never raises the stop card, and a finished task offers no verb the store would refuse (tui3: a task's page says only what is true of it #1240).

The engine host and sign-in

• A headless message or an opened task row that lands while a host is coming up reaches it, at no cost when no host is starting (enginehost: a readiness gate proves a real accept, and two raw-Dial callers retry the stale-socket window #1272).
• A reconnect reuses its registered identity and reports a finished sign-in only after its listener is released (fix(connect): a reconnect reuses its registered identity instead of introducing itself again #1236).

The profile

• Keys in config.json that nothing reads are said once, in the conversation, and never for a key the product itself writes or retired (config: report unread profile config keys once at load #1223, chat: name unread config.json keys once before defaults apply #1239, config: unread notice skips keys the product itself retired #1245).
• Two profile writes compose, in one process (config: concurrent profile writes in one process compose #1242) and across two processes, on every platform the repo builds for (config: make a profile write safe across processes with a cross-platform lock #1248).

Nothing keeps writing after the process closes

• The place sweep's note is sealed at close (fix(chatv3): seal the place sweep note at close instead of joining the walk #1227); the standing ticker belongs to the process and a pass in flight is cancelled at once (fix(chatv3): stop and join the standing ticker on process close #1256); the usage writer is owned and closed at quit (session: join the usage writer at Close so no usage row is written after a process quits #1259); the pool judge sweep is stopped and joined, and a landing the close interrupts is judged on the next start (chatv3: stop and join the pool judge sweep at close, and inventory process goroutines with a class law #1267); the model catalog's own warm is cancelled and joined, and a fetch that lands after the cancel no longer writes (catalog: the lazy warm is owned, cancelled and joined at close, so it cannot write under a later home #1274); each process owns its place sweep, and close cancels the walk and joins it, so nothing is renamed or removed after close returns (chat: closing a process stops its place sweep before it can change a later home #1276); a usage flush says whether it drained or reached its ceiling, and one ledger path's writer can be stopped and joined (session: a usage flush says whether it drained, and one writer can be stopped and joined #1285).
• A law lists every goroutine a conversation process starts and requires each to name its stop and its join (chatv3: stop and join the pool judge sweep at close, and inventory process goroutines with a class law #1267, cmd/codeaf: the model-warm waiters are joined; name the open catalog warm one package down #1269).

Tests and tooling

• The heavy-suite lock is a kernel file lock that works across process namespaces (scripts: hold the heavy-suite lock so it works across pid namespaces and dies with its holder #1264) and follows the suite, with a refusal that never calls a holder gone (scripts: the heavy-suite lock follows the suite, not the wrapper #1270); the lock is held by a small holder beside the suite and never inherited by what the suite starts, so a process a test leaves behind cannot keep the machine locked (scripts: the heavy-suite lock is held beside the suite, not by what the suite leaves behind #1284). The full check cross-compiles every release target (build: cross-compile the shipped platforms in make check #1254).
• Tests made independent of machine load or of the machine's state: internal/plan: make the spine level test counters concurrency-safe #1203, test: join the synthetic usage writer before teardown in the waiting-line test #1211, test(lane): gate router movement on request counts so the verdict does not depend on host load #1221, test(session): wait helpers check the condition before the clock #1226, test(session): the pin-the-wire test joins the usage writer before cleanup #1228, test(provider): order the late-first-token rescue by a signal, not elapsed slack #1229, test(connect): the second-door tests use dynamic ports, not the fixed callback ports #1237, test(exec): identify a leaf-end survivor by process identity, not a bare PID #1238, session: make the claim-unspent revision test deterministic by forcing the ordering #1246, test(connect): stop the second-door Slack test racing on a freed port #1247, test(exec): read the job shell tmux floor by a marker line, not a full env dump #1249, test(exec): read a position-independent marker in the skill-path shell test #1252, test(session): drive the claim-unspent revision through Submit so it cannot lose its ending #1263, session: a woken turn's fixture holds its script like every other turn's #1278. A repeatable drive of a run on the real binary in hosted mode lives under scripts/ (scripts: a repeatable hosted drive of a run on the real binary #1241).

Also on the branch

• The lazy lexer registry (tui2/prose: load a curated lexer set on first use, not all 279 at init #1193). Answers lead with the action, number their steps and end on one next thing (session: shape the answer section toward the i-have-adhd skill #1209).

Landings

santos/dev	carries	full check on Spark
164548f	#1204, #1205	green
7cda67c	#1211	green
b94df33	#1212, #1213, #1214	green
39ffbc5	#1215, #1221	green
fe9eb62	#1222, #1223, #1225, #1227, #1226, #1228, #1229	green
4e176a5	#1230, #1231, #1233	green, first run
608c459	#1220, #1232, #1235, #1240, #1237	green
1cbcb4b	#1239, #1238	green, first run
12840ee	#1234, #1242, #1243, #1241	green, first run
443c661	#1244, #1245, #1236, #1247, #1246	green, first run
8ed67b7	#1248, #1249	green on run 2; run 1 failed one temp directory cleanup in a package the stack does not touch
c3ab6e0	#1251	green on run 3; two earlier runs each failed one test in a package it does not touch, logs kept
992779e	#1250	green, first run
eae7055	#1252, #1254	green, first run
7cefdf1	#1256, #1255	green, first run
24e4385	#1257	green, first run
1c21396	#1258, #1259	green; the lower commit's first run failed one host test in a package the stack does not touch, log kept
09b50f8	#1263, #1260	green, first run
137bb8c	#1264	green, first run
761cdab	#1267	green
b71454e	#1269, #1262	green, first run
d3762f4	#1265, #1261	green, first run
da3368d	#1268	green, first run
ec9953e	#1271, #1272, #1270	green
70b3a3c	#1266, #1274	green, first run
8832349	#1275, #1273, #1278	green, first run
cd2bf32	#1276	green, first run, gated alone
5240a37	#1280	green, first run, gated alone
b293a72	#1279, #1284	green, first run
3a154ce	#1282, #1281	green, first run
cb3f0f3	#1283, #1285	green, first run
1357788	#1288	green, first run, gated alone
f796212	#1289	green, first run, gated alone
3d95e70	#1291	green, first run, gated alone
8b68293	#1290	green on rerun, first run red on one unexplained test, both logs kept
c975972	#1293	green, first run, gated alone
3d3b754	#1296	green, first run after a formatting stop, gated alone
1a692da	#1298	green, first run, gated alone
952e003	#1304	the interrupted page no longer offers two answers nobody can press; green, gated alone
83de531	#1126	the footprint benchmark, its method and one day's numbers; merged by Santosh
1e0537e	#1317	resume cost joins the footprint benchmark; merged by Santosh
9420891	#1305, #1308	a paused run can be carried on, and three proof steps that could not report failure; gated as one batch, 113 ok with one unrelated red in internal/lane cleared by mechanism, not by rerun
e098ca1	#1314, #1315, #1316	the needs-you marks: a permission stop says the line, sign-in and harness asks say what they wait for, the front tab stops marking an answered landing; gated as one batch, EXIT 0, 115 ok, taken under contention
32b4127		one fuzzy matcher for every picker, with subtle match highlighting; merged by Santosh
9b38c2d	#1322	a landing already accepted stops saying your call; green, gated alone, EXIT 0, 116 ok

Still to come before this leaves draft

• The open design question in design: closing the window never ends work, and interrupted work continues with one key (settled) #1224: whether closing the window ends work.

---

Already on dev through #1194, kept for the record

What follows reached dev on 2026-09-18 as #1194 and is unchanged since.

What a person gets

Feature	What it does for you	How you use it	Where it is
Crew model family: open or all	The three crew words (frugal, balanced, max) answer from open-weight models only, or from every model including frontier ones.	models.crew.source = open|all (default all), or the open/all switch in /crew.	On santos/dev (#1073)
Pareto crewing: crews computed from the live catalog	Crew presets are computed from OpenRouter's prices and quality indexes on the cost-quality front, refreshed daily, instead of a hand-picked table. Any seat can be auto.	/crew catalog, or models.crew.pick = catalog.	On santos/dev (#1093, squash 2fb296b)
Pick mode: table, catalog, learn	Choose the fixed table, today's catalog, or a crew learned from judged runs, per role (worker, checker, planner).	/crew table|catalog|learn, models.crew.pick.	On santos/dev (#1093, squash 2fb296b)
Learn: judged runs move the picks	After each chat /task run an independent judge scores every seat (billed to a judge seat). Scores go to your own sheet and feed the picker next time, blended with the pool by observation count, so your own runs improve your own picks first. Starts from a seed built from 145 real runs, so learning works on day one. A seat you type by hand is judged too.	Automatic under pick = learn. codeaf pool show lists what the picker knows.	On santos/dev (#1093, squash 2fb296b)
Model Pool: collective, text-free evidence	Every install can share its score rows through a relay and pull a signed index back, so everyone picks better because the others ran. Rows are computed numbers and ids under a per-install nonce: never code, prompts, paths or identity.	model_pool on|read|off (default on, notice shown once). codeaf pool show|status|verify [--json].	On santos/dev (#1093, squash 2fb296b)
Public relay and GitHub mirror	The relay Worker ships in-repo under relay/ with a runbook; it is live at https://codeaf.agentfield.ai/pool. The signed index is mirrored to the model-pool branch of this repo so anyone can watch it update. A team can run its own private relay with its own key (CODEAF_MODEL_POOL_RELAY_URL, _MIRROR_URL, _PUBLIC_KEY).	Nothing to do; works out of the box.	On santos/dev (#1093, squash 2fb296b)
The paper	docs/design/model-pool/pareto-crewing.pdf ("Pareto Crewing"): the objective, estimator and picker, with figures from real runs.	Read it.	On santos/dev (#1093, squash 2fb296b)
Named, multiple, switchable custom connections	Connect several OpenAI-compatible endpoints (local models, proxies), each with its own name, key and model list; switch between them, including mid-session; rename one and every stored pick follows. /model groups models under each connection's name. Switching onto a keyless default service is refused with a reason.	/connect → Custom OpenAI-compatible API; /settings → Providers → add / edit / active connection.	On santos/dev (#1092, squash 825ef2c; Santosh e2e-tested locally against a local OpenAI-compatible proxy)
Worker harness: one loop under /task and do	The internal hands (patch, doc, web, image) become one worker loop with a plan store, shared by the chat /task door and codeaf do.	No new surface; fewer steps and lower cost per task (smoke: 4/4 parts in 28 steps vs 3/4 in 42).	#1109, draft, wave 1 landing

Bug fixes on the branch (question answer-box keys, landing answer fate, retry avoiding the failed upstream, recovery evidence, taxonomy lane read, and, with #1092, mid-session /connect now reaching the live conversation on the engine road, a pre-existing hole) are not listed above; each has its own change note under docs/changes/unreleased/.

Known limits, stated on purpose

• The learned picker is greedy on its estimate; there is no exploration yet, so a model that is never picked is never scored. The next algorithm pass (Thompson sampling, hierarchical cap, drift) is a follow-up PR.
• The judge runs on the chat /task door only; codeaf do, ask and remote sessions do not feed the pool yet.
• The pool index is read at start-up (24 h cache); codeaf pool verify pulls a fresh copy, read at the next start.
• A pool cell becomes readable at 3 rows, from one install or three (the paper says three installs); follow-up.

Relay status

Live at https://codeaf.agentfield.ai/pool (healthz 200, index signed, codeaf pool verify good). The model-pool branch exists and carries the current signed index (refreshed hourly by a stand-in job until #1116 puts the workflow on dev). The pool is primed with the same measured runs the embedded seed encodes, so the published index carries real cells from day one.

End-to-end pass on Spark (independent session, done)

All 12 steps pass on #1093's head (cf4ea35; final fd29d79 differs by a runbook sentence). Report: spark:~/src/e2e-learn-2026-09-17.md with KNOWN-LIMITS.md and evidence/INDEX.md beside it; 18 capped runs, about $26.

Step	Result
1 fresh install, learn, judged tasks, own sheet + outbox flushed	pass (first pass failed: judge picked a rate-limited free model; fixed)
2 rows reach the relay, fold, publish	pass (index 1789681435, 19 cells)
3 fresh install D reads the pool and picks differently from the seed	pass (pool: worker gpt-5.6-sol; seed only: glm-5.3-flash)
4 privacy: rows are numbers/ids/nonce; read and off send nothing	pass
5 resilience: bogus relay → mirror → seed; task still runs; verify good	pass
6 manual /model override under learn is still judged	pass
7 crew words × open/all, table vs catalog, real tasks on frugal-open and max-all	pass
8 auto/catalog/learn seats resolve on headless doors	pass (first pass fell to the table; fixed)
9 /crew chooser and /settings pool row with notice	pass (note: pick mode is a settings row, not a chooser switch)
10 `pool show	status
11 codeaf models, --refresh, daily cache	pass
12 headless do/exec under a learn crew	pass (fixed with 8; judge on headless doors stays a follow-up)

Follow-ups from the e2e, now on santos/dev: a task's thread stops its parts before closing and a machinery cut records its reason (#1118); a decision card under --yolo takes its default (#1117); the auto crew row shows the rung it actually resolved to (#1119); a bare auto row under picked from = catalog reads the catalog's figures alone (#1120). codeaf do seats from the settings the run will use, so a fresh profile with the key in the environment reads the catalog, not the table (#1122); the relay accepts the exec and run doors (#1121); a launch's pool errands stop when the process closes instead of writing into a closed profile (#1124); a launch compiles internal/verify's patterns on first use and the engine host runs on a capped scheduler (#1125); the client's min_installs floor counts installs, as the relay's does (#1127); the relay folds a retried batch once by its nonce (#1128), carries an acceptable metric beside the judge score (#1129), publishes only cells that meet the floor (#1131) and writes once per cell per batch (#1136); a refused row leaves the outbox and the file is compacted (#1130, #1133); the pool errand tracker's critical sections unlock from a defer (#1134); a run a process death left unjudged, and any headless door's landing, is judged on the next chat start (#1132). the finished-tree check reads a project cloned into a subdirectory (#1135); the exec, run and do doors leave a pending record for the sweep (#1137, #1138, #1139); the wall admits a first round it cannot cost and refuses an overrun it cannot hold, so a long codeaf do lands instead of re-planning to the wall (#1144), with the delivery gate over a grown job root pinned by a test (#1147); pool show, pool verify and pool status print both metrics, the pending judge records and the last sweep (#1141, #1142); a test's crash fixture stays in a profile the test owns, and the package's test floor clears any profile the environment named, and the opening-hint test reads a profile it made and pins the greeting contract both ways (#1145, #1150, #1153), and tui3's package law makes every surface-building helper name a profile of its own (#1173); the manual's status row says whose ledger it is (#1143); the seed index is regenerated from the live relay by one in-repo command, so a fresh install's fallback is a verified copy of the pool (#1148); pool show --cells lists the held index's cells with their installs and dims (#1149); a landing that leaves gitignored build products behind stays complete and the reconciled row names them (#1152); codeaf version on an unstamped binary names the condition, no .git directory for the toolchain to read, instead of blaming a Makefile target (#1151). pool status says when the relay dropped a row and why, instead of the row vanishing silently (#1154); a job teardown records the group leader's identity at launch and never signals a process group the kernel has since handed to someone else (#1155); a codeaf do continuation after an overrun continues the plan it has from the recorded turns instead of re-planning from scratch (#1156); the process sets a soft memory limit of half the machine's memory, nothing below a 512 MiB floor, an explicit GOMEMLIMIT untouched, carried into engine --daemon (#1158), and the bound is the smallest finite one of physical memory and the cgroup v2/v1 limits walked from the process's own level to the root (#1162); pool status says when this run cached the index, so the seed-to-cache flip is visible in the run that caused it (#1161). The pool's copy of a seat's id is the bare vendor/id, so a fresh install on the default model (whose seat carries codeaf's alias marker) no longer has its first rows refused by the relay, and the judge picker's same-vendor exclusion works on it (#1163); no cmd/codeaf test can push rows to the default relay, the package floor pins a dead address (#1164); the relay bounds each judge's fitted severity to ±10, clamps every adjusted score to the rubric, publishes mean and sd on one scale and falls back to the median when spread is zero, which is what had published a cell at 103.5 (#1165); the relay can purge stored rows from a fixture vendor and refuse vendors not in ALLOWED_VENDORS (#1167), with ALLOWED_VENDORS set to the catalog's vendors plus codeaf (#1177, Worker version 47102a26; 624 fixture keys purged from the live store); the built-in seed is regenerated from the relay's first clean publish after the purge, 18 cells, no fixture rows (#1180); a job's shell no longer inherits the host's TMUX handle and gets a profile-owned TMUX_TMPDIR, so a command the model runs cannot kill the terminal hosting codeaf (#1166); an unattended run (--yolo, nobody to answer) is refused a git push, merge or rebase that would move a branch it did not create, including the branch the checkout began on, while its own task branch stays pushable and attended sessions are untouched (#1168, the road it took is in #1160's note); pool status says the install's identity, the judged total across all doors, and "none yet" when no landing has been judged (#1169); an exec run's worker spend is minted into the usage ledger at the door, one row per run, so the status row, the cap and the pool row count it (#1170); the task door honours a stored models.crew word (every arm had resolved to balanced) and a pinned tier row survives pick=learn instead of being recomputed (#1171); a landing card raised on the check road under --yolo takes its default and records that the dial answered and that the check ran out of time, instead of parking a headless run forever, while conflict, shift and ground landings still park and now say so in the record (#1174); the model catalog warm is seated on the profile's start-up errand tracker so a process close joins it, instead of a warm outliving the process and writing its cache into whatever state root was current (#1179); the auditor's calls tag themselves auditor with the node they check, and its usage rows carry the auditor role and the task, so a ledger tells an audit call from a session turn (#1181); a headless do --json whose node ends failed or unverified names the kept branch and the verdict in its envelope, so nobody digs through tasks.json for kept work (#1182); the settle turn a landing note wakes under task.settle auto runs under the checker's own bound, a call ceiling and a share of the run's cap, one call for a clean tree with no declared check, and records "not settled within its bound" instead of running to the wall, which had been a one-to-two-dollar tax on most headless runs (#1183); the chat-side tasks text and a resumed session's record line name a failed or unverified node's kept task/<slug> branch and its verdict word, the same two words the headless envelope carries (#1184); the identical-effects test is deterministic, its forty saves carrying distinct call signatures so the turn's repetition guard cannot end the turn and the leash is the only thing the assertion is about, which closes a margin-of-one race that had read as a load flake since #284 (#1185); a non-verified codeaf exec or codeaf run names its kept branch and verdict in its envelope through the one result-envelope seam the three headless doors share, so do, exec and run answer alike (#1186); a task worker parked on a command it started (a bash call the 30-second background clock promoted to a job) waited the node's whole allowance when the job never ended, which is what held a DOE run silent for 53 minutes under a live cap; the park now has a bound of its own, a third of the allowance, posts "the park was not settled within its bound" and hands the turn back while the command keeps running, with the diagnosis at docs/notes/yolo-task-worker-parked-on-promoted-bash.md (#1187); the model pool runbook's plan line says metered, not capped (#1188, #1189, docs only); the status row says working while the door's task subtree turns, read from the same signal the tab strip draws from so the two cannot disagree, with the manual's screen and task-page sections moved to match (#1191); a job subtree is cut when it passes a CPU or process bound, 60% of the machine sustained for 30 s or 128 processes when nothing else bounds it, the process backstop alone under a cgroup or affinity quota, and the run learns it as "the job subtree was not settled within its bound", which is what a model that spawns infinite loops under a dollar cap had escaped (#1190); a note records what a task's audit step can execute and where that boundary is set, the declared checks plus read-only git and coreutils, which is why a brief that declares no check leaves a cautious auditor nothing it may run (#1192, docs only); the prose lexer registry loads a curated set of forty languages on first use instead of parsing all 279 of chroma's lexers at init, plain text for the rest, which takes about 3 ms off cold start and 2 MB off the binary, with chroma's files and licence carried beside the copies (#1193). Still open, PRs in progress: the footprint benchmark method and table under docs/benchmarks (#1126); Pareto crewing v2 with a model-free grader (#1123, Santosh reviews). The "task-branch merge fails 1 in 3" observation was the test driver killing runs mid-check, not a product defect.

Related, not on this branch

• telemetry: audit fixes — hosted chat counters, no unversioned sends, silent smoke tests #1111 telemetry audit fixes → dev directly (must ride staging and the next main release; the website relay fix is already live). Also merged into santos/dev so the e2e covers it.
• ci: Model Pool mirror workflow (signed index onto the model-pool branch) #1116 Model Pool mirror workflow → dev directly (workflow file + verifier only), so the model-pool branch is refreshed by Actions; until then a stand-in job on Spark refreshes it hourly. Also on santos/dev.

Before this leaves draft

• connect, settings: named, multiple, switchable custom connections (#1089) #1092 (825ef2c) and Pareto crewing: the crew picker, the Model Pool with its judge and relay, and the paper #1093 (2fb296b) merged into santos/dev; dev, telemetry: audit fixes — hosted chat counters, no unversioned sends, silent smoke tests #1111's and ci: Model Pool mirror workflow (signed index onto the model-pool branch) #1116's branches merged on top (6092393).
• The e2e report above green (done).
• Santosh's e2e pass on santos/dev.
• Full make check on the final santos/dev head, on Spark — done at d39a4e308: EXIT 0, 116 packages ok, 0 failures, 0 cached, fresh clone. Pre-checks on the same head: package laws rc 0, 80 change entries all well formed, gofmt -l lists nothing, go build ./... and GOOS=windows go build ./... both rc 0.

Slice line

This branch is held at d39a4e308 as a reviewable slice. Two landings since the slice was first cut: the drafted-with footer links to the CodeAF repository rather than to agentfield (#1329), and a held landing offers its answer and stops demanding one (#1331). santos/dev2 carries the same head and is where work goes once Abir picks this up. Work that lands after this goes on the next shared branch so the slice stops growing under review.

[AbirAbbas]

Merged into dev through #1194 at Abir's request, as one squash of this branch's head 6db5125 plus two fixes for the tests that kept touched packages red here on every run today:

• TestWirePoolIndexStartsTheRefreshAndThePush counted one errand under GitHub Actions because poolcfg.Resolve reads the runner's CI=true as read-only; the test now empties CI for its duration.
• TestTurnBoundaryReportsRunningAndOneTerminalTransition overran its 4 s bound because, since processgroup: verify a job group's identity before signalling it #1155, Group.Alive probed a group whose leader is still a zombie with kill(-pgid, 0), so every finished background job on Linux waited out the 2 s termination grace before being reported done. Alive reads the group's members from /proc now and ignores zombies (internal/processgroup/members_linux.go), with contract tests.

Nothing on santos/dev itself was changed. Its 152 commits are on dev as one squash, so the next step on this branch is a reset onto dev; #1109, #1123 and #1126 still base on it. #1111 and #1116 are contained in what landed.

One observation from the smoke, not a blocker: codeaf do … --json wrote hi.txt and passed its gate, but the checklist row read a file named hi.txt exists — not reached · the run changed hi.txt.

[santoshkumarradha]

@AbirAbbas heads up, not a review request yet: this branch is now a closed slice at bc116d35c, and it is clean.

Evidence on that exact head, fresh clone, on Spark:

• Full make check: EXIT 0, 116 packages ok, 0 failures.
• Package laws: rc 0.
• Change entries: 80, all well formed.
• gofmt -l: nothing listed.
• go build ./... and GOOS=windows go build ./...: both rc 0.

Landed since the last pass, newest first:

• the trailer entry names its pull request (bc116d35c)
• a heavy suite takes both locks, so a stale tree can see it (scripts: a heavy suite takes both locks so a stale tree can see it #1324)
• the commit co-author links to the CodeAF account (The commit co-author links to the CodeAF account, and assisted-by names the model #1325)
• a landing already accepted stops saying "your call" (session: a landing already accepted stops saying your call #1322)
• one fuzzy matcher for every picker, caret parks where you type (One fuzzy matcher for every picker, subtle match highlighting, and the caret parks where you type #1321)
• the front tab and the tab beside it agree about one conversation (tui3: the front tab and the tab beside it agree about one conversation #1316)
• a sign-in and a harness ask say what they are waiting for (session: a sign-in and a harness ask say what they are waiting for #1315)
• a standing row stopped for permission says the line, not "asks:" (tui3: a standing row stopped for permission says the line, not asks: it #1314)
• three proof steps that could not report failure, in one tested form
• a run nothing is driving can be carried on, in the copy its work is already in
• the interrupted page no longer offers two answers nobody can give (manual: the interrupted page no longer offers two answers nobody can press #1304)

The PR stays in draft on purpose. Work from here goes on the next shared branch so this slice stops growing while it is being read. Say if you would rather have it split before you start.

[AbirAbbas]

Reviewed and verified 2026-09-21: gates green locally and in CI, the default road checked live on both roads against a dev baseline, the one regression the slice introduced fixed on the branch with a contract test. Evidence and the full write-up are in the review ledger.