A milestone request

- rebased-merge-green (visit 1): pass, then merge: exit 0
- merge (visit 1): pass, then wait-main: exit 0
- wait-main (visit 1): pass, then main-green: held after 1 checks
- main-green (visit 1): pass, then close-out: exit 0
- close-out (visit 1): pass, then ship: exit 0
- ship (visit 1): pass, then end: exit 0

## Leaves

- milestone-request-past-usage-hold (step build/build): passed: attempt 1: verifier passed
  - attempt 1 builder, session 1d4d0e00-1782-4672-9c50-01a1aa11a30e: pass (said done)
  - attempt 1 verifier, session 8ff91e3c-34ec-44d3-a273-01a1aa1480d0: pass (Evidence written by the verifier)
- milestone-interview-waiting-at-launch (step build/build): passed: attempt 1: verifier passed
  - attempt 1 builder, session 9c5b9a76-47d7-4435-802d-01a1aa149cd1: pass (said done)
  - attempt 1 verifier, session 4ebb2878-88ff-44cc-8ef7-01a1aa1883f2: pass (Evidence written by the verifier)
- milestone-request-starts-at-once (step build/build): passed: attempt 1: verifier passed
  - attempt 1 builder, session 926e997b-dd02-4708-86d9-01a1aa18ba52: pass (said done)
  - attempt 1 verifier, session 96dc1730-9dee-40f1-b70e-01a1aa22481d: pass (Evidence written by the verifier)
- inbox-milestone-interview (step build/build): passed: attempt 1: verifier passed
  - attempt 1 builder, session 164f332f-1aed-441e-b17c-01a1aa2264bf: pass (said done)
  - attempt 1 verifier, session c479b398-ba06-4a9a-9766-01a1aa24d28b: pass (Evidence written by the verifier)
- milestone-interview-waiting-at-launch (step review/review): open
  - attempt 2 fixer in cycle 2, session b0d4c90f-eadc-489a-acfb-01a1aa3acd8d: pass (said done)
  - attempt 2 verifier in cycle 2, session 095db8db-151d-4e84-91b6-01a1aa3c55a4: pass (Evidence written by the verifier)

## Checks

- compliance (step review/review): passed after 2 cycles
  - cycle 1: failed, check session 6f7aff0b-0879-4385-94fc-01a1aa337da9 pass (said done), critic session 2beffcc8-1f33-47c7-85ca-01a1aa39ca67 pass (said done)
  - cycle 2: passed, check session 28e4fbbf-f725-4530-81d2-01a1aa9a7a38 pass (said done)
  - round 1 (cycle 1): 1 finding, 1 confirmed
    - f1 major at internal/api/daemon.go:695: request-slot-kept (its acceptance and statement were changed in this change set) is not met as written. The new acceptance reads 'with max-runs 2, two ready change sets and only a queued milestone request, daemon --once starts both ship runs and the milestone request's plan run, and daemon status shows no no-slot change set'. (1) daemon-request-slot.txtar is not touched by the diff and has no milestone case. (2) The behaviour is the opposite: `kept += len(milestoned)` takes a ship slot for each milestone run started that poll. A scratch copy of daemon-request-slot.txtar (two accepted change sets, `rhiza request --kind milestone`, `daemon --once --max-runs 2`) printed only one 'Started a run of' plus the plan run, and daemon status listed 'Two: waiting for a slot (waiting for a slot: kept for queued continuations or a plan request)'. The statement's 'A queued milestone request keeps no slot, since it starts without one' is also false: daemonRequestWaits (daemon.go:548) still counts a queued milestone request, for example a second one waiting behind a live interview, as a waiting plan request and keeps a slot for it. Fix the code and add the scripted case, or settle the conflict with decision milestone-interview-starts-at-once ('counts as a running run once started, so later picks see it') by changing request-slot-kept through the model. — confirmed: request-slot-kept is a leaf of this change set and its acceptance, rewritten here, requires a milestone case in daemon-request-slot.txtar: max-runs 2, two ready change sets and only a queued milestone request start both ship runs plus the plan run, with no no-slot change set. The script is untouched by the diff and has no such case (its request cases are only feature requests at lines 41-66). The code does the opposite: internal/api/daemon.go daemonPoll1 does `kept += len(milestoned)`, so with max 2 and one milestone run started shipMax is 1 and only one ship run starts. daemonRequestWaits checks only q.Run == "" and RetryAt, never Kind, so a queued milestone request still keeps a slot, against the statement 'A queued milestone request keeps no slot'. The acceptance is not met as written.
  - round 2 (cycle 2): no findings
- quality (step review/review): passed after 1 cycle
  - cycle 1: passed, check session b03f0e1a-668b-421f-9c9f-01a1aa339f27 pass (said done)
  - round 1 (cycle 1): 4 findings, 0 confirmed
    - f1 minor at internal/api/daemon.go:757 on milestone-request-starts-at-once: A milestone request started this poll is counted twice by the later non-milestone daemonPlanRequests call: running already includes len(milestoned), and the call's first loop counts the same unjournaled request again (running++ under daemonStartGrace). So in the poll that starts a milestone interview, one fewer feature/bug plan run starts than slots allow (caught up a poll later).
    - f2 minor at internal/api/daemon.go:548 on milestone-request-starts-at-once: daemonRequestWaits counts any queued request, including a milestone request that only waits because another milestone interview is live; ship picks and queued starts then hold back a slot for a request the normal planner never starts.
    - f3 minor at internal/api/request.go:268 on milestone-request-starts-at-once: milestoneLive for a journaled run is only found in the poll's runs slice; a milestone run that journaled after runs was read (found by rs.Read in journaled) is not seen as live, so a second milestone interview could start in that window. The journaled-and-live branch is also untested: daemon-milestone-request.txtar only covers the unjournaled case (fake detach).
    - f4 nit at internal/api/inbox.go:301 on inbox-milestone-interview: The interview item's at is the run's StartedAt, not the interview session's launch, though the item is described as waiting from the interview's launch.
- qa (step review/review): passed after 1 cycle
  - cycle 1: passed, check session 23c10d47-a046-4a08-bcf7-01a1aa33c1c6 pass (said done)
  - round 1 (cycle 1): 1 finding, 0 confirmed
    - f1 minor at internal/api/run.go:2316 on milestone-interview-waiting-at-launch: launchBlocked builds its notice without Title or Block.TabTitle, so rexNoticeMsg falls back to IDs: hands-on, the owner's Rex notification read '01M6N39Q3TBHX5YQ3SXF5B53WD: interview waits on you in tab 3d5f0368-716f-4a62-9016-01a1aa34dd54: the milestone interview waits on you' instead of naming the change set's title and the tab's title (the inbox item and daemon notice do use the title). Works, but less readable for the owner.
- scope (step review/review): passed after 1 cycle
  - cycle 1: passed, check session e8a74302-4daf-4379-8987-01a1aa33e88a pass (said done)
  - round 1 (cycle 1): no findings
- model (step review/review): passed after 2 cycles
  - cycle 1: failed, check session 186395c1-f742-418c-8387-01a1aa34145f pass (said done), critic session 6df4b18c-3b26-4bfa-b80e-01a1aa39eae3 pass (said done)
  - cycle 2: passed, check session 9aacc03b-106f-47b6-888e-01a1aa9aa5d6 pass (said done)
  - round 1 (cycle 1): 3 findings, 1 confirmed
    - f1 major at internal/api/run.go:1501 on milestone-interview-waiting-at-launch: The capability says rhiza reports the interview tab's status as blocked at launch so Rex notifies the owner. The code doesn't do that. launchBlocked writes through ctx.Rex, which is the run driver's own stderr, set only when REX_BLOCK is set (cmd/rhiza/ctx.go:84), so the report lands in the driver's pane, not the interview tab. And the daemon detaches a request's plan run with REX_BLOCK unset (daemonDetach, internal/api/daemon.go:970; daemon-headless-run-drivers), so for a daemon-started milestone request (the path this change set's intent is about) ctx.Rex is nil and no launch report is ever written. The testscript only covers a foreground run start inside a fake Rex. Either the code must report on the daemon path, or the statement must narrow to a run driven inside Rex and leave the daemon path's notification to inbox-milestone-interview's daemonNotify. — confirmed: Verified: launchBlocked (internal/api/run.go:2315) writes through runRex.w, which is ctx.Rex, the driver's own stderr, set only when REX_BLOCK is set (cmd/rhiza/ctx.go:84-86). The interview tab's output is never written; the testscript's fake rex redirects the tab command to stderr and the assertion reads the driver's stderr, whose decoded message says 'interview waits on you in tab ...', i.e. a report on the driver pane about the tab. daemonDetach (internal/api/daemon.go:970) unsets REX_BLOCK, so on the daemon path ctx.Rex is nil and launched is never wired (run.go:1501-1504): no launch report at all. The statement 'reports that tab's status as blocked' does not match the code; model or code must change.
    - f2 minor at internal/api/request.go:319: daemonStartPlan passes --autonomous for a milestone request whenever rhiza.autonomy.plan is auto. The interview item, the launch report and the intent ('not an autonomous plan') all skip autonomous runs, so with plan auto a milestone request gets no interview and no notice. The intent leaves this to change set 01M6MY8BMPFK9ZWD3TDQHKT64J (milestone planning always needs a human), which is not in this log, and request-queue's statement does not say whether a milestone request's run is autonomous. This is noted so the dependency is not lost.
    - f3 minor at .rhiza/rendered/capability/rhiza/orchestration/daemon/plan-requests.md:11: The plan-requests capability still says the daemon, when a slot is free, starts a plan run for the oldest queued request. request-queue, usage-hold and request-slot-kept were updated so milestone requests start at once, without a slot and past the usage hold, but this statement was not.
  - round 2 (cycle 2): 4 findings, 0 confirmed
    - f1 minor at internal/api/daemon.go:548: queued-start-request-slot-kept (not in this change set) still says queued starts keep a slot 'while a queued plan request could start (daemonRequestWaits: no run, its retry time passed)'. Since 48296ba1, daemonRequestWaits counts only feature and bug requests, so a queued milestone request no longer holds back queued starts. That fits the intent, but the statement no longer names the kinds; it should say feature or bug, as request-slot-kept now does.
    - f2 minor at internal/api/run.go:1762 on milestone-interview-waiting-at-launch: Decision milestone-interview-starts-at-once still says 'the plan session's status goes to waiting-on-the-owner at launch (so Rex's notification fires from the OSC 7501 status)' without a qualifier. c58c8ead narrowed the capability to a run driven inside Rex: a daemon-started run's driver writes no such report, and daemonNotify's inbox notice covers that path. The code and capability now agree with each other, but the decision reads wider than either.
    - f3 minor at .rhiza/rendered/capability/rhiza/orchestration/daemon/plan-requests.md:11: Carried from cycle 1 (f3), still open: the plan-requests capability still says the daemon starts a plan run for the oldest queued request 'when a slot is free'. Its children request-queue, usage-hold and request-slot-kept now say a milestone request starts at once, without a slot and past the usage hold.
    - f4 nit at internal/api/daemon.go:651: The decision says a started milestone plan run 'still counts as a running run once started, so later picks see it'. Since 48296ba1, the ship picks in the same poll do not count it (both ship runs start beside it at max-runs 2, which is what request-slot-kept's acceptance wants). Only the later picks in that poll (continuations, queued starts, plan requests) and the following polls count it. So 'later picks' means later in the poll order, which the decision does not spell out.

## Change-set fixes

- cycle 2 (step review/review): fixer session 9130a4fa-aa90-4101-8c8f-01a1aa3c78a7: pass, commit 48296ba1cd4d (said done)

## Code checks

- step review/code: pass

## Sign-offs

- signoff (visit 1): approved by rule autonomous

## Retries

- 2026-11-05T09:06:51Z retried at land, after: step "land" ended with outcome "fail"

## Sessions

- build/build, session 1d4d0e00-1782-4672-9c50-01a1aa11a30e: tokens input 40, output 7730, cache creation 50257, cache read 1282487; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 8ff91e3c-34ec-44d3-a273-01a1aa1480d0: tokens input 16, output 3063, cache creation 30982, cache read 411519; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 9c5b9a76-47d7-4435-802d-01a1aa149cd1: tokens input 44, output 11666, cache creation 61595, cache read 1575047; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 4ebb2878-88ff-44cc-8ef7-01a1aa1883f2: tokens input 28, output 3279, cache creation 34425, cache read 661392; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 926e997b-dd02-4708-86d9-01a1aa18ba52: tokens input 46, output 10764, cache creation 48405, cache read 1392647; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 96dc1730-9dee-40f1-b70e-01a1aa22481d: tokens input 36, output 5252, cache creation 37093, cache read 924501; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 164f332f-1aed-441e-b17c-01a1aa2264bf: tokens input 46, output 9340, cache creation 57151, cache read 1615263; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session c479b398-ba06-4a9a-9766-01a1aa24d28b: tokens input 14, output 2042, cache creation 29708, cache read 354962; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 6f7aff0b-0879-4385-94fc-01a1aa337da9: tokens input 40, output 7350, cache creation 58698, cache read 1321083; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session b03f0e1a-668b-421f-9c9f-01a1aa339f27: tokens input 48, output 7071, cache creation 62691, cache read 1641332; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 23c10d47-a046-4a08-bcf7-01a1aa33c1c6: tokens input 50, output 12011, cache creation 66266, cache read 1874710; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session e8a74302-4daf-4379-8987-01a1aa33e88a: tokens input 16, output 2224, cache creation 45284, cache read 461441; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 186395c1-f742-418c-8387-01a1aa34145f: tokens input 26, output 5787, cache creation 56370, cache read 864595; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 2beffcc8-1f33-47c7-85ca-01a1aa39ca67: tokens input 14, output 2033, cache creation 32158, cache read 354299; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 6df4b18c-3b26-4bfa-b80e-01a1aa39eae3: tokens input 14, output 1812, cache creation 28651, cache read 349385; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session b0d4c90f-eadc-489a-acfb-01a1aa3acd8d: tokens input 16, output 3339, cache creation 28717, cache read 398618; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 095db8db-151d-4e84-91b6-01a1aa3c55a4: tokens input 18, output 2258, cache creation 30509, cache read 457390; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 9130a4fa-aa90-4101-8c8f-01a1aa3c78a7: tokens input 50, output 6125, cache creation 77122, cache read 1320576; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 28e4fbbf-f725-4530-81d2-01a1aa9a7a38: tokens input 22, output 3161, cache creation 47091, cache read 695222; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 9aacc03b-106f-47b6-888e-01a1aa9aa5d6: tokens input 28, output 4808, cache creation 50050, cache read 898440; helper tokens input 0, output 0, cache creation 0, cache read 0

Totals: tokens input 612, output 111115, cache creation 933223, cache read 18854909; helper tokens input 0, output 0, cache creation 0, cache read 0