Merge commit '3bb9c550ace076a2224382793cc5fcddd158dfb4' into torch/provider-runtime

docs/TEST_INTEGRITY.md

@@ -1,5 +1,102 @@
 # Test Integrity Notes
 
+## 2026-10-03 — Current unread inbox startup mitigation
+
+```yaml
+test_integrity_note:
+  change_type: new_tests
+  scenarios:
+    - id: SCN-fleet-startup-inbox
+      given: "Manager and specialist each have 102 unread handoffs, exceeding the legacy default history page"
+      when: "Fresh and resumed provider launch messages specify the current unread-inbox request and it is invoked through the registered identity-bound tool"
+      then: "Both launches name the correct identity and retrieve newer messages absent from default history, without acknowledging them or weakening authority; overflow coverage is explicitly uncertain"
+  observable_outcomes:
+    - "Actual provider launch arguments, registered MCP response, newest message identity and unchanged unread count"
+  determinism_controls:
+    - "Hermetic project/worktrees, increasing fixed clock and real local tool; no provider launches"
+  anti_cheat_rationale:
+    prevents:
+      - "Prompt-only proof that never exercises the actual inbox tool"
+      - "Claiming truncated history is complete or reading acknowledges a handoff"
+  relaxation:
+    did_relax_any_assertion: false
+    if_true_explain_spec_basis: ""
+```
+
+## 2026-10-03 — Audited one-day additional allowance
+
+```yaml
+test_integrity_note:
+  change_type: new_tests
+  scenarios:
+    - id: SCN-runtime-continuation-day-override
+      given: "An exhausted owner-approved daily allowance and retained charged attempts"
+      when: "The owner approves a bounded current-UTC-day total and later pauses or the day rolls over"
+      then: "Extra work starts without resetting attempts; non-owner/invalid overrides refuse; pause persists; the following day uses the original daily cap"
+  observable_outcomes:
+    - "Actual launched count, charged attempts, remaining allowance, owner audit and next-day limit"
+  determinism_controls:
+    - "Hermetic project, fixed clock and controlled launch callback; no live provider or host scheduling"
+  anti_cheat_rationale:
+    prevents:
+      - "Erasing usage or permanently removing daily caps on an owner override"
+      - "Allowing a specialist to authorize extra budget or bypass pause"
+  relaxation:
+    did_relax_any_assertion: false
+    if_true_explain_spec_basis: ""
+```
+
+## 2026-10-03 — Owner-configured concurrency
+
+```yaml
+test_integrity_note:
+  change_type: new_tests
+  scenarios:
+    - id: SCN-runtime-continuation-concurrency
+      given: "Seven eligible identities and an approved 48-turn daily cap"
+      when: "The owner raises concurrency to seven, starts a bounded controller, then pauses"
+      then: "Seven pending starts occur before completion; a tighter limit restricts candidates; invalid settings refuse; pause preserves cap, concurrency and charged attempts"
+  observable_outcomes:
+    - "Pending launch count, policy capacity, ledger attempts and refusal codes"
+  determinism_controls:
+    - "Hermetic Git repository, fixed clock, controlled promises and no provider calls"
+  anti_cheat_rationale:
+    prevents:
+      - "Treating sequential starts as concurrency or resetting usage on configuration"
+      - "Tick limits exceeding owner-approved policy"
+  relaxation:
+    did_relax_any_assertion: false
+    if_true_explain_spec_basis: ""
+```
+
+## 2026-10-03 — Visible automatic-work stops
+
+```yaml
+test_integrity_note:
+  change_type: new_tests
+  scenarios:
+    - id: SCN-runtime-continuation-health
+      given: "An enabled pilot exhausts its daily attempt allowance"
+      when: "Observation reads the ledger, next UTC day, pause or malformed state"
+      then: "The exact stop and remaining allowance are visible without resetting or modifying state, and no timer/token qualification is fabricated"
+    - id: SCN-console-continuation-stop
+      given: "A daily cap stop and a specialist no-progress hold"
+      when: "Attention items are projected"
+      then: "The budget decision belongs to the owner, coordination belongs to the manager, and no fake approval action or automatic budget increase is offered"
+  observable_outcomes:
+    - "Live snapshot health, byte-identical ledger and owner/manager attention routing"
+  determinism_controls:
+    - "Hermetic repository, fixed UTC clock, injected executor and plain snapshot fixtures"
+  anti_cheat_rationale:
+    prevents:
+      - "Silent budget exhaustion disguised as healthy idle"
+      - "Resetting a ledger to make work appear available"
+      - "Treating declared policy as a verified running timer or measured usage"
+  relaxation:
+    did_relax_any_assertion: false
+    if_true_explain_spec_basis: ""
+```
+
 ## 2026-10-03 — Rolling continuation and bounded no-progress escalation
 
 ```yaml

docs/TODO.md

@@ -2,6 +2,17 @@
 
 ## Current owner priority: reliability first (2026-10-03 UTC)
 
+End-to-end repair qualification is still open. Runtime reported exact converged
+candidate `d2d9845` with four fresh native check PASS receipts; QA independent
+acceptance is not yet recorded. Owner source fixes cover guarded presence,
+rolling/fair dispatch, no-progress escalation and visible daily-cap stops. The
+first automatic allowance of 12 turns was exhausted; any increase needs an
+explicit owner choice, not a manual-start bypass. Next dispatch should prioritize
+QA's exact verdict/support decisions, Release's declared-inventory consumer
+decision, safe Kernel/Work composition and actual Console implementation.
+Require evidence of specialist work, independent review/checks, serialized
+integration and next-work continuation before calling the autonomous loop ready.
+
 Live all-fleet resume exposed a new urgent proposal:
 `TASK-d95e72d0-816d-4fc2-acaf-b73642fd4881` — refill continuation capacity
 when individual turns exit instead of waiting for the longest batch member.

docs/spec_changes/2026-10-03-continuation-concurrency.md

@@ -0,0 +1,16 @@
+# Owner-configured continuation concurrency
+
+The owner can configure `torch continuation enable --concurrency 7 --yes`.
+The default remains three; valid settings are integers from one through seven.
+An explicit tick `--limit` may tighten but never exceed the approved policy.
+Each refill reads current policy; lowering capacity does not cancel active turns.
+Omitted configuration fields preserve the approved daily cap and concurrency.
+Configuration never resets the attempt ledger or bypasses physical identity guards.
+
+An already-running older controller cannot hot-load this change. Replace its
+timer, not its active service, and allow its native turns and controller lock to
+finish before the new controller takes over. No concurrent controllers may
+dispatch through the same project lock.
+
+Scenario SCN-runtime-continuation-concurrency proves seven simultaneous pending
+starts, tighter tick limits, invalid-policy refusal and preserved usage on pause.

docs/spec_changes/2026-10-03-daily-continuation-override.md

@@ -0,0 +1,14 @@
+# One-day continuation allowance override
+
+An explicit owner decision can grant a higher bounded total for the current UTC
+day using `torch continuation enable --today-max-turns 96 --yes`.
+The override total includes turns already charged; it never erases usage.
+The ordinary daily cap (1–48) remains unchanged. The override ceiling is 96.
+At UTC midnight the override ceases to apply without a scheduled reset write.
+Owner-only audited configuration, seven-slot concurrency, identity guards,
+pause, unknown-outcome protection and all verification boundaries remain intact.
+Omitting the override argument preserves its existing same-day decision.
+This is a turn allowance, not a measured token, subscription-credit or cost limit.
+
+SCN-runtime-continuation-day-override checks actual extra dispatch, preserved
+charges, authorization/range refusals, pause and automatic next-day expiry.

docs/spec_changes/2026-10-03-rolling-continuation.md

@@ -14,4 +14,10 @@ Status exposes occupied guard identities and no-progress holds. Installed releas
 
 Eligible identities are ordered least-recently-dispatched within the current UTC day, with the Manager first only on ties. A repeatedly revised specialist task must not consume every freed slot while an eligible peer has never started.
 
+## Visible operating stops
+
+The read-only project observation includes the automatic-turn budget, remaining attempts, exact pause/cap stop, retained capacity guards and current no-progress holds. It never resets the ledger, changes authority or treats declared policy as verified timer installation. No-progress holds are displayed only while the same active task IDs/revisions remain; resolved or revised tasks do not retain stale alerts.
+
+An exhausted automatic allowance appears as an owner policy decision in Overview and as an explicit Fleet status line. Manager-owned no-progress waits remain with the Manager, rather than being falsely routed to the owner. There is no fabricated approval button or silent allowance increase. Manual owner turns are not included in this ledger; token/cost governance remains unknown.
+
 Deterministic acceptance scenarios and anti-cheat notes are in docs/TEST_INTEGRITY.md. Independent live qualification remains necessary; do not close broader event-driven or persistent-operations umbrellas based on this source fix alone.

docs/spec_changes/2026-10-03-startup-unread-mitigation.md

@@ -0,0 +1,15 @@
+# Explicit unread inbox on startup and resume
+
+Legacy `torch_read_messages` defaults to the oldest 100 historical messages.
+Observed native inboxes exceeded 100 unread messages during fleet supervision.
+Launch/resume now explicitly requests the bound identity's unread inbox with a
+limit of 1000 and explains chronological order, potential overflow and deliberate
+acknowledgements. This uses the existing tool without changing its API contract.
+
+This mitigation does not implement pagination, newest-first history, coherent
+cross-query observation, or complete overflow detection. Those remain in the
+existing unread-first inbox task. A result of 1000 is explicitly uncertain,
+not a complete-inbox claim. No permissions follow from reading a message.
+
+SCN-fleet-startup-inbox exercises the actual fresh/resume launch arguments and
+registered identity-bound inbox tool against messages beyond the default page.

reports/audit/fleet-arbiter-checkpoint-2026-10-03.md

@@ -0,0 +1,70 @@
+# Fleet arbiter checkpoint — 2026-10-03, 05:58 UTC
+
+## Outcome
+
+The owner-approved blocker-clearing directive produced concrete component
+commits and exact QA contributor consent. No new verified fleet landing has
+been established in this checkpoint. Automatic usage reached the approved
+48-turn cap; no additional provider turns were started or budget increased.
+
+## Decisions and evidence
+
+- Work committed its read-only convergence component at
+  `7e0734ae90314b6182046b1d813efd40b453743f`.
+- Release committed read-only CLI routing at
+  `dd77b7015e5d34851725237d6f424babccf7f7d4`.
+- QA message `c3f7ac15-5d40-4f85-a27b-6d5837b141a9` approved the exact
+  compact-card source/test contribution. Actual browser capability remains
+  unavailable in those native sessions; this is not visual acceptance.
+- Arbiter directive `8865db38-a077-4935-a154-7b566d65aa44` authorized
+  source-only isolated composition without managed-branch convergence or
+  integration. Corresponding directives were persisted for all implementers.
+
+## Concrete compatibility failure
+
+A detached checkout at canonical
+`7e3d333c5467c15d72be950f1fac9c3cd5439aee` was created at
+`/tmp/torch-readonly-composition-EirOji/candidate`. Applying exactly Kernel
+`18ccb0890d93c8a01e2c2d96db775b1ec14fe973` with `cherry-pick -x` produced
+content conflicts in `src/control-plane/service.mjs`. Composition stopped;
+Work and Release components were not applied, and no composed test PASS is
+claimed. The conflicted detached checkout is retained as diagnostic evidence.
+Canonical and managed agent checkouts were not altered by this operation.
+
+The conflicts expose future schema-v3/reservation prerequisites absent from
+canonical, which initializes schema version 2. The reader requires
+`runtime_launch_reservations`, and its branch-local refusal scenario treats
+version 2 as incompatible. Pulling the entire future branch would therefore
+broaden this narrow current-branch unblock into an architecture upgrade.
+
+The existing Kernel reader tests passed 2/2 on the Kernel branch under hermetic
+fixtures (`/tmp/torch-reader-component-review-20261003.log`). This is source
+review evidence only: it does not establish canonical compatibility, composed
+CLI behavior, operational receipts, independent QA, or installed qualification.
+
+## Next bounded action
+
+Kernel should supply a current-canonical-compatible reader slice without
+future reservation APIs, schema migration or live writer initialization. QA
+must approve strict version-relative refusal scenarios, not weaken assertions.
+Immutable SQLite observation also needs a demonstrated consistent snapshot or
+fail-closed behavior under concurrent writers, not only a sidecar precheck.
+Correction request `34a90b11-a64d-4ed7-a7ae-cf2ba8ef46f2` and corresponding
+manager/peer requests preserve the exact evidence and composition boundary.
+
+## Controller handoff
+
+The old three-slot controller drained without termination. At 05:57:52 UTC,
+the replacement seven-slot worker ran, obtained the released controller lock,
+and returned `daily-turn-cap` with `launched: []`. This verifies a cap-preserving
+handoff, not seven concurrent native workers or reboot persistence. The
+replacement timer remains configured; the ledger was not reset.
+
+## Remaining gates
+
+Current-base compatible composition, strict composed CLI scenarios, exact
+source gates, independent QA, guarded serialized integration and next-work
+continuation remain open. Native execution cannot continue today without an
+explicit new budget decision; the existing policy resets its daily allowance
+at UTC midnight. No deployment, installed-runtime upgrade, live DDL, authority
+expansion or completion assertion follows from this checkpoint.

site/attention-projection.js

@@ -16,6 +16,18 @@ function attentionGroups(snapshot) {
   const agentName = (id) => agents.get(id)?.title ?? id ?? 'Owner not recorded';
   const add = (group, item) => groups[group].push(item);
   const approvals = (snapshot.approvalRequests?.items ?? []).filter((approval) => approval.status === 'pending');
+  const continuation = snapshot.continuation;
+  if (continuation?.available && continuation.stopReason === 'daily-turn-cap') add('owner', {
+    tone: 'decision', title: 'Automatic fleet work stopped at its daily limit', owner: 'Project owner',
+    detail: 'No additional automatic agent turns can start today unless you explicitly change the limit. Existing turns may finish; idle does not mean all work is done.',
+    evidence: `${continuation.attempts}/${continuation.maxTurnsPerDay} automatic attempts · UTC day ${continuation.day} · not measured token/cost usage`,
+    href: '#fleet', action: 'Review continuation policy', decisionApprovalId: null,
+  });
+  for (const hold of continuation?.held ?? []) add('fleet', {
+    tone: 'review', title: `${agentName(hold.areaId)} needs a concrete coordination decision`, owner: agentName('session-manager'),
+    detail: 'Two completed turns left the assigned task state unchanged. Unchanged-work retries are held; inspect evidence and resolve the actual blocker rather than restarting blindly.',
+    evidence: hold.areaId, href: '#communications', action: 'Open coordination messages', requestOwner: 'session-manager',
+  });
 
   const advisory = [];
   const recheckCodes = new Set(['BACKLOG_OBSERVED_COMMIT_STALE', 'BACKLOG_OBSERVED_COMMIT_MISSING']);

site/console.html

@@ -183,6 +183,7 @@
 
       <section id="fleet" class="console-section fleet-section" data-console-view="fleet" aria-labelledby="fleet-title">
         <div class="section-heading"><div><p class="section-kicker">Persistent identities</p><h2 id="fleet-title">Fleet and ownership</h2></div><span id="agent-health-note">Session state from latest observation</span></div>
+        <p id="continuation-status" class="surface-note" role="status">Reading automatic continuation policy…</p>
         <div class="fleet-columns">
           <article class="work-surface"><div class="panel-heading"><h3>Sessions</h3><span>One context per identity</span></div><div id="agent-list" class="agent-list"></div>
             <details class="runtime-profile-tools">

site/console.js

@@ -1039,6 +1039,12 @@ function renderAttention(groups) {
 }
 
 function render(snapshot) {
+  const continuation = snapshot.continuation;
+  setText('#continuation-status', continuation?.available
+    ? `Automatic turns: ${continuation.attempts}/${continuation.maxTurnsPerDay} used today (UTC); ${continuation.remainingTurns} left. ${continuation.dailyOverride?.day === continuation.day ? `Owner-approved extra allowance expires at UTC midnight; normal daily cap ${continuation.configuredMaxTurnsPerDay}. ` : ''}Concurrency policy: up to ${continuation.maxConcurrency ?? 3}. ${continuation.stopReason === 'daily-turn-cap'
+      ? 'No further automatic starts: the owner-controlled daily cap is reached. Running turns may finish.'
+      : continuation.stopReason === 'paused' ? 'Owner policy is paused; no new automatic starts.' : 'Policy permits new eligible turns; this does not verify timer installation.'} ${continuation.held?.length ?? 0} unchanged-work hold(s) need Manager coordination. This is not measured token or cost usage.`
+    : 'Automatic continuation policy is unavailable; do not assume the fleet can start more work.');
   const project = snapshot.project ?? snapshot.repository;
   const agents = snapshot.agents ?? [];
   const tasks = snapshot.backlog ?? [];

src/cli.mjs

@@ -98,7 +98,7 @@ Usage:
   torch setup [--parent <path>] [--dry-run] [--yes] [--json]
   torch up [--fresh] [--only <id,id>] [--dry-run] [--yes] [--json]
   torch recover-runtime --area <id> --unit <service> --invocation <id> [--expected-session <id> --expected-updated-at <time> --yes] [--json]
-  torch continuation <status|enable|pause|tick> [--max-turns-per-day <1-48>] [--limit <1-3>] [--yes] [--json]
+  torch continuation <status|enable|pause|tick> [--max-turns-per-day <1-48>] [--today-max-turns <1-96>] [--concurrency <1-7>] [--limit <1-7>] [--yes] [--json]
   torch down [--dry-run] [--yes] [--json]
   torch capture [--json]
   torch detach [--dry-run] [--yes] [--json]
@@ -590,10 +590,12 @@ export async function runCli(argv = process.argv.slice(2), {
         }
         if (operation === 'enable' || operation === 'pause') {
           print(configureContinuation(control, { actorId: 'owner', enabled: operation === 'enable',
-            maxTurnsPerDay: Number(optionValue(argv, '--max-turns-per-day') ?? 12) }), { json }); return 0;
+            maxTurnsPerDay: optionValue(argv, '--max-turns-per-day') === undefined ? undefined : Number(optionValue(argv, '--max-turns-per-day')),
+            todayMaxTurns: optionValue(argv, '--today-max-turns') === undefined ? undefined : Number(optionValue(argv, '--today-max-turns')),
+            maxConcurrency: optionValue(argv, '--concurrency') === undefined ? undefined : Number(optionValue(argv, '--concurrency')) }), { json }); return 0;
         }
         if (operation !== 'tick') throw new TorchError('Unknown continuation operation.', { code: 'UNKNOWN_COMMAND' });
-        print(await runContinuation(control, backlog, { actorId: 'owner', limit: Number(optionValue(argv, '--limit') ?? 3),
+        print(await runContinuation(control, backlog, { actorId: 'owner', limit: optionValue(argv, '--limit') === undefined ? undefined : Number(optionValue(argv, '--limit')),
           launch: areaId => new Promise(resolveTurn => {
             const child = spawnProcess(process.execPath, [fileURLToPath(new URL('../bin/torch.mjs', import.meta.url)),
               'up', '--only', areaId, '--yes', '--json'], { cwd: control.repositoryRoot, env,

src/observability/snapshot.mjs

@@ -17,6 +17,7 @@ import { observeTaskActivity } from '../backlog/activity.mjs';
 import { ScheduleLauncherService } from '../schedules/launcher.mjs';
 import { hierarchyOrder } from '../runtime/hierarchy-order.mjs';
 import { observeRuntimeTurn } from '../runtime/turn-guard.mjs';
+import { observeContinuation } from '../runtime/continuation.mjs';
 
 function json(path) {
   return JSON.parse(readFileSync(path, 'utf8'));
@@ -404,6 +405,7 @@ export function observeProject({ repositoryRoot, env = process.env, now = () =>
       metrics: ['cachedInput', 'uncachedInput', 'cacheCreation', 'cacheRead', 'compactions', 'resumedPromptBytes', 'costPerVerifiedItem'],
     },
   };
+  result.continuation = observeContinuation({ stateRoot, tasks: result.backlog, now });
   result.backlogHealth = backlogHealth(repository.root, result.backlog, result.agents, now);
   result.backlogActivity = observeBacklogActivity({ repositoryRoot: repository.root,
     tasks: result.backlog, config, manifest, now: now() });

src/runtime/continuation.mjs

@@ -9,15 +9,21 @@ function occupiedAreas(control) {
   return existsSync(path) ? readdirSync(path, { withFileTypes: true }).filter(d => d.isDirectory()).map(d => d.name) : [];
 }
 function taskKey(tasks) { return JSON.stringify(tasks.map(t => [t.id, t.revision]).sort((a, b) => a[0].localeCompare(b[0]))); }
+function dailyCap(state, day) {
+  return state.dailyOverride?.day === day ? Math.max(state.maxTurnsPerDay, state.dailyOverride.maxTurns) : state.maxTurnsPerDay;
+}
 function read(control) {
   const policyPath = join(control.stateRoot, 'continuation-policy.json');
-  const state = { enabled: false, maxTurnsPerDay: 12, areas: [], day: null, attempts: 0, handled: {}, progress: {},
+  const state = { enabled: false, maxTurnsPerDay: 12, maxConcurrency: 3, areas: [], day: null, attempts: 0, handled: {}, progress: {},
     ...(existsSync(statePath(control)) ? JSON.parse(readFileSync(statePath(control), 'utf8')) : {}),
     ...(existsSync(policyPath) ? JSON.parse(readFileSync(policyPath, 'utf8')) : {}) };
   if (typeof state.enabled !== 'boolean' || !Number.isInteger(state.maxTurnsPerDay)
     || state.maxTurnsPerDay < 1 || state.maxTurnsPerDay > 48 || !Array.isArray(state.areas)
+    || !Number.isInteger(state.maxConcurrency) || state.maxConcurrency < 1 || state.maxConcurrency > 7
     || !Number.isInteger(state.attempts) || state.attempts < 0 || !state.handled || typeof state.handled !== 'object'
-    || !state.progress || typeof state.progress !== 'object') {
+    || !state.progress || typeof state.progress !== 'object'
+    || (state.dailyOverride != null && (!/^\d{4}-\d{2}-\d{2}$/.test(state.dailyOverride.day)
+      || !Number.isInteger(state.dailyOverride.maxTurns) || state.dailyOverride.maxTurns < 1 || state.dailyOverride.maxTurns > 96))) {
     throw new TorchError('Continuation policy or attempt ledger is invalid; launch refused.', { code: 'CONTINUATION_POLICY_INVALID' });
   }
   return state;
@@ -25,32 +31,63 @@ function read(control) {
 function save(control, state, policy = false) {
   const path = policy ? join(control.stateRoot, 'continuation-policy.json') : statePath(control);
   const temporary = `${path}.${randomUUID()}.tmp`;
-  const value = policy ? { enabled: state.enabled, maxTurnsPerDay: state.maxTurnsPerDay, areas: state.areas }
+  const value = policy ? { enabled: state.enabled, maxTurnsPerDay: state.maxTurnsPerDay, maxConcurrency: state.maxConcurrency, areas: state.areas, dailyOverride: state.dailyOverride ?? null }
     : { day: state.day, attempts: state.attempts, handled: state.handled, progress: state.progress };
   writeFileSync(temporary, JSON.stringify(value), { flag: 'wx', mode: 0o600 });
   renameSync(temporary, path);
 }
 
-export function configureContinuation(control, { actorId, enabled, maxTurnsPerDay = 12 } = {}) {
+export function configureContinuation(control, { actorId, enabled, maxTurnsPerDay, maxConcurrency, todayMaxTurns } = {}) {
   control.assertOwnerActor(actorId);
-  if (typeof enabled !== 'boolean' || !Number.isInteger(maxTurnsPerDay) || maxTurnsPerDay < 1 || maxTurnsPerDay > 48) {
-    throw new TorchError('Continuation requires an explicit enable/pause and 1–48 daily turns.', { code: 'CONTINUATION_POLICY_INVALID' });
+  const previous = read(control);
+  maxTurnsPerDay ??= previous.maxTurnsPerDay;
+  maxConcurrency ??= previous.maxConcurrency;
+  if (typeof enabled !== 'boolean' || !Number.isInteger(maxTurnsPerDay) || maxTurnsPerDay < 1 || maxTurnsPerDay > 48
+    || !Number.isInteger(maxConcurrency) || maxConcurrency < 1 || maxConcurrency > 7
+    || (todayMaxTurns !== undefined && (!Number.isInteger(todayMaxTurns) || todayMaxTurns < maxTurnsPerDay || todayMaxTurns > 96))) {
+    throw new TorchError('Continuation requires explicit enable/pause, 1–48 daily turns, 1–7 concurrent turns and an optional same-day total between the daily cap and 96.', { code: 'CONTINUATION_POLICY_INVALID' });
   }
-  const state = { ...read(control), enabled, maxTurnsPerDay, areas: control.listAgents().map(a => a.areaId) };
+  const state = { ...previous, enabled, maxTurnsPerDay, maxConcurrency, areas: control.listAgents().map(a => a.areaId) };
+  if (todayMaxTurns !== undefined) state.dailyOverride = { day: control.clock().toISOString().slice(0, 10), maxTurns: todayMaxTurns };
   save(control, state, true);
   control.auditOwnerAction({ actorId, operation: 'runtime.continuation.configure', entityType: 'project', entityId: control.projectId,
-    details: { enabled, maxTurnsPerDay, areas: state.areas } });
-  return { enabled, maxTurnsPerDay, areas: state.areas, sessionsStarted: false };
+    details: { enabled, maxTurnsPerDay, maxConcurrency, dailyOverride: state.dailyOverride ?? null, areas: state.areas } });
+  return { enabled, maxTurnsPerDay, maxConcurrency, dailyOverride: state.dailyOverride ?? null, areas: state.areas, sessionsStarted: false };
 }
 
-export function planContinuation(control, backlog, { at = new Date(), limit = 3 } = {}) {
+export function observeContinuation({ stateRoot, tasks = [], now = () => new Date() } = {}) {
+  try {
+    const state = read({ stateRoot });
+    const day = now().toISOString().slice(0, 10);
+    const attempts = state.day === day ? state.attempts : 0;
+    const cap = dailyCap(state, day);
+    const remainingTurns = Math.max(0, cap - attempts);
+    const held = Object.entries(state.progress).filter(([area, progress]) => {
+      const active = tasks.filter(t => t.owner === area && ['assigned', 'in_progress'].includes(t.state));
+      return active.length && progress?.status === 0 && progress.noProgress >= 2 && progress.taskKey === taskKey(active);
+    }).map(([areaId]) => ({ areaId, reason: 'no-progress-needs-coordination' }));
+    return { available: existsSync(join(stateRoot, 'continuation-policy.json')), enabled: state.enabled,
+      day, dayTimezone: 'UTC', attempts, maxTurnsPerDay: cap, configuredMaxTurnsPerDay: state.maxTurnsPerDay,
+      dailyOverride: state.dailyOverride ?? null, maxConcurrency: state.maxConcurrency, remainingTurns,
+      stopReason: !state.enabled ? 'paused' : remainingTurns === 0 ? 'daily-turn-cap' : null,
+      capacityHeldBy: occupiedAreas({ stateRoot }), held,
+      budgetKind: 'automatic-turn-cap', manualTurnsIncluded: false, tokenOrCostGovernance: 'unknown',
+      timerInstallationVerified: false, mutationPerformed: false };
+  } catch {
+    return { available: false, stopReason: 'policy-or-ledger-unreadable', mutationPerformed: false };
+  }
+}
+
+export function planContinuation(control, backlog, { at = new Date(), limit } = {}) {
   const state = read(control);
   const day = at.toISOString().slice(0, 10);
   const attempts = state.day === day ? state.attempts : 0;
-  if (!Number.isInteger(limit) || limit < 1 || limit > 3) throw new TorchError('Continuation limit must be 1–3.', { code: 'CONTINUATION_POLICY_INVALID' });
+  const cap = dailyCap(state, day);
+  if (limit !== undefined && (!Number.isInteger(limit) || limit < 1 || limit > 7)) throw new TorchError('Continuation limit must be 1–7.', { code: 'CONTINUATION_POLICY_INVALID' });
+  const capacity = Math.min(limit ?? state.maxConcurrency, state.maxConcurrency);
   const metadata = JSON.parse(readFileSync(join(control.stateRoot, 'project.json'), 'utf8'));
-  if (!state.enabled || metadata.detachedAt || attempts >= state.maxTurnsPerDay) {
-    return { enabled: state.enabled, reason: metadata.detachedAt ? 'detached' : !state.enabled ? 'paused' : 'daily-turn-cap', candidates: [], attempts };
+  if (!state.enabled || metadata.detachedAt || attempts >= cap) {
+    return { enabled: state.enabled, maxConcurrency: capacity, reason: metadata.detachedAt ? 'detached' : !state.enabled ? 'paused' : 'daily-turn-cap', candidates: [], attempts };
   }
   const tasks = backlog.list();
   const candidates = [];
@@ -80,12 +117,12 @@ export function planContinuation(control, backlog, { at = new Date(), limit = 3
   const ordinal = area => state.handled[area]?.dispatchedDay === day ? state.handled[area].dispatchedOrdinal ?? 0 : 0;
   candidates.sort((a, b) => ordinal(a.areaId) - ordinal(b.areaId)
     || Number(b.areaId === 'session-manager') - Number(a.areaId === 'session-manager'));
-  return { enabled: true, day, attempts, remainingTurns: state.maxTurnsPerDay - attempts,
+  return { enabled: true, maxConcurrency: capacity, day, attempts, remainingTurns: cap - attempts,
     occupiedAreas: occupiedAreas(control), held,
-    candidates: candidates.slice(0, Math.min(limit, state.maxTurnsPerDay - attempts)), mutationPerformed: false };
+    candidates: candidates.slice(0, Math.min(capacity, cap - attempts)), mutationPerformed: false };
 }
 
-export async function runContinuation(control, backlog, { actorId, launch, at, clock = () => at ?? new Date(), limit = 3 } = {}) {
+export async function runContinuation(control, backlog, { actorId, launch, at, clock = () => at ?? new Date(), limit } = {}) {
   control.assertOwnerActor(actorId);
   if (typeof launch !== 'function') throw new TorchError('Continuation needs an authorized launcher.', { code: 'RUNTIME_EXECUTION_NOT_AUTHORIZED' });
   const lock = join(control.stateRoot, 'continuation.lock');
@@ -100,9 +137,9 @@ export async function runContinuation(control, backlog, { actorId, launch, at, c
     while (true) {
       // Refill immediately after EACH completion. Pending promises and physical
       // guards both count, including manual executors outside this controller.
-      let current = planContinuation(control, backlog, { at: clock(), limit: 3 });
+      let current = planContinuation(control, backlog, { at: clock(), limit });
       let occupied = new Set([...occupiedAreas(control), ...pending.keys()]);
-      while (occupied.size < limit && current.enabled && !current.reason) {
+      while (occupied.size < current.maxConcurrency && current.enabled && !current.reason) {
         const candidate = current.candidates.find(c => !occupied.has(c.areaId));
         if (!candidate) break;
         const state = read(control);
@@ -115,10 +152,10 @@ export async function runContinuation(control, backlog, { actorId, launch, at, c
         try { result = launch(candidate.areaId); } catch { result = null; }
         pending.set(candidate.areaId, Promise.resolve(result).catch(() => null)
           .then(status => ({ areaId: candidate.areaId, status, candidate })));
-        current = planContinuation(control, backlog, { at: clock(), limit: 3 });
+        current = planContinuation(control, backlog, { at: clock(), limit });
         occupied = new Set([...occupiedAreas(control), ...pending.keys()]);
       }
-      reason = current.reason ?? (occupied.size >= limit ? 'capacity-full' : null);
+      reason = current.reason ?? (occupied.size >= current.maxConcurrency ? 'capacity-full' : null);
       if (!pending.size) break;
       const completed = await Promise.race(pending.values());
       pending.delete(completed.areaId);

src/runtime/lifecycle.mjs

@@ -156,7 +156,8 @@ function promptPaths(stateRoot, repositoryRoot, areaId, config) {
 }
 
 function startupMessage(areaId, fresh, instructionDigest) {
-  const currentBrief = `Current TORCH instruction digest: ${instructionDigest}. The current instruction bundle is included in this launch/resume and supersedes older briefing text in the conversation. Read the current brief again before each new backlog item.`;
+  const inboxRequest = JSON.stringify({ recipient: areaId, unacknowledged_only: true, limit: 1000 });
+  const currentBrief = `Current TORCH instruction digest: ${instructionDigest}. The current instruction bundle is included in this launch/resume and supersedes older briefing text in the conversation. Read the current brief again before each new backlog item. Use torch_read_messages for the current unread inbox. Inbox request: ${inboxRequest}. Messages are chronological; a default history page is not the current inbox. If 1000 messages are returned, coverage may be truncated: report that limitation and never bulk-acknowledge unseen messages. Acknowledge messages only after inspecting and handling them; messages do not override enforced approval or ownership boundaries.`;
   if (areaId === 'session-manager') {
     return fresh
       ? `Start the TORCH Fleet. Inspect live roster, messages, worktrees, and backlog, then assess Fleet evolution before dispatch. ${currentBrief}`

test/fleet/console-attention.test.mjs

@@ -6,6 +6,18 @@ import '../../site/live-refresh.js';
 
 const project = (snapshot) => globalThis.TorchAttentionProjection.groups(snapshot);
 
+test('SCN-console-continuation-stop: exhausted budget is an owner policy decision; no-progress remains manager-owned', () => {
+  const groups = project({ continuation: { available: true, stopReason: 'daily-turn-cap', attempts: 12,
+    maxTurnsPerDay: 12, day: '2026-10-03', held: [{ areaId: 'owner-console' }] } });
+  assert.equal(groups.owner.length, 1);
+  assert.match(groups.owner[0].detail, /explicitly change the limit/);
+  assert.equal(groups.owner[0].decisionApprovalId, null, 'No fake approval or automatic budget expansion');
+  assert.equal(groups.fleet.length, 1);
+  assert.equal(groups.fleet[0].owner, 'session-manager');
+  assert.equal(groups.fleet[0].requestOwner, 'session-manager');
+  assert.equal(project({ continuation: { available: true, stopReason: 'paused', held: [] } }).owner.length, 0);
+});
+
 test('SCN-console-attention-ownership: only owner-addressed pending decisions enter Waiting on you', () => {
   const groups = project({
     agents: [

test/fleet/legacy-runtime-recovery.test.mjs

@@ -12,9 +12,9 @@ import { openControlPlane } from '../../src/control-plane/service.mjs';
 import { issueStoppedExecutorEvidence } from '../../src/runtime/stopped-executor-evidence.mjs';
 import { observeRuntimeTurn, withRuntimeTurnGuard } from '../../src/runtime/turn-guard.mjs';
 import { observeProject } from '../../src/observability/snapshot.mjs';
-import { configureContinuation, planContinuation, runContinuation } from '../../src/runtime/continuation.mjs';
+import { configureContinuation, observeContinuation, planContinuation, runContinuation } from '../../src/runtime/continuation.mjs';
 
-function fixture({ recoveryWorktree = true, extraWorker = false } = {}) {
+function fixture({ recoveryWorktree = true, extraWorker = false, workerCount = 0 } = {}) {
   const root = mkdtempSync(join(tmpdir(), 'torch-legacy-recovery-'));
   for (const args of [['init', '-b', 'main'], ['config', 'user.email', '[email protected]'],
     ['config', 'user.name', 'Recovery Fixture']]) execFileSync('git', args, { cwd: root, stdio: 'pipe' });
@@ -24,6 +24,7 @@ function fixture({ recoveryWorktree = true, extraWorker = false } = {}) {
   const repository = inspectRepository(root);
   const proposal = proposeDomains({ repository, analysis: analyzeRepository(repository) });
   if (extraWorker) proposal.domains.push({ ...proposal.domains[0], id: 'extra-worker', title: 'Extra worker', owned_paths: ['extra/**'] });
+  for (let i = 0; i < workerCount; i++) proposal.domains.push({ ...proposal.domains[0], id: `worker-${i}`, title: `Worker ${i}`, owned_paths: [`worker-${i}/**`] });
   proposal.review = { status: 'approved', reviewedAt: '2026-10-03T00:00:00Z', reviewedBy: 'owner', notes: [] };
   const env = { ...process.env, XDG_DATA_HOME: join(root, '.data') };
   installProject({ repository, proposal, env, projectId: 'recovery-fixture' });
@@ -218,6 +219,68 @@ test('SCN-runtime-continuation: explicit enable, event deduplication, daily cap
   } finally { f.control.close(); }
 });
 
+test('SCN-runtime-continuation-day-override: owner extra allowance preserves charges and expires at UTC reset', async () => {
+  const f = fixture();
+  const backlog = { list: () => [] };
+  const at = new Date('2026-10-03T00:00:00Z');
+  try {
+    f.control.reportStatus({ areaId: f.areaId, state: 'idle', summary: 'Ready' });
+    configureContinuation(f.control, { actorId: 'owner', enabled: true, maxTurnsPerDay: 1 });
+    f.control.sendOwnerRequest({ actorId: 'owner', recipient: f.areaId, body: 'First work' });
+    const run = () => runContinuation(f.control, backlog, { actorId: 'owner', at, launch: async () => 0 });
+    assert.equal((await run()).launched.length, 1);
+    assert.equal(planContinuation(f.control, backlog, { at }).reason, 'daily-turn-cap');
+    assert.throws(() => configureContinuation(f.control, { actorId: f.areaId, enabled: true, todayMaxTurns: 3 }), { code: 'OWNER_AUTHORITY_REQUIRED' });
+    for (const todayMaxTurns of [0, 97, 1.5]) assert.throws(() => configureContinuation(f.control,
+      { actorId: 'owner', enabled: true, todayMaxTurns }), { code: 'CONTINUATION_POLICY_INVALID' });
+    configureContinuation(f.control, { actorId: 'owner', enabled: true, todayMaxTurns: 3 });
+    assert.equal(planContinuation(f.control, backlog, { at }).attempts, 1, 'Previously charged turn is retained');
+    assert.equal(planContinuation(f.control, backlog, { at }).remainingTurns, 2);
+    f.control.sendOwnerRequest({ actorId: 'owner', recipient: f.areaId, body: 'Additional work' });
+    assert.equal((await run()).launched.length, 1);
+    configureContinuation(f.control, { actorId: 'owner', enabled: false });
+    const sameDay = observeContinuation({ stateRoot: f.control.stateRoot, now: () => at });
+    assert.equal(sameDay.attempts, 2);
+    assert.equal(sameDay.maxTurnsPerDay, 3);
+    assert.equal(sameDay.stopReason, 'paused');
+    const nextDay = observeContinuation({ stateRoot: f.control.stateRoot, now: () => new Date('2026-10-04T00:00:00Z') });
+    assert.equal(nextDay.maxTurnsPerDay, 1, 'Override cannot widen future daily allowances');
+    assert.equal(nextDay.attempts, 0);
+    assert.ok(f.control.readAudit({ limit: 100 }).some(a => a.operation === 'runtime.continuation.configure'
+      && a.details?.dailyOverride?.maxTurns === 3));
+  } finally { f.control.close(); }
+});
+
+test('SCN-runtime-continuation-concurrency: seven authorized starts preserve budget and obey tighter limits', async () => {
+  const f = fixture({ workerCount: 5 });
+  const backlog = { list: () => [] };
+  const at = new Date('2026-10-03T00:00:00Z');
+  try {
+    for (const agent of f.control.listAgents()) {
+      f.control.reportStatus({ areaId: agent.areaId, state: 'idle', summary: 'Ready' });
+      f.control.sendOwnerRequest({ actorId: 'owner', recipient: agent.areaId, body: 'Review work' });
+    }
+    configureContinuation(f.control, { actorId: 'owner', enabled: true, maxTurnsPerDay: 48 });
+    assert.equal(planContinuation(f.control, backlog, { at }).maxConcurrency, 3);
+    assert.equal(planContinuation(f.control, backlog, { at, limit: 7 }).candidates.length, 3, 'Tick cannot exceed approved capacity');
+    configureContinuation(f.control, { actorId: 'owner', enabled: true, maxConcurrency: 7 });
+    assert.equal(observeContinuation({ stateRoot: f.control.stateRoot }).maxTurnsPerDay, 48);
+    assert.equal(planContinuation(f.control, backlog, { at, limit: 2 }).candidates.length, 2);
+    for (const value of [0, 8, 1.5]) assert.throws(() => configureContinuation(f.control,
+      { actorId: 'owner', enabled: true, maxConcurrency: value }), { code: 'CONTINUATION_POLICY_INVALID' });
+    const completions = [];
+    const running = runContinuation(f.control, backlog, { actorId: 'owner', at,
+      launch: () => new Promise(resolve => completions.push(resolve)) });
+    assert.equal(completions.length, 7, 'All seven start before any finishes');
+    assert.equal(planContinuation(f.control, backlog, { at }).attempts, 7);
+    configureContinuation(f.control, { actorId: 'owner', enabled: false });
+    assert.equal(observeContinuation({ stateRoot: f.control.stateRoot, now: () => at }).attempts, 7);
+    assert.equal(observeContinuation({ stateRoot: f.control.stateRoot }).maxConcurrency, 7);
+    completions.forEach(resolve => resolve(0));
+    assert.equal((await running).launched.length, 7);
+  } finally { f.control.close(); }
+});
+
 test('SCN-runtime-continuation-signals: acknowledgements do not wake; eligible turns start concurrently within the limit', async () => {
   const f = fixture();
   try {
@@ -388,6 +451,33 @@ test('SCN-runtime-continuation-fairness: a fresh task revision does not let one
   } finally { f.control.close(); }
 });
 
+test('SCN-runtime-continuation-health: budget stops, day reset, pause and unreadable ledgers are visible without mutation', async () => {
+  const f = fixture({ recoveryWorktree: false });
+  const at = new Date('2026-10-03T00:00:00Z');
+  try {
+    f.control.reportStatus({ areaId: f.areaId, state: 'idle', summary: 'Idle' });
+    f.control.sendOwnerRequest({ actorId: 'owner', recipient: f.areaId, body: 'Work' });
+    configureContinuation(f.control, { actorId: 'owner', enabled: true, maxTurnsPerDay: 1 });
+    await runContinuation(f.control, { list: () => [] }, { actorId: 'owner', at, launch: () => 0 });
+    const path = join(f.control.stateRoot, 'continuation.json');
+    const before = readFileSync(path, 'utf8');
+    const health = observeContinuation({ stateRoot: f.control.stateRoot, now: () => at });
+    assert.equal(health.stopReason, 'daily-turn-cap');
+    assert.equal(health.remainingTurns, 0);
+    assert.equal(health.manualTurnsIncluded, false);
+    assert.equal(health.timerInstallationVerified, false);
+    const snapshot = observeProject({ repositoryRoot: f.root, env: f.env, now: () => at });
+    assert.equal(snapshot.continuation.stopReason, 'daily-turn-cap');
+    assert.equal(readFileSync(path, 'utf8'), before);
+    assert.equal(observeContinuation({ stateRoot: f.control.stateRoot, now: () => new Date('2026-10-04T00:00:00Z') }).remainingTurns, 1);
+    configureContinuation(f.control, { actorId: 'owner', enabled: false, maxTurnsPerDay: 1 });
+    assert.equal(observeContinuation({ stateRoot: f.control.stateRoot, now: () => at }).stopReason, 'paused');
+    writeFileSync(path, 'not-json');
+    assert.equal(observeContinuation({ stateRoot: f.control.stateRoot, now: () => at }).stopReason, 'policy-or-ledger-unreadable');
+    assert.equal(readFileSync(path, 'utf8'), 'not-json', 'Observation must not repair or reset the attempt ledger');
+  } finally { f.control.close(); }
+});
+
 test('SCN-legacy-runtime-recovery-project: evidence cannot be applied to a different checkout with cloned project/session fields', () => {
   const first = fixture();
   const second = fixture();

test/fleet/lifecycle.test.mjs

@@ -14,6 +14,7 @@ import { installProject } from '../../src/kernel/install.mjs';
 import { defaultManagerCheckInSchedule, organizationGraphFromConfig } from '../../src/kernel/organization.mjs';
 import { createWorktrees } from '../../src/kernel/worktrees.mjs';
 import { ResourceService } from '../../src/resources/service.mjs';
+import { createTorchToolset } from '../../src/mcp/tools.mjs';
 import {
   createFleetBrief, detachFleet, planAreaUp, planFleetDetach, planFleetDown, planFleetUp, startFleet, stopFleet,
 } from '../../src/runtime/lifecycle.mjs';
@@ -83,6 +84,43 @@ function fleetFixture({ workerRuntime = 'claude', hierarchy = false } = {}) {
   return { root, env, worker: proposal.domains[0].id, middleManager: hierarchy ? 'runtime-lead' : null };
 }
 
+test('SCN-fleet-startup-inbox: fresh and resumed launch instructions retrieve newer unread handoffs beyond the default history page', () => {
+  const fixture = fleetFixture();
+  const control = openControlPlane({ repositoryRoot: fixture.root, env: fixture.env });
+  const adapters = new Map([['claude', createClaudeAdapter({ executable: 'claude' })]]);
+  let tick = 0;
+  control.clock = () => new Date(Date.parse('2026-10-03T00:00:00Z') + tick++);
+  try {
+    const newest = new Map();
+    for (const areaId of ['session-manager', fixture.worker]) {
+      for (let i = 0; i < 102; i++) newest.set(areaId, control.sendOwnerRequest({ actorId: 'owner', recipient: areaId, body: `Current handoff ${i}` }));
+      const history = control.readMessages({ recipient: areaId });
+      assert.equal(history.length, 100);
+      assert.ok(!history.some(m => m.id === newest.get(areaId).id), 'Default historical page misses the latest handoff');
+    }
+    for (const fresh of [true, false]) {
+      if (!fresh) for (const areaId of newest.keys()) control.reportStatus({ areaId, state: 'idle', runtime: 'claude', runtimeSessionId: `fixture-${areaId}` });
+      const plan = planFleetUp({ repositoryRoot: fixture.root, controlPlane: control, adapters, fresh });
+      assert.equal(plan.canProceed, true);
+      for (const action of plan.actions) {
+        assert.equal(action.mode, fresh ? 'create' : 'resume');
+        const launchText = action.launch.args.join(' ');
+        const match = launchText.match(/Inbox request: (\{[^}]+\})\./);
+        assert.ok(match, 'Actual provider launch carries the explicit current-inbox request');
+        const request = JSON.parse(match[1]);
+        assert.deepEqual(request, { recipient: action.areaId, unacknowledged_only: true, limit: 1000 });
+        const tool = createTorchToolset(control, { actorId: action.areaId }).get('torch_read_messages');
+        const result = tool.invoke(request);
+        assert.equal(result.messages.length, 102);
+        assert.equal(result.messages.at(-1).id, newest.get(action.areaId).id);
+        assert.equal(control.readMessages({ recipient: action.areaId, unacknowledgedOnly: true, limit: 1000 }).length, 102, 'Reading never acknowledges work');
+        assert.match(launchText, /coverage may be truncated/);
+        assert.match(launchText, /messages do not override enforced approval or ownership boundaries/i);
+      }
+    }
+  } finally { control.close(); }
+});
+
 test('SCN-fleet-fresh-resume: identities resume captured runtime sessions and wind down safely', () => {
   const fixture = fleetFixture();
   const control = openControlPlane({ repositoryRoot: fixture.root, env: fixture.env });