@bridge4dev/runner 0.47.0 → 0.49.0

package/dist/supervisor.js

@@ -1,7 +1,9 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { log } from './log.js';
+import { CONTEXT_USAGE_MIN_DELTA_RATIO, CONTEXT_USAGE_MIN_DELTA_TOKENS, RATE_LIMITS_RESEND_INTERVAL_MS, } from './levels.js';
 import { claimAutoResume, clearAutoResume, pruneAutoResume } from './auto-resume.js';
+import { errorVerdict, isNewWork, isStoppedToolTail, ownsProcess, turnEndVerdict, } from './stop-cycle.js';
 import { classifyFailure, isRepeatOfSameFailure, MAX_RETRIES_PER_SESSION, retryDelayMs, } from './adapters/error-policy.js';
 import { evaluateRecipeCommand, maskSecrets, maskString } from './policy.js';
 import { agentPromptSizeLabel, inspectAgentPrompt, quotePath, readAgentPrompt, } from './agent-prompt.js';
@@ -58,6 +60,16 @@ function gitPolicyOf(descriptor) {
             : {}),
     };
 }
+function freshLevels() {
+    return {
+        contextSent: null,
+        contextHeld: null,
+        contextPassNext: false,
+        limitsSent: null,
+        sent: 0,
+        dropped: 0,
+    };
+}
 const LAUNCH_REFUSED = { ok: false, reason: 'refused' };
 export class Supervisor {
     ws;
@@ -85,6 +97,9 @@ export class Supervisor {
     static EMPTY_TURN_SETTLE_MS = 25_000;
     /** The window actually used — the constant, or a test's own shorter one. */
     emptyTurnSettleMs;
+    rateLimitsResendMs;
+    /** The stop-settle window actually used — the constant, or a test's own. */
+    stopSettleMs;
     /** A finished session's journal is kept this long for a late reconnect. */
     static JOURNAL_TTL_MS = 72 * 3_600_000;
     /** Backstop: events the API will never accept must not pile up forever. */
@@ -135,6 +150,8 @@ export class Supervisor {
         this.opts = opts;
         this.journals = opts.journals ?? new JournalStore();
         this.emptyTurnSettleMs = opts.emptyTurnSettleMs ?? Supervisor.EMPTY_TURN_SETTLE_MS;
+        this.rateLimitsResendMs = opts.rateLimitsResendMs ?? RATE_LIMITS_RESEND_INTERVAL_MS;
+        this.stopSettleMs = opts.stopSettleMs ?? Supervisor.STOP_SETTLE_MS;
         this.verify = new VerifyRunner({
             enabled: opts.verifyEnabled !== false,
             onReport: (report) => {
@@ -743,6 +760,7 @@ export class Supervisor {
             lastReported: descriptor.status,
             costUsd: descriptor.costUsd,
             costBaseUsd: descriptor.costUsd,
+            levels: freshLevels(),
             stopRequested: false,
             parkRequested: false,
             pendingMessages: [],
@@ -750,6 +768,10 @@ export class Supervisor {
             extraBudgetMinutes: descriptor.extraBudgetMinutes,
             epoch: descriptor.epoch,
             openQuestions: new Set(),
+            openPermissions: new Set(),
+            liveToolUses: new Set(),
+            pauseEpoch: 0,
+            processSeq: 0,
             answeredAsks: new Set(),
             deliveredMessageIds: new Set(),
             backgroundTasks: 0,
@@ -841,9 +863,18 @@ export class Supervisor {
                 // where the agent left off» there is the one thing the feed must not do.
                 // It happens for real: a process that dies before it reports its session
                 // id (the SIGABRT this ticket came from) leaves the row with none.
+                //
+                // Ticket #370: the sentence about the agent's MEMORY waits for proof.
+                // It used to be written here, on the strength of a stored id and before
+                // the CLI had been asked anything — and on Athanor it appeared sixty
+                // seconds before `thread/resume` timed out and took the session with it.
+                // What is honest at this moment is that the runner is back; whether the
+                // conversation reopens is answered by the process, in `provider_session`.
+                if (descriptor.providerSessionId)
+                    running.resumeClaimPending = true;
                 this.sendEvent(running, 'system_note', {
                     text: descriptor.providerSessionId
-                        ? 'Session resumed — the agent still has this conversation. Send a message to continue where it left off.'
+                        ? 'Session resumed — send a message and the agent picks its conversation back up.'
                         : 'Session resumed, but the agent never got as far as naming its conversation, so it starts this one over. Your files, your branch and everything above are untouched.',
                 });
             }
@@ -953,6 +984,14 @@ export class Supervisor {
         // apply it never started (ticket #225). The feed has already told them the
         // conversation was cut.
         const rewind = running.rewindAnchor;
+        // #373: a new process is a new subject. Everything the previous one left
+        // behind — the stop it was going through, the tools it had in flight, the
+        // cards it was parked on — belongs to a process that no longer exists, and
+        // carrying any of it over would let an old cancellation swallow a new
+        // failure.
+        delete running.stopCycle;
+        running.liveToolUses.clear();
+        running.openPermissions.clear();
         try {
             const agentPrompt = this.resolveAgentPrompt(running, resuming && !rewinding);
             const workspaceContext = composeWorkspaceContext(descriptor, agentPrompt?.text);
@@ -963,6 +1002,15 @@ export class Supervisor {
             // from. Its transcript is still on disk — that is what makes the point
             // usable at all.
             const resumeTarget = rewind ? rewind.agentSession : resumeId;
+            // #370: whether the promise about the agent's memory has anything to
+            // prove. A launch with no conversation to reopen can never confirm one.
+            running.launchResumed = Boolean(resumeTarget);
+            // Nothing to prove on a launch that opens no conversation (a stale-resume
+            // recovery nulls the id) — and a promise left standing would be kept
+            // later, by a relaunch that had nothing to do with it.
+            if (!running.launchResumed)
+                delete running.resumeClaimPending;
+            running.processSeq += 1;
             running.session = adapter.startSession({
                 sessionId: descriptor.id,
                 cwd: running.worktreePath,
@@ -1354,6 +1402,16 @@ export class Supervisor {
         // Guarded like the event loop above — a journal that cannot be written (a
         // full disk, a daemon already shutting down) must not take the exit path
         // with it, because everything below it is cleanup.
+        // #373: the stop this process was going through has reached its end. Marked
+        // before the cleanup below so anything still queued behind it is judged
+        // against a cycle that knows the process is gone.
+        if (running.stopCycle && running.stopCycle.session === session) {
+            this.clearStopSettleTimer(running.stopCycle);
+            running.stopCycle.phase = 'parked';
+        }
+        // Both sets describe THIS process and nothing else (#373).
+        running.liveToolUses.clear();
+        running.openPermissions.clear();
         try {
             this.clearApiRetry(running);
             this.withdrawOpenQuestions(running, 'session_stopped');
@@ -1697,11 +1755,111 @@ export class Supervisor {
      * its timer runs out, and it must end in exactly the way it would have
      * ended immediately. A copy would be two behaviours one edit apart.
      */
+    /**
+     * The level gate for the context meter (#366).
+     *
+     * While a turn is open, a frame goes out only when the meter moved by at
+     * least one of the shared thresholds or the window itself changed; the
+     * newest held-back value is flushed right before `turn_end`, so the ring at
+     * rest is exact. Outside a turn every frame passes – there are only a handful
+     * (process start, a model change, and the Claude adapter's own measurement,
+     * which resolves AFTER `turn_end`), and each one is news.
+     */
+    forwardContextUsage(running, usedTokens, maxTokens) {
+        const levels = running.levels;
+        const frame = { usedTokens, maxTokens };
+        const last = levels.contextSent;
+        const turnOpen = running.lastReported === 'RUNNING';
+        const moved = last === null ? Number.POSITIVE_INFINITY : Math.abs(usedTokens - last.usedTokens);
+        const pass = last === null ||
+            last.maxTokens !== maxTokens ||
+            levels.contextPassNext ||
+            !turnOpen ||
+            moved >= CONTEXT_USAGE_MIN_DELTA_TOKENS ||
+            moved / maxTokens >= CONTEXT_USAGE_MIN_DELTA_RATIO;
+        // Only the newest value is worth keeping; whatever it replaces is gone.
+        if (levels.contextHeld !== null)
+            levels.dropped += 1;
+        if (!pass) {
+            levels.contextHeld = frame;
+            return;
+        }
+        levels.contextHeld = null;
+        levels.contextPassNext = false;
+        levels.contextSent = frame;
+        levels.sent += 1;
+        this.sendEvent(running, 'context_usage', frame);
+    }
+    /** Send the value the gate was holding, if any – strictly before `turn_end`. */
+    flushHeldContextUsage(running) {
+        const levels = running.levels;
+        const held = levels.contextHeld;
+        if (held === null)
+            return;
+        levels.contextHeld = null;
+        // A held value identical to the last one sent is not news – flushing it
+        // would add a frame to every turn and give back half the saving.
+        const sent = levels.contextSent;
+        if (sent !== null && sent.usedTokens === held.usedTokens && sent.maxTokens === held.maxTokens) {
+            return;
+        }
+        levels.contextSent = held;
+        levels.sent += 1;
+        this.sendEvent(running, 'context_usage', held);
+    }
+    /**
+     * The level gate for plan usage (#366).
+     *
+     * A snapshot goes out when it is the first, when anything but `measuredAt`
+     * changed, when it carries a refusal (#258 – always, even twice in a row), or
+     * when the one last sent is older than the resend floor. The fingerprint is
+     * the whole payload minus the clock, so a field an adapter adds tomorrow is
+     * part of it without anybody remembering to list it here.
+     */
+    forwardRateLimits(running, limits) {
+        const levels = running.levels;
+        const print = JSON.stringify({ ...limits, measuredAt: undefined });
+        const now = Date.now();
+        const last = levels.limitsSent;
+        const pass = last === null ||
+            Boolean(limits.blocked) ||
+            last.print !== print ||
+            now - last.at >= this.rateLimitsResendMs;
+        if (!pass) {
+            levels.dropped += 1;
+            return;
+        }
+        levels.limitsSent = { print, at: now };
+        levels.sent += 1;
+        this.sendEvent(running, 'rate_limits', { ...limits });
+    }
     completeTurn(running, descriptor, event) {
+        // #366: the ring at rest must be exact – the value the gate held back
+        // during the turn goes out first, so it is older than `turn_end` by seq.
+        this.flushHeldContextUsage(running);
         this.sendEvent(running, 'turn_end', {
             ok: event.ok,
             errorMessage: event.errorMessage,
             ...(event.aborted ? { aborted: true } : {}),
+            // #258 / #373: two facts the adapters have always measured and this line
+            // has always dropped on the floor. `limitBlocked` is what tells the API a
+            // turn was REFUSED rather than run, and `produced` is what tells it the
+            // turn did something — without which the phantom ending a resumed process
+            // emits (#300) resets the «three limit pauses in a row» counter one second
+            // after the third one, and «woke → refused → slept» never stops.
+            ...(event.limitBlocked ? { limitBlocked: true } : {}),
+            // ALWAYS present, true or false — the absence of this field is what the
+            // API reads as «this runner is older than the fix», and a new runner that
+            // sometimes omitted it would be indistinguishable from one.
+            produced: event.produced === true,
+        });
+        // …and whatever the adapter measures once the turn is over (Claude does,
+        // asynchronously) is news, not a step of the same turn.
+        running.levels.contextPassNext = true;
+        log.info('supervisor: levels', {
+            sessionId: descriptor.id,
+            sent: running.levels.sent,
+            dropped: running.levels.dropped,
         });
         // The session is already on its way out with a status that MEANS
         // something — a spent budget, a Stop, a teardown. A turn ending inside
@@ -1867,6 +2025,13 @@ export class Supervisor {
     isParkable(running) {
         return ((running.lastReported === 'REVIEW' || running.lastReported === 'WAITING_INPUT') &&
             running.openQuestions.size === 0 &&
+            // #373. `stop()` answers every pending permission «denied» in the RUNNER's
+            // name, and the status is not a reliable reading of «a card is open»: a
+            // pause reports a resting status the instant it interrupts, and a card
+            // resolved by POLICY never moves the status back. So the seat-freeing path
+            // needs the same guard the pause has — without it `ensureCapacity` walks
+            // straight past invariant 8 and denies the card to make room.
+            running.openPermissions.size === 0 &&
             Boolean(running.descriptor.providerSessionId));
     }
     /**
@@ -1960,7 +2125,7 @@ export class Supervisor {
             // and Codex's own «interrupted, so start the next queued turn» both come
             // through no frame this runner could refuse.
             if (Supervisor.isPaused(running))
-                this.stopWorkUnderPause(running);
+                this.stopWorkUnderPause(running, event);
             else
                 this.noteAgentIsWorking(running);
         }
@@ -1970,6 +2135,16 @@ export class Supervisor {
                 this.reportStatus(descriptor.id, statusForReport(running), {
                     providerSessionId: event.providerSessionId,
                 });
+                // #370: the promise, now that it can be kept. Both CLIs answer a REFUSED
+                // reopen with no session of any kind — Claude emits no `system:init` at
+                // all, Codex throws before it gets here — so this event is the proof the
+                // conversation really came back, and the only honest moment to say so.
+                if (running.resumeClaimPending && running.launchResumed) {
+                    delete running.resumeClaimPending;
+                    this.sendEvent(running, 'system_note', {
+                        text: 'The agent still has this conversation — carry on where it left off.',
+                    });
+                }
                 // The CLI resumed at the anchor and forked, so the cut announced when
                 // the rewind was asked for stands. Nothing to send — it is already in
                 // the feed; this only retires the promise to take it back.
@@ -1987,6 +2162,39 @@ export class Supervisor {
                 });
                 return;
             case 'turn_end': {
+                // #373: a stop in flight owns the endings of the process it is stopping.
+                // The incident was two results 1.2 seconds apart — the first the stop we
+                // asked for, the second `error_during_execution` — and the second one
+                // filed a paused session as FAILED, which is terminal, with a live clock
+                // still on it.
+                const cycle = running.stopCycle;
+                if (cycle && ownsProcess(cycle, running.session)) {
+                    const verdict = turnEndVerdict(cycle);
+                    if (verdict === 'tail') {
+                        log.info('supervisor: a late turn ending belongs to the stop', {
+                            sessionId: descriptor.id,
+                            process: running.processSeq,
+                            reason: cycle.reason,
+                            phase: cycle.phase,
+                            ok: event.ok,
+                        });
+                        return;
+                    }
+                    if (verdict === 'stopped') {
+                        cycle.turnEndSent = true;
+                        this.publishStoppedTurn(running, descriptor, event);
+                        this.settleStopCycle(running, cycle);
+                        return;
+                    }
+                    // `ordinary` — a manual Stop keeps the contract it has had since
+                    // QA-120: this ending goes out unchanged, and the next genuine failure
+                    // is not hidden behind it (`errorVerdict` answers `failure` for a
+                    // `user` cycle whatever its phase). Settled rather than deleted, so
+                    // the acknowledgement still on its way finds its cycle and writes the
+                    // one line this stop owes the feed — the result can beat the ACK.
+                    this.clearStopSettleTimer(cycle);
+                    cycle.settled = true;
+                }
                 // #252: decided BEFORE the frame goes out. A `turn_end{ok:false}` files
                 // the session as FAILED, and FAILED is terminal — a session we intend to
                 // retry must never be told it has ended. So a turn that is going to be
@@ -2085,6 +2293,31 @@ export class Supervisor {
                     });
                     return;
                 }
+                // #373, invariant 4. Everything above this line is a named, recoverable
+                // condition and keeps its own handling; what is left is «an error we do
+                // not recognise», and that is the branch that files the session FAILED.
+                // A process this runner is closing on purpose produces exactly that on
+                // its way out, and a pause must not end in a terminal status.
+                //
+                // The verdict, not a string match: a process that fell over while we
+                // had merely ASKED it to stop has genuinely failed and still says so
+                // (`processGone` on a cycle that closed nothing).
+                {
+                    const cycle = running.stopCycle;
+                    if (cycle &&
+                        ownsProcess(cycle, running.session) &&
+                        errorVerdict(cycle, event.processGone === true) === 'tail') {
+                        log.info('supervisor: an error from the process we are closing', {
+                            sessionId: descriptor.id,
+                            process: running.processSeq,
+                            reason: cycle.reason,
+                            phase: cycle.phase,
+                            processGone: event.processGone === true,
+                            code: event.code ?? null,
+                        });
+                        return;
+                    }
+                }
                 // Forward the code: the API stores the payload as-is, so the dashboard
                 // can offer "Sign in" instead of a dead error card.
                 this.sendEvent(running, 'error', {
@@ -2103,6 +2336,10 @@ export class Supervisor {
                 });
                 return;
             case 'permission':
+                // #373, invariant 8: a card the agent is parked on. Parking the session
+                // would answer it «no» in the runner's name, so the pause stops this
+                // process but leaves it open.
+                running.openPermissions.add(event.requestId);
                 this.sendEvent(running, 'permission', {
                     requestId: event.requestId,
                     toolName: event.toolName,
@@ -2115,6 +2352,7 @@ export class Supervisor {
                 });
                 return;
             case 'permission_resolved':
+                running.openPermissions.delete(event.requestId);
                 this.sendEvent(running, 'permission_resolved', {
                     requestId: event.requestId,
                     allow: event.allow,
@@ -2221,17 +2459,17 @@ export class Supervisor {
                 });
                 return;
             case 'context_usage':
-                this.sendEvent(running, 'context_usage', {
-                    usedTokens: event.usedTokens,
-                    maxTokens: event.maxTokens,
-                });
+                // #366. A LEVEL: only a value that moved is worth a frame. The gate
+                // decides before `sendEvent`, so a dropped frame never spends a seq.
+                this.forwardContextUsage(running, event.usedTokens, event.maxTokens);
                 return;
             // #279. A LEVEL signal like `agent_tasks`: every frame carries the whole
-            // snapshot, so the API stores what arrived rather than merging, and a
+            // snapshot, so the API keeps what arrived rather than merging, and a
             // dropped frame costs freshness, never correctness. Account-wide, not
             // session-wide — the API files it under the SERVER, not this session.
+            // #366: gated the same way as the context meter, see `forwardRateLimits`.
             case 'rate_limits':
-                this.sendEvent(running, 'rate_limits', { ...event.limits });
+                this.forwardRateLimits(running, event.limits);
                 return;
             case 'agent_tasks': {
                 // Ticket #113. A LEVEL signal: every frame carries the whole live set,
@@ -2272,6 +2510,15 @@ export class Supervisor {
                 return;
             }
             case 'tool':
+                // #373: which calls are in flight, so a stop can tell its own tail from
+                // work starting up. Kept here rather than in the adapters — both of them
+                // already report the two phases, and one reader is one place to be wrong.
+                if (event.toolUseId) {
+                    if (event.phase === 'use')
+                        running.liveToolUses.add(event.toolUseId);
+                    else
+                        running.liveToolUses.delete(event.toolUseId);
+                }
                 this.sendEvent(running, 'tool', {
                     phase: event.phase,
                     name: event.name,
@@ -2726,6 +2973,14 @@ export class Supervisor {
              * Now it goes back in the queue, exactly like a parked process below, and
              * the feed says why.
              */
+            // #373: a new turn on this process ends the previous stop's ownership of
+            // it. Dropped HERE and not when the clock came off, because this is the
+            // moment the endings stop being the stop's own — a release alone leaves
+            // the interrupt in flight and its second result still coming.
+            if (running.stopCycle && running.stopCycle.session === running.session) {
+                this.clearStopSettleTimer(running.stopCycle);
+                delete running.stopCycle;
+            }
             if (!running.session.send(text)) {
                 log.warn('supervisor: the agent process refused the message — requeued', {
                     sessionId: running.descriptor.id,
@@ -2951,23 +3206,329 @@ export class Supervisor {
             running.interruptWhenReady = true;
             return;
         }
+        const open = running.stopCycle;
+        if (open && ownsProcess(open, running.session) && !open.settled) {
+            // #357 part 2, and invariant 2 of the pause plan. Ten frames arrive while
+            // the CLI is waiting out a provider retry — from a phone and a laptop at
+            // once, or from a person pressing a button that gave them no sign it had
+            // been heard. One stop, one line in the feed, one status report; the rest
+            // wait for the same answer.
+            //
+            // A clock landing on a Stop the person pressed a second earlier is the
+            // same stop with a stricter reason: the CLI has one outstanding interrupt
+            // and answers it once, but the ending now belongs to a PAUSE, which closes
+            // the process. Left as `user` this cycle would step aside at the first
+            // ending and the second result would file the session FAILED — the
+            // incident, through a door the fix did not cover.
+            if (reason === 'pause' && open.reason === 'user') {
+                open.reason = 'pause';
+                log.info('supervisor: a clock landed on a stop already in flight', { sessionId });
+            }
+            log.info('supervisor: a stop is already in flight — joining it', {
+                sessionId,
+                reason,
+                phase: open.phase,
+            });
+            await open.inFlight?.catch(() => undefined);
+            return;
+        }
+        await this.beginStopCycle(running, reason, announce);
+    }
+    /**
+     * How long a stop waits for the ending that should follow it (#373).
+     *
+     * The transition out of `interrupting` is the first result, not the
+     * acknowledgement — an ACK only says the request was heard, and the incident
+     * shows an ACK and a result are different events that arrive in either order.
+     * This is the backstop for the case where no result comes at all: an idle
+     * session had no turn to end, and a CLI can always simply not answer.
+     */
+    static STOP_SETTLE_MS = 5_000;
+    /**
+     * How long after one stop the next output is still read as its tail (#196).
+     *
+     * The floor under the stop cycle rather than a substitute for it: while a
+     * cycle is open every event joins it, and this is what keeps a burst from
+     * opening a NEW cycle per line in the window after one closed without closing
+     * its process. Far shorter than the gap before a genuinely new turn — a
+     * background subagent finishing — which still gets its own stop.
+     */
+    static PAUSE_BURST_MS = 2_000;
+    /**
+     * Stop one agent process once, and own what stopping it produces (#373).
+     *
+     * The shape is deliberate: the interrupt is a round trip that can take half a
+     * minute (a CLI sitting out a provider retry answers only when it comes back
+     * — 28.5 seconds, measured in #357), so nothing here may be on the path the
+     * event pump takes. The cycle is stored before the request goes out, which is
+     * what makes every later request join this one instead of starting a second.
+     */
+    async beginStopCycle(running, reason, announce) {
+        const session = running.session;
+        if (!session)
+            return;
+        const sessionId = running.descriptor.id;
+        const cycle = {
+            session,
+            reason,
+            epoch: running.pauseEpoch,
+            phase: 'interrupting',
+            inFlight: null,
+            outcome: null,
+            refused: false,
+            closed: false,
+            turnEndSent: false,
+            settled: false,
+            hadTurn: running.lastReported === 'RUNNING' || running.lastReported === 'STARTING',
+            toolsAtStop: new Set(running.liveToolUses),
+        };
+        running.stopCycle = cycle;
+        // Kept for the cool-down in `stopWorkUnderPause`: a cycle that ends without
+        // closing the process must not be replaced by another one on the next event.
+        running.pauseInterruptAt = Date.now();
+        log.info('supervisor: stopping the agent', {
+            sessionId,
+            reason,
+            process: running.processSeq,
+            epoch: cycle.epoch,
+            status: running.lastReported,
+            hadTurn: cycle.hadTurn,
+            toolsInFlight: cycle.toolsAtStop.size,
+            openQuestions: running.openQuestions.size,
+            openPermissions: running.openPermissions.size,
+        });
         // The turn being interrupted is the turn the question belongs to — leaving
         // the ask parked would make the user's next message be swallowed as its
         // answer (QA-106 m7). The adapter reports each withdrawal itself; the local
         // set is cleared so the session can be parked again.
-        running.session.cancelQuestions('turn_aborted');
+        session.cancelQuestions('turn_aborted');
         running.openQuestions.clear();
-        await running.session.interrupt();
-        if (announce) {
-            this.sendEvent(running, 'notice', {
-                level: 'info',
-                text: reason === 'pause'
-                    ? 'Paused — the turn was stopped. Nothing else will start until the clock runs out.'
-                    : 'Turn interrupted by the user',
+        // Armed BEFORE the request goes out, not after it answers. A control channel
+        // that never answers is a real case — it is half of #357 — and a stop that
+        // waited for an acknowledgement before starting its own clock would hold the
+        // session, its seat and the pause for as long as the CLI stayed silent.
+        this.armStopSettle(running, cycle);
+        const inFlight = (async () => {
+            let outcome;
+            try {
+                outcome = await session.interrupt();
+            }
+            catch (error) {
+                // An adapter is not supposed to throw here, and one that does has told
+                // us nothing about whether the turn stopped — which is exactly the
+                // «refused» case.
+                outcome = 'refused';
+                log.warn('supervisor: the interrupt request threw', {
+                    sessionId,
+                    error: String(error),
+                });
+            }
+            // A newer cycle (or a new process) took over while we waited: this answer
+            // is about a stop nobody is waiting for any more.
+            if (running.stopCycle !== cycle)
+                return;
+            cycle.outcome = outcome;
+            // Invariant 7: a refusal that arrives after WE closed this process is
+            // void. `stop()` rejects every outstanding control request on close, and
+            // reading our own park as a failure is the defect with the sign flipped.
+            cycle.refused = outcome === 'refused' && cycle.phase === 'interrupting';
+            if (announce) {
+                this.sendEvent(running, 'notice', {
+                    level: 'info',
+                    text: reason === 'pause'
+                        ? 'Paused — the turn was stopped. Nothing else will start until the clock runs out.'
+                        : 'Turn interrupted by the user',
+                });
+            }
+            const next = running.descriptor.kind === 'CHAT' ? 'WAITING_INPUT' : 'REVIEW';
+            this.reportStatus(sessionId, next, {
+                costUsd: running.costUsd,
+                activeMs: Supervisor.spentMs(running),
+            });
+            this.armStopSettle(running, cycle);
+        })();
+        cycle.inFlight = inFlight;
+        await inFlight;
+    }
+    /**
+     * Wait a bounded time for the ending an accepted interrupt should produce.
+     *
+     * «Bounded» rather than «for ever» because two real cases produce no ending
+     * at all: a pause landing between turns (there was nothing to stop), and a
+     * CLI that takes the request and then says nothing. Leaving the cycle open
+     * there would hold the seat and the clock indefinitely.
+     */
+    armStopSettle(running, cycle) {
+        // The result can beat the acknowledgement — they are different events and
+        // the incident shows both orders. If it already has, this cycle is settled
+        // and there is nothing left to wait for.
+        if (cycle.phase !== 'interrupting' || running.stopCycle !== cycle)
+            return;
+        if (this.isStale(running))
+            return;
+        this.clearStopSettleTimer(cycle);
+        const timer = setTimeout(() => {
+            delete cycle.settleTimer;
+            if (running.stopCycle !== cycle || this.isStale(running))
+                return;
+            const midTurn = running.lastReported === 'RUNNING' || running.lastReported === 'STARTING';
+            if (cycle.reason === 'user' && (cycle.outcome === null || midTurn)) {
+                // A manual Stop never forces: #357's own rule is that the turn stops
+                // when the CLI comes back, and the measured wait there was 28.5 seconds
+                // — a provider retry the person cannot see. So this cycle stands for as
+                // long as the turn does, not for five seconds: the guarantee it carries
+                // is «one stop per turn», and a stop that expired underneath a running
+                // turn would let the eleventh press become a second interrupt.
+                this.armStopSettle(running, cycle);
+                return;
+            }
+            if (!cycle.turnEndSent && cycle.hadTurn && cycle.reason === 'pause') {
+                // A turn was running and its ending never came. One goes out anyway:
+                // the feed's readers retire a turn on `turn_end`, and a turn with no
+                // ending leaves the tray counting work that stopped minutes ago.
+                cycle.turnEndSent = true;
+                this.publishStoppedTurn(running, running.descriptor, { ok: true, aborted: true });
+            }
+            log.info('supervisor: the stop produced no ending in time', {
+                sessionId: running.descriptor.id,
+                process: running.processSeq,
+                reason: cycle.reason,
+                outcome: cycle.outcome,
+                hadTurn: cycle.hadTurn,
+            });
+            this.settleStopCycle(running, cycle);
+        }, this.stopSettleMs);
+        timer.unref?.();
+        cycle.settleTimer = timer;
+    }
+    clearStopSettleTimer(cycle) {
+        if (cycle.settleTimer) {
+            clearTimeout(cycle.settleTimer);
+            delete cycle.settleTimer;
+        }
+    }
+    /**
+     * The turn is over — close the process, keeping the session resumable.
+     *
+     * This is the change the whole plan is about. A pause used to leave a live
+     * CLI standing for up to five hours, which is where the second result came
+     * from; now the runner takes the ending it asked for and parks, and the next
+     * message (or the clock's own «continue») starts a process that resumes the
+     * same conversation.
+     */
+    settleStopCycle(running, cycle) {
+        if (running.stopCycle !== cycle)
+            return;
+        this.clearStopSettleTimer(cycle);
+        cycle.settled = true;
+        // Settled, never DELETED here. The cycle goes on owning this process's
+        // endings — a late second result after a stop that closed nothing is the
+        // incident itself — and is dropped only when a new turn starts on this
+        // process (`deliverMessage`) or a new process starts (`launchAgent`).
+        const refusal = cycle.reason === 'user' ? 'manual-stop' : this.parkRefusalUnderPause(running);
+        if (refusal) {
+            // A manual Stop closes nothing by design: the person stopped a turn, not
+            // the session. A pause may be refused the close for its own reasons — an
+            // open permission card, a conversation the CLI has not named yet.
+            log.info('supervisor: the stopped process stays open', {
+                sessionId: running.descriptor.id,
+                reason: cycle.reason,
+                why: refusal,
             });
+            this.sayIfTheStopWasRefused(running, cycle, false);
+            return;
         }
-        const next = running.descriptor.kind === 'CHAT' ? 'WAITING_INPUT' : 'REVIEW';
-        this.reportStatus(sessionId, next, {
+        cycle.phase = 'parking';
+        cycle.closed = true;
+        this.sayIfTheStopWasRefused(running, cycle, true);
+        this.park(running, { quiet: true });
+    }
+    /**
+     * The agent never said yes — say so, and say only what actually happened.
+     *
+     * Invariant 5: a stop the CLI refused must not read as a clean cancellation.
+     * Which sentence is true depends on what came next, so it is written here and
+     * not where the refusal was noticed — a line promising «its process was
+     * closed» over a manual Stop, which closes nothing, is the same class of lie
+     * as the one this ticket is about (gotcha 324).
+     */
+    sayIfTheStopWasRefused(running, cycle, closing) {
+        if (!cycle.refused)
+            return;
+        cycle.refused = false; // one sentence per stop
+        this.sendEvent(running, 'notice', {
+            level: 'warn',
+            text: closing
+                ? 'The agent did not confirm the stop, so its process was closed. Nothing was lost — the conversation continues when the session does.'
+                : 'The agent did not confirm the stop, so the turn may still be running. Nothing has been lost.',
+        });
+    }
+    /**
+     * Why this paused process must NOT be closed, or null when it may be.
+     *
+     * Invariant 8 lives here. `park()` calls the adapter's `stop()`, and `stop()`
+     * answers every pending permission «denied» in the RUNNER's name — a decision
+     * nobody made, in a place that keeps decisions for ninety days. Worse, the API
+     * sends nothing when the clock is lifted over an open card
+     * (`pauseInterruptedTurn` is false while `openAsks > 0`), so the session would
+     * simply stand there, silent, with the card gone.
+     *
+     * A conversation the CLI has not named yet is the other refusal: parking
+     * promises the context is saved, and there is nothing to resume from.
+     */
+    parkRefusalUnderPause(running) {
+        if (!running.session)
+            return 'no-process';
+        if (running.stopRequested || running.budgetSpent)
+            return 'session-ending';
+        // The clock came off while the stop was in flight. There is nothing left to
+        // park FOR, and closing the process now would make the old operation stop
+        // the new work — the acceptance matrix says it must not. The cycle stays,
+        // settled, so the ending still on its way is still its own.
+        if (!Supervisor.isPaused(running))
+            return 'clock-lifted';
+        if (running.openPermissions.size > 0)
+            return 'open-permission';
+        if (running.openQuestions.size > 0)
+            return 'open-question';
+        if (!running.descriptor.providerSessionId)
+            return 'no-conversation';
+        return null;
+    }
+    /**
+     * The one ending a stop cycle publishes (#373).
+     *
+     * `ok` unconditionally: a turn this runner stopped is not a turn that failed,
+     * and `turn_end{ok:false}` is what put a paused session into the terminal
+     * status it could never be woken out of. The facts the turn actually carried
+     * ride along — `limitBlocked` because the API counts refusals with it, and
+     * `produced` because it is what keeps the refusal counter honest (#300).
+     */
+    publishStoppedTurn(running, descriptor, event) {
+        // The session is already on its way out with a status that MEANS something —
+        // a spent budget, a Stop, a teardown — and a cheerful `turn_end{ok:true}`
+        // after it replaces a true ending with a wrong one. The same guard
+        // `completeTurn` has had since the budget pause was written.
+        if (running.stopRequested || running.budgetSpent)
+            return;
+        // #366: the ring at rest must be exact — the value the gate held back during
+        // the turn goes out before the ending, as in `completeTurn`.
+        this.flushHeldContextUsage(running);
+        // A phantom held from an earlier turn must not fire after this one closed.
+        this.clearEmptyTurn(running);
+        this.sendEvent(running, 'turn_end', {
+            ok: true,
+            // A turn that finished on its own in the same instant is not «stopped».
+            ...(event.aborted === true || !event.ok ? { aborted: true } : {}),
+            ...(event.limitBlocked ? { limitBlocked: true } : {}),
+            produced: event.produced === true,
+        });
+        running.levels.contextPassNext = true;
+        // The last instant this conversation is both complete and readable — the
+        // process is about to go, and `conversationAnchor()` needs a live one.
+        this.currentAnchor(running);
+        const next = descriptor.kind === 'CHAT' ? 'WAITING_INPUT' : 'REVIEW';
+        this.reportStatus(descriptor.id, next, {
             costUsd: running.costUsd,
             activeMs: Supervisor.spentMs(running),
         });
@@ -2990,6 +3551,10 @@ export class Supervisor {
         const until = pausedUntil ? Date.parse(pausedUntil) : Number.NaN;
         if (Number.isFinite(until) && until > Date.now()) {
             const first = !Supervisor.isPaused(running);
+            // #373: a NEW clock is a new stop. A pause that merely MOVED is the same
+            // one — it must not start a second cycle on a process already parking.
+            if (first)
+                running.pauseEpoch += 1;
             running.pausedUntil = until;
             // Interrupting on every pause frame, not only the first: the frame is
             // also how a MOVED pause arrives, and a turn that slipped through in
@@ -3010,6 +3575,13 @@ export class Supervisor {
         // user», over a turn the user never touched. Exactly the lie #196 removed.
         delete running.interruptWhenReady;
         delete running.pauseInterruptAt;
+        // #373: the clock coming off does NOT drop the stop it started. The
+        // interrupt may still be in flight, and its second result is the incident —
+        // «снять паузу во время остановки» is a row of the acceptance matrix, and a
+        // cycle deleted here would let that result file the session FAILED. What
+        // ends the cycle's ownership is a NEW turn on this process
+        // (`deliverMessage`) or a new process (`launchAgent`); both are the moment
+        // its endings stop being its own.
         // Whatever was held while the clock ran goes now, in the order it arrived.
         this.flushPendingMessages(running);
     }
@@ -3025,9 +3597,29 @@ export class Supervisor {
      * Deliberately quiet: the notice was already written when the pause landed,
      * and one per interrupted background turn would bury the feed.
      */
-    stopWorkUnderPause(running) {
+    stopWorkUnderPause(running, event) {
         if (!Supervisor.isPaused(running) || !running.session)
             return;
+        // #373. The stop already in flight owns everything the process is still
+        // saying — including the result of the very question this runner withdrew,
+        // which is what fired the incident's SECOND interrupt: `AGENT_OUTPUT_EVENTS`
+        // could not tell a tool RESULT from a tool starting, so the tail of the stop
+        // read as a turn beginning.
+        const cycle = running.stopCycle;
+        if (cycle && ownsProcess(cycle, running.session) && !cycle.settled) {
+            log.info('supervisor: output under a pause belongs to the stop in flight', {
+                sessionId: running.descriptor.id,
+                phase: cycle.phase,
+                type: event.type,
+                stoppedToolTail: isStoppedToolTail(cycle, event),
+            });
+            return;
+        }
+        // A tool RESULT is the tail of something. Whose tail decides whether it is
+        // worth another stop: a call that was already running when we stopped is the
+        // first stop finishing, one we never saw start is work that began after it.
+        if (!isNewWork(event, cycle))
+            return;
         // One interrupt per burst, not per event. An abort is not instant: a turn
         // being stopped still emits whatever was already in flight, and without
         // this every one of those lines would fire another `interrupt()` — a
@@ -3035,8 +3627,10 @@ export class Supervisor {
         // stopping. Two seconds is far shorter than the gap before a genuinely NEW
         // turn (a background subagent finishing), which still gets its own.
         const now = Date.now();
-        if (running.pauseInterruptAt !== undefined && now - running.pauseInterruptAt < 2_000)
+        if (running.pauseInterruptAt !== undefined &&
+            now - running.pauseInterruptAt < Supervisor.PAUSE_BURST_MS) {
             return;
+        }
         running.pauseInterruptAt = now;
         // Through the ordinary path rather than straight at the adapter (QA-149
         // MAJOR-2): it also withdraws the cards this turn had opened. A turn killed
@@ -3444,6 +4038,7 @@ export class Supervisor {
                         lastReported: descriptor.status === 'REVIEW' ? 'REVIEW' : 'WAITING_INPUT',
                         costUsd: descriptor.costUsd,
                         costBaseUsd: descriptor.costUsd,
+                        levels: freshLevels(),
                         stopRequested: false,
                         parkRequested: false,
                         pendingMessages: [],
@@ -3453,6 +4048,10 @@ export class Supervisor {
                         extraBudgetMinutes: descriptor.extraBudgetMinutes,
                         epoch: descriptor.epoch,
                         openQuestions: new Set(),
+                        openPermissions: new Set(),
+                        liveToolUses: new Set(),
+                        pauseEpoch: 0,
+                        processSeq: 0,
                         answeredAsks: new Set(),
                         deliveredMessageIds: new Set(),
                         backgroundTasks: 0,