Fleet Throughput Contract — cumulative execution record

One anchor per landed node. Each entry records the commit, the gate measure as executed, the tests, and anything negative found on the way. The evergreen plan holds the design; this record holds what actually happened.

Contract changes (rolling refill, narrowed freeze, one fleet-size table, preamble diet)

Commit 36e668a (2026-08-17, worker codex-b, wall 562 s, 134 insertions / 60 deletions over skills/reckon-ship/SKILL.md, two reference files and tests/test_skill_contracts.py; merged at 0bb4fa5).

• Rolling refill. A finished, verified worker's slot refills immediately from the ready queue; the safety rule "no dependent node builds on unverified work" occurs exactly once in the skill, and dependent work still waits for verified integrated predecessors.
• Narrowed landing freeze. Promotion and merge stay blocked until the mandatory plan write; dispatching an unrelated ready node explicitly no longer waits.
• One fleet-size vocabulary. Exactly one Items/Strategy table remains across the contract files, marked advisory, naming the free distinct-member roster as the real ceiling.
• Preamble diet. Both engine-injected references are gated behind "only when hand-composing"; the fixed mandatory read set measured 1 file, 8,197 words, ≈10,930 tokens — under the 12k gate and less than half the prior ~24k.

Tests: 4 contract tests added; tests/test_skill_contracts.py 33 passed, 0 failed. Wave-1 integration gate: full suite 1915 passed, 0 failed at 35d4cf3. Logs: ~/.config/reckon/crew/runs/r-20260817T140138256599-ftc-contract/.

Cheap observation reads (ledger record filters, version-only plan read)

Commit 43ebf37 (2026-08-17, worker codex-c, wall 434 s, 578 insertions / 152 deletions over reckon/ledger.py, reckon/mcp.py, reckon/mcp_views.py, reckon/_mcp_tools.py and four test files; merged at 35d4cf3).

• Ledger record filters. crew view=records reads the ledger once and filters completed runs by exact plan, inclusive completed_at since boundary, then most-recent promotion limit, preserving stored order; legacy view=ledger unchanged.
• Version-only read. Typed read_plan view=version returns only resource identity, version, and view. Measured on the live fixture: 126 bytes versus the 2,542-byte raw read — a 95.04% reduction; a landing test writes at that expected_version with no raw read.

Tests: 4 added; focused suites 190 + 34 passed, 0 failed; ruff clean. Wave-1 integration gate: full suite 1915 passed, 0 failed at 35d4cf3. Logs: ~/.config/reckon/crew/runs/r-20260817T140140956251-ftc-mcp-obs/.

Skill/CLI reconciliation (surface parity pinned by test)

Commit 372c243 (2026-08-17, worker codex-b, wall 596 s, 234 insertions / 52 deletions over skills/reckon-ship/SKILL.md, two reference files, AGENTS.md and tests/test_skill_contracts.py; merged at a7de6fd).

• Parity is now mechanical, not prose. 5 new tests cover 6 MCP crew views, 14 instructed CLI command paths and their flags, 6 dispatch exit outcomes, 3 refusal remedies, and launch-owned lifecycle guidance — so a view literal, flag or exit code that drifts from the CLI fails a test instead of misleading an orchestrator.
• Swept items. Member-collision guard, vendored-script prerequisite with its reckon sync remedy, dispatch exit codes 0–5, manifest-aware classification, durable-default manifest guidance, in-harness caveats on resume/stop/continuity, the previously missing records and budget views, the XDG config-home rename with legacy fallback, and removal of the duplicate fleet-size table from AGENTS.md in favour of the canonical skill table.
• The three refusals hit in practice are documented with remedies. A plan dirty against the worktree base (exit 4), a goal joined with ; (exit 2), and a node with no enumerated write path — each cost this sprint's orchestrator a failed dispatch round-trip and each is now stated with its fix.

Tests: 5 added; tests/test_skill_contracts.py 38 passed, 0 failed. Wave-4 integration gate: full suite 1934 passed, 0 failed, 0 skipped at 0f85988 in 84.70 s. Logs: ~/.config/reckon/crew/runs/r-20260817T160556706684-ftc-reconcile/ and ~/.config/reckon/crew/runs/r-20260817T161942885073-w4-verify/.

Filterable runs and complete role routing

Commit 864fc0c (2026-08-17, worker codex-c, wall 325 s, 86 insertions / 7 deletions over reckon/cli.py, reckon/crew.py, reckon/schema/flight-defaults.yaml and two test files; fast-forwarded).

• Filters. crew list takes --project and --phase through the shared live-pointer read. Measured over three pointers: project-only returns 2, phase-only returns 2, and the two combined return exactly 1. Unfiltered listing stays the default.
• Every mandated worker type now dispatches. The shipped role set is cleanup, documentation, implement, investigate, review and test — all six resolve without a role error, with test/investigate/review read-only and cleanup/documentation/implement at worktree-full. The contract previously instructed test and documentation workers the CLI would have refused.

Tests: 5 added; focused suites 189 passed, 0 failed; ruff clean. Role resolution recorded at ~/.config/reckon/crew/runs/r-20260817T163347537041-ftc-roles/resolved-roles.json.

Time budgets (measured per-role defaults, overrun watchdog, retired concurrency key)

Commit d5d3c35 (2026-08-17, worker codex-d, 311 insertions / 70 deletions over reckon/schema/flight.yaml and its two generated artifacts, reckon/flight.py, reckon/crew.py, reckon/schema/flight-defaults.yaml and two test files; merged at fa14abc). Scope was widened mid-flight, so the run is recorded scope_changed and excluded from effort calibration.

Defaults derived from the committed ledger, with the provenance of each figure stated rather than implied:

• Ceiling separated from default. The hard ceiling resolves independently at 60 m, so a 45 m implement node dispatches against defaults with no host config edit.
• Watchdog. Live classification exposes declared budget, elapsed time, overrun state and overrun seconds in one poll; opt-in enforcement stops an overdue CLI process only past the configured 1.5× grace multiple and records phase=stopped truthfully. Disabled by default.
• Concurrency key retired per the locked decision: absent from the source schema, the generated model, the public JSON schema, resolved config and provenance. A legacy host value is stripped before validation and surfaced as a warning while dispatch stays valid — demonstrated on this workstation's own host config, which still carries concurrency: 3 and resolves without error.

Tests: 4 added; focused suites 186 passed, 0 failed; ruff clean; schema regeneration exit 0. Logs: ~/.config/reckon/crew/runs/r-20260817T161940557547-ftc-budgets/.

Negative finding: an exclusive scope can be exclusive and still insufficient. The node was first dispatched owning the generated reckon/_flight_schema.py but not its source reckon/schema/flight.yaml nor the published docs/_shared/flight.schema.json. It stopped without writing anything rather than hand-edit a generated artifact, and was correct to: the repository enforces regeneration parity under test. The scoped pre-dispatch property checks that no two nodes share a path, not that the named paths can carry the goal — so only the coordinator can catch this, and a generated file must never be scoped without its source.

Sandbox tier follows execution capability

Commit 9747555 (2026-08-17, worker codex-c, wall 343 s, 82 insertions / 13 deletions over reckon/schema/flight.yaml and its two generated artifacts, reckon/flight.py, reckon/schema/flight-defaults.yaml and tests/test_flight.py; fast-forwarded).

Found by using the role the previous node had just added. The final suite gate was dispatched under the new test role and could not run: the role resolved read-only, so uv had no writable cache and no network to resolve build requirements, and pytest collected 0 tests. The gate was recorded not-run with that reason rather than passed or failed — an absence of evidence is neither.

• Enforcement follows a declared capability, not a role-name allowlist. Resolution now rejects any execution-capable role lacking worktree-write permission and reserves read-only for roles explicitly declared non-executing. An arbitrary role named executor proves the rule generalises, so a future execution-capable role cannot be shipped read-only.
• Tests: 1 invariant test added and the six-role contract test strengthened; focused suites 190 passed, 0 failed; ruff clean; schemas regenerate byte-identically (41,628 bytes of generated artifacts from an 11,905-byte source).

Why the §5 parity test did not catch it. That test asserts every role the contract instructs resolves, which this role did. Resolving and being able to do the work are different properties, and only the second one matters to a worker — which is why the new invariant is written against capability rather than against the list of names.

Final sprint gate, and the fix demonstrating itself. The gate was re-dispatched under the corrected test role, resolving worktree-full: full suite 1941 passed, 0 failed, 0 skipped at 3e017f0 in 74.39 s, exit 0. The same node that could not collect a single test before the fix wrote both its cache and its manifest after it. Log: ~/.config/reckon/crew/runs/r-20260817T165120105364-s11-gate/full-pytest.log.