@cmmd-center/forge 0.13.2 → 0.13.3

package/dist/bin.cjs

@@ -16544,7 +16544,7 @@ function makeNetServiceShape(createServer = node_net.createServer) {
 }
 //#endregion
 //#region ../../packages/shared/src/releaseInfo.generated.ts
-const FORGE_RELEASE_VERSION = "0.13.2";
+const FORGE_RELEASE_VERSION = "0.13.3";
 //#endregion
 //#region ../../packages/shared/src/hostProcess.ts
 /**
@@ -65864,7 +65864,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.2";
+var version$1 = "0.13.3";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -96204,33 +96204,34 @@ function serializeNativeToolActivity(activity) {
 		}
 	};
 }
-/** The failure activities `appendProviderFailureActivity` emits, all `provider.*.failed`. */
-function isProviderFailureActivity(activity) {
-	return activity.kind.startsWith("provider.") && activity.kind.endsWith(".failed");
+function isReplicatedFailureActivity(activity) {
+	return activity.kind === "runtime.error" || activity.kind.startsWith("provider.") && activity.kind.endsWith(".failed");
 }
 function failureDetail(activity) {
 	const payload = activity.payload;
-	if (!payload || typeof payload !== "object" || !("detail" in payload)) return null;
-	const detail = payload.detail;
-	return typeof detail === "string" && detail.trim() ? detail.trim() : null;
+	if (!payload || typeof payload !== "object") return null;
+	const record = payload;
+	const detail = typeof record.detail === "string" ? record.detail.trim() : "";
+	if (detail) return detail;
+	return (typeof record.message === "string" ? record.message.trim() : "") || null;
 }
 /**
 * Replicates why a turn failed.
 *
-* Without this a failure never crossed the replication boundary — only `tool.`
-* activities were serialized — so durable history could not show one and every
+* Without this a failure never crossed the replication boundary. Only `tool.`
+* activities were serialized, so durable history could not show one and every
 * failure reached the user as an endless "Working" spinner. Measured in
 * production on 2026-08-30: zero failure events had EVER been recorded against
 * 652 tool_call rows, which is how a workspace-path block, a broker-token
 * refusal and a dispatch into a deleted directory all looked identical.
 *
-* `error_summary` is used rather than a new kind because both the Forge
-* protocol and CMMD's ingest schema already accept it; nothing here needed a
-* contract change. The detail carries the actionable sentence, so it is joined
-* onto the summary — the event has no separate detail field.
+* `error_summary` is used because both the Forge protocol and CMMD's ingest
+* schema already accept it. Provider startup failures store `detail`, while
+* active runtime failures store `message`. The event has no separate detail
+* field, so either value is joined onto the summary.
 */
-function serializeProviderFailureActivity(activity) {
-	if (!isProviderFailureActivity(activity)) return null;
+function serializeFailureActivity(activity) {
+	if (!isReplicatedFailureActivity(activity)) return null;
 	const summary = text(activity.summary, 4e3);
 	if (summary === null) return null;
 	const detail = failureDetail(activity);
@@ -96572,7 +96573,7 @@ function isTurnUsageTokens(value) {
 function serializeRuntimeThreadEvents(thread) {
 	const messages = thread.messages.flatMap(serializeThreadMessage);
 	const failureActivities = thread.activities.flatMap((activity) => {
-		const event = serializeProviderFailureActivity(activity);
+		const event = serializeFailureActivity(activity);
 		return event === null ? [] : [event];
 	});
 	const replicaActivities = thread.activities.flatMap((activity) => {
@@ -100840,6 +100841,31 @@ function claudeWriteToken(env = process.env) {
 	return accessor.read(env);
 }
 //#endregion
+//#region ../../packages/shared/src/claudeReadinessReason.ts
+/**
+* The reason literals Forge acts on, confirmed against CMMD-36441's readiness
+* service. If the route renames one, the rename lands here as a fall-through
+* to null, never as the wrong kind.
+*
+* Reading the reason is what makes `stale` legible. CMMD-36441 answers
+* `credential_reconnect_required` on a `stale` answer that still reports
+* `connected: true`, and the older `credential_generation_not_applied` on a
+* `stale` answer that simply has not landed yet. Those want opposite
+* handling, and both used to get "Reconnect Claude in Settings" because the
+* guard read only the delivery status.
+*/
+const CODE_BY_UPSTREAM_REASON$1 = {
+	credential_expired_refreshing: "CREDENTIAL_EXPIRED_REFRESHING",
+	credential_reconnect_required: "CREDENTIAL_RECONNECT_REQUIRED",
+	credential_not_connected: "CREDENTIAL_RECONNECT_REQUIRED",
+	credential_generation_not_applied: "CREDENTIAL_GENERATION_NOT_APPLIED",
+	runtime_unavailable: "RUNTIME_UNAVAILABLE"
+};
+function claudeReadinessReasonCode(reason) {
+	if (typeof reason !== "string" || !Object.hasOwn(CODE_BY_UPSTREAM_REASON$1, reason)) return null;
+	return CODE_BY_UPSTREAM_REASON$1[reason] ?? null;
+}
+//#endregion
 //#region src/egress/providerDeliveryReceipt.ts
 const PROVIDER_ACCOUNT_IDENTITY$2 = /^pai_v1_[A-Za-z0-9_-]{43}$/;
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
@@ -101014,82 +101040,6 @@ function providerDeliveryBindingsEqual(left, right) {
 	return classifyProviderDeliveryBindingChange(left, right) === "unchanged";
 }
 //#endregion
-//#region src/provider/claudeReadinessReason.ts
-/**
-* The reason literals Forge has copy for, confirmed against CMMD-36441's
-* readiness service. If the route renames one, the rename lands here as a
-* fall-through to the generic sentence, never as a wrong sentence.
-*
-* Reading the reason is what makes `stale` legible. CMMD-36441 answers
-* `credential_reconnect_required` on a `stale` answer that still reports
-* `connected: true`, and the older `credential_generation_not_applied` on a
-* `stale` answer that simply has not landed yet. Those want opposite
-* sentences, and both used to get "Reconnect Claude in Settings" because the
-* guard read only the delivery status.
-*/
-const CODE_BY_UPSTREAM_REASON$1 = {
-	credential_expired_refreshing: "CREDENTIAL_EXPIRED_REFRESHING",
-	credential_reconnect_required: "CREDENTIAL_RECONNECT_REQUIRED",
-	credential_not_connected: "CREDENTIAL_RECONNECT_REQUIRED",
-	credential_generation_not_applied: "CREDENTIAL_GENERATION_NOT_APPLIED",
-	runtime_unavailable: "RUNTIME_UNAVAILABLE"
-};
-const CLAUDE_NATIVE_CREDENTIAL_UNUSABLE_COPY = "The delivered Claude credential is unavailable or unusable in this runtime.";
-/**
-* An ISO 8601 instant, with or without fractional seconds, UTC or offset.
-* Anchored to nothing on purpose: CMMD wraps the time in a sentence, and the
-* time is the only part of that sentence Forge repeats.
-*/
-const ISO_INSTANT_PATTERN = /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})/;
-function claudeReadinessReasonCode(reason) {
-	if (typeof reason !== "string" || !Object.hasOwn(CODE_BY_UPSTREAM_REASON$1, reason)) return null;
-	return CODE_BY_UPSTREAM_REASON$1[reason] ?? null;
-}
-function expiredAtFromReadinessMessage(message) {
-	if (typeof message !== "string") return null;
-	return ISO_INSTANT_PATTERN.exec(message)?.[0] ?? null;
-}
-function claudeCredentialExpiredTurnCopy(expiredAt) {
-	return `The delivered Claude credential expired at ${expiredAt}. CMMD is delivering a refreshed one, so retry this turn in a moment.`;
-}
-function claudeCredentialExpiredCardCopy(expiredAt) {
-	return `The delivered Claude credential expired at ${expiredAt}. CMMD is delivering a refreshed one to this runtime.`;
-}
-/**
-* The last allowlisted readiness reason this process saw.
-*
-* A server process serves exactly one runtime, so one slot is the whole store.
-* It holds a reason code and a timestamp, never credential bytes. The provider
-* catalog reads a local credential file and cannot tell an expired snapshot
-* from a blank one, so without this the card can only offer the generic
-* sentence while the guard already knows better.
-*/
-let latestVerdict = null;
-/**
-* Remember, or clear, what the readiness answer said.
-*
-* An answer carrying no allowlisted reason clears the slot, which is what makes
-* the card go back to the generic sentence the moment CMMD applies a
-* credential: an applied answer carries no reason.
-*/
-function recordClaudeReadinessVerdict(readiness) {
-	const code = claudeReadinessReasonCode(readiness.reason);
-	latestVerdict = code === null ? null : {
-		code,
-		expiredAt: expiredAtFromReadinessMessage(readiness.lastErrorMessage)
-	};
-}
-/**
-* What the provider status card says about a delivered credential it cannot
-* use. Names the expiry only when a readiness answer supplied the time; a
-* guessed time would be worse than the generic sentence.
-*/
-function claudeNativeCredentialUnusableMessage() {
-	const verdict = latestVerdict;
-	if (verdict?.code === "CREDENTIAL_EXPIRED_REFRESHING" && verdict.expiredAt !== null) return claudeCredentialExpiredCardCopy(verdict.expiredAt);
-	return CLAUDE_NATIVE_CREDENTIAL_UNUSABLE_COPY;
-}
-//#endregion
 //#region src/provider/providerReadiness.ts
 const GENERATION_HASH_PATTERN$1 = /^[a-f0-9]{64}$/;
 const STILL_APPLYING_STATUSES = new Set([
@@ -101134,10 +101084,18 @@ async function queryProviderReadiness(input) {
 	}
 	return classifyClaudeSnapshot(snapshot, sprite);
 }
-function isAppliedClaudeSnapshot(snapshot) {
-	return snapshot.connected === true && snapshot.deliveryStatus === "applied" && snapshot.nativeExecutable === true && typeof snapshot.generationId === "string" && snapshot.generationId.trim().length > 0;
+/**
+* Whether CMMD allows a turn to start on this runtime. The delivery status is
+* not part of it: a refresh that failed over a credential the guest verified
+* and that has not expired reads as failed with nativeExecutable true, and the
+* turn is the probe (FOR-3085). The generation fence and the receipt below
+* still bind the answer.
+*/
+function claudeSnapshotAllowsTurn(snapshot) {
+	return snapshot.connected === true && snapshot.nativeExecutable === true && typeof snapshot.generationId === "string" && snapshot.generationId.trim().length > 0;
 }
-function classifyUnappliedClaudeSnapshot(snapshot) {
+/** Why a turn may not start, for an answer that does not allow one. */
+function classifyClaudeTurnRefusal(snapshot) {
 	const code = claudeReadinessReasonCode(snapshot.reason);
 	if (code === "RUNTIME_UNAVAILABLE") return {
 		kind: "not_ready",
@@ -101165,7 +101123,7 @@ function classifyUnappliedClaudeSnapshot(snapshot) {
 	};
 }
 function classifyClaudeSnapshot(snapshot, sprite) {
-	if (!isAppliedClaudeSnapshot(snapshot)) return classifyUnappliedClaudeSnapshot(snapshot);
+	if (!claudeSnapshotAllowsTurn(snapshot)) return classifyClaudeTurnRefusal(snapshot);
 	const generationId = snapshot.generationId.trim();
 	if ((0, node_crypto.createHash)("sha256").update(generationId).digest("hex") !== sprite.localGenerationHash) return {
 		kind: "not_ready",
@@ -211732,6 +211690,83 @@ const makeProviderAuthProvenance = (input) => {
 	};
 };
 //#endregion
+//#region src/provider/claudeReadinessReason.ts
+/**
+* What Forge says about a delivered Claude credential that expired.
+*
+* CMMD's credential authority rotates the refresh token on every refresh, and a
+* runtime holds a one-time snapshot, so the snapshot's refresh token dies at
+* the next rotation. Nothing re-delivers on its own, and on 2026-09-04 23:07Z
+* the turn met a dead credential: the CLI said "OAuth session expired and could
+* not be refreshed", the thread said Claude was unavailable on this
+* Environment, and the provider card said the credential was "unavailable or
+* unusable". Three sentences, none of them the fact, which is that the
+* credential expired at a known time and a replacement is on its way.
+*
+* CMMD-36441 now answers the pre-turn readiness read with a typed reason and
+* queues a same-generation re-delivery. This module is the one place that
+* turns those reasons into words.
+*
+* Which kind of answer a reason names comes from
+* `@cmmd-forge/shared/claudeReadinessReason`, which the browser readiness poll
+* reads too, so the two cannot disagree about a reason (FOR-3085). A reason
+* that maps to nothing falls through to the generic copy, and every sentence a
+* person reads is written here rather than forwarded from upstream. Only an
+* ISO timestamp is ever lifted out of CMMD's message, so no credential detail
+* in an upstream string can reach a browser.
+*/
+const CLAUDE_NATIVE_CREDENTIAL_UNUSABLE_COPY = "The delivered Claude credential is unavailable or unusable in this runtime.";
+/**
+* An ISO 8601 instant, with or without fractional seconds, UTC or offset.
+* Anchored to nothing on purpose: CMMD wraps the time in a sentence, and the
+* time is the only part of that sentence Forge repeats.
+*/
+const ISO_INSTANT_PATTERN = /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})/;
+function expiredAtFromReadinessMessage(message) {
+	if (typeof message !== "string") return null;
+	return ISO_INSTANT_PATTERN.exec(message)?.[0] ?? null;
+}
+function claudeCredentialExpiredTurnCopy(expiredAt) {
+	return `The delivered Claude credential expired at ${expiredAt}. CMMD is delivering a refreshed one, so retry this turn in a moment.`;
+}
+function claudeCredentialExpiredCardCopy(expiredAt) {
+	return `The delivered Claude credential expired at ${expiredAt}. CMMD is delivering a refreshed one to this runtime.`;
+}
+/**
+* The last allowlisted readiness reason this process saw.
+*
+* A server process serves exactly one runtime, so one slot is the whole store.
+* It holds a reason code and a timestamp, never credential bytes. The provider
+* catalog reads a local credential file and cannot tell an expired snapshot
+* from a blank one, so without this the card can only offer the generic
+* sentence while the guard already knows better.
+*/
+let latestVerdict = null;
+/**
+* Remember, or clear, what the readiness answer said.
+*
+* An answer carrying no allowlisted reason clears the slot, which is what makes
+* the card go back to the generic sentence the moment CMMD applies a
+* credential: an applied answer carries no reason.
+*/
+function recordClaudeReadinessVerdict(readiness) {
+	const code = claudeReadinessReasonCode(readiness.reason);
+	latestVerdict = code === null ? null : {
+		code,
+		expiredAt: expiredAtFromReadinessMessage(readiness.lastErrorMessage)
+	};
+}
+/**
+* What the provider status card says about a delivered credential it cannot
+* use. Names the expiry only when a readiness answer supplied the time; a
+* guessed time would be worse than the generic sentence.
+*/
+function claudeNativeCredentialUnusableMessage() {
+	const verdict = latestVerdict;
+	if (verdict?.code === "CREDENTIAL_EXPIRED_REFRESHING" && verdict.expiredAt !== null) return claudeCredentialExpiredCardCopy(verdict.expiredAt);
+	return CLAUDE_NATIVE_CREDENTIAL_UNUSABLE_COPY;
+}
+//#endregion
 //#region src/provider/claudeCredentialStore.ts
 /**
 * Which Credential Store the Claude CLI uses on this machine, read the way the
@@ -295274,7 +295309,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "69affcc8397652715f8bd06fe2f226f4b607e1db";
+	return "1881e36c16315be6322e1a109dd4a331b484b963";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;

package/dist/bin.mjs

@@ -16520,7 +16520,7 @@ function makeNetServiceShape(createServer = Net.createServer) {
 }
 //#endregion
 //#region ../../packages/shared/src/releaseInfo.generated.ts
-const FORGE_RELEASE_VERSION = "0.13.2";
+const FORGE_RELEASE_VERSION = "0.13.3";
 //#endregion
 //#region ../../packages/shared/src/hostProcess.ts
 /**
@@ -65582,7 +65582,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.2";
+var version$1 = "0.13.3";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -95829,33 +95829,34 @@ function serializeNativeToolActivity(activity) {
 		}
 	};
 }
-/** The failure activities `appendProviderFailureActivity` emits, all `provider.*.failed`. */
-function isProviderFailureActivity(activity) {
-	return activity.kind.startsWith("provider.") && activity.kind.endsWith(".failed");
+function isReplicatedFailureActivity(activity) {
+	return activity.kind === "runtime.error" || activity.kind.startsWith("provider.") && activity.kind.endsWith(".failed");
 }
 function failureDetail(activity) {
 	const payload = activity.payload;
-	if (!payload || typeof payload !== "object" || !("detail" in payload)) return null;
-	const detail = payload.detail;
-	return typeof detail === "string" && detail.trim() ? detail.trim() : null;
+	if (!payload || typeof payload !== "object") return null;
+	const record = payload;
+	const detail = typeof record.detail === "string" ? record.detail.trim() : "";
+	if (detail) return detail;
+	return (typeof record.message === "string" ? record.message.trim() : "") || null;
 }
 /**
 * Replicates why a turn failed.
 *
-* Without this a failure never crossed the replication boundary — only `tool.`
-* activities were serialized — so durable history could not show one and every
+* Without this a failure never crossed the replication boundary. Only `tool.`
+* activities were serialized, so durable history could not show one and every
 * failure reached the user as an endless "Working" spinner. Measured in
 * production on 2026-08-30: zero failure events had EVER been recorded against
 * 652 tool_call rows, which is how a workspace-path block, a broker-token
 * refusal and a dispatch into a deleted directory all looked identical.
 *
-* `error_summary` is used rather than a new kind because both the Forge
-* protocol and CMMD's ingest schema already accept it; nothing here needed a
-* contract change. The detail carries the actionable sentence, so it is joined
-* onto the summary — the event has no separate detail field.
+* `error_summary` is used because both the Forge protocol and CMMD's ingest
+* schema already accept it. Provider startup failures store `detail`, while
+* active runtime failures store `message`. The event has no separate detail
+* field, so either value is joined onto the summary.
 */
-function serializeProviderFailureActivity(activity) {
-	if (!isProviderFailureActivity(activity)) return null;
+function serializeFailureActivity(activity) {
+	if (!isReplicatedFailureActivity(activity)) return null;
 	const summary = text(activity.summary, 4e3);
 	if (summary === null) return null;
 	const detail = failureDetail(activity);
@@ -96197,7 +96198,7 @@ function isTurnUsageTokens(value) {
 function serializeRuntimeThreadEvents(thread) {
 	const messages = thread.messages.flatMap(serializeThreadMessage);
 	const failureActivities = thread.activities.flatMap((activity) => {
-		const event = serializeProviderFailureActivity(activity);
+		const event = serializeFailureActivity(activity);
 		return event === null ? [] : [event];
 	});
 	const replicaActivities = thread.activities.flatMap((activity) => {
@@ -100459,6 +100460,31 @@ function claudeWriteToken(env = process.env) {
 	return accessor.read(env);
 }
 //#endregion
+//#region ../../packages/shared/src/claudeReadinessReason.ts
+/**
+* The reason literals Forge acts on, confirmed against CMMD-36441's readiness
+* service. If the route renames one, the rename lands here as a fall-through
+* to null, never as the wrong kind.
+*
+* Reading the reason is what makes `stale` legible. CMMD-36441 answers
+* `credential_reconnect_required` on a `stale` answer that still reports
+* `connected: true`, and the older `credential_generation_not_applied` on a
+* `stale` answer that simply has not landed yet. Those want opposite
+* handling, and both used to get "Reconnect Claude in Settings" because the
+* guard read only the delivery status.
+*/
+const CODE_BY_UPSTREAM_REASON$1 = {
+	credential_expired_refreshing: "CREDENTIAL_EXPIRED_REFRESHING",
+	credential_reconnect_required: "CREDENTIAL_RECONNECT_REQUIRED",
+	credential_not_connected: "CREDENTIAL_RECONNECT_REQUIRED",
+	credential_generation_not_applied: "CREDENTIAL_GENERATION_NOT_APPLIED",
+	runtime_unavailable: "RUNTIME_UNAVAILABLE"
+};
+function claudeReadinessReasonCode(reason) {
+	if (typeof reason !== "string" || !Object.hasOwn(CODE_BY_UPSTREAM_REASON$1, reason)) return null;
+	return CODE_BY_UPSTREAM_REASON$1[reason] ?? null;
+}
+//#endregion
 //#region src/egress/providerDeliveryReceipt.ts
 const PROVIDER_ACCOUNT_IDENTITY$2 = /^pai_v1_[A-Za-z0-9_-]{43}$/;
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
@@ -100633,82 +100659,6 @@ function providerDeliveryBindingsEqual(left, right) {
 	return classifyProviderDeliveryBindingChange(left, right) === "unchanged";
 }
 //#endregion
-//#region src/provider/claudeReadinessReason.ts
-/**
-* The reason literals Forge has copy for, confirmed against CMMD-36441's
-* readiness service. If the route renames one, the rename lands here as a
-* fall-through to the generic sentence, never as a wrong sentence.
-*
-* Reading the reason is what makes `stale` legible. CMMD-36441 answers
-* `credential_reconnect_required` on a `stale` answer that still reports
-* `connected: true`, and the older `credential_generation_not_applied` on a
-* `stale` answer that simply has not landed yet. Those want opposite
-* sentences, and both used to get "Reconnect Claude in Settings" because the
-* guard read only the delivery status.
-*/
-const CODE_BY_UPSTREAM_REASON$1 = {
-	credential_expired_refreshing: "CREDENTIAL_EXPIRED_REFRESHING",
-	credential_reconnect_required: "CREDENTIAL_RECONNECT_REQUIRED",
-	credential_not_connected: "CREDENTIAL_RECONNECT_REQUIRED",
-	credential_generation_not_applied: "CREDENTIAL_GENERATION_NOT_APPLIED",
-	runtime_unavailable: "RUNTIME_UNAVAILABLE"
-};
-const CLAUDE_NATIVE_CREDENTIAL_UNUSABLE_COPY = "The delivered Claude credential is unavailable or unusable in this runtime.";
-/**
-* An ISO 8601 instant, with or without fractional seconds, UTC or offset.
-* Anchored to nothing on purpose: CMMD wraps the time in a sentence, and the
-* time is the only part of that sentence Forge repeats.
-*/
-const ISO_INSTANT_PATTERN = /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})/;
-function claudeReadinessReasonCode(reason) {
-	if (typeof reason !== "string" || !Object.hasOwn(CODE_BY_UPSTREAM_REASON$1, reason)) return null;
-	return CODE_BY_UPSTREAM_REASON$1[reason] ?? null;
-}
-function expiredAtFromReadinessMessage(message) {
-	if (typeof message !== "string") return null;
-	return ISO_INSTANT_PATTERN.exec(message)?.[0] ?? null;
-}
-function claudeCredentialExpiredTurnCopy(expiredAt) {
-	return `The delivered Claude credential expired at ${expiredAt}. CMMD is delivering a refreshed one, so retry this turn in a moment.`;
-}
-function claudeCredentialExpiredCardCopy(expiredAt) {
-	return `The delivered Claude credential expired at ${expiredAt}. CMMD is delivering a refreshed one to this runtime.`;
-}
-/**
-* The last allowlisted readiness reason this process saw.
-*
-* A server process serves exactly one runtime, so one slot is the whole store.
-* It holds a reason code and a timestamp, never credential bytes. The provider
-* catalog reads a local credential file and cannot tell an expired snapshot
-* from a blank one, so without this the card can only offer the generic
-* sentence while the guard already knows better.
-*/
-let latestVerdict = null;
-/**
-* Remember, or clear, what the readiness answer said.
-*
-* An answer carrying no allowlisted reason clears the slot, which is what makes
-* the card go back to the generic sentence the moment CMMD applies a
-* credential: an applied answer carries no reason.
-*/
-function recordClaudeReadinessVerdict(readiness) {
-	const code = claudeReadinessReasonCode(readiness.reason);
-	latestVerdict = code === null ? null : {
-		code,
-		expiredAt: expiredAtFromReadinessMessage(readiness.lastErrorMessage)
-	};
-}
-/**
-* What the provider status card says about a delivered credential it cannot
-* use. Names the expiry only when a readiness answer supplied the time; a
-* guessed time would be worse than the generic sentence.
-*/
-function claudeNativeCredentialUnusableMessage() {
-	const verdict = latestVerdict;
-	if (verdict?.code === "CREDENTIAL_EXPIRED_REFRESHING" && verdict.expiredAt !== null) return claudeCredentialExpiredCardCopy(verdict.expiredAt);
-	return CLAUDE_NATIVE_CREDENTIAL_UNUSABLE_COPY;
-}
-//#endregion
 //#region src/provider/providerReadiness.ts
 const GENERATION_HASH_PATTERN$1 = /^[a-f0-9]{64}$/;
 const STILL_APPLYING_STATUSES = new Set([
@@ -100753,10 +100703,18 @@ async function queryProviderReadiness(input) {
 	}
 	return classifyClaudeSnapshot(snapshot, sprite);
 }
-function isAppliedClaudeSnapshot(snapshot) {
-	return snapshot.connected === true && snapshot.deliveryStatus === "applied" && snapshot.nativeExecutable === true && typeof snapshot.generationId === "string" && snapshot.generationId.trim().length > 0;
+/**
+* Whether CMMD allows a turn to start on this runtime. The delivery status is
+* not part of it: a refresh that failed over a credential the guest verified
+* and that has not expired reads as failed with nativeExecutable true, and the
+* turn is the probe (FOR-3085). The generation fence and the receipt below
+* still bind the answer.
+*/
+function claudeSnapshotAllowsTurn(snapshot) {
+	return snapshot.connected === true && snapshot.nativeExecutable === true && typeof snapshot.generationId === "string" && snapshot.generationId.trim().length > 0;
 }
-function classifyUnappliedClaudeSnapshot(snapshot) {
+/** Why a turn may not start, for an answer that does not allow one. */
+function classifyClaudeTurnRefusal(snapshot) {
 	const code = claudeReadinessReasonCode(snapshot.reason);
 	if (code === "RUNTIME_UNAVAILABLE") return {
 		kind: "not_ready",
@@ -100784,7 +100742,7 @@ function classifyUnappliedClaudeSnapshot(snapshot) {
 	};
 }
 function classifyClaudeSnapshot(snapshot, sprite) {
-	if (!isAppliedClaudeSnapshot(snapshot)) return classifyUnappliedClaudeSnapshot(snapshot);
+	if (!claudeSnapshotAllowsTurn(snapshot)) return classifyClaudeTurnRefusal(snapshot);
 	const generationId = snapshot.generationId.trim();
 	if (createHash("sha256").update(generationId).digest("hex") !== sprite.localGenerationHash) return {
 		kind: "not_ready",
@@ -211320,6 +211278,83 @@ const makeProviderAuthProvenance = (input) => {
 	};
 };
 //#endregion
+//#region src/provider/claudeReadinessReason.ts
+/**
+* What Forge says about a delivered Claude credential that expired.
+*
+* CMMD's credential authority rotates the refresh token on every refresh, and a
+* runtime holds a one-time snapshot, so the snapshot's refresh token dies at
+* the next rotation. Nothing re-delivers on its own, and on 2026-09-04 23:07Z
+* the turn met a dead credential: the CLI said "OAuth session expired and could
+* not be refreshed", the thread said Claude was unavailable on this
+* Environment, and the provider card said the credential was "unavailable or
+* unusable". Three sentences, none of them the fact, which is that the
+* credential expired at a known time and a replacement is on its way.
+*
+* CMMD-36441 now answers the pre-turn readiness read with a typed reason and
+* queues a same-generation re-delivery. This module is the one place that
+* turns those reasons into words.
+*
+* Which kind of answer a reason names comes from
+* `@cmmd-forge/shared/claudeReadinessReason`, which the browser readiness poll
+* reads too, so the two cannot disagree about a reason (FOR-3085). A reason
+* that maps to nothing falls through to the generic copy, and every sentence a
+* person reads is written here rather than forwarded from upstream. Only an
+* ISO timestamp is ever lifted out of CMMD's message, so no credential detail
+* in an upstream string can reach a browser.
+*/
+const CLAUDE_NATIVE_CREDENTIAL_UNUSABLE_COPY = "The delivered Claude credential is unavailable or unusable in this runtime.";
+/**
+* An ISO 8601 instant, with or without fractional seconds, UTC or offset.
+* Anchored to nothing on purpose: CMMD wraps the time in a sentence, and the
+* time is the only part of that sentence Forge repeats.
+*/
+const ISO_INSTANT_PATTERN = /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})/;
+function expiredAtFromReadinessMessage(message) {
+	if (typeof message !== "string") return null;
+	return ISO_INSTANT_PATTERN.exec(message)?.[0] ?? null;
+}
+function claudeCredentialExpiredTurnCopy(expiredAt) {
+	return `The delivered Claude credential expired at ${expiredAt}. CMMD is delivering a refreshed one, so retry this turn in a moment.`;
+}
+function claudeCredentialExpiredCardCopy(expiredAt) {
+	return `The delivered Claude credential expired at ${expiredAt}. CMMD is delivering a refreshed one to this runtime.`;
+}
+/**
+* The last allowlisted readiness reason this process saw.
+*
+* A server process serves exactly one runtime, so one slot is the whole store.
+* It holds a reason code and a timestamp, never credential bytes. The provider
+* catalog reads a local credential file and cannot tell an expired snapshot
+* from a blank one, so without this the card can only offer the generic
+* sentence while the guard already knows better.
+*/
+let latestVerdict = null;
+/**
+* Remember, or clear, what the readiness answer said.
+*
+* An answer carrying no allowlisted reason clears the slot, which is what makes
+* the card go back to the generic sentence the moment CMMD applies a
+* credential: an applied answer carries no reason.
+*/
+function recordClaudeReadinessVerdict(readiness) {
+	const code = claudeReadinessReasonCode(readiness.reason);
+	latestVerdict = code === null ? null : {
+		code,
+		expiredAt: expiredAtFromReadinessMessage(readiness.lastErrorMessage)
+	};
+}
+/**
+* What the provider status card says about a delivered credential it cannot
+* use. Names the expiry only when a readiness answer supplied the time; a
+* guessed time would be worse than the generic sentence.
+*/
+function claudeNativeCredentialUnusableMessage() {
+	const verdict = latestVerdict;
+	if (verdict?.code === "CREDENTIAL_EXPIRED_REFRESHING" && verdict.expiredAt !== null) return claudeCredentialExpiredCardCopy(verdict.expiredAt);
+	return CLAUDE_NATIVE_CREDENTIAL_UNUSABLE_COPY;
+}
+//#endregion
 //#region src/provider/claudeCredentialStore.ts
 /**
 * Which Credential Store the Claude CLI uses on this machine, read the way the
@@ -294724,7 +294759,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "69affcc8397652715f8bd06fe2f226f4b607e1db";
+	return "1881e36c16315be6322e1a109dd4a331b484b963";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;