Root daemon

    - f1 blocker at cmd/rhiza/testdata/script/tui-autonomy-app.txtar:25 on root-daemon-settings-scope: The script fails at HEAD, so the PR's make check is red. Setup puts every script under a root (rhiza.toml at $WORK), and since the settings split `rhiza daemon set rhiza.daemon.maxRuns 3` writes that machine key to rhiza.toml. Its source is now "rhiza.toml", but the unedited script still expects '"source": "git config"'. Reproduced with go test -trimpath ./cmd/rhiza -run TestScripts/tui-autonomy-app (FAIL at line 25). The script passes on main. Update the expectation, or set a project key there. — confirmed: Reproduced at HEAD b18965f4: go test -trimpath ./cmd/rhiza -run 'TestScripts/tui-autonomy-app$' FAILs at tui-autonomy-app.txtar:25 (no match for "source": "git config"). `rhiza daemon set rhiza.daemon.maxRuns 3` now writes the machine key to the root's rhiza.toml, so the expected source is stale; the leaf verifier also saw this failure and left it. make check would be red.
    - f2 major at internal/api/daemon.go:219 on root-daemon-round-robin: Turns restart at the home project on every poll. names always puts homeName first, then registry order, and daemon.RoundRobin always starts at index 0, with no turn position kept between polls. Each freed slot goes to the first project in that order that has ready work. With maxRuns 1, or whenever the home project has more ready change sets than the slots that free up, the other projects never get a run until the home's backlog is empty. That is fill-in-order, not round-robin across projects. daemon-round-robin.txtar only tests one poll at a time, so it can't catch this. Keep a rotating start index (or each project's last-started time) across polls. — confirmed: runDaemon's poll (daemon.go:219) builds names with homeName first then registry order on every poll, and daemon.RoundRobin (internal/daemon/roundrobin.go) always starts its turn loop at index 0 with no state carried between polls. With maxRuns 1 (or the home's ready backlog exceeding freed slots) each freed slot goes to the home project again, so other projects starve until home's backlog empties. That breaks the leaf statement 'fills the machine-wide maxRuns round-robin across projects'; daemon-round-robin.txtar checks only single polls.
    - f3 minor at internal/api/daemon.go:255 on root-daemon-round-robin: The machine-wide running count adds up only the projects whose prepare succeeded. A registered project that is skipped is left out: its per-repo lock held, or its settings fail to read (turns[i].err). Its live runs still run, but they take no slot, so the other projects can go over maxRuns in total.
    - f4 minor at internal/api/daemon_projects.go:240: daemonDemand counts a plan request whose start has not journaled yet (daemonRequestsStarting) in Running, and the project's poll cap becomes Running+share. But daemon.Pick in daemonPoll1 does not count that start, so in the minute before the request's run journals the ship picks can start one more run than the project's share, which pushes the machine total past maxRuns.
    - f5 minor at internal/api/daemon.go:156: Still open from cycle 1 (quality f3). When a registered project's dir changes, project() replaces its daemonProj without calling stop() on the old one, so the old lock stays held.
  - round 3 (cycle 3): 5 findings, 0 confirmed
    - f1 minor at internal/api/daemon.go:255 on root-daemon-round-robin: Still open from cycle 2 (f3): the machine-wide running count adds up only the projects whose prepare succeeded. A registered project skipped for a held lock or unreadable settings keeps its live runs, but they take no slot, so the others can exceed maxRuns in total.
    - f2 minor at internal/api/daemon_projects.go:240: Still open from cycle 2 (f4): a plan request whose start has not journaled yet counts in Running, so the project's cap becomes Running+share while daemon.Pick does not count that start; for about a minute ship picks can start one run past the project's share.
    - f3 minor at internal/api/daemon.go:161: Still open from cycles 1 and 2: when a registered project's dir changes, project() replaces its daemonProj without calling stop() on the old one, so the old per-repo lock stays held.
    - f4 minor at internal/daemon/roundrobin_test.go:51 on root-daemon-round-robin: The rotation across polls (cycle 2 f2's fix) is covered only by the unit test; no testscript drives two daemon polls with maxRuns 1 to show the second slot goes to the other project, and the runDaemon wiring of lastTurn is untested.
    - f5 nit at internal/api/daemon.go:276: lastTurn advances to the last picked project even when that project's start then fails in poll, so its turn is spent without a run.
- qa (step review/review): passed after 2 cycles
  - cycle 1: failed, check session 78f55b1d-ca9e-4bae-8ae9-01a1b2f195e1 pass (said done), critic session 7f39143e-70e5-4ebd-b079-01a1b2f69b6f pass (said done)
  - cycle 2: passed, check session 32ca8314-2c60-463a-99b9-01a1b3348f0b pass (said done)
  - round 1 (cycle 1): 3 findings, 3 confirmed
    - f1 blocker at internal/api/daemon_projects.go:187 on root-daemon-round-robin: Each project's poll passes the full machine-wide conf.maxRuns to daemonPoll1, so the cap is per project, not shared, and daemon.RoundRobin (internal/daemon/roundrobin.go:26) has no caller outside tests. Hands-on with the built binary: a root with two projects of three accepted milestone change sets each and rhiza.daemon.maxRuns = 3 in rhiza.toml started six runs in one daemon --once, alpha's three then other's three, not alternating. — confirmed: daemonProj.poll (internal/api/daemon_projects.go:187) hands each project's daemonPoll1 its own run store and the full conf.maxRuns, so each project gets the whole cap. daemon.RoundRobin is called nowhere outside tests, so root-daemon-round-robin's alternating, machine-wide fill is not built.
    - f2 blocker at internal/api/daemon.go:242: daemon-picks (as rewritten by this change set) says the daemon starts runs until its running runs reach the machine-wide maxRuns; the per-project poll loop counts only that project's runs against the cap, so N projects can run N*maxRuns at once (seen: 6 runs under maxRuns 3 with two projects). — confirmed: Same root cause, against daemon-picks' rewritten statement: the poll loop in daemon.go calls p.poll once per project, and each call counts only p.rs's running runs against maxRuns. N projects can therefore run N*maxRuns at once, which breaks the machine-wide cap the statement promises.
    - f3 major at internal/api/daemon_service.go on root-daemon-service: rhiza daemon status run at the root itself (outside any project checkout) fails with 'sessions need a git repository: git rev-parse --git-common-dir: fatal: not a git repository', in both service and tab mode, though the leaf says status acts on the root's daemon from anywhere under the root. The lock refusal's own next ('rhiza daemon status') fails when the second daemon was started from the root. — confirmed: runDaemonStatus (internal/api/daemon.go:1368) starts with gitCommonDir(ctx), which runs git rev-parse --git-common-dir and fails at a root that is not a git checkout. The status op never resolves the root's daemon the way serviceSetup does with rootcfg.Find. The leaf says status works from anywhere under the root, so this misses its statement.
  - round 2 (cycle 2): 1 finding, 0 confirmed
    - f1 minor at internal/api/daemon.go:1491 on root-daemon-service: rhiza daemon status run outside any root and outside a git repo exits 1 with 'sessions need a git repository: git rev-parse --git-common-dir: fatal: not a git repository', while rhiza daemon --once in the same dir exits 2 with 'not inside a Rhiza root: the daemon runs on the root' and next: rhiza root init. daemonStatusDir falls back to gitCommonDir when rootcfg.Find fails, so status outside a root still gives the per-repo-era git error instead of naming the missing root.
- scope (step review/review): passed after 1 cycle
  - cycle 1: passed, check session 9cd7d332-dfb1-438a-8435-01a1b2f1d1a1 pass (said done)
  - round 1 (cycle 1): no findings
- model (step review/review): passed after 2 cycles
  - cycle 1: failed, check session 24e24d02-11d3-4bbe-a542-01a1b2f21a95 pass (said done), critic session ed3cc54e-9c08-476f-b286-01a1b2f6d998 pass (said done)
  - cycle 2: passed, check session e6d866a2-e525-4678-a23f-01a1b334ccf0 pass (said done)
  - round 1 (cycle 1): 6 findings, 3 confirmed
    - f1 blocker at internal/api/daemon.go:203 on root-daemon-round-robin: The model says the root daemon fills one machine-wide maxRuns round-robin across projects, with an optional per-project max. The code never calls daemon.RoundRobin outside its tests. runDaemon's poll goes through the projects one after another, and each p.poll calls daemonPoll1 with conf.maxRuns (daemon_projects.go:187) while counting only that project's own run store. So N projects can run up to N x maxRuns runs at once, and slots are taken project by project in registry order, not by turns. — confirmed: At HEAD daemon.RoundRobin (internal/daemon/roundrobin.go:26) has no non-test caller. runDaemon's poll (internal/api/daemon.go:205-242) visits projects in order (home first) and each p.poll calls daemonPoll1 with conf.maxRuns against that project's own rs (daemon_projects.go:187), so the cap is per project (N x maxRuns) and slots fill project by project, not round-robin. The model's root-daemon-round-robin statement does not match the code; QA evidence root-daemon-round-robin-qa-1 (FAIL) agrees.
    - f2 major at internal/api/daemon_projects.go:187: daemon-picks (changed by this change set) now says picks go round-robin across projects until the daemon's running runs reach the machine-wide maxRuns. The code caps each project separately: daemonPoll1 gets that project's rs and conf.maxRuns, and no count spans projects. The statement does not match the code. — confirmed: Same root cause, separate statement: daemon-picks as changed by this change set says picks go round-robin until running runs reach the machine-wide maxRuns, but daemonPoll1 (daemon_projects.go:187) receives one project's run store and conf.maxRuns, and no count spans projects. Statement and code disagree.
    - f3 major at internal/api/daemon.go:1369 on root-daemon-service: root-daemon-service says rhiza daemon status acts on the root's daemon from anywhere under the root. runDaemonStatus still starts with gitCommonDir(ctx) and reads the per-repo state. A scratch build run at a fresh root (rhiza root init .; rhiza daemon status) exits 1 with 'sessions need a git repository'. Inside a project that is not the daemon's home, status reads that project's state, not the daemon's. — confirmed: runDaemonStatus (internal/api/daemon.go:1368-1371) starts with gitCommonDir(ctx) and reads per-repo lock and state, while start/stop/install go through the root (daemon_startstop.go:100). root-daemon-service's statement says status acts on the root's daemon from anywhere under the root; QA evidence root-daemon-service-qa-1 (FAIL) shows daemon status at the root failing with 'sessions need a git repository'.
    - f4 minor at internal/api/daemon.go:139 on root-daemon-lock: The statement says the daemon holds one lock in <root>/.rhiza-root/. The code also keeps a per-repo lock in the home project's git common dir and one in every other project (newDaemonProj), so it holds N+1 locks. The model should say that per-project locks still exist and why (status in a project names the daemon), or the code should drop them.
    - f5 minor at .rhiza (usage-settings acceptance): The usage-settings acceptance still says 'A new usage-settings.txtar'. The decision m29-update-usage-settings-script and the code (the existing script was updated) both say to update the existing one, and question review-01m6rmj6-r3-f3 is still open. The acceptance text should match the decision, and the question should be answered.
    - f6 nit at internal/api/usage_learn.go:35: limitsDir falls back to the repo's own folder outside a root, and repoSessionName falls back to the main checkout's folder name. Both keep a per-repo mode that m29-root-required rules out ('no per-repo daemon mode is kept'). This code is dead under that decision, or the model doesn't name it.
  - round 2 (cycle 2): 3 findings, 0 confirmed
    - f1 minor at internal/api/daemon_projects.go:123 on root-daemon-lock: Still open from cycle 1: root-daemon-lock says the daemon holds one lock in <root>/.rhiza-root/, but newDaemonProj still takes a per-repo daemon.TryLock in every non-home project (and the home's own lock is kept), so the daemon holds N+1 locks. The model should say the per-project locks remain and why (status inside a project names the daemon), or the code should drop them.
    - f2 minor at .rhiza (usage-settings acceptance): Still open from cycle 1: usage-settings' acceptance still reads 'A new usage-settings.txtar' although m29-update-usage-settings-script (which answers review-01m6rmj6-r3-f3) and the code update the existing script. The acceptance text should be reworded to match the decision.
    - f3 nit at internal/api/daemon_projects.go:200: daemon-picks says owner-queued runs 'skip these filters and only share the maxRuns slots', but daemonDemand puts queued continuations, starts and plan requests into the project's Ready list, so RoundRobin also caps them by rhiza.project.maxRuns. The statement could name the per-project max as a limit queued runs share too.

## Change-set fixes

- cycle 2 (step review/review): fixer session 0f09cac7-f389-4dd5-8c57-01a1b3259168: pass, commit 77b51bbefaab (said done)

## Code checks

- step review/code: pass

## Sign-offs

- signoff (visit 1): approved by rule autonomous

## Sessions

- build/build, session adf085cc-01b0-4f68-94ad-01a1b29a520f: tokens input 20, output 6294, cache creation 44792, cache read 560999; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 1511520f-ad6c-43e1-83e7-01a1b29cf6ec: tokens input 34, output 5720, cache creation 38780, cache read 872510; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 823706f8-fbdd-4b9b-8766-01a1b29d1eef: tokens input 38, output 5855, cache creation 44530, cache read 1188488; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session ca42ace1-8811-4951-99e9-01a1b2a1fda5: tokens input 36, output 6335, cache creation 41807, cache read 990309; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 5cd59f4a-b8a8-43ec-b56f-01a1b2a224f1: tokens input 126, output 36422, cache creation 121081, cache read 7243200; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 9a37309f-d2c0-4599-8125-01a1b2bc0056: tokens input 32, output 4005, cache creation 46880, cache read 888976; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 1aa1d73e-e97f-4c74-b2b1-01a1b2bc2adf: tokens input 18, output 2675, cache creation 31331, cache read 476623; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session a098c954-4008-482b-96f4-01a1b2bd48db: tokens input 16, output 2929, cache creation 32405, cache read 421496; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 076bf92d-1f3b-4850-9d95-01a1b2bd880f: tokens input 16, output 3379, cache creation 39248, cache read 439748; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 347ccaf4-e4e9-40bb-b6c4-01a1b2be7032: tokens input 12, output 2123, cache creation 26187, cache read 288518; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session e4358287-7ef2-46c7-ac76-01a1b2beab5b: tokens input 58, output 14848, cache creation 71243, cache read 2335360; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 35df0f99-040a-44ce-87aa-01a1b2ca4480: tokens input 34, output 7375, cache creation 47542, cache read 1104085; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session fd90b1b5-60fa-4493-860d-01a1b2ca6e3a: tokens input 36, output 5739, cache creation 42833, cache read 1104347; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session cf396a2d-5a75-476a-8df9-01a1b2ccedb6: tokens input 18, output 3210, cache creation 34115, cache read 478870; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 703f09fc-a2d3-4d52-a970-01a1b2cd247c: tokens input 34, output 7457, cache creation 52816, cache read 1142876; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session b2f10654-c730-431d-a658-01a1b2d19d7b: tokens input 22, output 3990, cache creation 37720, cache read 634013; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 289bc894-fd25-4234-b3a1-01a1b2d1c64e: tokens input 28, output 5910, cache creation 46640, cache read 874718; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 1b977378-74ea-49c7-b798-01a1b2d6b324: tokens input 40, output 4064, cache creation 36451, cache read 974176; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session de5b688b-9fac-4774-90a7-01a1b2d6dcca: tokens input 38, output 7785, cache creation 50050, cache read 1253706; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session e5bbdaf3-d2c3-4695-aa75-01a1b2e3ff81: tokens input 12, output 1618, cache creation 28171, cache read 292494; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 4f922dba-0cf5-42f6-b688-01a1b2e4d38c: tokens input 52, output 8111, cache creation 50957, cache read 1747630; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 1b83b35c-86cb-46ec-960e-01a1b2e768ee: tokens input 24, output 2892, cache creation 34992, cache read 672156; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 84e546b5-e2e7-4627-a61d-01a1b2f12de2: tokens input 34, output 8029, cache creation 60899, cache read 1240854; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session f0503d42-12cc-4e1f-84a8-01a1b2f161a7: tokens input 30, output 6573, cache creation 78051, cache read 1222796; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 78f55b1d-ca9e-4bae-8ae9-01a1b2f195e1: tokens input 56, output 17441, cache creation 66186, cache read 2153108; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 9cd7d332-dfb1-438a-8435-01a1b2f1d1a1: tokens input 22, output 4128, cache creation 96811, cache read 1013215; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 24e24d02-11d3-4bbe-a542-01a1b2f21a95: tokens input 28, output 7948, cache creation 71713, cache read 1138719; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 9d5031d7-38aa-41ae-992b-01a1b2f635db: tokens input 16, output 2516, cache creation 28331, cache read 394583; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 3eac12a2-eb9f-4be3-96ec-01a1b2f661c8: tokens input 12, output 1975, cache creation 32268, cache read 313545; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 7f39143e-70e5-4ebd-b079-01a1b2f69b6f: tokens input 14, output 2692, cache creation 29939, cache read 352658; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session ed3cc54e-9c08-476f-b286-01a1b2f6d998: tokens input 16, output 2505, cache creation 30777, cache read 415636; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session d87bf8fd-0441-4154-89e5-01a1b2f7d236: tokens input 94, output 26669, cache creation 90657, cache read 4349639; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 954e6fe9-8ccf-47bc-b338-01a1b318d3ae: tokens input 36, output 5006, cache creation 39612, cache read 1093486; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 1945772e-42e1-447f-bb4e-01a1b318fd5c: tokens input 58, output 10322, cache creation 57028, cache read 1865688; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session ab28259b-78f0-4a2b-95b9-01a1b32568fe: tokens input 22, output 3285, cache creation 33459, cache read 598509; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 0f09cac7-f389-4dd5-8c57-01a1b3259168: tokens input 12, output 1748, cache creation 29086, cache read 301241; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 9befbd2e-902c-416f-8d54-01a1b334278a: tokens input 20, output 3819, cache creation 53409, cache read 649524; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session e3aef2b9-c800-4a9a-b550-01a1b3345230: tokens input 40, output 10142, cache creation 73154, cache read 1651779; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 32ca8314-2c60-463a-99b9-01a1b3348f0b: tokens input 64, output 16238, cache creation 64739, cache read 2285765; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session e6d866a2-e525-4678-a23f-01a1b334ccf0: tokens input 28, output 4288, cache creation 48257, cache read 872086; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session ccb2f122-e791-4d70-98b8-01a1b33a8c13: tokens input 20, output 2627, cache creation 31229, cache read 516415; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 54d811b3-4ef7-4f64-83c9-01a1b33b81ef: tokens input 10, output 3532, cache creation 28294, cache read 240911; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session a18850a0-edd5-4ee7-a738-01a1b33d5a57: tokens input 18, output 2946, cache creation 33337, cache read 483864; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 61db32a2-384a-4be2-a326-01a1b33d815f: tokens input 6, output 709, cache creation 21919, cache read 128472; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 144aa878-41f0-4b68-92c9-01a1b33e184d: tokens input 22, output 3234, cache creation 32445, cache read 595398; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 289c8bdd-07ed-4c87-8dd2-01a1b340085e: tokens input 16, output 3226, cache creation 42185, cache read 452818; helper tokens input 0, output 0, cache creation 0, cache read 0

Totals: tokens input 1438, output 300334, cache creation 2174356, cache read 50316007; helper tokens input 0, output 0, cache creation 0, cache read 0