@botbuddy/cli 1.64.26 → 1.64.28

package/daemon-release/darwin-arm64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.64.26",
-  "source_commit": "3c0c0a5b3043740906a1d230d2e52bfb040af538",
-  "source_sha256": "37ab46e615c285d102088320e3106cbc968d5c42f345e48051980173eaeffba2",
+  "release_version": "1.64.28",
+  "source_commit": "68e4229ab423ab6cb69a029a794cd6f9bbdab501",
+  "source_sha256": "e456c16060302ab7b6d5642d057985316384a24e806ba400dcdba74836a5c886",
   "target": "darwin-arm64",
-  "sha256": "1c61bc84457da670166622fe9ef8fc7295a1f2286591e7cb8850aed78023858b"
+  "sha256": "0234fb211982fc176db2da07f2c8be94d5c33f93e11ad2fc07e22c32ed62a8bd"
 }

package/daemon-release/linux-x64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.64.26",
-  "source_commit": "3c0c0a5b3043740906a1d230d2e52bfb040af538",
-  "source_sha256": "37ab46e615c285d102088320e3106cbc968d5c42f345e48051980173eaeffba2",
+  "release_version": "1.64.28",
+  "source_commit": "68e4229ab423ab6cb69a029a794cd6f9bbdab501",
+  "source_sha256": "e456c16060302ab7b6d5642d057985316384a24e806ba400dcdba74836a5c886",
   "target": "linux-x64",
-  "sha256": "718ad319db010d21e1ac51da283f7d64d2cd9c9313abbc16912d1e560426be2e"
+  "sha256": "402e8e84890e6095422c1e0ffa85639e9842fa3ffd3f5abd6d28a80f664b34b2"
 }

package/daemon-release/manifest.json

@@ -1,21 +1,21 @@
 {
   "schema_version": 1,
-  "release_version": "1.64.26",
-  "source_commit": "3c0c0a5b3043740906a1d230d2e52bfb040af538",
-  "source_sha256": "37ab46e615c285d102088320e3106cbc968d5c42f345e48051980173eaeffba2",
+  "release_version": "1.64.28",
+  "source_commit": "68e4229ab423ab6cb69a029a794cd6f9bbdab501",
+  "source_sha256": "e456c16060302ab7b6d5642d057985316384a24e806ba400dcdba74836a5c886",
   "targets": {
     "darwin-arm64": {
       "goos": "darwin",
       "goarch": "arm64",
       "binary": "daemon/bin/darwin-arm64/botbuddy-daemon",
-      "sha256": "1c61bc84457da670166622fe9ef8fc7295a1f2286591e7cb8850aed78023858b",
+      "sha256": "0234fb211982fc176db2da07f2c8be94d5c33f93e11ad2fc07e22c32ed62a8bd",
       "mode": "0755"
     },
     "linux-x64": {
       "goos": "linux",
       "goarch": "amd64",
       "binary": "daemon/bin/linux-x64/botbuddy-daemon",
-      "sha256": "718ad319db010d21e1ac51da283f7d64d2cd9c9313abbc16912d1e560426be2e",
+      "sha256": "402e8e84890e6095422c1e0ffa85639e9842fa3ffd3f5abd6d28a80f664b34b2",
       "mode": "0755"
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.64.26",
+  "version": "1.64.28",
   "description": "BotBuddy \u2014 Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/stack.mjs

@@ -139,6 +139,16 @@ export const EXIT = Object.freeze({
   CLEANUP_FAILED: 8, // child completed but signed physical reap was not proven
 });
 
+/**
+ * BOT-3094: BOT-2968's reap reasons for a queued lease whose bound session can never promote it.
+ * The place is lost either way, so a parked `stack up` / `stack run` requests a new lease ONCE
+ * from a freshly read session; the server binds it only to a current work session.
+ */
+export const SESSION_REAP_REASONS = new Set(["session_ended", "session_stale", "session_invalid"]);
+
+/** BOT-3094: cancel_unclaimed_stack_lease refusals that mean "claimed or not cancellable": reap nothing. */
+const CANCEL_REFUSAL_CODES = new Set(["PROVISION_ALREADY_CLAIMED", "PROVISION_AUTHORITY_HISTORY_FENCE", "LEASE_NOT_PROVISIONING", "PROVISION_JOB_NOT_FOUND"]);
+
 const STACK_READINESS_HELP = `${bold("READINESS")}
   An active lease proves infrastructure activation. It does not prove application readiness:
   the child may still be initializing its schema, runtime configuration, or worktree locks.
@@ -162,7 +172,7 @@ ${bold("USAGE")}
                                    include the owner's attested local/remote forwards
   botbuddy stack touch  <lease_id>   Bump the idle clock (and report measured use) so the reaper doesn't stop it
   botbuddy stack done   <lease_id>   Release (done): idle the stack for re-adoption (--reap tears it down)
-  botbuddy stack cancel <lease_id>   Give a queued lease's place up (= done --reap; BOT-2400)
+  botbuddy stack cancel <lease_id>   Give a queued lease's place up; never reaps a claimed lease (BOT-3094)
   botbuddy stack run [options] -- <executable> [args...]
                                       Own one Helper-backed test/fix batch end-to-end
 
@@ -443,7 +453,8 @@ export function stackCommandHelp(command) {
   const selected = all.filter((section) => headings[command]?.some((heading) => section.startsWith(bold(heading))));
   const usage = command === "run" ? "[options] -- <executable> [args...]"
     : command === "up" ? "[options]" : "<lease_id> [options]";
-  const detail = command === "cancel" ? "\n  Cancel gives up a queued lease's place (equivalent to done --reap).\n" : "";
+  const detail = command === "cancel"
+    ? "\n  Cancel gives up a queued (or unclaimed provisioning) lease's place atomically. It never reaps a lease a\n  Helper has claimed: release that with `stack done <lease_id> --reap`.\n" : "";
   return `${bold(`botbuddy stack ${command}`)} ${usage}${detail}\n\n${selected.join("\n")}\n\n${STACK_READINESS_HELP}\n  Use bb stack --help for all commands and options.`;
 }
 
@@ -508,6 +519,8 @@ export function parseStackArgs(argv) {
     disposition: "destroy", json: false, receiptMaxBytes: DEFAULT_RECEIPT_MAX_BYTES,
     // BOT-1803: eager release (reap) instead of the default idle release (done/run).
     reap: cancel,
+    // BOT-3094: cancel goes through the atomic cancel_unclaimed_stack_lease, never a plain reap.
+    cancel,
   };
   const positionals = [];
   const need = (name, v) => {
@@ -718,6 +731,9 @@ export function parseStackArgs(argv) {
       "own supabase/config.toml (distinct project_id + remapped ports).");
   }
   if (opts.releasePortClaim && (command !== "done" || !opts.reap || opts.localExec)) errors.push("--release-port-claim requires `stack done --reap` without --local-exec");
+  // BOT-3094: the atomic cancel finalizes a self-reserved provisioning lease server-side, so a local-exec stack's
+  // own `supabase stop` would never run. A local-exec lease is released only through `stack done --local-exec`.
+  if (opts.cancel && opts.localExec) errors.push("`stack cancel` does not take --local-exec; release a local-exec lease with `stack done <lease_id> --local-exec`");
   if (opts.reap && !["done", "run"].includes(command)) {
     errors.push("--reap is valid only with `stack done` or `stack run`");
   }
@@ -2574,7 +2590,48 @@ async function runLocalDone(leaseId, opts, deps = {}) {
   return { exitCode, receipt };
 }
 
-export async function cmdUp(opts, {
+/** BOT-3094: the one stderr line a session re-request prints, shared by `stack up` and `stack run`. */
+function sessionRequeueNotice(lost) {
+  return `stack: lease ${lost.lease_id} was reaped while queued (reap_reason=${lost.reap_reason}): its session can no longer promote it, ` +
+    "so its place is gone — requesting a new lease once from the current session";
+}
+
+/**
+ * `stack up`. BOT-3094: a queue park that ends in a session reap (SESSION_REAP_REASONS) requests a
+ * new lease once, re-reading the session credential; every receipt of that attempt carries
+ * `requeued_from`. A second session reap, or any other outcome, ends the command as before.
+ */
+export async function cmdUp(opts, deps = {}) {
+  const emitResult = deps.emitResult ?? emit;
+  const clock = deps.now ?? Date.now;
+  const startedAtMs = clock();
+  const first = await cmdUpOnce(opts, deps, { allowRequeue: true });
+  if (typeof first !== "object" || first === null || !first.requeue) return first;
+  const requeuedFrom = first.requeue;
+  process.stderr.write(`${sessionRequeueNotice(requeuedFrom)}\n`);
+  // One QUEUE-park budget (--timeout) across both attempts, so an outer wait sized to it still holds.
+  // Only the queue park is shortened: the Helper provision waits keep the full --timeout.
+  const retryOpts = { ...opts, queueParkTimeout: remainingParkSecs(opts.timeout, startedAtMs, clock()) };
+  return cmdUpOnce(retryOpts, { ...deps, emitResult: (receipt, o, code) => emitResult({ ...receipt, requeued_from: requeuedFrom }, o,
+    // The command's outcome is still the lost lease: a refused re-request (no new lease) is LEASE_FAILED.
+    requeueRefused(receipt.lease_id, receipt.code, code, receipt.outcome) ? EXIT.LEASE_FAILED : code) }, { allowRequeue: false });
+}
+
+/** BOT-3094: seconds left of a --timeout park budget (at least 1). */
+function remainingParkSecs(timeoutSec, startedAtMs, nowMs) {
+  return Math.max(1, Math.ceil(timeoutSec - (nowMs - startedAtMs) / 1000));
+}
+
+/**
+ * BOT-3094: the re-request was answered with a refusal and minted no lease. Only an `error` outcome
+ * that would exit BACKEND or INVALID: a capacity-wait TIMEOUT, an interrupt and AUTH keep their exits.
+ */
+export function requeueRefused(leaseId, code, exitCode, outcome) {
+  return !leaseId && outcome === "error" && typeof code === "string" && code.length > 0 &&
+    (exitCode === EXIT.BACKEND || exitCode === EXIT.INVALID);
+}
+
+async function cmdUpOnce(opts, {
   runPreflight = runLocalExecPreflight,
   callTool = callToolJson,
   authProvider = stackAuthHeader,
@@ -2599,7 +2656,7 @@ export async function cmdUp(opts, {
   reauth = (current, kind) => reauthenticateParkedLease(current, kind),
   sleep = null,
   now = null,
-} = {}) {
+} = {}, { allowRequeue = false } = {}) {
   let slot;
   try { slot = deriveSlot(opts); } catch (e) {
     return emitResult(buildReceipt({ command: "up", outcome: "error", error: e.message }), opts, EXIT.INVALID);
@@ -2747,9 +2804,9 @@ export async function cmdUp(opts, {
   if (linkNotice) process.stderr.write(`${linkNotice}\n`);
   // BOT-2099: every lease wait in `stack up` (queue park, Helper provision, Helper takeover)
   // survives auth/availability blips (parkOnLease) and adopts the re-minted credential.
-  const resilientWait = async (isDone, isFailed) => {
+  const resilientWait = async (isDone, isFailed, { timeoutSec = opts.timeout } = {}) => {
     const result = await parkOnLease(leaseId, isDone, isFailed, {
-      timeoutSec: opts.timeout, auth, wait: waitFn, reauth, ...(sleep ? { sleep } : {}), ...(now ? { now } : {}),
+      timeoutSec, auth, wait: waitFn, reauth, ...(sleep ? { sleep } : {}), ...(now ? { now } : {}),
       // Codex #1168 R2 P1: probe with the credential the park just re-minted — `auth`/`call`
       // are only updated after the park returns, and an old-credential read would 401 and
       // miss a grant or reap that landed during the outage.
@@ -2798,9 +2855,13 @@ export async function cmdUp(opts, {
     }
     // Park zero-poll until the lease leaves the queue (granted in BOT-1187 order).
     // BOT-2013: a lease reaped while queued (orphaned_agent, …) is lost, not "left the queue".
-    const parked = await resilientWait(nonQueued, isReaped);
+    // BOT-3094: a session re-request parks only for what is left of --timeout.
+    const parkSecs = opts.queueParkTimeout ?? opts.timeout;
+    const parked = await resilientWait(nonQueued, isReaped, { timeoutSec: parkSecs });
     if (parked.authUnavailable) return emitAuthUnavailable(parked);
     if (parked.failed) {
+      // BOT-3094: nothing was provisioned for a queued lease, so its loss leaves nothing to clean up.
+      if (allowRequeue && SESSION_REAP_REASONS.has(parked.reap_reason)) return { requeue: { lease_id: leaseId, reap_reason: parked.reap_reason } };
       return emitResult(buildReceipt({
         command: "up", outcome: "error", lease_id: leaseId, state: parked.state, slot,
         reap_reason: parked.reap_reason ?? null,
@@ -2824,8 +2885,8 @@ export async function cmdUp(opts, {
       // BOT-2237: a park that ended inside an unrecovered platform incident never observed admission.
       const blind = parked.incident && !parked.incident.recovered;
       const why = blind
-        ? `parked ${opts.timeout}s inside a platform incident (${parked.incident.reason} since ${parked.incident.first_at}), so its admission was never observed`
-        : `parked ${opts.timeout}s without capacity`;
+        ? `parked ${parkSecs}s inside a platform incident (${parked.incident.reason} since ${parked.incident.first_at}), so its admission was never observed`
+        : `parked ${parkSecs}s without capacity`;
       // BOT-2400: a held place is PARK_DEADLINE; the BOT-2237 incident code still wins when the
       // park never observed admission (the place is held either way — see queue_hold).
       const code = blind ? parked.incident.reason : (queueHold.held ? PARK_DEADLINE : PARK_HOLD_UNCONFIRMED);
@@ -3516,11 +3577,28 @@ export async function cmdDone(leaseId, opts, {
   const idleRelease = !opts.reap && !opts.localExec;
   // BOT-2847: an unanswered release (RPC_ERROR, transport, 5xx) is retried for about 60 s; a
   // definite refusal is reported at once. An exhausted retry names the cause and the attempts.
+  // BOT-3094: `stack cancel` is the atomic cancel_unclaimed_stack_lease, which gives up a queued
+  // (or unclaimed provisioning) lease under the admission lock and refuses once a Helper claimed it.
+  // A plain release here would reap whatever the lease became after the caller read it as queued.
+  // An already-reaped lease answers a no-op success, so a retried cancel is safe.
   const released = await callWithTransientRetry(
-    () => call("release_stack_lease", { lease_id: leaseId, disposition: opts.disposition, ...(idleRelease ? { idle: true } : {}) }), releaseRetry);
+    () => (opts.cancel
+      ? call("cancel_unclaimed_stack_lease", { lease_id: leaseId })
+      : call("release_stack_lease", { lease_id: leaseId, disposition: opts.disposition, ...(idleRelease ? { idle: true } : {}) })), releaseRetry);
   const r = released.result;
   const unanswered = released.exhausted ? `${describeStackRpcFailure(r)} (no answer in ${released.attempts} attempts over ${Math.round(released.elapsedMs / 1000)}s)` : null;
   if (!r.ok) return emitResult(buildReceipt({ command: "done", outcome: "error", lease_id: leaseId, error: unanswered ?? r.error }), opts, r.auth ? EXIT.AUTH : EXIT.BACKEND);
+  if (!r.data.success && opts.cancel && !unanswered) {
+    // Every definite refusal reaps nothing. Only a claimed / not-cancellable lease gets the explicit release hint.
+    const state = typeof r.data.state === "string" ? r.data.state : null;
+    const code = r.data.code ?? "CANCEL_REFUSED";
+    const why = CANCEL_REFUSAL_CODES.has(code)
+      ? `lease ${leaseId} ${state ? `is ${state} and ` : ""}is no longer an unclaimed queued lease, so nothing was reaped. ` +
+        `Inspect it with \`bb stack status ${leaseId}\`; release it explicitly with \`bb stack done ${leaseId} --reap\`.`
+      : `nothing was reaped (${r.data.message ?? "the control plane refused the cancel"}).`;
+    return emitResult(buildReceipt({ command: "done", outcome: "refused", lease_id: leaseId, code, ...(state ? { state } : {}),
+      error: `cancel refused (${code}): ${why}` }), opts, EXIT.LEASE_FAILED);
+  }
   if (!r.data.success) return emitResult(buildReceipt({ command: "done", outcome: "error", lease_id: leaseId, code: r.data.code, error: unanswered ?? r.data.code }), opts, EXIT.BACKEND);
   if (idleRelease && r.data.idle === true) {
     return emitResult(buildReceipt({
@@ -3641,7 +3719,8 @@ export async function cmdDone(leaseId, opts, {
       portBlock = { released: false, reason: `local claim retained: ${error.code ?? error.message}` };
     }
   }
-  return emitResult(buildReceipt({ command: "done", outcome: portBlock?.released === false ? "error" : "released", lease_id: leaseId, state, disposition,
+  return emitResult(buildReceipt({ command: "done", outcome: portBlock?.released === false ? "error" : (opts.cancel ? "cancelled" : "released"), lease_id: leaseId, state, disposition,
+    ...(opts.cancel && r.data.noop === true ? { noop: true } : {}),
     ...retried,
     ...(portBlock ? { port_block: portBlock } : {}),
     ...(helperTeardown ? { teardown: "helper" } : {}),
@@ -3827,13 +3906,34 @@ export async function runStackLifecycle(opts, childArgv, adapters = {}) {
   // A receipt always says what happened to a port-block claim. Before allocation
   // no claim exists, which is a safe, explicit disposition rather than omission.
   // BOT-1803: whether this run re-adopted / re-provisioned an idle lease, and its stack digest.
-  const incidentBox = { incident: null, execution: null, idleLease: null, webUrl: null, portBlock: { released: false, reason: "no port-block claim was created before stack allocation" } };
-  let result;
-  try {
-    result = await runStackLifecycleOnce(opts, childArgv, adapters, incidentBox);
-  } catch (error) {
-    result = { exitCode: classifyStackAuthError(error), outcome: "error", error: String(error?.message ?? error) };
+  const freshBox = () => ({ incident: null, execution: null, idleLease: null, webUrl: null, portBlock: { released: false, reason: "no port-block claim was created before stack allocation" } });
+  let incidentBox = freshBox();
+  const startedAtMs = (adapters.now ?? Date.now)();
+  const once = async (attemptOpts = opts) => {
+    try {
+      return await runStackLifecycleOnce(attemptOpts, childArgv, adapters, incidentBox);
+    } catch (error) {
+      return { exitCode: classifyStackAuthError(error), outcome: "error", error: String(error?.message ?? error) };
+    }
+  };
+  let result = await once();
+  // BOT-3094: a queue park lost to a session reap requests a new lease ONCE, from scratch: a new
+  // Once re-reads the session credential, re-resolves the stack and claims fresh ports. The lost
+  // lease's cleanup must be proven first, or its ports could still be held.
+  let requeuedFrom = null;
+  // A signal that landed during that cleanup means the caller is stopping: never start again.
+  if (result?.exitCode === EXIT.LEASE_FAILED && result.lostWhileQueued === true && SESSION_REAP_REASONS.has(result.reapReason) &&
+      result.cleanup?.ok !== false && !incidentBox.stopSignal) {
+    requeuedFrom = { lease_id: result.leaseId, reap_reason: result.reapReason };
+    process.stderr.write(`${sessionRequeueNotice(requeuedFrom)}\n`);
+    const { incident } = incidentBox;
+    incidentBox = { ...freshBox(), incident };
+    // One park budget (--timeout) across both attempts.
+    const remaining = remainingParkSecs(opts.timeout, startedAtMs, (adapters.now ?? Date.now)());
+    result = await once({ ...opts, queueParkTimeout: remaining });
+    if (result && typeof result === "object" && requeueRefused(result.leaseId, result.code, result.exitCode, result.outcome)) result = { ...result, exitCode: EXIT.LEASE_FAILED };
   }
+  if (requeuedFrom && result && typeof result === "object") result = { ...result, requeuedFrom };
   const withIncident = incidentBox.incident && !result?.incident ? { ...result, incident: incidentBox.incident } : result;
   const withExecution = incidentBox.execution && !withIncident?.execution ? { ...withIncident, execution: incidentBox.execution } : withIncident;
   const withIdle = incidentBox.idleLease && !withExecution?.idleLease ? { ...withExecution, idleLease: incidentBox.idleLease } : withExecution;
@@ -3851,6 +3951,25 @@ export async function runStackLifecycle(opts, childArgv, adapters = {}) {
 /** BOT-2467: where a lifecycle result carries its outcome-record channel. */
 export const OUTCOME_CHANNEL = Symbol.for("botbuddy.stackRunOutcomeChannel");
 
+/** The lease calls `bb stack run` makes over its retrying caller (`rpc.call(name, args, opts)`). */
+export function defaultStackRunApi(rpc) {
+  return {
+    request: (args) => rpc.call("request_stack_lease", args),
+    // BOT-2780 (beta requester origin): BOT-2499's identified admission, never a fallback.
+    requestIdentified: (args) => rpc.call("request_stack_lease_identified", args),
+    getAdmission: (args) => rpc.call("get_stack_lease_admission", args),
+    get: (leaseId, { signal } = {}) => rpc.call("get_stack_lease", { lease_id: leaseId }, { signal }),
+    // BOT-1803: a heartbeat carries the measured client use when there is one. BOT-3095: it is the
+    // RUN's heartbeat, so it says the run is alive — the server then keeps a quiet live run out of
+    // `no_use` idling (and preemption) up to its ceiling. `bb stack touch` never sends this.
+    touch: (leaseId, usage, { signal } = {}) => rpc.call("touch_stack_lease", { lease_id: leaseId, ...(usage ? { usage } : {}), run_alive: true }, { signal }),
+    // BOT-1803: `{ idle: true }` idles an ACTIVE lease instead of reaping it.
+    release: (leaseId, signal, { idle = false } = {}) => rpc.call("release_stack_lease", { lease_id: leaseId, disposition: "destroy", ...(idle ? { idle: true } : {}) }, { signal }),
+    // BOT-2400: keep a queued lease's place when the park deadline passes.
+    hold: (leaseId, holdSecs) => holdQueuePlace((name, args) => rpc.call(name, args), leaseId, holdSecs),
+  };
+}
+
 async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
   // BOT-1750 (Codex R9/R11 P2): `stack run` is a lease-creating entry point AND a
   // long-lived one (queue → provision → child → heartbeat → cleanup). A cached token
@@ -3872,19 +3991,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
   });
   // BOT-2467: cmdRun records the run's outcome with the credential this run ended on.
   incidentBox.outcomeChannel = { get auth() { return rpc.auth; }, callTool: adapters.callTool ?? callToolJson };
-  const api = adapters.api ?? {
-    request: (args) => rpc.call("request_stack_lease", args),
-    // BOT-2780 (beta requester origin): BOT-2499's identified admission, never a fallback.
-    requestIdentified: (args) => rpc.call("request_stack_lease_identified", args),
-    getAdmission: (args) => rpc.call("get_stack_lease_admission", args),
-    get: (leaseId, { signal } = {}) => rpc.call("get_stack_lease", { lease_id: leaseId }, { signal }),
-    // BOT-1803: a heartbeat carries the measured client use when there is one.
-    touch: (leaseId, usage, { signal } = {}) => rpc.call("touch_stack_lease", { lease_id: leaseId, ...(usage ? { usage } : {}) }, { signal }),
-    // BOT-1803: `{ idle: true }` idles an ACTIVE lease instead of reaping it.
-    release: (leaseId, signal, { idle = false } = {}) => rpc.call("release_stack_lease", { lease_id: leaseId, disposition: "destroy", ...(idle ? { idle: true } : {}) }, { signal }),
-    // BOT-2400: keep a queued lease's place when the park deadline passes.
-    hold: (leaseId, holdSecs) => holdQueuePlace((name, args) => rpc.call(name, args), leaseId, holdSecs),
-  };
+  const api = adapters.api ?? defaultStackRunApi(rpc);
   // An injected api double without `hold` keeps the pre-BOT-2400 release unless the test also
   // injected the tool transport (never a real network call from a test).
   const holdPlace = api.hold ?? (adapters.callTool ? (leaseId, holdSecs) => holdQueuePlace((name, args) => rpc.call(name, args), leaseId, holdSecs) : null);
@@ -4800,7 +4907,10 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
     // BOT-1630: ONE park budget (--timeout) across every park. A Helper that finds the host under
     // pressure mid-provision defers the lease back to `queued` (its place kept); run then parks
     // again against the same deadline instead of timing out on the provision clock.
-    const parkDeadlineMs = (adapters.now ?? Date.now)() + opts.timeout * 1000;
+    // BOT-3094: a session re-request's queue park gets only what is left of --timeout (queueParkTimeout);
+    // the provision and own-reap waits keep the full --timeout.
+    const parkSecs = opts.queueParkTimeout ?? opts.timeout;
+    const parkDeadlineMs = (adapters.now ?? Date.now)() + parkSecs * 1000;
     let parkView = request.data;
     let parkReason = null;
     for (;;) {
@@ -4818,7 +4928,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       // BOT-2013: every reap state (reaping / reaped / reap_failed) means the queued lease is lost.
       // BOT-2099: an auth/availability blip is retried inside the park until its deadline;
       // it never releases a queued lease or becomes the lease's outcome.
-      const parked = await resilientWait(leaseId, (s) => s !== "queued" && s != null, isReaped, { timeoutSec: opts.timeout, deadlineMs: parkDeadlineMs, auth: rpc.auth, signal: activeWaitAbort.signal });
+      const parked = await resilientWait(leaseId, (s) => s !== "queued" && s != null, isReaped, { timeoutSec: parkSecs, deadlineMs: parkDeadlineMs, auth: rpc.auth, signal: activeWaitAbort.signal });
       activeWaitAbort = null;
       const incident = parkIncident ? { incident: parkIncident } : {};
       if (parked?.interrupted || receivedSignal) { const cleanup = await requestCleanup(); return { exitCode: SIGNAL_EXIT[receivedSignal], outcome: "interrupted", leaseId, cleanup, ...incident }; }
@@ -4835,8 +4945,8 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
         // lease's admission, so it must not claim the host had no capacity.
         const blind = parkIncident && !parkIncident.recovered;
         const why = blind
-          ? `lease ${leaseId} parked ${opts.timeout}s inside a platform incident (${parkIncident.reason} since ${parkIncident.first_at}), so its admission was never observed`
-          : `parked ${opts.timeout}s without capacity`;
+          ? `lease ${leaseId} parked ${parkSecs}s inside a platform incident (${parkIncident.reason} since ${parkIncident.first_at}), so its admission was never observed`
+          : `parked ${parkSecs}s without capacity`;
         // BOT-2400 (item 1): the park deadline never gives the queue place up. Hold the lease
         // for the owner's next run (which re-attaches to it) and exit PARK_DEADLINE; only
         // `stack cancel` / `stack done` or the owner's death releases it.
@@ -4877,7 +4987,12 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
           ...incident, ...(ledger ? { ledger } : {}), ...(queueHold ? { queueHold } : {}), ...(parkReason ? { parkReason } : {}),
         };
       }
-      if (parked?.failed) { const cleanup = await requestCleanup(); return { exitCode: EXIT.LEASE_FAILED, outcome: "error", leaseId, error: `lease was ${parked.state} while queued (reap_reason=${parked.reap_reason ?? "unknown"})`, cleanup, ...incident }; }
+      if (parked?.failed) {
+        const cleanup = await requestCleanup();
+        // BOT-3094: lostWhileQueued + reapReason let runStackLifecycle re-request after a session reap.
+        return { exitCode: EXIT.LEASE_FAILED, outcome: "error", leaseId, error: `lease was ${parked.state} while queued (reap_reason=${parked.reap_reason ?? "unknown"})`, cleanup,
+          lostWhileQueued: true, ...(parked.reap_reason ? { reapReason: parked.reap_reason } : {}), ...incident };
+      }
       if (parked?.error || parked?.auth) {
         const cleanup = await requestCleanup();
         return {
@@ -5188,6 +5303,10 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
     };
     heartbeat = clock.setInterval(touchLease, cadenceMs);
     heartbeat.unref?.();
+    // BOT-3095: one heartbeat as the child starts, not a full cadence later, so a run that
+    // re-adopted an idle stack says it is alive before the next minute's idle pass.
+    const firstTouch = clock.setTimeout(() => touchLease(), 0);
+    firstTouch?.unref?.();
     if (opts.hardTtl) hardTimer = clock.setTimeout(() => stopChild("SIGTERM", EXIT.TIMEOUT), opts.hardTtl * 1000);
     hardTimer?.unref?.();
     childResult = await waitForChild(child);
@@ -5320,6 +5439,9 @@ export function runReceiptFields(result) {
     ...(result.idleLease?.stackDigest ? { stack_digest: result.idleLease.stackDigest } : {}),
     ...(result.idleLease?.readoptHealth ? { readopt_health: result.idleLease.readoptHealth } : {}),
     ...(result.parkReason ? { park_reason: result.parkReason } : {}),
+    // BOT-3094: why a queued lease was lost, and the lease a session re-request replaced.
+    ...(result.reapReason ? { reap_reason: result.reapReason } : {}),
+    ...(result.requeuedFrom ? { requeued_from: result.requeuedFrom } : {}),
     // BOT-2142: where the lease ran and how the child reached it.
     execution_mode: result.execution?.mode ?? null,
     execution_host_key: result.execution?.hostKey ?? null,