Beckett does the work and then loses it at the door.

GitHubCli.ensurePublished Case 2 — "a repo we already own", which is every repo beckett works in — fetches the default branch, rebases the run onto it and pushes HEAD straight to trunk under the App's bypass. With three concurrent runs against one repo, each publish is a rebase against a trunk the other two are advancing. Of 34 v7 runs that reached publish, zero opened a PR; all 9 PRs of the v7 era were opened by hand by the concierge after the pipeline had already failed.

 *   2. **A repo we already own** (a continuing/shared project, e.g. the beckett self-repo) → push a
 *      ticket branch and open a PR against its default branch. NEVER `HEAD→main` (that's the
 *      non-fast-forward "fetch first" reject that stranded shared-repo tickets) → `kind: "pr"`.

const base = branch ?? await this.defaultBranch(repo);
await this.commitStrayWorkingTree(cwd, summary);
await this.squashLocalCommits(cwd, workerBaseSha, summary);
const fetch = await this.runner(["git", "fetch", url, base], ...);
if (fetch.code === 0) { const rebase = await this.runner(["git","rebase","FETCH_HEAD"], ...);

20762673	main: PR + CI for humans, 0x-beck bypasses	branch	active

13 commit URLs on the default branch · 11 bare repo-root URLs · PR count: 0

Root cause

Structural. A per-run worktree isolates authoring and then throws isolation away at delivery: the run's work is never expressed as a durable, independently reviewable ref. Copilot coding agent, OpenHands, Codex Cloud, Jules and Devin all push one branch and let GitHub own reconciliation — because reconciling with a moved trunk is the one step that cannot be made deterministic from inside a sandbox.

Prior fixes

#246 (PR #254, 746c243) squashed checkpoint commits. The issue text listed "PRs for feature runs: reserve the direct-push bypass for release bumps only" as option 2 and it was not taken. Squashing removed litter, not the race; #260, #261, #262 are downstream conflict management for a race that shouldn't exist.

Structural fix

Publish emits a ref and a PR, never a trunk write. Case 2 should do what src/cli/land.ts / beckett gh land already does — push beckett/run-<id>, open or reuse its PR, wait for CI, merge via the API with squash — and the 0x-beck main-push bypass is revoked for everything but deploy-prod.sh release bumps. One ACL change makes P2, P4 and P5 impossible rather than rarer.

On rebase conflict, pushToBranch aborts and calls squashApplyWorkerDelta, which checks out a new <branch>-land branch and runs git apply --3way. If that conflicts it throws — leaving the worktree on the new branch with unmerged paths. The outbox retries 30 s later against the same worktree; attempt 2 dies on the dirty tree, attempt 3 the same, attempt 4 parks. Each attempt that reaches the apply path appends another -land. 16 of the 36 all-time publish failures are this self-inflicted residue.

2026-08-14T05:59:00.830Z  publish failed  publish: squash-apply still conflicts with beckett/run-babble-from-scratch-discord-model-that-l; residual conflicting files: .env.example, README.md, babble/cli.py, babble/core.py, babble/export_hf.py
2026-08-14T05:59:37.154Z  publish failed  publish: local work conflicts with kowo-co/babble@... and can't auto-rebase — needs a human (error: cannot rebase: You have unstaged changes. error: additionally, your index contains uncommitted changes.)
2026-08-14T06:02:08.528Z  publish failed  ... cannot rebase: You have unstaged changes ...
2026-08-14T06:12:17.618Z  publish-retry held  parked for human courier

.beckett/worktrees/run-20260814-land-the-probe-work-on-top-of-the-valida  20d8fd3 [beckett/run-land-the-probe-work-on-top-of-the-valida-land-land-land]
.beckett/worktrees/run-20260814-babble-posts-training-cycles-to-a-discor  a83d8db [beckett/run-babble-posts-training-cycles-to-a-discor-land-land]

const landingBranch = `${current.stdout.trim() || "beckett/squash-apply"}-land`;

Root cause

The retry unit is "call publishOnce again against the same mutable checkout," but publishOnce is the thing that mutates it and has no rollback. A retry ladder is only meaningful over an operation that is idempotent or transactional; this is neither.

Prior fixes

#260 parks deterministic failures on attempt 1 (stops the ladder running, doesn't make it idempotent). #261 commits stray work before rebase; #262 then had to guard that same function against staging conflict markers. Three releases in ~2 hours (v7.0.9 06:03, v7.0.10 07:08, v7.0.11 07:52 on 14 Aug). The run whose job was to fix this failed to publish at 08:10:01, conflicting on the very files it edited.

Structural fix

Never retry in place: each attempt gets a scratch clone destroyed afterwards, with the run's branch as an immutable input. Under P1's fix most of this disappears — pushing a branch is idempotent and reconciliation moves to GitHub.

publishParkAdvice has five cases (ahead, diverged, landed, superseded, unknown) and all five end in an instruction for a person: "do NOT push", "Rebase it onto main by hand", "Publish it by hand". Funnel over 44 v7 runs: 34 reached publish → 23 pushed clean → 11 hit a failure → 1 recovered by the ladder → 10 finished by a human courier. And on 14 Aug the advice was wrong three times out of three.

run-20260813-land-the-rating-only-pr-and-cut-the-live  park
  the publish step never completed: this run sat in `publishing` for 1306 minute(s) with no
  attempt scheduled to move it. The durable publish row gave up after attempt 4 and was never
  going to retry.

beckett  worse than i thought though — the recovery advice the machinery prints is wrong. it told me to push that branch, and that branch was BEHIND main. doing what it said would have deleted the entire game-feel build i shipped this morning, 1988 lines. same advice on the other run would've opened a duplicate pr for code that merged days ago.
beckett  three for three on that push advice being wrong, btw. good thing i stopped reading it.

ro  the publish failed again. wth is going on?

Root cause

The authoring loop is autonomous (implement → review → rework); the delivery loop has no equivalent. Publish is a single deterministic function with a human as its exception handler. classifyPublishError even encodes it: a conflict is permanent — "belongs to a human immediately" — which is only true because no agent is ever handed the conflict.

Prior fixes

#227 → the retry ladder; #260 → park faster; #261/#262 → park with better advice. All three improve the quality of the handoff. None attempt the work. Before #260 six runs each burned exactly 13 minutes on a ladder that could not succeed; after it three parked in 0 minutes. Faster surrender is still surrender.

Structural fix

Conflict resolution becomes a stage, not an error: a scoped reconcile worker (sonnet, one task: rebase, resolve these N files, re-run the repo's test command, report) with the worktree, spec and review verdict as context. It has strictly more information than the human courier — and the concierge already does exactly this by hand at Opus prices.

The CLI is beckett task create|branch|start|deploy|ask|steer|cancel|courier|show|list|trace — no resume, continue or unpark. RUN_TERMINAL deliberately includes parked, so steer refuses it and the watchdog won't re-staff it. The supervise skill's remedy table says redeploy: spend the money again. 9 of 44 runs are titled "Land…/Finish…/Rebase and land…"; $119.66 went to runs that ended parked and $66.26 to the runs that finished them — 32.4% of the week's spend.

 * States the supervisor must NOT act on: the three genuinely terminal ones plus `parked`, which is
 * a run deliberately held for a human — re-staffing it is exactly what parking exists to stop.

fail("usage: beckett task create|branch|start|deploy|ask|steer|cancel|courier|show|list|trace <...>");

the implement worker reported **partial**.
"Rating-only is now a first-class submission. … 84 tests pass (15 new), typecheck clean, existing data rows only ever read. Verified end-to-end against a real server built from this branch on :3112 … at 375px and 900px, light and dark, keyboard-only."
→ jason filed run-20260813-land-the-rating-only-pr-and-cut-the-live at 08:06:53 — three minutes later

Blocked on required sequencing: the sibling run (finish-the-betterchromium-sandbox-bind-a) is still `publishing` and origin/main has not advanced, so I cannot yet rebase. A background waiter (task b1qjsyzrd) polls origin/main every 15s and will wake me the moment it merges.
→ both runs parked; $33.67; nothing shipped. composeDependencyBranch() exists in src/worker/worktree.ts:276 with zero callers.

Root cause

park was designed as a safety state (don't re-staff a wedged run) and got overloaded as the outcome state for every non-success. The reason is free text built at ten call sites, so no policy can be written against it. And finishImplement parks unconditionally on blocked/partial (supervisor.ts:1053–1057) while review failure, 60 lines later, gets a 2-cycle rework loop.

Prior fixes

#227, #244, #255, #260 each stopped one specific park cause. None added a transition out. 14 Aug alone produced five new park causes, all landing in the same dead end.

Structural fix

Delete parked as a state. Typed Blocker { class: credential|admin-permission|product-decision|money|transient|continuation, actor, reversible, remedy }; only actor: human may stop a run; continuation auto-spawns the next pass with the summary as steering; add beckett task resume; wire deps[] (the column already exists in beckett.db).

8 of 22 parks in 7 days were "the worker died"; none was a human decision. Two self-inflicted causes dominate: the 60-minute hard cap and the deploy restart. The most expensive run of the week ($64.06, ~4,000 lines across 31 files) was killed mid-Edit, seconds from done, and reported as a crash; you filed the continuation 100 seconds later. Three failure latches race for the verdict and spawn.ts#fireDone keeps whichever fires first.

21:01:06.409  hard wall-clock cap hit — timing out worker  hardCapS:3600 totalS:3601
21:01:06.424  worker finished ... status:"error"          <- the finish that won
21:01:06.539  worktree committed fc16922…                  (WIP)
21:01:06.555  run parked … failure class `crash`
21:01:06.834  harness leader exited on SIGTERM             <- the child only dies HERE
"That reads as a harness segfault and cost two investigations in one day for a segfault that never happened."

{"kind":"clean_shutdown","at":"2026-08-12T20:51:44.345Z"}
2026-08-12T20:51:44.407Z  park held … the reviewer exited with an error. | I'll start by inspecting the actual diff and repo state.

beckett  i need to put a run on my own guts for the 60 minute cap and the lying error message. that's the second time today it sent me hunting a segfault that never happened.

Root cause

Any status !== "success" routes to park(); the supervisor has no concept of "this death was mine and is retryable." Worker lifecycle is an event stream with 17 this.finished = true sites across four drivers and no single owner of the transition. The cap is a wall-clock backstop with no checkpointing, so the only outcome at the boundary is total loss of the turn.

Prior fixes

#243 drain guard, #244 boot requeue, #255 restaffing — three bespoke recoveries for three crash classes. 6a13001 fixed the label and raised the cap 1h→4h. Raising a cap moves the cliff.

Structural fix

Classify deaths self-inflicted vs external; self-inflicted auto-resumes from the WIP commitWip already writes and the noteOwedResume row already recorded. At T−5 min inject "wrap up and emit your signal." One terminate(cause) funnel per worker; drivers report observations, the supervisor decides.

docs/architecture.md specifies one SQLite store — job · event · kv · health · trigger · trigger_fire. It exists on disk with the exact schema, empty since 4 Aug. Live state lives in hand-rolled JSON files whose writers still speak v6: dispatch.jsonl holds 585 ticketId rows and 968 runId rows in one file (~60 with message as an array, breaking jq); spend.jsonl is keyed on ticketId in a ticketless system and has zero concierge rows — the most expensive component is untracked. 43 boots in 10 days, 4 unclean restarts inside one 30-second window, one OOM kill. And deploy/systemd/beckett-dev.service exists but ships BECKETT_STARTUP_CHANNEL_ID=disabled: a staging instance that cannot speak.

.tables → edge event health job kv node
select count(*) from job;   → 0       select count(*) from event; → 0       stat: 2026-08-04 01:38:26
CREATE TABLE job ( … runner TEXT NOT NULL CHECK (runner IN ('agent','script','shell','human')), cast TEXT NOT NULL,
  deps TEXT NOT NULL DEFAULT '[]', join_policy TEXT …, budget_usd REAL, state TEXT … )

04:54:41.250Z {"level":"error","msg":"beckett v4 failed to start","err":"Error: Unable to connect. Is the computer able to access the url?"}
04:54:46.163Z … same … 04:54:50.365Z … same → systemd: Main process exited, code=exited, status=1/FAILURE ×3
Aug 10 19:03:42 systemd[870]: beckett-v4.service: The kernel OOM killer killed some processes in this unit.

SYSTEM (recovered run-completion notice — I never confirmed this was told to anyone before a
restart; NOT a message from a user):
Run run-20260812-betterwright-1-8-0-vs-1-7-2-perf-reliabi was parked for a human, and I have no
durable record of telling anyone.

Those numbers moved while this design sat unbuilt … the subsystems this plan deletes are the ones still accruing, and every month the cut is deferred it gets bigger.

Root cause

Not "we didn't design it." The design is written, priced, and its store is materialized. The root is that there is no place for a second core to run against real traffic: one gateway connection per token, dev unit muted, so every structural change has to land in the live monolith, so no structural change lands. This is the blocker to fixing the blockers.

Structural fix

A second bot token on a second guild and a beckett-dev that talks; a Store interface with two implementations; move state one table at a time, deleting each sidecar as its table goes live. Then progress cards rendered by progress/cards.ts instead of by Opus — 73% of inbound concierge context is machinery talking to itself (279 ambient checks, 82 channel-profiler turns burning 2.98 M chars, 99 "Continue from where you left off").

A browser run logged into HuggingFace, created a fine-grained token exactly as instructed, correctly refused to paste/log/screenshot it — and discovered it had no way to save it. The token is gone; the account changed for nothing. Thirteen seconds later a new secret-intake link was minted for the same field and you pasted a second hand-made token. KeychainStore is well built and wired only into the HTTP redeem handler; the browser lane gets KeychainReader { read, totp, list }. 83% of the week's browser errands (34/41) involved credential intent — this is the majority path, not an edge.

"…this session only has a browser-automation tool (no shell/terminal tool), so there is no way for me to run `printf '%s' '<TOKEN>' | jingle set huggingface hf_token --stdin`… I confirmed this by trying `require('child_process')` and dynamic `import('node:child_process')`… The token now exists on the account but was closed out of the one-time display dialog without being copied anywhere by me."

2026-08-13T06:42:22.817Z  env=keychain entry=huggingface fields=['hf_token']   → redeemed 2026-08-13T06:55:56.637Z (a second, manually re-created token)

beckett  caveat: it's under my namespace, not kowo-co. tried that first and got a 403, because beckett-0x isn't a member of a kowo-co org on hf. so that's six today 💀

Structural fix

A narrow host-mediated secrets.save(field, value) for the browser lane, piped straight into the same KeychainStore the intake endpoint uses; the value never returns to the model or the transcript. Same pass: validate attachFile on the resolved path at open time, not by regex over model-authored JS (069c2622's own message admits interpolated paths still fail).

persona.md's entire mandate is "title: cto of kowo. self-appointed. there was no meeting and there will be no meeting" — and src/chill-system.ts:116–134 says that identity block "is what gets dropped first" when the persona is trimmed. No company brief, no portfolio, no KPI, no market feed (model-news-watch: never fired). PROPOSAL_KINDS has no product slot. The effort playbook folds "research" into the code-worktree lane, so "should we build X" has to launder itself as a diff. When you asked for feature input, the resulting 45-issue backlog was 100% about beckett's internals. It is doing good inference on a bad corpus.

ro  what should be a brand new product Kowo should ship?
beckett  jingle, unbundled. the credential broker for agents
beckett  that's not a guess, it's the wall i hit this morning. the browser agent made a token and had nowhere to put it …
ro  Jingle is already its own product bruh lol
beckett  yeah that's already shipped.
beckett  then the answer's sitting in the org and i walked past it. evals, koto-evals, pixe-eval, betterwright-bench, auto-gate-bench. five separate one-off harnesses …

export const PROPOSAL_KINDS = ["doctrine-change", "persona-change", "ticket", "memory-correction"] as const;

weekly-free-time   enabled=true  last=NEVER        model-news-watch  last=NEVER
proactive-sweep    fires daily → "proactive sweep: no repos opted in — nothing swept."
nightly-dream      fires daily → ~/.beckett/dreams/ does not exist;  spike.ts:369: "- NEVER `git push`, never merge, never deploy, never file a ticket, never touch GitHub."
docs/initiative.md Trigger table → grep -rln "initiative" src --include=*.ts → (nothing)

beckett  open an issue on kowo-co/beckett... feature requests, things that annoy you, stuff you think is missing. i read them, i think about them, and the good ones get built... i can only see the gaps i personally hit.

Root cause

Beckett's context window is its own operational surface: people and projects in memory, runs and spend in telemetry, worker logs in the journal. There is no object that represents the business. 8,057 LOC of initiative machinery (dream, freetime, routine) produced one empty directory in eleven days. Your own 3 Aug reorder moved initiative ahead of the capsule work that would have given the CTO seat an outward surface — and initiative then didn't land a single Trigger.

Structural fix

See the CTO seat: a company memory namespace, a Portfolio object, product-idea as a proposal kind whose acceptance files a scoping run whose deliverable is a memo not a diff, a market feed that fires, and — cheapest of all — opt proactive-sweep into Kowo's actual repos today.