@bridge4dev/runner 0.45.0 → 0.46.1

package/dist/supervisor.js

@@ -14,6 +14,7 @@ import { VerifyRunner, runOneOffCommand, } from './verify.js';
 import { VerifyReportQueue } from './verify-queue.js';
 import { applySession, gitBranches, gitCommit, gitDiff, gitLog, gitPush, gitRefs, gitShow, gitStatus, revertApply, gitStage, gitUnstage, gitDiscard, gitPull, gitMergeAbort, updateFromBase, workspaceState, } from './gitops.js';
 import { fsView } from './fsview.js';
+import { publishFile } from './file-publish.js';
 import { agentAuthStatuses, AuthRelay, clearAgentAuthFailure, noteAgentAuthFailure, } from './auth-relay.js';
 import { selfUpdate } from './self-update.js';
 import { rememberWorkspacePath } from './environment.js';
@@ -77,6 +78,8 @@ export class Supervisor {
      * agent mid-thought.
      */
     static EMPTY_TURN_SETTLE_MS = 25_000;
+    /** The window actually used — the constant, or a test's own shorter one. */
+    emptyTurnSettleMs;
     /** A finished session's journal is kept this long for a late reconnect. */
     static JOURNAL_TTL_MS = 72 * 3_600_000;
     /** Backstop: events the API will never accept must not pile up forever. */
@@ -114,6 +117,7 @@ export class Supervisor {
         this.ws = ws;
         this.opts = opts;
         this.journals = opts.journals ?? new JournalStore();
+        this.emptyTurnSettleMs = opts.emptyTurnSettleMs ?? Supervisor.EMPTY_TURN_SETTLE_MS;
         this.verify = new VerifyRunner({
             enabled: opts.verifyEnabled !== false,
             onReport: (report) => {
@@ -128,7 +132,26 @@ export class Supervisor {
         ws.on('frame', (frame) => {
             void this.onFrame(frame).catch((error) => log.error('supervisor: frame handler failed', { type: frame.type, error: String(error) }));
         });
+        /**
+         * The seat report is on a heartbeat, not only on the events that change it.
+         *
+         * Deliberate, and the lesson of the bug this whole frame exists for: seat
+         * state lives in three mutable fields on each entry (`session`,
+         * `stopRequested`, `parkRequested`), so there is no single mutation to hook
+         * — and «every call site remembers to tell the API» is exactly the rule
+         * that had already been broken in three places. A tick that re-derives the
+         * truth cannot be forgotten by a future call site.
+         *
+         * Nearly free: `publishSlots` fingerprints what it last sent and returns
+         * without touching the socket when nothing moved, so a quiet runner sends
+         * one frame per change and none in between.
+         */
+        this.slotsTimer = setInterval(() => this.publishSlots(), Supervisor.SLOTS_REPORT_INTERVAL_MS);
+        this.slotsTimer.unref?.();
     }
+    /** How often the seat report re-derives the truth. See the constructor. */
+    static SLOTS_REPORT_INTERVAL_MS = 15_000;
+    slotsTimer;
     /**
      * Push every unacked verdict at the API.
      *
@@ -150,11 +173,83 @@ export class Supervisor {
     get activeSessionIds() {
         return [...this.sessions.keys()];
     }
+    /** The last set of seat-holders we told the API about, to send only changes. */
+    lastPublishedSlots = '';
+    /**
+     * Tell the API which sessions are actually holding a seat here (0.46.0).
+     *
+     * The seat count is a property of THIS process, and until now the API could
+     * only guess it from its own rows. The guess was wrong whenever a session
+     * ended on paper without releasing its entry, and wrong in the direction that
+     * costs a person their session: the dashboard offers a seat, the create
+     * passes, this runner refuses, the session dies in fifty milliseconds.
+     *
+     * Called from `reportStatus` — the choke point every seat change already
+     * passes through — and from the interval in the constructor, which is the net
+     * under any path that forgets. Both are safe to call as often as they like:
+     * this compares what it is about to say against what it last said and returns
+     * without touching the socket when nothing moved.
+     *
+     * Two lists, because two different questions are being asked and answering
+     * both with one number is wrong in both directions:
+     *
+     *  - `sessionIds` — everything still tracked here, parked or not. This is the
+     *    reconciliation list, and it must be generous: a session the API has
+     *    buried needs laying to rest whatever state it is in on this side.
+     *  - `blockingIds` — what a new session would really have to wait for.
+     *    `ensureCapacity` parks an idle REVIEW or WAITING_INPUT session to make
+     *    room, so those seats are available on demand.
+     *
+     * Reporting the second as the first would have the API stop live REVIEW
+     * sessions; reporting the first as the second would call a machine full while
+     * it had room. Both were caught by the independent QA review of this change.
+     */
+    publishSlots() {
+        const tracked = [];
+        const blocking = [];
+        for (const entry of this.sessions.values()) {
+            const id = entry.descriptor.id;
+            tracked.push(id);
+            if (entry.stopRequested || entry.parkRequested || !entry.session)
+                continue;
+            // `ensureCapacity` would park this one to make room, so its seat is
+            // available on demand and does not refuse anybody. Counting it as taken
+            // reported a machine with three finished-turn sessions as full while it
+            // would happily have started a fourth (independent QA, 31.08.2026).
+            if (this.isParkable(entry))
+                continue;
+            blocking.push(id);
+        }
+        tracked.sort();
+        blocking.sort();
+        const limit = this.maxSessions;
+        const fingerprint = `${limit}:${tracked.join(',')}|${blocking.join(',')}`;
+        if (fingerprint === this.lastPublishedSlots)
+            return;
+        // Recorded only when it actually went out. A frame dropped because the
+        // socket was down must not be remembered as sent — otherwise the seat
+        // report would go quiet until the set changed again, which on an idle
+        // machine is exactly never.
+        if (this.ws.send({
+            type: 'session_slots',
+            sessionIds: tracked,
+            blockingIds: blocking,
+            maxSessions: limit,
+        })) {
+            this.lastPublishedSlots = fingerprint;
+        }
+    }
     async onFrame(frame) {
         switch (frame.type) {
             case 'hello_ack':
+                // A new connection knows nothing about the seats we reported to the
+                // last one — the API keeps that beside the socket, not in the database,
+                // because it is only true while the socket is. Forget what we told the
+                // old one so the first tick after this reconnect actually sends.
+                this.lastPublishedSlots = '';
                 this.setMaxSessions(frame.maxSessions);
                 await this.reconcile(frame.sessions);
+                this.publishSlots();
                 // A build that finished while the socket was down has its verdict
                 // sitting on disk. This is the moment it can be delivered.
                 this.flushVerifyReports();
@@ -376,7 +471,7 @@ export class Supervisor {
         if (orphaned) {
             this.orphanMessages.delete(descriptor.id);
             for (const message of orphaned) {
-                this.acceptUserMessage(descriptor.id, message.text, message.attachments);
+                this.acceptUserMessage(descriptor.id, message.text, message.attachments, message.messageId);
             }
         }
         try {
@@ -1063,6 +1158,20 @@ export class Supervisor {
             // Idle process ended (parked or died between turns) — stay resumable.
             running.session = null;
             running.parkRequested = false;
+            /**
+             * The subagents died with it (QA-2026-08-16 M-5).
+             *
+             * Here rather than in `park()`, because parking only ASKS the process to
+             * stop and this is where it actually went. The adapter stops publishing
+             * the moment it is told to stop, so without this the last frame's count
+             * stands for ever: the strip says «Working in background» over a parked
+             * session and — far worse — the API goes on suppressing that session's
+             * «your turn» notification for the rest of its life, because the number
+             * it stored never reaches zero again.
+             *
+             * Before the `reportStatus` just below, so the zero rides out on it.
+             */
+            running.backgroundTasks = 0;
             running.costBaseUsd = running.costUsd; // next process starts from here
             // Persist the clock: a parked session can sit for hours and the runner
             // may be restarted before it ever runs again.
@@ -1094,6 +1203,11 @@ export class Supervisor {
             isTerminal(running.lastReported)) {
             this.journals.closeAndDelete(descriptor.id);
         }
+        // The map just lost an entry, and this is the one place where that happens
+        // WITHOUT a status frame to carry the news: the terminal status was already
+        // reported before the process stream ended. Without this the API goes on
+        // believing the runner tracks a session that is gone, until the next tick.
+        this.publishSlots();
         // A resume arrived while this life was winding down — start it now that the
         // map entry is gone. One place, after every removal path above.
         if (running.pendingRestart && !this.sessions.has(descriptor.id)) {
@@ -1301,6 +1415,11 @@ export class Supervisor {
         if (event.ok && event.produced !== true && this.holdEmptyTurn(running, descriptor, event)) {
             return;
         }
+        // Not held — so any phantom still waiting from an earlier turn is stale and
+        // must not outlive this ending. Cleared HERE and not before the decision
+        // above, or `holdEmptyTurn`'s «two in a row is a quiet agent, not two
+        // phantoms» rule could never see the first one (QA-2026-08-16 M-6).
+        this.clearEmptyTurn(running);
         this.settleTurnStatus(running, descriptor, event);
     }
     /**
@@ -1334,7 +1453,12 @@ export class Supervisor {
             });
         }
         else {
-            this.reportStatus(descriptor.id, 'FAILED', {
+            // The turn failed for a reason nothing above could soften: not a plan
+            // refusal, not a retryable provider fault. FAILED is terminal, so the
+            // process and the seat go with it — see `finishSession`. Reporting the
+            // status alone is what left this machine holding a seat for a session
+            // the API had already buried (31.08.2026).
+            this.finishSession(running, 'FAILED', {
                 costUsd: running.costUsd,
                 activeMs: Supervisor.spentMs(running),
                 errorMessage: event.errorMessage ?? 'Agent turn failed',
@@ -1364,7 +1488,7 @@ export class Supervisor {
             return false;
         log.info('supervisor: holding a turn that produced nothing', {
             sessionId: descriptor.id,
-            settleMs: Supervisor.EMPTY_TURN_SETTLE_MS,
+            settleMs: this.emptyTurnSettleMs,
         });
         const timer = setTimeout(() => {
             running.emptyTurnTimer = undefined;
@@ -1374,7 +1498,7 @@ export class Supervisor {
                 return;
             log.info('supervisor: the empty turn was real after all', { sessionId: descriptor.id });
             this.settleTurnStatus(running, descriptor, event);
-        }, Supervisor.EMPTY_TURN_SETTLE_MS);
+        }, this.emptyTurnSettleMs);
         timer.unref();
         running.emptyTurnTimer = timer;
         return true;
@@ -1392,6 +1516,35 @@ export class Supervisor {
         clearTimeout(running.emptyTurnTimer);
         running.emptyTurnTimer = undefined;
     }
+    /**
+     * Record how many subagents are alive, and say so when it matters (#236).
+     *
+     * One place, because there are now two callers with opposite news — a frame
+     * from the adapter, and the process going away — and «is it the human's turn»
+     * must be answered the same way by both.
+     *
+     * The report on reaching zero is the whole point: the agent is already
+     * sitting in a resting status, so nothing else will ever tell the API that
+     * the session finally became the person's. `REVIEW` counts as well as
+     * `WAITING_INPUT` — a TICKET session waiting on its own subagent is in the
+     * same position, and leaving it out was how one of the two statuses kept its
+     * notification suppressed for good (QA-2026-08-16 M-5).
+     */
+    setBackgroundTasks(running, live) {
+        if (live === running.backgroundTasks)
+            return;
+        const finished = running.backgroundTasks > 0 && live === 0;
+        running.backgroundTasks = live;
+        const resting = running.lastReported === 'WAITING_INPUT' || running.lastReported === 'REVIEW'
+            ? running.lastReported
+            : null;
+        if (finished && resting) {
+            this.reportStatus(running.descriptor.id, resting, {
+                costUsd: running.costUsd,
+                activeMs: Supervisor.spentMs(running),
+            });
+        }
+    }
     isParkable(running) {
         return ((running.lastReported === 'REVIEW' || running.lastReported === 'WAITING_INPUT') &&
             running.openQuestions.size === 0 &&
@@ -1522,11 +1675,6 @@ export class Supervisor {
                 // when it finally succeeds or finally gives up.
                 if (!event.ok && this.armApiRetry(running, descriptor, event))
                     return;
-                // A previous turn's phantom, if any, is over: this turn has ended for
-                // real, and a timer still holding its predecessor would report a status
-                // for a turn that is two turns old (#300 — the hold itself lives in
-                // `completeTurn`, where the decision belongs).
-                this.clearEmptyTurn(running);
                 this.completeTurn(running, descriptor, event);
                 return;
             }
@@ -1574,7 +1722,43 @@ export class Supervisor {
                 // No `lastPrompt` guard: a free CHAT session boots with an empty prompt
                 // and is exactly the case that hits an auth failure at startup, so
                 // requiring one excluded the sessions that need the retry most.
-                if (isAuthCode(event.code) && !running.authRetryDone) {
+                // FIRST, and before any decision about retrying (#365). This is the only
+                // authority on a login the credentials file cannot see through — a
+                // provider-side revocation leaves the file looking perfectly healthy,
+                // and `codex login status` never leaves the machine — so it is the one
+                // thing that turns the server panel from «signed in» to «sign in
+                // needed» (#121).
+                //
+                // It used to sit BELOW the retry, i.e. it wanted a SECOND refusal. On
+                // Codex a second refusal never came: the first one was swallowed in
+                // favour of a relaunch that could not happen, so the panel kept showing
+                // a dead login as healthy — and the owner spent an hour signing into
+                // the wrong machine while this line waited for its turn.
+                //
+                // `auth_expired` ONLY, and not every auth code. `auth_missing` means the
+                // credential was locally absent — nothing was refused — and the panel's
+                // own probe already answers «not signed in» for that machine without
+                // any help from here. Marking it would only add a way to be wrong: the
+                // mark outranks a healthy file for fifteen minutes, so a home that was
+                // repaired a second later would keep a red panel over a working login.
+                if (event.code === 'auth_expired') {
+                    const refused = relayAgent(String(descriptor.agent).toLowerCase());
+                    if (refused)
+                        noteAgentAuthFailure(refused);
+                }
+                // Only `auth_missing` is worth a relaunch, and the distinction is the
+                // adapter's own (`probeAuth`), not a guess from prose.
+                //
+                //  - `auth_missing` — there is no credential where we look. Usually the
+                //    link into the shared store went out from under a live daemon, and
+                //    the adapter re-asserts its home on start, so one relaunch really
+                //    does fix it.
+                //  - `auth_expired` — the provider refused a credential that IS there.
+                //    A repeat presents the same dead token and gets the same answer,
+                //    while the person waits for a retry that was never going to work.
+                //    `error-policy.ts` has said exactly this about Claude since 0.44.1
+                //    («A person has to sign in; a repeat cannot») — the two now agree.
+                if (event.code === 'auth_missing' && !running.authRetryDone) {
                     running.authRetry = { prompt: running.lastPrompt };
                     this.sendEvent(running, 'notice', {
                         level: 'warn',
@@ -1582,22 +1766,18 @@ export class Supervisor {
                     });
                     return;
                 }
-                // The retry is spent and the agent is still refused — this is the only
-                // authority on a login the credentials file cannot see through (a
-                // provider-side revocation leaves the file looking perfectly healthy).
-                // The panel is told from here, not from a guess (#121).
-                if (isAuthCode(event.code)) {
-                    const refused = relayAgent(String(descriptor.agent).toLowerCase());
-                    if (refused)
-                        noteAgentAuthFailure(refused);
-                }
                 // Forward the code: the API stores the payload as-is, so the dashboard
                 // can offer "Sign in" instead of a dead error card.
                 this.sendEvent(running, 'error', {
                     message: event.message,
                     ...(event.code ? { code: event.code } : {}),
                 });
-                this.reportStatus(descriptor.id, 'FAILED', {
+                // Through `finishSession`, not `reportStatus`: this branch is the one
+                // the 31.08.2026 incident was traced to. It filed the session FAILED
+                // and returned, and the agent process went on streaming for another
+                // seventy-one seconds — holding a seat on a machine whose database said
+                // it was free.
+                this.finishSession(running, 'FAILED', {
                     costUsd: running.costUsd,
                     activeMs: Supervisor.spentMs(running),
                     errorMessage: event.message,
@@ -1757,21 +1937,7 @@ export class Supervisor {
                  * turn (`endTaskTurn` keeps the live set).
                  */
                 const live = event.tasks.filter((task) => task.status === 'running').length;
-                if (live !== running.backgroundTasks) {
-                    const wasWaiting = running.backgroundTasks > 0 && live === 0;
-                    running.backgroundTasks = live;
-                    // The moment the last subagent finishes is the moment the session
-                    // really does become the human's — and the agent is sitting in
-                    // WAITING_INPUT, so nothing else will ever say so. `reportStatus`
-                    // carries the new number and the API turns it into the notification
-                    // it withheld earlier.
-                    if (wasWaiting && running.lastReported === 'WAITING_INPUT') {
-                        this.reportStatus(running.descriptor.id, 'WAITING_INPUT', {
-                            costUsd: running.costUsd,
-                            activeMs: Supervisor.spentMs(running),
-                        });
-                    }
-                }
+                this.setBackgroundTasks(running, live);
                 return;
             }
             case 'notice': {
@@ -1884,7 +2050,20 @@ export class Supervisor {
             // instead of dropping it silently.
             log.warn('supervisor: message for unknown session — requesting descriptor', { sessionId });
             const queued = this.orphanMessages.get(sessionId) ?? [];
-            queued.push({ text, ...(attachments?.length ? { attachments } : {}) });
+            /**
+             * The name travels with the words (QA-2026-08-16 M-2).
+             *
+             * Without it the replay below took the message a SECOND time under no
+             * name, and the API's redelivery of the row it queued for the same
+             * `unknown_session` then looked brand new to `deliveredMessageIds` — the
+             * agent got one instruction twice, in the one scenario that reliably
+             * produces both copies.
+             */
+            queued.push({
+                text,
+                ...(attachments?.length ? { attachments } : {}),
+                ...(messageId ? { messageId } : {}),
+            });
             this.orphanMessages.set(sessionId, queued.slice(-Supervisor.ORPHAN_MESSAGE_CAP));
             this.ws.send({ type: 'session_unknown', sessionId });
             return 'unknown_session';
@@ -2140,9 +2319,11 @@ export class Supervisor {
         }
         if (!running.session) {
             // The process died while we waited. Relaunching is `launchAgent`'s job and
-            // it needs a prompt; without one there is nothing honest to do here.
-            this.clearApiRetry(running);
-            this.reportStatus(running.descriptor.id, 'FAILED', {
+            // it needs a prompt; without one there is nothing honest to do here — so
+            // the session ends, entry and all (`finishSession`). It used to end only
+            // on paper, and the row left behind then swallowed the next
+            // `session_start` for the same id.
+            this.finishSession(running, 'FAILED', {
                 errorMessage: 'The agent process ended while waiting to retry',
             });
             return;
@@ -2202,6 +2383,11 @@ export class Supervisor {
                 this.sendEvent(running, 'message_delivered', { targetSeqs: delivered });
             }
         };
+        // M-4 (QA-2026-08-16): a new turn is starting, so a phantom held from the
+        // previous one must not fire 25 seconds from now and report WAITING_INPUT
+        // over an agent that is working — the very lie #300 is about, and this time
+        // with an irreversible notification behind it.
+        this.clearEmptyTurn(running);
         if (running.session && !running.parkRequested) {
             // #252: the words this turn is actually running. `lastPrompt` deliberately
             // stays put — three older latches relaunch a PROCESS with it, and handing
@@ -2658,6 +2844,65 @@ export class Supervisor {
             });
         }
     }
+    /**
+     * Let go of a session the API says no longer exists, so its files can go.
+     *
+     * `purge_session` and `clean` used to refuse outright while ANY entry for the
+     * id was in the map. That reads as caution and behaves as a deadlock: the
+     * frame arrives precisely because the API has already deleted the row, so
+     * nothing will ever come along to release the entry, the worktree stays on
+     * disk, and the retry runs until the purge ages out of its window. On
+     * production one such tombstone was still failing two hours later, on a
+     * machine that was refusing new sessions for exactly the seat it held.
+     *
+     * The API is the authority on whether a session exists. If it says gone, the
+     * honest answer is to end it here too — the same teardown a reconnect
+     * performs for a session missing from `hello_ack` — and only then report that
+     * we could not finish, if the process really will not go.
+     *
+     * Returns true when nothing is holding the id any more.
+     */
+    async releaseForCleanup(sessionId) {
+        const running = this.sessions.get(sessionId);
+        if (!running)
+            return true;
+        log.warn('supervisor: cleanup asked for a session this runner still held', { sessionId });
+        if (!running.stopRequested) {
+            running.stopRequested = true;
+            this.clearBudgetTimers(running);
+            this.clearApiRetry(running);
+            this.clearEmptyTurn(running);
+            this.withdrawOpenQuestions(running, 'session_stopped');
+            // No status report: the row is already gone on the other side, so a frame
+            // about it would be answered with «Unknown session» and nothing else.
+            running.session?.stop('session_stopped');
+            if (!running.session)
+                this.sessions.delete(sessionId);
+            this.drainSessionsWaitingForCapacity();
+            this.publishSlots();
+        }
+        // `pumpEvents` removes the entry when the process stream actually ends, and
+        // that is asynchronous. Bounded wait rather than an unbounded one: the
+        // caller is a command with its own timeout, and a purge that has to happen
+        // on the next drain instead of this one costs a retry, not the worktree.
+        for (let waited = 0; waited < Supervisor.CLEANUP_RELEASE_MS; waited += 100) {
+            if (!this.sessions.has(sessionId))
+                return true;
+            await new Promise((resolve) => setTimeout(resolve, 100));
+        }
+        return !this.sessions.has(sessionId);
+    }
+    /**
+     * How long cleanup waits for a stopped agent process to actually be gone.
+     *
+     * Deliberately a small slice of the API's ten-second command budget: removing
+     * the worktree still has to happen after this, under the repository lock, and
+     * a purge that times out on the wire is reported as a failure even when it
+     * succeeded here. Three seconds is enough for an ordinary exit; anything
+     * slower is better answered honestly, so the drain comes back and finds the
+     * entry already gone.
+     */
+    static CLEANUP_RELEASE_MS = 3_000;
     stopSession(sessionId) {
         const running = this.sessions.get(sessionId);
         if (!running)
@@ -2676,6 +2921,59 @@ export class Supervisor {
                 this.journals.closeAndDelete(sessionId);
             }
         }
+        this.publishSlots();
+    }
+    /**
+     * The ONE way a session ends on this runner.
+     *
+     * A terminal status is two facts, not one: the API is told the session is
+     * over, AND this machine stops holding a seat for it. They used to be
+     * separate lines at eight call sites, and three of them wrote only the first
+     * — `settleTurnStatus`'s failed-turn branch, `forwardEvent`'s `case 'error'`
+     * and `runApiRetry`. Each left a `RunningSession` in the map with a live
+     * `session` handle and `stopRequested === false`, which is precisely what
+     * `liveSessionCount` counts. The seat was then held for a session the API had
+     * already buried, until the next reconnect — weeks, on a healthy runner.
+     *
+     * On production (31.08.2026) that arithmetic refused a fourth session on a
+     * machine whose database said one was running, and the dashboard had offered
+     * the seat a moment earlier. `launchCrashed` had the rule right all along
+     * («an entry left in the map would hold one of the runner's few slots»); it
+     * just could not be the only place that knew it.
+     *
+     * Deliberately NOT folded into `reportStatus`: that method is also how a
+     * session reaches REVIEW, WAITING_INPUT and RUNNING, and a teardown hidden
+     * inside it would be invisible at exactly the call sites that must not tear
+     * anything down. The name says what it does.
+     */
+    finishSession(running, status, extra) {
+        const sessionId = running.descriptor.id;
+        // Before the report, so a frame that races the teardown cannot re-arm
+        // anything the teardown is in the middle of taking away.
+        running.stopRequested = true;
+        this.clearBudgetTimers(running);
+        this.clearApiRetry(running);
+        this.clearEmptyTurn(running);
+        // The cards die with the turn: a question nobody can answer any more is a
+        // worse thing to leave on screen than no question at all.
+        this.withdrawOpenQuestions(running, 'session_stopped');
+        this.reportStatus(sessionId, status, extra);
+        if (running.session) {
+            // `pumpEvents` deletes the entry when the stream ends, and its
+            // `stopRequested` branch skips the STOPPED frame because `lastReported`
+            // is already terminal. Until then the seat is free anyway: `stopRequested`
+            // takes the entry out of `liveSessionCount` on this very line.
+            running.session.stop('session_stopped');
+        }
+        else {
+            this.sessions.delete(sessionId);
+            if (this.ws.connected && running.journal.unacked().length === 0) {
+                this.journals.closeAndDelete(sessionId);
+            }
+        }
+        // A freed seat is only useful to whoever is waiting for one.
+        this.drainSessionsWaitingForCapacity();
+        this.publishSlots();
     }
     // ─── Reconciliation (hello_ack) ────────────────────────────────────
     async reconcile(descriptors) {
@@ -2927,11 +3225,30 @@ export class Supervisor {
                             });
                         }
                     }
-                    // REVIEW stays REVIEW (WAITING_INPUT is not reachable from it);
-                    // mid-turn statuses are downgraded to "waiting for the user".
-                    if (descriptor.status !== 'REVIEW') {
-                        this.reportStatus(descriptor.id, 'WAITING_INPUT', {});
-                    }
+                    /**
+                     * REVIEW stays REVIEW (WAITING_INPUT is not reachable from it);
+                     * mid-turn statuses are downgraded to "waiting for the user".
+                     *
+                     * REVIEW is now REPORTED rather than skipped — ticket #356, and the
+                     * news in that frame is not the status, which has not moved. It is
+                     * the ZERO riding on it.
+                     *
+                     * `running.backgroundTasks` is seeded to 0 above, because a runner
+                     * restart takes every subagent with it. But the number the API holds
+                     * is written by the runner ALONE, and it is only ever written by a
+                     * frame that carries the field — which `reportStatus` attaches only
+                     * for a tracked session. Skipping the report here left the API
+                     * believing whatever the dead process last said, for good: the badge
+                     * would keep saying «Agents», the Inbox would keep hiding the card,
+                     * and no later frame would ever correct either. `setBackgroundTasks`
+                     * cannot help — it compares against the in-memory 0 and returns
+                     * early, having nothing to announce.
+                     *
+                     * Same-status frames are legal (`canDevSessionTransition` answers
+                     * `true` for `from === to`), so this costs one no-op write and buys
+                     * back a session that would otherwise have been lost.
+                     */
+                    this.reportStatus(descriptor.id, statusForReport(running), {});
                     this.flushPendingMessages(running);
                 }
                 else if (descriptor.status === 'WAITING_INPUT') {
@@ -3022,8 +3339,22 @@ export class Supervisor {
                     const sessionId = frame.sessionId;
                     if (!sessionId)
                         return void reply({ ok: false, error: 'sessionId is required' });
-                    const running = this.sessions.get(sessionId);
-                    if (running)
+                    /**
+                     * `clean` keeps the flat refusal. `purge_session` does not. The
+                     * difference is who is allowed to ask.
+                     *
+                     * `purge_session` only ever arrives after the API has deleted the
+                     * row, so «wait for it to wind down» waits for something that will
+                     * never happen — that is the deadlock `releaseForCleanup` exists to
+                     * break. `clean` is a user-callable command
+                     * (`POST /dev/sessions/:id/commands`, any dev member) and the API
+                     * checks no status before relaying it. This refusal is the ONLY guard
+                     * on that route: releasing here would stop a mid-turn agent and then
+                     * `git worktree remove --force` its worktree, destroying every
+                     * uncommitted change in it. Caught by the independent QA review of
+                     * this change, by two reviewers separately.
+                     */
+                    if (this.sessions.get(sessionId))
                         return void reply({ ok: false, error: 'Session is still active — stop it first' });
                     // `worktree remove` also mutates the shared .git registration.
                     await this.withRepoLockFor(sessionWorktreePath(sessionId), () => removeSessionWorktree(sessionId));
@@ -3035,7 +3366,7 @@ export class Supervisor {
                     const sessionId = frame.sessionId;
                     if (!sessionId)
                         return void reply({ ok: false, error: 'sessionId is required' });
-                    if (this.sessions.get(sessionId)) {
+                    if (!(await this.releaseForCleanup(sessionId))) {
                         return void reply({ ok: false, error: 'Session is still active — stop it first' });
                     }
                     const branch = str(frame.args?.['branch']);
@@ -3727,6 +4058,43 @@ export class Supervisor {
                         return void reply({ ok: false, error: 'root argument is required' });
                     return void reply({ ok: true, result: fsView(root, str(frame.args?.['path']) ?? '.') });
                 }
+                /**
+                 * Выложить файл с этой машины (0.46.0).
+                 *
+                 * Адрес, куда уходят байты, раннер собирает САМ из своего `apiUrl` —
+                 * во фрейме его нет и быть не должно. Иначе одна подделанная команда
+                 * стала бы способом вытянуть файл с чужой машины на чужой хост.
+                 */
+                case 'fs_publish': {
+                    const root = str(frame.args?.['root']);
+                    const filePath = str(frame.args?.['path']);
+                    const slotId = str(frame.args?.['slotId']);
+                    if (!root || !filePath || !slotId) {
+                        return void reply({ ok: false, error: 'root, path and slotId are required' });
+                    }
+                    if (!this.opts.apiUrl || !this.opts.runnerToken) {
+                        return void reply({
+                            ok: false,
+                            error: 'This runner has no API credentials configured',
+                        });
+                    }
+                    const maxBytesRaw = frame.args?.['maxBytes'];
+                    const maxBytes = typeof maxBytesRaw === 'number' ? maxBytesRaw : 0;
+                    try {
+                        const result = await publishFile({
+                            root,
+                            relPath: filePath,
+                            slotId,
+                            maxBytes,
+                            apiUrl: this.opts.apiUrl,
+                            token: this.opts.runnerToken,
+                        });
+                        return void reply({ ok: true, result });
+                    }
+                    catch (error) {
+                        return void reply({ ok: false, error: String(error.message ?? error) });
+                    }
+                }
                 case 'self_update': {
                     // Everything that can refuse this lives in self-update.ts; here we
                     // only make sure the answer is on the wire BEFORE the process goes
@@ -4143,9 +4511,17 @@ export class Supervisor {
             // would mean it goes on claiming background work forever.
             ...(running ? { backgroundTasks: running.backgroundTasks } : {}),
         });
+        // Every seat change is accompanied by a status report — a session starting,
+        // parking, ending. Hooking the seat report here rather than at each of those
+        // is the whole point: «remember to also tell the API» is the rule that had
+        // already been broken in three places, and it is what this frame exists to
+        // stop mattering. `publishSlots` sends only when the answer actually
+        // changed, and the interval in the constructor is the net under both.
+        this.publishSlots();
     }
     /** Graceful daemon shutdown: kill agents, keep sessions resumable server-side. */
     shutdown() {
+        clearInterval(this.slotsTimer);
         this.authRelay.cancel();
         for (const running of this.sessions.values()) {
             this.clearBudgetTimers(running);
@@ -4330,10 +4706,6 @@ const AGENT_LABELS = { CLAUDE: 'Claude Code', CODEX: 'Codex' };
 function reportsCost(agent) {
     return agent === 'CLAUDE';
 }
-/** Adapter error codes that mean "the sign-in did not work". */
-function isAuthCode(code) {
-    return code === 'auth_expired' || code === 'auth_missing';
-}
 /**
  * Does this descriptor point at work that already exists on a branch?
  * If so, silently creating a fresh branch off HEAD would hide the agent's