…eam, clean failures

Iterating on the live TUI from real-terminal feedback:

- One global run timer in the footer instead of a per-item clock on every
  pending row (and whole-second, no jittery decimals).
- "brunch" wordmark is now a big lowercase figlet (Slant) in a warm orange
  gradient, replacing the egg.
- Activity log + wordmark stream through Ink <Static> so the full run lands in
  scrollback instead of collapsing in a redrawn bounded box; line cap removed.
- Brigade tracker no longer lights "taste" mid-cook — per-slice verify actions
  fire during cooking, so taste stays unlit until a real end-of-cook signal.
- Failures throw instead of process.exit, so withCookBus disposes (unmounts
  Ink) before the error prints — no more frozen "prep ◐" hang. cook validates
  args before mounting the TUI and rejects unknown flags (e.g. --spec-id).

check + presenter/cook/pi-actions tests green; full build deferred (active
graphite stack navigation).

Co-Authored-By: Claude <noreply@anthropic.com>

Wires the two remaining kitchen-brigade phases faithfully to the
orchestrator-arcs mapping (verify→taste, ship→serve):

- taste lights on the epic-verification verdict (action `epic <id> → …`), not
  on per-slice `verify <target>` lines — those fire mid-cook and previously lit
  taste while still cooking.
- serve lights on a new `cook-done` event emitted at the end of runCook (after
  promotion); a halted run never ships, so it never lights serve.

phase.test covers both signals + the full prep→cook→taste→plate→serve walk;
check + presenter/cook tests green.

Co-Authored-By: Claude <noreply@anthropic.com>

Each cook pi session was a black box in the pending panel — just a KB count.
runPi already subscribes to the session's text stream; instead of bytes,
surface the agent's latest non-empty line (tail-truncated, throttled every
2 KB) as the activity-progress detail, so a wait reads as live work ("agent
writing tests · …adds the RefreshToken guard") rather than "still going".

Kept headless createAgentSession — no pi InteractiveMode, no new pi API: pi's
tool-call events come via an extension hook (on('tool_call')), not the
subscribe stream, so a richer "editing <file> / running <tool>" heartbeat is a
separate follow-up that needs the extension-registration path verified.

check + pi-actions/presenter tests green.

Co-Authored-By: Claude <noreply@anthropic.com>

Richer "what the agent is doing" in the pending panel (the spike's Option A,
full tier): instead of only the agent's latest line, show the tool calls —
"edit src/auth/token.ts", "bash bun test", "grep RefreshToken".

pi exposes no tool-call hook on session.subscribe (text/lifecycle only), so
buildSessionOptions now supplies the built-in tools itself via customTools +
noTools:'builtin': each createXToolDefinition(cwd) is wrapped to emit a label
from its params, then delegates unchanged. The builders bake in the real
config (withFileMutationQueue, truncation defaults), so behavior is preserved
— confirmed in pi's edit.js. Observation is fail-safe (emit in try/catch).

toolLabel + instrumentToolDefinition are pure/unit-tested (label mapping;
wrap delegates same args + result; observer error can't break a tool call).

Caveat: the customTools/noTools runtime wiring isn't covered by tests (they
stub createSession, bypassing buildSessionOptions) — needs a real cook run to
confirm the agent receives the instrumented tools and they emit live.

check + pi-actions tests green.

Co-Authored-By: Claude <noreply@anthropic.com>

Brownfield cook provisioned every slice's git worktree eagerly in
wireHandlers — N `git worktree add` + N recursive node_modules CoW copies
paid synchronously at startup before any slice fired.

- Move slice-worktree creation into resolveSliceCwd via idempotent
  ensureSliceWorktree, so a slice's worktree is materialized on first fire.
  A run touching 2 of 8 slices pays for 2 worktrees, not 8. Synchronous
  provisioning serializes concurrent fires on the JS thread, so parallel-policy
  worktree adds never overlap.
- Symlink each slice's node_modules to the parent worktree's single copy
  instead of CoW-copying per slice (SHAREABLE_TOP_LEVEL_ENTRIES). walkFiles
  already skips symlinks, so the shared tree is never re-walked during dep
  seeding, merge, or promotion. Other gitignored dirs still copy per slice.

Correctness-neutral: same worktrees/branches, just lazy; deps resolve through
the symlink. npm run verify green; adds symlink + idempotency unit tests.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

`brunch serve --land` opt-in: after a brownfield cook promotes to
cook/<runId>, merge that branch into the repo's checked-out branch as
serve's final step. landCookBranch refuses on a dirty tree / detached
HEAD and aborts on conflict — the cook branch is always left intact.
Plain `cook` and default `serve` are unchanged, so FE-877's "never
freelance into the working branch" invariant holds unless opted in.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

The interviewer (interview.ts) and the three cook agent actions
(write-tests / write-code / verify-epic in pi-actions.ts) move from
claude-opus-4-6 to claude-opus-4-8. Secondary-chat and the plan-architect
default are left on 4.6 intentionally.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

The grid made the happy path legible; this does the unhappy path.

- events: slice + cook-done gain `reason?`.
- pi-actions: failed-slice emits carry a reason — evaluate-done maps failureKind
  ('infra error' / 'tests failed'); write-tests/write-code catches use
  'test authoring failed' / 'code authoring failed'.
- cook-cli: cook-done carries result.reason on halt.
- run-store: slice rows store `reason`; RunState.haltReason set from
  cook-done(ok:false), unset on completion.
- ink: a failed slice row shows its reason (red); a HaltSummary footer pins
  "✗ halted · <reason>" (truncated) when the run halts.

Retry-attempt counts ("3/3") DEFERRED — retryCount lives on the petri-net
tokens, not the action context; that's a separate slice.

Verified in an isolated worktree off the TUI branch: check clean; presenter +
pi-actions + cook tests green (141). The one full-suite failure is
build-boundary.test (client production-chunk manifest) — unrelated to this
server-only change; a worktree/symlinked-node_modules artifact, re-verify on a
normal checkout.

Co-Authored-By: Claude <noreply@anthropic.com>

Completes the retry half of failure legibility — without net-token plumbing.
A slice loops failed→running on retry, so the attempt count is derivable from
the slice-event stream the store already folds: queued→running is attempt 1, a
step change mid-run keeps it, failed→running bumps it. The grid shows "attempt N"
only for N≥2 (no clutter on the first run).

No engine/net changes: retryCount on the petri tokens isn't needed — the
observable slice transitions carry the same information.

check + presenter tests green (46).

Co-Authored-By: Claude <noreply@anthropic.com>

project-detect.test.ts had the "resolves the runner from workspace
packages in a monorepo" describe block verbatim twice — remove the copy.

🍳 Built with brunch

Co-Authored-By: claude-opus-4-8 <noreply@anthropic.com>

write-tests and write-code emit a failed slice event before rethrowing on
runPi failure; verify-epic did not, so epic-verification failures left the
slice grid without a failed row or reason. Mirror the wrapper on the epic's
representative slice.

🍳 Built with brunch

Co-Authored-By: Opus 4.8 <noreply@anthropic.com>

mergeSlicesIntoEpicSandbox builds __epic__ trees via walkFiles, which skips
symlinks, so the parent's symlinked node_modules never reached the merged
cwd. verify-epic and probes then ran without resolvable deps even though
per-slice verification passed. Re-link the shareable entries after the merge.

🍳 Built with brunch

Co-Authored-By: Opus 4.8 <noreply@anthropic.com>

The `withTestDir relocates test targets…` describe block was copied verbatim
a second time. Remove the duplicate.

🍳 Built with brunch

Co-Authored-By: Opus 4.8 <noreply@anthropic.com>

Cook actions (write-tests/write-code/verify-epic) and the interview already
run on claude-opus-4-8; the architect default lagged at claude-opus-4-6.
Lift it to 4-8 so plan, cook, and interview paths share the latest Opus.

🍳 Built with brunch

Co-Authored-By: Opus 4.8 <noreply@anthropic.com>

… detail

Three serve/plan presentation fixes the dogfood run surfaced:

- Recipe banner: the header said "brunch plan" / "✓ plan" while the phase
  tracker right below it reads "recipe". Rename both to "recipe" so the
  planning surface speaks one brigade term (the CLI command stays `plan`;
  this is the phase label).
- out folder: plan-start showed the launch root (e.g. the repo dir). Emit
  the spec plan dir (.brunch/cook/specs/<id>) — the exact place plan.yaml
  lands.
- Verbose warnings: --verbose now appends a one-sentence plain-English
  account after each terse warning code (explainEmitterWarning /
  explainReconciliationWarning), so a reviewer needn't know the code
  vocabulary. Default verbosity keeps the terse line.

Also fix a pre-existing typecheck break in run-artifact.test.ts (mode
'codebase' → 'greenfield'; PlanMode is greenfield|brownfield) that was
reddening the gate.

🍳 Built with brunch

Co-Authored-By: claude-opus-4-8 <noreply@anthropic.com>