@botbuddy/cli 1.63.18 → 1.63.21

package/daemon-release/darwin-arm64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.63.18",
-  "source_commit": "2618d4af55e0c7ae2ba0ba681651a0e26001c27c",
-  "source_sha256": "c34897f45f8995842c783f1e8fa3d5162bcee644ea217ecbfdf7de4bbf43f013",
+  "release_version": "1.63.21",
+  "source_commit": "ab207b617fc4964bbb38137736885e9962e71afc",
+  "source_sha256": "93fe3db3d6b3c94deb36c76aa04f51cea071e3f839082545af484e9d2abacee4",
   "target": "darwin-arm64",
-  "sha256": "ddc8dc88ba145722693857b73162735b60a2b976f0d79259d4c69f1852712688"
+  "sha256": "84dd23363db44e16419fe733119d819566d8727441f309a318e342cffec5c18b"
 }

package/daemon-release/linux-x64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.63.18",
-  "source_commit": "2618d4af55e0c7ae2ba0ba681651a0e26001c27c",
-  "source_sha256": "c34897f45f8995842c783f1e8fa3d5162bcee644ea217ecbfdf7de4bbf43f013",
+  "release_version": "1.63.21",
+  "source_commit": "ab207b617fc4964bbb38137736885e9962e71afc",
+  "source_sha256": "93fe3db3d6b3c94deb36c76aa04f51cea071e3f839082545af484e9d2abacee4",
   "target": "linux-x64",
-  "sha256": "5aca12a9cbba85b2566dd76ea6fad3e9288f0f7367df3e2050c4df0d65a1e1ba"
+  "sha256": "a8f549e6f04d9e61b8e9ff6f37dca0c4fe008d37fdd0afd35a771b2c9c0e36c5"
 }

package/daemon-release/manifest.json

@@ -1,21 +1,21 @@
 {
   "schema_version": 1,
-  "release_version": "1.63.18",
-  "source_commit": "2618d4af55e0c7ae2ba0ba681651a0e26001c27c",
-  "source_sha256": "c34897f45f8995842c783f1e8fa3d5162bcee644ea217ecbfdf7de4bbf43f013",
+  "release_version": "1.63.21",
+  "source_commit": "ab207b617fc4964bbb38137736885e9962e71afc",
+  "source_sha256": "93fe3db3d6b3c94deb36c76aa04f51cea071e3f839082545af484e9d2abacee4",
   "targets": {
     "darwin-arm64": {
       "goos": "darwin",
       "goarch": "arm64",
       "binary": "daemon/bin/darwin-arm64/botbuddy-daemon",
-      "sha256": "ddc8dc88ba145722693857b73162735b60a2b976f0d79259d4c69f1852712688",
+      "sha256": "84dd23363db44e16419fe733119d819566d8727441f309a318e342cffec5c18b",
       "mode": "0755"
     },
     "linux-x64": {
       "goos": "linux",
       "goarch": "amd64",
       "binary": "daemon/bin/linux-x64/botbuddy-daemon",
-      "sha256": "5aca12a9cbba85b2566dd76ea6fad3e9288f0f7367df3e2050c4df0d65a1e1ba",
+      "sha256": "a8f549e6f04d9e61b8e9ff6f37dca0c4fe008d37fdd0afd35a771b2c9c0e36c5",
       "mode": "0755"
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.63.18",
+  "version": "1.63.21",
   "description": "BotBuddy \u2014 Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/stack-isolation.mjs

@@ -791,9 +791,12 @@ export function stableRunStackReusable(worktreeRoot, dirName, { read = readFileS
  * generated links name the listener of the invocation that started that stack, so
  * refuse any unreleased marker for this slot before deriving a new bundle or ports.
  */
-export function assertFreshRunStackAvailable(worktreeRoot, slot, { read = readFileSync, readdir = readdirSync, lstat = lstatSync } = {}) {
+export function assertFreshRunStackAvailable(worktreeRoot, slot, { read = readFileSync, readdir = readdirSync, lstat = lstatSync, liveOwnerOnly = false } = {}) {
   const refuse = () => {
-    const error = new Error("requester origin cannot resume a retained slot context; inspect its owning lease with `bb stack status <lease-id>` and use `bb stack done <lease-id> --reap` only after that owner finishes, then confirm reaped before a fresh run");
+    const error = new Error(liveOwnerOnly
+      // A stable run refuses only a live owner: never suggest tearing its batch down.
+      ? "another `bb stack run` on this machine is still using this slot's stack; wait for it to finish, then re-run"
+      : "requester origin cannot resume a retained slot context; inspect its owning lease with `bb stack status <lease-id>` and use `bb stack done <lease-id> --reap` only after that owner finishes, then confirm reaped before a fresh run");
     error.code = "REQUESTER_ORIGIN_RETAINED_CONTEXT";
     throw error;
   };
@@ -809,16 +812,52 @@ export function assertFreshRunStackAvailable(worktreeRoot, slot, { read = readFi
     let marker;
     try { marker = JSON.parse(read(path, "utf8")); } catch { refuse(); }
     if (!marker || typeof marker.slot !== "string") refuse();
-    if (marker.slot !== slot || marker.released === true) continue;
+    // BOT-2788: an idle-retained context is resumable. Its lease went idle cleanly, so no
+    // batch is using it; the control plane re-adopts it only for the exact remote variant
+    // (same logical origin) and reprovisions it through the canonical reap otherwise.
+    if (marker.slot !== slot || marker.released === true || marker.idle_retained === true) continue;
     // An expired context whose owner is gone is what materialization GC collects anyway; the
     // control plane still refuses a new remote lease while any lease on the slot is unreaped.
     const ownerAlive = Number.isInteger(marker.owner_pid) && marker.owner_pid > 0 &&
       (!marker.host || marker.host === hostname()) && pidIsAlive(marker.owner_pid);
     const expired = marker.idle_retained !== true && Number.isFinite(marker.retain_until) && Date.now() >= marker.retain_until;
-    if (!expired || ownerAlive) refuse();
+    // BOT-2788: a stable run (liveOwnerOnly) refuses only while the owner may still run.
+    if (ownerAlive || (!liveOwnerOnly && !expired)) refuse();
   }
 }
 
+const REQUESTER_ORIGIN_RE = /^http:\/\/127\.0\.0\.1:([0-9]{4,5})$/;
+/**
+ * BOT-2788: the loopback port of the logical requester origin an IDLE stack in this stable
+ * directory generated its links for, or null. Only a cleanly idled context on this same
+ * machine qualifies; anything else starts a fresh origin (the control plane then reprovisions
+ * any idle stack whose remote variant differs).
+ */
+export function idleRequesterOriginPort(worktreeRoot, dirName, { read = readFileSync, host = hostname } = {}) {
+  if (typeof dirName !== "string" || !dirName) return null;
+  const marker = readStackMarker(join(worktreeRoot, LEASED_STACKS_DIR, dirName), read);
+  if (!marker || marker.idle_retained !== true || marker.released === true) return null;
+  if (typeof marker.host !== "string" || marker.host !== host()) return null;
+  const match = REQUESTER_ORIGIN_RE.exec(typeof marker.requester_origin === "string" ? marker.requester_origin : "");
+  const port = match ? Number(match[1]) : NaN;
+  return Number.isInteger(port) && port >= 1024 && port <= 65535 ? port : null;
+}
+
+/** BOT-2788: does this stable directory hold a cleanly idled stack (its lease went idle)? */
+export function stableRunStackIdle(worktreeRoot, dirName, { read = readFileSync } = {}) {
+  if (typeof dirName !== "string" || !dirName) return false;
+  const marker = readStackMarker(join(worktreeRoot, LEASED_STACKS_DIR, dirName), read);
+  return marker?.idle_retained === true && marker.released !== true;
+}
+
+/** BOT-2788: record the logical requester origin this stack's remote variant names. */
+export function recordRequesterOrigin(stackDir, origin, { read = readFileSync, write = writeFileSync, rename = renameSync } = {}) {
+  if (!REQUESTER_ORIGIN_RE.test(origin ?? "")) throw new Error("requester origin refused");
+  const marker = readStackMarker(stackDir, read);
+  if (!marker) throw new Error("stack marker unavailable");
+  atomicWrite(join(stackDir, LEASED_STACK_MARKER), JSON.stringify({ ...marker, requester_origin: origin }), { write, rename });
+}
+
 /** BOT-1803: record a PROVEN reap on the stack's marker, so the next run may reuse the directory. */
 export function markLeasedStackReleased(stackDir, { read = readFileSync, write = writeFileSync, rename = renameSync } = {}) {
   const marker = readStackMarker(stackDir, read);

package/src/stack-requester-origin-config.mjs

@@ -1,6 +1,6 @@
 // BOT-2780: parse and roundtrip the private derived config before bundling.
 // The vendored, hash-pinned smol-toml 1.9.1 parser (src/vendor/smol-toml) is loaded only
-// for the beta requester-origin feature; help and legacy paths never import it.
+// for requester-origin runs (BOT-2780/BOT-2788); help and legacy paths never import it.
 import {isDeepStrictEqual} from 'node:util';
 const fail=(code,message)=>{const error=Error(message);error.code=code;throw error};
 let parser;

package/src/stack.mjs

@@ -43,7 +43,7 @@ import { AGENT_KEY_RE, readAgentSessionTokenEnv } from "./agent-key.mjs";
 import { resolveAgentSessionCredential, selfHealAgentSession } from "./agent-session.mjs";
 import { runDockerCommand, runDockerWorkflow, ADMITTED_DOCKER_VALIDATIONS } from "./docker-hygiene.mjs";
 import { acquireStackLock, lockPathForProject, projectIdFromConfig } from "./stack-file-lock.mjs";
-import { LEASED_STACK_IDLE_RETENTION_SECS, assertFreshRunStackAvailable, recordAdmissionRequest, bindLeasedStackClaim, recoverLeasedStackClaim, hasLocalLeaseClaim, leasedClaimContext, assertLeasedStackIsolated, leasedStackClaimHeld, markLeasedStackReleased, stableRunStackReusable, leasedStackIdentity, materializeRunStackDir, portMapInConfig, refreshLeasedStackRetention, releaseLeasedStackClaim, reservePortBlocks } from "./stack-isolation.mjs";
+import { LEASED_STACK_IDLE_RETENTION_SECS, assertFreshRunStackAvailable, idleRequesterOriginPort, recordRequesterOrigin, stableRunStackIdle, recordAdmissionRequest, bindLeasedStackClaim, recoverLeasedStackClaim, hasLocalLeaseClaim, leasedClaimContext, assertLeasedStackIsolated, leasedStackClaimHeld, markLeasedStackReleased, stableRunStackReusable, leasedStackIdentity, materializeRunStackDir, portMapInConfig, refreshLeasedStackRetention, releaseLeasedStackClaim, reservePortBlocks } from "./stack-isolation.mjs";
 import { reserveRequesterOrigin } from "./stack-requester-origin.mjs";
 import { identifiedAdmissionAck, identifiedAdmissionDelivery, identifiedAdmissionRecovery } from "./stack-identified-admission.mjs";
 import { patchRequesterAuthOrigin } from "./stack-requester-origin-config.mjs";
@@ -62,11 +62,20 @@ import { reportStackRunOutcome } from "./stack-run-outcome.mjs";
 export const STACK_SCHEMA_VERSION = 1;
 
 /**
- * BOT-2780: only `stack run --remote --execution-ring beta --reap` reserves a requester
- * origin and allocates through BOT-2499's identified admission. The origin cannot outlive
- * its CLI, so the invocation must own cleanup; stable/auto/local and idle runs are unchanged.
+ * BOT-2780 / BOT-2788: a `stack run` that may be served by another host reserves a requester
+ * origin and allocates through BOT-2499's identified admission. Stable (the default ring):
+ * auto or remote placement, with or without `--reap` (an idle stack is continued on the same
+ * logical origin by a later run); runs that pin a host, a prepared stack path, a fixed nonce
+ * or a co-located placement, or pass a callback port (BOT-2775), keep the legacy path
+ * unchanged. Beta: BOT-2780's `--remote --reap` gate, which refuses those contexts instead.
  */
-export const requesterOriginEnabled = (opts) => opts.execution === "remote" && opts.executionRing === "beta" && opts.reap === true;
+export const requesterOriginEnabled = (opts) => {
+  if (opts.execution === "local" || opts.localOnly || opts.localExec) return false;
+  // Beta keeps BOT-2780's gate (remote + --reap); its idle/callback runs stay on BOT-2775's path.
+  if (opts.executionRing === "beta") return opts.execution === "remote" && opts.reap === true;
+  if (opts.execution != null && opts.execution !== "auto" && opts.execution !== "remote") return false;
+  return opts.host == null && opts.stackNonce == null && (opts.stackPath == null || opts.stackPath === "" || opts.stackPath === ".") && opts.callbackPort == null;
+};
 // Exact replays of one identified request after an uncertain answer (lost response, 5xx,
 // ADMISSION_UNCERTAIN, pending delivery). The same request_id can never create a second lease.
 const ADMISSION_REPLAY_DELAYS_MS = [1000, 2000, 4000];
@@ -255,12 +264,17 @@ ${bold("run OPTIONS")}
                          else a remote host with capacity; the bundle digest is sent up front.
   --execution-ring R     Capacity rollout ring: stable (default) excludes beta daemon hosts.
                          beta is explicit opt-in and requires \`stack run --remote\`.
-                         With --remote --execution-ring beta --reap (BOT-2780), run reserves a
-                         loopback requester origin first and writes it as the private stack copy's
-                         [auth] external_url, so generated auth links (/auth/v1/verify…) reach the
-                         stack unchanged even when the SSH API forward is remapped; the child gets
-                         it as connection.requester_origin. The lease is requested through the
-                         identified admission (exact replay after a lost response, no fallback).
+                         Requester origin (BOT-2780/BOT-2788): a stable \`stack run\` that may be
+                         served remotely (auto or --remote; no --host/--stack-path/--callback-port)
+                         and --remote --execution-ring beta --reap reserve a loopback origin first;
+                         only the remote bundle's config names it as [auth] external_url, so
+                         generated auth links (/auth/v1/verify…) reach the stack unchanged even when
+                         the SSH API forward is remapped; the child gets connection.requester_origin.
+                         A co-located placement runs the canonical stack and closes the origin.
+                         The next run re-reserves an idle stack's origin to reuse it; when that
+                         port is busy the idle stack is reprovisioned, never retargeted. The lease
+                         is requested through the identified admission (exact replay after a lost
+                         response, no fallback).
   --callback-port N      The caller runs a listener the stack calls back through
                          host.docker.internal:N (e.g. 4600): sent as callback_port. On a stable or
                          auto REMOTE lease run first probes the host with a throwaway reverse forward
@@ -899,7 +913,7 @@ async function claimProjectLock(projectId, lock, subject) {
   }
 }
 
-export async function resolveRunExecution(cwd, opts, { materialize = materializeRunStackDir, lock = acquireStackLock, identity = leasedStackIdentity, reserveBlocks = reservePortBlocks, releaseClaim = releaseLeasedStackClaim, claimHeld = leasedStackClaimHeld, stableReusable = stableRunStackReusable, markReleased = markLeasedStackReleased, portRegistryDir = null, warn = (line) => process.stderr.write(`${line}\n`) } = {}) {
+export async function resolveRunExecution(cwd, opts, { materialize = materializeRunStackDir, lock = acquireStackLock, identity = leasedStackIdentity, reserveBlocks = reservePortBlocks, releaseClaim = releaseLeasedStackClaim, claimHeld = leasedStackClaimHeld, stableReusable = stableRunStackReusable, markReleased = markLeasedStackReleased, idleOriginPort = idleRequesterOriginPort, stableIdle = stableRunStackIdle, recordOrigin = recordRequesterOrigin, reserveOrigin = reserveRequesterOrigin, portRegistryDir = null, warn = (line) => process.stderr.write(`${line}\n`) } = {}) {
   const refuseRoot = (execution) => {
     if (execution.stackPath === ".") {
       throw new Error(
@@ -909,10 +923,12 @@ export async function resolveRunExecution(cwd, opts, { materialize = materialize
     }
     return execution;
   };
-  // BOT-2780: the requester origin is only for a fresh CLI-managed stack context. A
-  // prepared path, pinned host or fixed nonce could resume a stack whose generated links
-  // already name another invocation's listener.
-  const originRun = requesterOriginEnabled(opts);
+  // BOT-2780: the requester origin is only for a CLI-managed stack context. A prepared path,
+  // pinned host or fixed nonce could resume a stack whose generated links name another
+  // invocation's listener (a stable run with one of them is simply not an origin run).
+  // A stable origin run is the caller's choice to supply its admission identity (runStack
+  // always does); a beta run without one is refused below.
+  const originRun = requesterOriginEnabled(opts) && (opts.executionRing === "beta" || (UUID_RE.test(opts.admissionRequestId ?? "") && Boolean(opts.requesterMachineId)));
   if (originRun && (opts.host != null || opts.stackNonce != null || (opts.stackPath && opts.stackPath !== ".") ||
       !UUID_RE.test(opts.admissionRequestId ?? "") || !opts.requesterMachineId)) {
     const error = new Error("beta requester origins require a fresh CLI-managed stack context (no --host, --stack-path or fixed nonce)");
@@ -986,27 +1002,70 @@ export async function resolveRunExecution(cwd, opts, { materialize = materialize
   const held = await claimProjectLock(projectId, lock, `this batch's isolated stack (${projectId})`);
   let requesterOrigin = null;
   let originContext = null;
+  let originContinuation = null;
+  let previousPort = null;
+  // BOT-2788: this run resumes the directory of a cleanly idled stack (its block is bound to it).
+  const resumedIdle = originRun && nonce == null && stableIdle(worktreeRoot, stableDir);
   try {
-    let configText;
     if (originRun) {
-      // BOT-2780: refuse a retained slot context, then reserve the listener BEFORE the
-      // private config (and so the bundle digest) is derived. The source config is never
-      // changed; only the private materialized copy names the reserved origin.
-      assertFreshRunStackAvailable(worktreeRoot, opts.slot);
+      // BOT-2780: refuse a live retained slot context, then reserve the listener BEFORE the
+      // remote config variant (and so the bundle digest) is derived.
+      // A stable run refuses only a context whose owner is still running; a dead owner's
+      // unexpired claim is the control plane's to judge (it refuses any live slot lease).
+      assertFreshRunStackAvailable(worktreeRoot, opts.slot, { liveOwnerOnly: opts.executionRing !== "beta" });
       originContext = Object.freeze({ request_id: opts.admissionRequestId, worktree: worktreeRoot, slot: opts.slot, machine: opts.requesterMachineId });
-      requesterOrigin = await reserveRequesterOrigin({ context: originContext });
-      // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal -- canonical realpath of the current worktree; fixed own source config, never a request-supplied path.
-      configText = await patchRequesterAuthOrigin(readFileSync(join(worktreeRoot, "supabase", "config.toml"), "utf8"), requesterOrigin.origin);
+      // BOT-2788: an idle stack in this directory generated its links for a logical origin.
+      // Re-reserve exactly that port, so the remote variant (and so the idle lease) is the
+      // same. A busy port is never retargeted: a new origin makes a new variant, which the
+      // control plane reprovisions through its canonical reap instead of re-adopting.
+      previousPort = nonce == null ? idleOriginPort(worktreeRoot, stableDir) : null;
+      if (previousPort != null) {
+        try {
+          requesterOrigin = await reserveOrigin({ context: originContext, port: previousPort });
+          originContinuation = "previous";
+        } catch (error) {
+          if (error?.code !== "REQUESTER_ORIGIN_PORT_BUSY") throw error;
+          originContinuation = "previous_port_busy";
+          warn(`stack: the idle stack's requester origin 127.0.0.1:${previousPort} is in use on this machine; reserving a new origin (the idle stack is reprovisioned, never retargeted)`);
+        }
+      }
+      if (!requesterOrigin) {
+        requesterOrigin = await reserveOrigin({ context: originContext });
+        originContinuation ??= "new";
+      }
+      // Validate the source config before anything is materialized: an explicit conflicting
+      // auth issuer refuses a beta run, and keeps a stable run on the unchanged legacy path.
+      try {
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal -- canonical realpath of the current worktree; fixed own source config, never a request-supplied path.
+        await patchRequesterAuthOrigin(readFileSync(join(worktreeRoot, "supabase", "config.toml"), "utf8"), requesterOrigin.origin);
+      } catch (error) {
+        if (error?.code !== "REQUESTER_ORIGIN_EXPLICIT_CONFLICT" || opts.executionRing === "beta") throw error;
+        warn("stack: supabase/config.toml sets its own [auth] external_url, so this run keeps the legacy (non-requester-origin) path");
+        await requesterOrigin.close();
+        requesterOrigin = null;
+        originContinuation = null;
+      }
     }
+    // The materialized stack stays canonical (a co-located placement serves it unchanged);
+    // only the remote bundle's config variant names the reserved origin.
     const execution = refuseRoot(resolveStackPath(cwd, materialize(
       cwd,
       { slot: opts.slot, repo: opts.repo, ticket: opts.ticket, nonce, idleTtlSecs: opts.idleTtl ?? undefined },
       // BOT-2403: a functions directory another writer replaced under this stack is reported.
-      { ...(portRegistryDir ? { portRegistryDir } : {}), warn, ...(configText !== undefined ? { configText } : {}) },
+      { ...(portRegistryDir ? { portRegistryDir } : {}), warn },
     )));
+    let originConfigText = null;
+    if (requesterOrigin) {
+      // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal -- this invocation's own materialized stack directory, never a request-supplied path.
+      originConfigText = await patchRequesterAuthOrigin(readFileSync(join(stackDirFor(execution), "supabase", "config.toml"), "utf8"), requesterOrigin.origin);
+      // Re-materializing rewrote the marker: keep the idle stack's own origin on it until this
+      // run is admitted (runStack records the reserved one then, via recordOrigin below).
+      if (previousPort != null) recordOrigin(stackDirFor(execution), `http://127.0.0.1:${previousPort}`);
+    }
     return {
       ...execution,
-      ...(requesterOrigin ? { requesterOrigin, originContext, admissionRequestId: opts.admissionRequestId,
+      ...(requesterOrigin ? { requesterOrigin, originContext, originConfigText, originContinuation, resumedIdle, admissionRequestId: opts.admissionRequestId,
+        recordOrigin: () => recordOrigin(stackDirFor(execution), requesterOrigin.origin),
         recordAdmission: (requestId) => recordAdmissionRequest(stackDirFor(execution), requestId, portRegistryDir ? { registryDir: portRegistryDir } : undefined) } : {}),
       bindLease: (leaseId) => bindLeasedStackClaim(stackDirFor(execution), leaseId, portRegistryDir ? { registryDir: portRegistryDir } : undefined),
       // Release is called once the batch's signed reap is done, so hand the host
@@ -3492,6 +3551,8 @@ export async function recoverLocalLeaseClaim(lease, proof, { cwd = process.cwd()
 const SIGNAL_EXIT = Object.freeze({ SIGINT: 130, SIGTERM: 143, SIGHUP: 129 });
 /** BOT-1803: request answers meaning "this slot's idle lease is being reaped; re-request once it is". */
 const IDLE_REPROVISION_REASONS = Object.freeze({ IDLE_LEASE_REPROVISIONING: "digest_mismatch", LEASE_PREEMPTED: "preempted" });
+// BOT-2788: identified answers about the caller's OWN slot lease (no receipt was written).
+const IDENTIFIED_OWN_SLOT_ANSWERS = new Set([...Object.keys(IDLE_REPROVISION_REASONS), "SLOT_REAPING", "QUEUED_LEASE_VARIANT_MISMATCH", "EXISTING_SLOT_REFUSED"]);
 // BOT-2403: the re-adopted idle stack failed the functions-mount gate and was reaped.
 const READOPT_UNHEALTHY_REASON = "unhealthy_mount";
 
@@ -3949,7 +4010,10 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
         // BOT-2780: one identified admission key per invocation, held through replays.
         ...(requesterOriginEnabled(opts) ? { admissionRequestId: randomUUID(), requesterMachineId: hardwareUuid } : {}),
       });
-      if (requesterOriginEnabled(opts) && (!execution.requesterOrigin || !execution.admissionRequestId || !execution.originContext)) {
+      // A beta run must hold its origin; a stable run whose repo pins its own auth issuer keeps
+      // the legacy path (resolveRunExecution reports that), and any origin it holds is complete.
+      if ((requesterOriginEnabled(opts) && opts.executionRing === "beta" && !execution.requesterOrigin) ||
+          (execution.requesterOrigin && (!execution.admissionRequestId || !execution.originContext || typeof execution.originConfigText !== "string"))) {
         await closeOrigin();
         const error = new Error("requester origin context unavailable"); error.code = "REQUESTER_ORIGIN_CONTEXT_REFUSED"; throw error;
       }
@@ -3981,13 +4045,24 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
     let executionRequest = opts.execution ?? "auto";
     let bundle = null;
     const bundleInclude = opts.bundleInclude ?? [];
-    const buildRunBundle = ({ digestOnly = false } = {}) => {
+    // BOT-2788: the remote variant differs from the materialized (canonical) stack only in
+    // its private supabase/config.toml, which names the reserved requester origin.
+    let originConfigPath = null;
+    if (execution.requesterOrigin) {
+      // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal -- this invocation's own materialized stack directory, never a request-supplied path.
+      try { originConfigPath = realpathSync(join(stackDirFor(execution), "supabase", "config.toml")); } catch { originConfigPath = null; }
+    }
+    const buildRunBundle = ({ digestOnly = false, remoteVariant = false } = {}) => {
       // BOT-2162: ship the worktree's BOT-2107 readiness declaration with the stack, so the
       // serving Helper runs the canonical bind-RPC probe for a remote lease too.
       const declaration = join(execution.worktreeRoot, ".botbuddy", "config.json");
       let hasDeclaration = false;
       try { hasDeclaration = existsSync(declaration) && lstatSync(declaration).isFile(); } catch { hasDeclaration = false; }
+      if (remoteVariant && !originConfigPath) {
+        const error = new Error("the requester-origin config variant has no materialized config to replace"); error.code = "REQUESTER_ORIGIN_DIGEST_UNAVAILABLE"; throw error;
+      }
       return buildBundle(stackDirFor(execution), {
+        ...(remoteVariant ? { readFile: (abs, ...rest) => abs === originConfigPath ? Buffer.from(execution.originConfigText, "utf8") : readFileSync(abs, ...rest) } : {}),
         // A digest that ships nothing has no upload cap (the archive is only hashed).
         maxBytes: digestOnly ? Number.MAX_SAFE_INTEGER : (opts.bundleMaxBytes ?? DEFAULT_BUNDLE_MAX_BYTES),
         ...(digestOnly ? { rawLimitBytes: Number.MAX_SAFE_INTEGER } : {}),
@@ -4003,12 +4078,15 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
     // an idle lease instead of handing back a stack whose content it cannot prove current.
     let stackDigest = null;
     let digestError = null;
-    if (executionRequest === "local") {
+    // BOT-2788: an `auto` origin run keeps the canonical (co-located) digest, so local idle
+    // re-adoption is unchanged; the control plane matches a remote idle stack by its exact
+    // remote variant (bundle_sha256) instead. An explicit remote run's digest IS the variant.
+    if (executionRequest === "local" || (execution.requesterOrigin && executionRequest !== "remote")) {
       try { stackDigest = buildRunBundle({ digestOnly: true })?.sha256 ?? null; } catch (error) { digestError = error; }
     }
     if (executionRequest !== "local") {
       try {
-        bundle = buildRunBundle();
+        bundle = buildRunBundle({ remoteVariant: Boolean(execution.requesterOrigin) });
         for (const entry of bundle.included ?? []) {
           stderrLine(`stack: the bundle includes ${entry.path} (sha256 ${entry.sha256.slice(0, 12)}…; keys: ${entry.keys.join(", ") || "none"})`);
         }
@@ -4024,6 +4102,12 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
         // Codex #1077 P2: without a digest, `auto` could still pick a remote host and be
         // refused BUNDLE_REQUIRED instead of queueing here, so ask for this machine.
         executionRequest = "local";
+        // BOT-2788: a co-located request needs no requester origin; it takes the unchanged
+        // legacy path exactly as before (only a beta run, always remote, must keep its origin).
+        if (execution.requesterOrigin) {
+          await closeOrigin();
+          for (const key of ["requesterOrigin", "originContext", "originConfigText", "originContinuation", "admissionRequestId", "recordAdmission", "recordOrigin"]) delete execution[key];
+        }
         stderrLine(`${yellow("⚠")} stack: could not build the remote-lease bundle (${message}); requesting a co-located lease (execution local) instead.`);
       }
     }
@@ -4061,6 +4145,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
     // server-side; replays of this exact request can never create a second lease.
     let identifiedVerdict = null;
     let requestIdentified = null;
+    let renewIdentifiedRequest = null;
     if (execution.admissionRequestId) {
       if (!stackDigest || !bundle?.sha256) {
         return { exitCode: EXIT.INTERNAL, outcome: "error", code: "REQUESTER_ORIGIN_DIGEST_UNAVAILABLE", error: "the requester-origin bundle digest could not be computed; no lease was requested" };
@@ -4079,6 +4164,13 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       const settle = (code) => {
         identifiedVerdict = ownedAck ? { kind: "owned", code, ack: ownedAck } : { kind: "uncertain", code, ack: null };
       };
+      // BOT-2788: a readopted key is consumed once its idle stack is reaped as unhealthy; the
+      // fresh request after that reap is a new admission with its own recorded key.
+      renewIdentifiedRequest = () => {
+        leaseArgs.request_id = randomUUID();
+        execution.recordAdmission?.(leaseArgs.request_id);
+        replays = 0; mayHaveCommitted = false; ownedAck = null; identifiedVerdict = null;
+      };
       // Returns a legacy-shaped answer: the decorated delivery for a ready ACK, a definite
       // refusal, or (with identifiedVerdict set) the original answer for the caller to retain.
       requestIdentified = async () => {
@@ -4099,22 +4191,39 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
           } else if (res.data?.success !== true) {
             const code = typeof res.data?.code === "string" ? res.data.code : "ADMISSION_UNCERTAIN";
             if (ADMISSION_COMMITTED_UNCERTAIN.has(code)) { settle(code); return res; }
+            // BOT-2788: the server answers these only after its receipt probe found no admission
+            // for this key, so they prove nothing was committed under it — even after a lost
+            // response. The lease id names the caller's OWN slot lease, kept only so the run can
+            // wait for its reap (or report it); it is never adopted or released from here.
+            if (IDENTIFIED_OWN_SLOT_ANSWERS.has(code) && UUID_RE.test(res.data?.lease_id ?? "")) {
+              return { ...res, data: { success: false, code, lease_id: res.data.lease_id, state: res.data.state ?? null,
+                reap_reason: res.data.reap_reason ?? null, ...(res.data?.message ? { message: res.data.message } : {}) } };
+            }
             if (ADMISSION_REPLAYABLE.has(code)) replayCode = code;
             // After an answer that may have committed, a later refusal is not proof of absence.
             else if (mayHaveCommitted) { settle("ADMISSION_UNCERTAIN"); return res; }
-            // A definite, effect-free refusal never carries cleanup authority.
+            // A definite refusal never carries cleanup authority. BOT-2788: an idle lease the control
+            // plane is reprovisioning (or lost to preemption) keeps its id ONLY so the run can wait
+            // for its reap and send this same request again; it is never adopted or released.
             else return { ...res, data: { success: false, code, ...(res.data?.message ? { message: res.data.message } : {}),
-              ...(res.data?.phase ? { phase: res.data.phase } : {}), ...(res.data?.wait ? { wait: res.data.wait } : {}) } };
+              ...(res.data?.phase ? { phase: res.data.phase } : {}), ...(res.data?.wait ? { wait: res.data.wait } : {}),
+              ...(code === HOST_CAPACITY_SOURCE_STALE_CODE ? capacityStaleReceiptFields(res.data) : {}) } };
           } else {
             const ack = identifiedAdmissionAck(res.data, leaseArgs.request_id);
             // A malformed or foreign ACK is untrusted: never cleanup authority, never adopted.
-            if (!ack || ack.admission_kind !== "created" || (ownedAck && ack.lease_id !== ownedAck.lease_id)) {
+            if (!ack || (ownedAck && ack.lease_id !== ownedAck.lease_id)) {
               mayHaveCommitted = true;
               if (ack && ownedAck && ack.lease_id !== ownedAck.lease_id) ownedAck = null; // two leases for one key: trust neither
-              settle(!ack || ack.admission_kind === "created" ? "ADMISSION_UNCERTAIN" : "ADMISSION_READOPTION_UNSUPPORTED");
+              settle("ADMISSION_UNCERTAIN");
               return res;
             }
             const delivery = identifiedAdmissionDelivery(res.data, ack);
+            // BOT-2788: a readopted ACK is this slot's own lease handed back: an idle stack (stored
+            // connection, nothing provisioned) takes the idle-reuse path; a queued place kept at a
+            // park deadline takes the BOT-2400 re-attach path (no second upload).
+            if (delivery && ack.admission_kind === "readopted") {
+              return { ...res, data: { ...delivery, reused: true, ...(ack.state === "queued" ? {} : { reused_idle: true }) } };
+            }
             if (delivery) return { ...res, data: delivery };
             if (ack.delivery_status === "ready") { mayHaveCommitted = true; settle("ADMISSION_UNCERTAIN"); return res; }
             ownedAck = ack;
@@ -4226,8 +4335,12 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       // BOT-2400 (item 6): this agent's OWN previous lease on the slot is still `reaping` (a
       // provision rollback, an idle reap, the previous batch's teardown). It is not somebody's
       // live batch: park until it is reaped, then send the same request again.
-      const ownReaping = request.data?.success === true && request.data.reused === true &&
-        request.data.state === "reaping" && request.data.lease_id ? request.data.lease_id : null;
+      const ownReaping = (request.data?.success === true && request.data.reused === true &&
+        request.data.state === "reaping" && request.data.lease_id) ||
+        // BOT-2788: the identified admission's typed form of the same answer.
+        (request.data?.success === false && request.data.code === "SLOT_REAPING" && request.data.lease_id)
+        ? request.data.lease_id : null;
+      if (ownReaping) idleLease.slotReaping = ownReaping;
       if (ownReaping && attempt < 3) {
         stderrLine(`stack: this slot's previous lease ${ownReaping} is still reaping — waiting for it to reach reaped, then requesting again`);
         activeWaitAbort = new AbortController();
@@ -4282,6 +4395,13 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
             };
           }
           why = READOPT_UNHEALTHY_REASON;
+          if (renewIdentifiedRequest) {
+            try { renewIdentifiedRequest(); } catch (error) {
+              retainBlock = true;
+              return { exitCode: EXIT.INTERNAL, outcome: "error", code: "REQUESTER_ORIGIN_CONTEXT_REFUSED", leaseId: broken,
+                error: `could not record a new admission request after reaping unhealthy idle lease ${broken} (${error?.message ?? error}); no new lease was requested` };
+            }
+          }
         }
       }
       if (!why) break;
@@ -4364,6 +4484,9 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
 
     leaseProvisioned = true; // from here a Helper may act on this lease
     execution.bindLease?.(leaseId);
+    // BOT-2788: the lease's stack (or its kept place) now names this origin; record it for the
+    // next run only once admitted, so a refusal never moves an idle stack's recorded origin.
+    if (execution.requesterOrigin) { try { execution.recordOrigin?.(); } catch { /* advisory: the next run reprovisions */ } }
     let state = request.data.state;
     if (reusedIdle) {
       idleLease.reused = "idle";
@@ -4510,7 +4633,9 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
         // `stack cancel` / `stack done` or the owner's death releases it.
         // BOT-2780: a requester-origin run cannot be resumed by a later invocation (its stack
         // names this CLI's listener, which closes now), so it releases instead of holding a place.
-        const queueHold = holdPlace && !execution.requesterOrigin ? await holdPlace(leaseId, HOLD_ON_TIMEOUT_MAX_SEC) : null;
+        // BOT-2788: a stable origin run keeps its place too — its marker keeps the origin, so the
+        // next run re-reserves it and re-attaches (the same bundle variant) through identified admission.
+        const queueHold = holdPlace && !(execution.requesterOrigin && opts.executionRing === "beta") ? await holdPlace(leaseId, HOLD_ON_TIMEOUT_MAX_SEC) : null;
         if (queueHold) {
           // A refused/lost hold reply is not an owner cancellation: it may have
           // committed before the reply was lost, or the queued lease may have
@@ -4704,6 +4829,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
           return { exitCode: cleanup.ok ? EXIT.BACKEND : EXIT.CLEANUP_FAILED, outcome: "error", code: error?.code ?? "REQUESTER_ORIGIN_FORWARD_REFUSED", leaseId, error: String(error?.message ?? error), cleanup };
         }
         placement.requesterOrigin = execution.requesterOrigin.origin;
+        placement.requesterOriginContinuation = execution.originContinuation ?? null;
         stderrLine(`stack: requester origin ${execution.requesterOrigin.origin} → ${placement.hostKey ?? "remote"} API (generated auth links use it unchanged)`);
         childConnection = { ...childConnection, requester_origin: execution.requesterOrigin.origin };
       }
@@ -4860,6 +4986,14 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
     // once, or repeated refusals would exhaust the host (Codex #928 R21 P2).
     // BOT-1803: an IDLE lease (cleanupResult.state "active") is not a reap — its stack still
     // runs, so its block stays reserved; so does one this run must not free (retainBlock).
+    // BOT-2788: an origin run that resumed an idle stack's directory but never took a lease of
+    // its own (a refusal) leaves that idle stack exactly as it found it: its block stays
+    // reserved and its marker idle-retained, so a later run can still continue it.
+    if (execution?.resumedIdle && !leaseId && !idleLease.previousLeaseId && !idleLease.slotReaping) {
+      retainBlock = true;
+      try { refreshRetention(stackDirFor(execution), { idleTtlSecs: LEASED_STACK_IDLE_RETENTION_SECS, idleRetained: true }); } catch { /* advisory */ }
+      try { execution.renew?.({ idleTtlSecs: LEASED_STACK_IDLE_RETENTION_SECS, idleRetained: true }); } catch { /* advisory */ }
+    }
     const provenReap = !retainBlock && (!leaseProvisioned
       || (cleanupResult?.ok === true && (cleanupResult.state === "reaped" || cleanupResult.state == null)));
     if (execution?.release) {
@@ -4920,6 +5054,8 @@ export function runReceiptFields(result) {
     transport: result.execution?.transport ?? "none",
     // BOT-2780: the reserved requester origin generated auth links name (never a credential).
     ...(result.execution?.requesterOrigin ? { requester_origin: result.execution.requesterOrigin } : {}),
+    // BOT-2788: "previous" (an idle stack's origin re-reserved), "previous_port_busy" or "new".
+    ...(result.execution?.requesterOriginContinuation ? { requester_origin_continuation: result.execution.requesterOriginContinuation } : {}),
     ...(result.allocationRecovery ? { allocation_recovery: result.allocationRecovery } : {}),
     ...(result.execution?.forwards ? { forwards: result.execution.forwards } : {}),
     ...(result.execution?.bundle ? { bundle: result.execution.bundle } : {}),