v2.7.14 — Org Runtime: the schedule holds

Org Runtime fixes that make a scheduled org serve daemon actually hold its schedule, plus a measured Second Brain retrieval improvement.

Org Runtime v2 — the schedule now holds

Four defects, each of which silently cost a running org work:

• Scheduled runs were capped at 10 minutes. maxMs defaulted to min(interval, 10min) unless run_config.max_run was set. Real cycles run 75–93 minutes, so a 2h-scheduled org was force-stopped a twelfth of the way in, every time, with nothing reporting it. Now defaults to the full interval.
• A tick arriving mid-run was dropped, so an org that overran its interval idled until the next boundary. Missed ticks now coalesce into a single catch-up fired the moment the run ends.
• A daemon restart reset the period wholesale — an org that ran 24 minutes ago on a 2h schedule then waited a further 2h instead of the 1h36m it was owed. The first tick is now phased to the org's own clock.
• Nothing could ask a live daemon to start an org off-cycle. org run against a served org spawned a second daemon competing for the same runtime.json and broker lease, so "run it now" meant killing the daemon and losing both the schedule and any in-flight work. org run now hands the request to the daemon through a run sentinel mirroring the existing stop one, carrying --task along with it.

Also: a planned stop (org_complete) now drains in-flight agent sessions for up to 5 minutes instead of SIGTERMing them at 15 seconds. Agents mid-build or mid-edit were being killed and reported as crashed, and their work discarded.

run_config.max_run is new — a wall-clock bound on one scheduled cycle, defaulting to the schedule interval. /mastermind:createorg now sets it for scheduled orgs and documents --max-run.

Observability

• A failed agent turn is no longer logged as usage. An SDK result whose subtype was anything but success — max_turns, refused, rate-limited, errored mid-execution — was recorded only as a usage event, indistinguishable from a healthy turn. Three consecutive cycles once produced zero tool calls across all seven roles, and the only signal was the idle watchdog firing twenty minutes later with no stated cause.
• org status reports degraded state. A role that exhausted its spawn retries left the org permanently short-handed while status still read a clean running. Abandoned roles are now named on the status line.
• The SDK process cap no longer starves an org of its own roles. Sized for the machine (cpus - 2), it silently deferred the tail roles of any larger org forever — a 7-role org on an 8-core box permanently lost its 7th.

Org roles run at the project root

Role sessions ran in an empty scratch dir, so the policy engine denied every repo path (path escapes org workdir) — a development org could not read or edit a single file of the project it existed to work on. Roles fell back to Bash, which is not path-scoped, meaning the sandbox blocked the safe tools and let the unrestricted one through. Opt back in with run_config.workspace: "isolated".

Second Brain

• Embedding model swapped to gte-modernbert-base, worth +0.128 Recall@5 (0.364 → 0.492) on a 517-document golden set via monomind doc eval. The choice moved twice under measurement before landing here.
• Chunk summaries truncate at 120 characters with an ellipsis. They were sliced to a bare 150, so a clipped summary read as a complete sentence to both a human and the embedding model.

Doctor

New AppleDouble Sidecars check. macOS writes ._name files when copying to exFAT and most USB/network volumes; Claude Code reads .claude/skills/ and .claude/commands/ to discover entries, so a stray ._createorg.md registers as a real command whose content is a binary resource fork. Checked across both .claude trees — including the npm-shipped copy, where such a file would reach users. doctor --fix removes them.