@cohortapp/agent-sdk 2.18.12 → 2.18.14

package/scaffold/config/alerts.yaml

@@ -15,6 +15,13 @@ alerts:
     # Cost guardrails (USD).
     costPerSessionP99USD: 2.50  # p99 session cost over the daily ledger
     dailySpendWarnUSD: 20       # soft warn before the hard budget cap
+    # A cadence failed for a cause that retrying cannot fix — its prompt file is
+    # missing or unreadable. Fires at ONE: a permanent failure means a scheduled
+    # obligation has stopped and will not restart until a person puts the file
+    # back. (Nested form, matching the built-in defaults.)
+    cadencePermanentFailure:
+      warnCount: 1
+      critCount: 3
     # Liveness (seconds).
     absentAgentSec: 900         # a peer with no heartbeat in 15min
     daemonHealthStaleSec: 180   # daemon health.json older than 3min

package/scripts/ci/check-cadence-prompts-exist.mjs

@@ -0,0 +1,96 @@
+/**
+ * check-cadence-prompts-exist.mjs — every built-in cadence's prompt file is on disk.
+ *
+ * WHY THIS GUARD EXISTS. On 2026-09-24 Eli Rosenberg's seat scheduled the
+ * cadence `commitment-sweep` with `prompt: schedules/triggers/commitment-sweep.md`,
+ * and that file was not there. The consumer never checked: the handoff renderer
+ * threw ENOENT, the catch fell through to the spawn — which opens the same path
+ * — and the tick went back on the bus. Measured at 16 requeues per 30 seconds,
+ * indefinitely, until an emergency stop halted the whole seat to contain it.
+ *
+ * Two fixes, and this is the cheap half. The runtime half is
+ * `lib/cadence-failure-class.mjs` + the consumer's `failPermanently`: a failure
+ * whose cause cannot change by waiting stops, records itself and alerts,
+ * instead of retrying at poll speed. But a cadence the FRAMEWORK ships should
+ * never reach that path at all — its prompt is a file in this repo, so its
+ * absence is a build-time fact, and a build-time fact belongs in a check rather
+ * than in a seat's log at 3 a.m.
+ *
+ * Scope, stated honestly: this guard covers the hardcoded CADENCE_REGISTRY in
+ * `scripts/daemon/cadence-handlers.mjs` — the cadences every seat gets. It
+ * CANNOT cover a seat's `config/.cadence-registry.json` (written by the plan
+ * compiler on the seat, naming prompts the seat is meant to author), which is
+ * exactly where Eli's came from. That case is the runtime half's job.
+ *
+ * Usage (standalone): `node scripts/ci/check-cadence-prompts-exist.mjs`
+ *   exit 0 → every registry prompt resolves; exit 1 → one is missing.
+ *
+ * @module scripts/ci/check-cadence-prompts-exist
+ */
+
+"use strict";
+
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+/** Repo root: two levels up from scripts/ci/. @type {string} */
+const REPO_ROOT = path.resolve(fileURLToPath(new URL(".", import.meta.url)), "..", "..");
+
+/**
+ * Check every hardcoded cadence definition that names a prompt.
+ *
+ * @param {object} [opts]
+ * @param {string} [opts.cwd=REPO_ROOT]
+ * @param {object} [opts.registry]  pre-supplied registry (skips the import)
+ * @returns {Promise<{ok:boolean, checked:number, missing:Array<{cadence:string, prompt:string, resolved:string}>}>}
+ */
+export async function checkCadencePromptsExist(opts = {}) {
+  const cwd = opts.cwd || REPO_ROOT;
+  let registry = opts.registry;
+  if (!registry) {
+    const mod = await import(path.join(cwd, "scripts/daemon/cadence-handlers.mjs"));
+    registry = mod.CADENCE_REGISTRY || {};
+  }
+  const missing = [];
+  let checked = 0;
+  for (const [cadence, def] of Object.entries(registry)) {
+    const prompt = def && typeof def.prompt === "string" ? def.prompt : null;
+    if (!prompt) continue; // inline/guarded-only cadences have no prompt to ship
+    checked++;
+    const resolved = path.resolve(cwd, prompt);
+    if (!existsSync(resolved)) missing.push({ cadence, prompt, resolved });
+  }
+  return { ok: missing.length === 0, checked, missing };
+}
+
+/**
+ * Run the check and print a human report.
+ * @param {string} [cwd=REPO_ROOT]
+ * @returns {Promise<number>} 0 = ok, 1 = a prompt is missing
+ */
+export async function run(cwd = REPO_ROOT) {
+  const { ok, checked, missing } = await checkCadencePromptsExist({ cwd });
+  if (ok) {
+    console.log(`check-cadence-prompts-exist: OK (${checked} built-in cadence prompt(s) on disk)`);
+    return 0;
+  }
+  console.error("check-cadence-prompts-exist: FAIL — a shipped cadence names a prompt that is not in the repo:");
+  for (const m of missing) {
+    console.error(`  ${m.cadence} → "${m.prompt}"  (not found: ${m.resolved})`);
+  }
+  console.error(
+    `check-cadence-prompts-exist: ${missing.length} missing of ${checked} checked. ` +
+    "On a seat this is not a log line — it is a cadence that stops, loudly, every time it is due."
+  );
+  return 1;
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  run()
+    .then((code) => process.exit(code))
+    .catch((err) => {
+      console.error("check-cadence-prompts-exist: ERROR", err && err.message ? err.message : err);
+      process.exit(2);
+    });
+}

package/scripts/ci/check.mjs

@@ -22,6 +22,7 @@
  *   - check-subagent-frontmatter: every agents/*.md passes the registry validator
  *   - check-durable-write-seam  : durable JSON writes under lib/ go through fs-atomic
  *   - check-skill-packs         : vendored design skill packs match their pinned manifests
+ *   - check-cadence-prompts-exist : every built-in cadence's prompt file is on disk
  *
  * Usage: `node scripts/ci/check.mjs`
  *   exit 0 → all checks passed; exit 1 → one or more failed.
@@ -42,6 +43,7 @@ import { run as runDocsAccuracy } from "./check-docs-accuracy.mjs";
 import { run as runSubagentFrontmatter } from "./check-subagent-frontmatter.mjs";
 import { run as runDurableWriteSeam } from "./check-durable-write-seam.mjs";
 import { run as runSkillPacks } from "./check-skill-packs.mjs";
+import { run as runCadencePrompts } from "./check-cadence-prompts-exist.mjs";
 
 /**
  * The ordered list of guards this aggregator runs.
@@ -60,6 +62,7 @@ export const CHECKS = [
   { name: "check-subagent-frontmatter", run: runSubagentFrontmatter },
   { name: "check-durable-write-seam", run: runDurableWriteSeam },
   { name: "check-skill-packs", run: runSkillPacks },
+  { name: "check-cadence-prompts-exist", run: runCadencePrompts },
 ];
 
 /**

package/scripts/ci/run-tests.mjs

@@ -75,7 +75,17 @@ function main(argv) {
   }
 
   if (argv.includes("--list")) {
-    for (const f of files) console.log(relative(REPO_ROOT, f));
+    // ONE write, not one per file. `console.log` to a PIPE is asynchronous, and
+    // the caller below used to `process.exit()` the moment main() returned —
+    // which discards whatever has not drained yet. It only shows up under load:
+    // run-tests.test.mjs#"--list prints the discovered set" spawns this with a
+    // pipe from INSIDE the full suite, where a machine running `node --test`
+    // across every core does not drain it in time, and the child exited 0
+    // having printed a list truncated mid-alphabet. A green run and a silently
+    // short inventory is exactly the failure this module exists to prevent —
+    // see the header — so it is fixed on both halves: one write here, and
+    // `process.exitCode` rather than `process.exit()` at the bottom.
+    process.stdout.write(files.map((f) => relative(REPO_ROOT, f)).join("\n") + "\n");
     console.error(`run-tests: ${files.length} test file(s) discovered (nothing was run).`);
     return 0;
   }
@@ -95,5 +105,9 @@ function main(argv) {
 }
 
 if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  process.exit(main(process.argv.slice(2)));
+  // `process.exitCode`, NOT `process.exit()`: the latter tears the process down
+  // immediately and drops any stdout still queued on a pipe. Node exits with
+  // this code on its own once the event loop drains, which is the only way a
+  // piped `--list` is guaranteed to arrive whole.
+  process.exitCode = main(process.argv.slice(2));
 }

package/scripts/daemon/cadence-consumer.mjs

@@ -96,6 +96,13 @@ import { writeHandoff, listHandoffs, expireHandoffs, pruneHandoffs, handoffPaths
 import { writeFileAtomic } from "../../lib/fs-atomic.mjs";
 import { resolveClaudeBin as sharedResolveClaude } from "../../lib/claude-bin.mjs";
 import { getCadenceDef } from "./cadence-handlers.mjs";
+// PERMANENT vs TRANSIENT (lane/permanent-errors). A retry loop that never
+// inspects its error class is how two seats burned down: a cadence whose prompt
+// file does not exist retried at poll speed forever (measured 16 requeues per
+// 30 s on Eli Rosenberg's seat, 2026-09-24). The taxonomy is pure and lives on
+// its own so the policy can be argued with without a daemon.
+import { classifyCadenceFailure, isPermanent, PERMANENT_MAX_ATTEMPTS } from "../../lib/cadence-failure-class.mjs";
+import { bump as bumpCounter } from "../../lib/diagnostics/counters.mjs";
 import { obligationAllowedUnderPosture } from "../../lib/plan/compile.mjs";
 import { isHumanLaneCadence } from "../../lib/cadences.mjs";
 import { sessionPermissionArgs } from "../../lib/session-permissions.mjs";
@@ -636,6 +643,12 @@ export function startConsumer(opts = {}) {
   const budgetEscalateMs = opts.budgetEscalateMs ?? DEFAULT_BUDGET_ESCALATE_MS;
   const maxSpawnMs = opts.maxSpawnMs ?? DEFAULT_SPAWN_TIMEOUT_MS;
   const spawnSession = opts.spawnSession || realSpawnSession;
+  // Cadence registry lookup. Injectable because the config-driven half
+  // (`config/.cadence-registry.json`) is read once and memoised at module
+  // scope, which a hermetic test cannot re-point — and the permanent-error
+  // path is reached precisely through a CONFIGURED cadence whose prompt is
+  // absent, so it has to be reachable in a test.
+  const cadenceDef = typeof opts.getCadenceDef === "function" ? opts.getCadenceDef : getCadenceDef;
   const userLogger = opts.logger;
   // Test / tuning hooks for the reliability layer.
   const backoffSchedule = opts.backoffSchedule || BACKOFF_SCHEDULE_MS;
@@ -725,13 +738,64 @@ export function startConsumer(opts = {}) {
    * `renderCadencePromptBody`, so the handed-off prompt is byte-identical to
    * what a sub-session would have been given, parallelism directive included —
    * and land it under state/session/handoffs/prompts/<tickId>.md.
+   *
+   * WHY IT TAGS ITS OWN FAILURES. This function does two unrelated things: it
+   * READS the cadence's prompt (whose failure says the spawn cannot work
+   * either — the spawn opens the same path) and it WRITES a rendered copy into
+   * the handoff dir (whose failure says nothing about the spawn at all). The
+   * caller has to tell them apart, and the first attempt at that inferred it
+   * from the message — `msg.includes(promptPath)`.
+   *
+   * That inference is WRONG, measured 2026-09-25: `readFileSync` on a
+   * DIRECTORY throws exactly `EISDIR: illegal operation on a directory, read`,
+   * with no path in the text. A directory at the configured prompt path
+   * therefore passed the `existsSync` pre-check, threw here, was read as "not
+   * about the prompt", classified transient, and fell through to a spawn — the
+   * commonest unreadable case, and precisely the one the PROMPT_UNREADABLE code
+   * exists for. Node puts the path in the message for ENOENT and EACCES and
+   * not for EISDIR; no caller should have to know which.
+   *
+   * So the phase is not inferred, it is STAMPED, at the only two places that
+   * know it: `err.cadencePhase` is `"prompt"` on the read and `"handoff"` on
+   * everything after it. `err.cadenceErrno` carries `err.code` alongside, since
+   * the errno is the contract and the message is not.
    */
   function renderHandoffPrompt(tickId, promptPath) {
     const fullPrompt = join(agentRoot, promptPath);
-    const body = renderCadencePromptBody(agentRoot, readFileSync(fullPrompt, "utf-8"));
-    const out = join(handoffPaths(agentRoot).prompts, `${tickId}.md`);
-    writeFileAtomic(out, body);
-    return out;
+    let source;
+    try {
+      source = readFileSync(fullPrompt, "utf-8");
+    } catch (err) {
+      throw stampPhase(err, "prompt");
+    }
+    // Everything past the read is about OUR output, not the cadence's input:
+    // a render bug or an unwritable handoff dir leaves the spawn perfectly able
+    // to run, so neither may be read as a permanent prompt fault.
+    try {
+      const body = renderCadencePromptBody(agentRoot, source);
+      const out = join(handoffPaths(agentRoot).prompts, `${tickId}.md`);
+      writeFileAtomic(out, body);
+      return out;
+    } catch (err) {
+      throw stampPhase(err, "handoff");
+    }
+  }
+
+  /**
+   * Stamp an error with the phase it came from, so a catch does not have to
+   * guess. Non-destructive: an already-stamped error keeps its innermost phase
+   * (the read is nested inside nothing, but this keeps re-throws honest), and a
+   * non-object throw is wrapped rather than dropped.
+   */
+  function stampPhase(err, phase) {
+    if (!err || typeof err !== "object") {
+      const wrapped = new Error(String(err ?? "unknown error"));
+      wrapped.cadencePhase = phase;
+      return wrapped;
+    }
+    if (!err.cadencePhase) err.cadencePhase = phase;
+    if (!err.cadenceErrno && typeof err.code === "string") err.cadenceErrno = err.code;
+    return err;
   }
 
   /**
@@ -759,7 +823,7 @@ export function startConsumer(opts = {}) {
       // predicate both places — the daemon and the plan cannot disagree about
       // what is suspended.
       if (posture && cadence) {
-        const def = getCadenceDef(cadence) || {};
+        const def = cadenceDef(cadence) || {};
         const verdict = obligationAllowedUnderPosture(
           {
             kind: "SCHEDULE",
@@ -824,6 +888,13 @@ export function startConsumer(opts = {}) {
     handed_off: 0,
     handoff_timeouts: 0,
     deferred: 0,
+    // A failure the classifier called PERMANENT — the cause cannot change by
+    // waiting, so the tick was dead-lettered instead of retried. Rides the
+    // heartbeat (writeHealth) so `maestro cadence status` and the beat carry it
+    // without a new channel; `last_permanent_failure` names the cadence and the
+    // code so the reader does not have to go back to the log to find out which.
+    permanent_failures: 0,
+    last_permanent_failure: null,
     last_event_id: null,
     last_decision: null,
   };
@@ -887,6 +958,99 @@ export function startConsumer(opts = {}) {
     return { ok: false, decision: "deferred", reason };
   }
 
+  /**
+   * A failure the classifier calls PERMANENT: stop retrying, record it
+   * durably, and make it visible to a person.
+   *
+   * THE FAULT THIS CLOSES (Eli Rosenberg's seat, 2026-09-24). A cadence whose
+   * configured prompt file was not on disk requeued forever — measured at 16
+   * per 30 seconds — because nothing in the retry path ever asked whether the
+   * cause could change by waiting. It cannot: a file that does not exist will
+   * not exist 30 seconds later.
+   *
+   * Three things happen, and all three matter:
+   *
+   *  1. STOP. `failTick` with `min(this consumer's budget,
+   *     PERMANENT_MAX_ATTEMPTS)` — the permanent cap lowers a budget, never
+   *     raises one. Two attempts, then dlq/: not because the cause can never be
+   *     repaired (someone can drop the prompt onto the seat), but because it
+   *     cannot be repaired BY WAITING.
+   *
+   *     STATED HONESTLY (corrected 2026-09-25). `failTick`'s first outcome for
+   *     attempt 1 is a REQUEUE, so what this buys is "one extra attempt, then
+   *     stop" — not "the cadence's own schedule is the retry window", which is
+   *     what an earlier draft of this comment claimed. The schedule only
+   *     becomes the window once the last attempt reaches dlq/. Spacing the one
+   *     extra attempt is a separate act, and it is done here:
+   *     `holdCadenceForBackoff` moves the per-cadence gate forward so the retry
+   *     cannot land in the same drain that produced the first failure. The
+   *     measured before/after is 16 requeues per 30 s, unbounded → 2 attempts
+   *     one backoff interval apart, then a durable stop.
+   *
+   *     The budget is the smaller half of this; the bigger half is (2) and (3),
+   *     and that a permanent fault no longer falls through to a second code
+   *     path that opens the same missing file.
+   *  2. RECORD. The dlq/ file is the durable record and now carries
+   *     `permanent:<code>` in `last_error`, so the reason survives a restart
+   *     and a log rotation. A durable counter (`cadence.permanent_failure`)
+   *     goes to logs/diagnostics/counters/<day>.jsonl alongside it.
+   *  3. BE VISIBLE. The counter is what the seat's EXISTING alert lane reads
+   *     (lib/diagnostics/alerts.mjs `cadence_permanently_failing`, delivered by
+   *     the alerts cadence through config/alerts.yaml's webhook, or logged
+   *     when there is none) — no new channel. And `stats.permanent_failures`
+   *     rides the heartbeat, so the seat's health file and everything
+   *     downstream of it say so without anyone tailing a log.
+   *
+   * Never throws: the counter bump is best-effort by contract and failTick is
+   * already guarded.
+   *
+   * @param {object} event     the claimed tick
+   * @param {object} verdict   a CadenceFailureVerdict (class "permanent")
+   * @param {string} detail    the raw error text, for the dlq record + log
+   * @param {string} stage     log stage naming WHERE it was caught
+   */
+  function failPermanently(event, verdict, detail, stage) {
+    // The permanent cap LOWERS a budget, never raises one: if this consumer is
+    // already stricter than the cap, its own number wins.
+    const budget = Math.min(maxAttempts, verdict.maxAttempts ?? PERMANENT_MAX_ATTEMPTS);
+    const reason = `permanent:${verdict.code} — ${verdict.reason}${detail ? `: ${detail}` : ""}`;
+    log({
+      level: "error",
+      stage,
+      permanent: true,
+      code: verdict.code,
+      id: event.id,
+      cadence: event.cadence,
+      error: detail || verdict.reason,
+      max_attempts: budget,
+      note: "cause cannot change by waiting — one more attempt after the cadence backoff, then dead-lettered",
+    });
+    try {
+      bumpCounter("cadence.permanent_failure", { cadence: event.cadence, code: verdict.code }, { agentRoot });
+    } catch { /* a counter must never crash the path it observes */ }
+    stats.permanent_failures += 1;
+    stats.last_permanent_failure = {
+      cadence: event.cadence,
+      code: verdict.code,
+      at: new Date().toISOString(),
+    };
+    stats.last_decision = "permanent-failure";
+    // Space the one remaining attempt. Without this the requeue below is
+    // re-claimed by the very next drain pass — "bounded" but still at poll
+    // speed, which is the behaviour this lane exists to remove.
+    const heldUntil = holdCadenceForBackoff(event.cadence);
+    const outcome = failTick(agentRoot, event.id, reason, { maxAttempts: budget });
+    if (outcome?.destination === "dlq") stats.dlq += 1;
+    else {
+      stats.retries += 1;
+      log({ level: "warn", stage: "permanent_retry_held", id: event.id, cadence: event.cadence, code: verdict.code, retry_at: new Date(heldUntil).toISOString() });
+    }
+    // The heartbeat is the visible surface; write it now rather than waiting up
+    // to `heartbeatMs` for a reader to learn a cadence just died.
+    heartbeat();
+    return { ok: false, decision: outcome?.destination === "dlq" ? "dlq-permanent" : "failed-permanent", code: verdict.code };
+  }
+
   // Ledger hygiene runs from the sweep at most this often.
   const HANDOFF_PRUNE_EVERY_MS = 60 * 60_000;
   let lastHandoffPruneAt = 0;
@@ -989,20 +1153,47 @@ export function startConsumer(opts = {}) {
     s.failures += 1;
     // Exponential back-off honouring the (test-overridable) schedule.
     const idx = Math.min(s.failures, backoffSchedule.length - 1);
-    s.nextAllowedAt = Date.now() + backoffSchedule[idx];
+    s.nextAllowedAt = nowMs() + backoffSchedule[idx];
     if (s.failures >= circuitThreshold) {
-      s.openUntil = Date.now() + circuitDurationMs;
+      s.openUntil = nowMs() + circuitDurationMs;
       log({ level: "error", stage: "circuit_opened", cadence, failures: s.failures, open_until: new Date(s.openUntil).toISOString() });
       writeCircuitFile();
     }
   }
 
+  /**
+   * Hold a cadence off the spawn path for one backoff interval WITHOUT
+   * advancing it toward an open circuit.
+   *
+   * WHY IT IS SEPARATE FROM `recordSubsessionFailure`. A permanent failure is
+   * not a flaky sub-session: counting it toward `circuitThreshold` would trip a
+   * breaker whose whole job is to ride out a bad patch, for a cause that has no
+   * patch to ride out. What it DOES need is spacing — `PERMANENT_MAX_ATTEMPTS`
+   * is a count, not a delay, and `failPermanently`'s first outcome is a requeue,
+   * so without this the "one extra attempt" lands in the very same drain that
+   * produced the first. `escalate` consults `isCadenceAllowed` before it reaches
+   * the prompt at all, so moving `nextAllowedAt` forward is all it takes for the
+   * extra attempt to cost a real interval rather than a millisecond.
+   *
+   * Idempotent-ish and monotonic: never moves the hold EARLIER, so a circuit or
+   * a longer transient backoff already in force keeps its own deadline.
+   */
+  function holdCadenceForBackoff(cadence) {
+    const s = getCadenceState(cadence);
+    // The first rung is deliberately 0 ("retry immediately once"); a permanent
+    // fault has already proved it needs a gap, so take the first NON-zero rung.
+    const step = backoffSchedule.find((ms) => ms > 0) ?? 0;
+    const until = nowMs() + step;
+    if (until > s.nextAllowedAt) s.nextAllowedAt = until;
+    return s.nextAllowedAt;
+  }
+
   function writeCircuitFile() {
     // Persist the open-circuit snapshot so doctor + the operator can see
     // which cadences are currently held back without scraping logs.
     const open = {};
     for (const [cad, s] of cadenceState.entries()) {
-      if (s.openUntil > Date.now()) {
+      if (s.openUntil > nowMs()) {
         open[cad] = { failures: s.failures, open_until: new Date(s.openUntil).toISOString() };
       }
     }
@@ -1020,7 +1211,7 @@ export function startConsumer(opts = {}) {
 
   function isCadenceAllowed(cadence) {
     const s = getCadenceState(cadence);
-    const now = Date.now();
+    const now = nowMs();
     if (s.openUntil > now) return { allowed: false, reason: "circuit-open", retry_at: s.openUntil };
     if (s.nextAllowedAt > now) return { allowed: false, reason: "backoff", retry_at: s.nextAllowedAt };
     // Circuit closes automatically when openUntil passes.
@@ -1107,7 +1298,7 @@ export function startConsumer(opts = {}) {
       }
     }
 
-    const def = getCadenceDef(event.cadence);
+    const def = cadenceDef(event.cadence);
     let promptPath = def?.prompt;
     if (!promptPath) {
       // Unknown cadence — try the conventional location.
@@ -1121,6 +1312,15 @@ export function startConsumer(opts = {}) {
         stats.dlq += 1;
         return { ok: false, decision: "dlq-no-prompt" };
       }
+    } else if (!existsSync(join(agentRoot, promptPath))) {
+      // THE ELI FAULT, caught before it can loop. The `!promptPath` branch above
+      // has checked the conventional path since it was written; a prompt named
+      // by CONFIG was never checked at all — it was handed straight to the
+      // handoff renderer and then, when that threw, to the spawn, which opens
+      // the same path. Both fail, neither is terminal, and the tick comes back
+      // on the bus 30 seconds later. Check it once, here, and classify.
+      const verdict = classifyCadenceFailure({ phase: "prompt", error: `prompt not found: ${promptPath}` });
+      return failPermanently(event, verdict, `configured prompt missing: ${promptPath}`, "escalate_prompt_missing");
     }
 
     // Per-cadence in-flight guard (F9): never the same cadence twice at once —
@@ -1139,31 +1339,69 @@ export function startConsumer(opts = {}) {
       const fd = frontDoorState();
       const verdict = shouldHandOffTick({ ...fd, mode: def?.mode, metadata: event.metadata });
       if (verdict.handOff) {
+        // The PROMPT read is its own step, with its own catch. It used to sit
+        // inside the handoff try/catch, so a prompt that could not be read was
+        // indistinguishable from a handoff file that could not be written — and
+        // the shared catch fell through to the spawn, which opens the same
+        // prompt path. That is the busy loop: `handoff_failed_spawning_instead`
+        // 16 times per 30 seconds on Eli Rosenberg's seat, 2026-09-24.
+        // Split apart, each failure gets the answer it deserves: a permanent
+        // prompt fault stops here; an unwritable handoff still falls through,
+        // because the spawn genuinely might work.
+        let rendered = null;
         try {
-          const rendered = renderHandoffPrompt(event.id, promptPath);
-          const h = writeHandoff(agentRoot, {
-            tickId: event.id,
-            cadence: event.cadence,
-            mode: def?.mode || "escalate",
-            promptPath: rendered,
-            metadata: { ...(event.metadata || {}), sourcePrompt: promptPath },
-          }, { now: nowMs(), deadlineMs: handoffDeadlineMs });
-          if (!h.ok) throw new Error(h.error || "handoff write failed");
-          completeTick(agentRoot, event.id, {
-            decision: "handed-to-session",
-            cadence: event.cadence,
-            prompt: promptPath,
-            handoff: h.path,
-            deadline_at: h.handoff && h.handoff.deadlineAt,
-          });
-          stats.handed_off += 1;
-          stats.last_decision = "handed-to-session";
-          log({ level: "info", stage: "handed_to_session", id: event.id, cadence: event.cadence, prompt: rendered, deadline_at: h.handoff && h.handoff.deadlineAt });
-          return { ok: true, decision: "handed-to-session" };
+          rendered = renderHandoffPrompt(event.id, promptPath);
         } catch (err) {
-          // A handoff we could not write is not a reason to lose the tick —
-          // fall through to the legacy spawn, loudly.
-          log({ level: "warn", stage: "handoff_failed_spawning_instead", id: event.id, cadence: event.cadence, error: err && err.message });
+          // renderHandoffPrompt stamps which half failed (see its doc): the
+          // READ of the cadence prompt, or everything after it. Only the read
+          // says anything about whether a spawn would work — the spawn opens
+          // the same path — so only `cadencePhase === "prompt"` may reach a
+          // permanent verdict. An unwritable handoff dir falls through to the
+          // spawn like any other handoff fault.
+          //
+          // This used to be inferred from `msg.includes(promptPath)`, which is
+          // false for EISDIR (Node omits the path), so the commonest unreadable
+          // case — a DIRECTORY at the prompt path — fell through and spawned.
+          // Never classify a path fault by whether the message quotes the path.
+          const msg = (err && err.message) || "";
+          const promptVerdict = classifyCadenceFailure({
+            phase: err?.cadencePhase === "prompt" ? "prompt" : "spawn",
+            error: msg,
+            errno: err?.cadenceErrno,
+          });
+          if (isPermanent(promptVerdict)) {
+            return failPermanently(event, promptVerdict, msg, "handoff_prompt_failed_permanently");
+          }
+          log({ level: "warn", stage: "handoff_render_failed_spawning_instead", id: event.id, cadence: event.cadence, phase: err?.cadencePhase || null, error: msg });
+        }
+        if (rendered) {
+          try {
+            const h = writeHandoff(agentRoot, {
+              tickId: event.id,
+              cadence: event.cadence,
+              mode: def?.mode || "escalate",
+              promptPath: rendered,
+              metadata: { ...(event.metadata || {}), sourcePrompt: promptPath },
+            }, { now: nowMs(), deadlineMs: handoffDeadlineMs });
+            if (!h.ok) throw new Error(h.error || "handoff write failed");
+            completeTick(agentRoot, event.id, {
+              decision: "handed-to-session",
+              cadence: event.cadence,
+              prompt: promptPath,
+              handoff: h.path,
+              deadline_at: h.handoff && h.handoff.deadlineAt,
+            });
+            stats.handed_off += 1;
+            stats.last_decision = "handed-to-session";
+            log({ level: "info", stage: "handed_to_session", id: event.id, cadence: event.cadence, prompt: rendered, deadline_at: h.handoff && h.handoff.deadlineAt });
+            return { ok: true, decision: "handed-to-session" };
+          } catch (err) {
+            // A handoff FILE we could not write is not a reason to lose the tick,
+            // and it says nothing about whether the spawn would work — fall
+            // through to the legacy spawn, loudly, exactly as before. The prompt
+            // half of this, which DOES say so, is handled above.
+            log({ level: "warn", stage: "handoff_failed_spawning_instead", id: event.id, cadence: event.cadence, error: err && err.message });
+          }
         }
       }
     }
@@ -1292,6 +1530,15 @@ export function startConsumer(opts = {}) {
     stats.spawn_failures += 1;
     recordSubsessionFailure(event.cadence);
     const reason = result.error || (stderrTail ? `exit ${result.exit_code}: ${stderrTail}` : `exit ${result.exit_code}`);
+    // Can this possibly succeed if we try again? `realSpawnSession` answers
+    // -2 (prompt not on disk) / -3 (prompt unreadable) for causes that do not
+    // move; those get the classifier's bounded budget and a durable,
+    // visible record. Everything else — a timeout, a non-zero exit, a crash —
+    // is transient and unchanged.
+    const spawnVerdict = classifyCadenceFailure({ phase: "spawn", exitCode: result.exit_code, error: reason });
+    if (isPermanent(spawnVerdict)) {
+      return failPermanently(event, spawnVerdict, reason, "subsession_failed_permanently");
+    }
     const outcome = failTick(agentRoot, event.id, reason, { maxAttempts });
     if (outcome?.destination === "dlq") stats.dlq += 1;
     else stats.retries += 1;
@@ -1304,7 +1551,7 @@ export function startConsumer(opts = {}) {
     stats.received += 1;
     stats.last_event_id = event.id;
 
-    const def = getCadenceDef(event.cadence);
+    const def = cadenceDef(event.cadence);
     if (def?.mode === "inline" && typeof def.handler === "function") {
       try {
         const out = await def.handler({ event, agentRoot, log });

package/scripts/daemon/context-compiler.mjs

@@ -17,6 +17,7 @@ import { join } from "path";
 import { isEnabled as orgEnabled, loadOrgConfig } from "../../lib/org/client.mjs";
 import { recall as orgRecall } from "../../lib/org/knowledge.mjs";
 import { isPrivateConversation, historyDirNames } from "../../lib/context/history-scope.mjs";
+import { stripDisclosureInstructionsAndWarn } from "../../lib/identity/disclosure-instructions.mjs";
 import { fitSections } from "../../lib/context/budget.mjs";
 import { currentWorkBlock, audienceForItem } from "../../lib/session/current-work.mjs";
 
@@ -590,9 +591,16 @@ export async function compileContext(item, classResult, options = {}) {
     sections.push("--- COMPILED CONTEXT (do not repeat verbatim) ---");
     sections.push("");
 
+    // The sender profile is SEAT-AUTHORED prose (memory/profiles/users/*.yaml),
+    // not inbound data, and it lands in a context block the model reads as
+    // guidance. A profile line ordering a self-introduction would defeat the
+    // rest of the fix for exactly one correspondent — the hardest version of
+    // the bug to reproduce — and the repo cannot see the file. Filtered like
+    // the CLAUDE.md scrape; the transcript below is deliberately NOT filtered,
+    // because it is a record of what people said, not an instruction.
     if (profileText) {
       sections.push("## Sender Profile");
-      sections.push(profileText);
+      sections.push(stripDisclosureInstructionsAndWarn(profileText, "memory/profiles/users/*.yaml"));
       sections.push("");
     }