@ctrl-spc/cs 0.7.0 → 0.7.1

package/dist/codex-home.js

@@ -122,6 +122,16 @@ const OWNER_FILE = 'ctrl-spc-owner.json';
 export function codexHomesRoot() {
     return join(configDir(), 'codex-homes');
 }
+/** Persistent isolated homes belong only to panel3 conversation owners. They
+ * are separate from `codexHomesRoot()` so the per-process PID sweep can keep
+ * its existing contract without deleting a resumable owner conversation. */
+export function panel3CodexOwnerHomesRoot() {
+    return join(configDir(), 'panel3-codex-owner-homes');
+}
+export function panel3CodexOwnerHomePath(ownerRunId) {
+    const key = ownerRunId.replace(/[^a-zA-Z0-9-]/g, '_');
+    return join(panel3CodexOwnerHomesRoot(), key);
+}
 /** Where this run's throwaway codex home lives. Inside the product's own config
  *  dir, beside `scratch/`, so it is the user's own directory and it is obvious
  *  what wrote it. Keyed by request so two concurrent runs never share one. */
@@ -197,7 +207,7 @@ export function codexRunConfigToml(server, runTodoId, runtimePlatform = process.
  * only v3's `startAgent` passes it off. Never inferred from `server`'s shape:
  * v2 and v3 both pass `{ url }` here, so the shape cannot tell them apart.
  */
-subagentsEnabled = true) {
+subagentsEnabled = true, persistentPanelOwner = false) {
     const lines = [
         '# Written by CTRL+SPC for ONE codex run. Not the user\'s config; never read',
         '# by anything but the worker this was written for.',
@@ -207,6 +217,13 @@ subagentsEnabled = true) {
            only for that bundled runtime; other platforms keep Codex's own model
            selection. */
         ...(runtimePlatform === 'win32' ? ['model = "gpt-5.5"', ''] : []),
+        ...(persistentPanelOwner ? [
+            'sandbox_mode = "workspace-write"',
+            '',
+            '[sandbox_workspace_write]',
+            'network_access = true',
+            '',
+        ] : []),
         '[features]',
         /* The account's own connectors, which no config.toml grants and no argv
            removes. See the block comment above. */
@@ -340,6 +357,50 @@ subagentsEnabled = true, runtimePlatform = process.platform) {
         return null;
     }
 }
+/**
+ * Create or refresh the isolated home for one durable panel3 Level 2 owner.
+ * Unlike `ensureCodexRunHome`, this never removes the directory: Codex's native
+ * session files inside it are the state a later activation resumes. Only the
+ * credential copy and current sealed MCP configuration are refreshed.
+ */
+export function ensurePanel3CodexOwnerHome(server, ownerRunId, runtimePlatform = process.platform) {
+    const source = join(userCodexHome(), 'auth.json');
+    if (!existsSync(source))
+        return null;
+    const home = panel3CodexOwnerHomePath(ownerRunId);
+    try {
+        mkdirSync(home, { recursive: true, mode: 0o700 });
+        chmodSync(home, 0o700);
+        copyFileSync(source, join(home, 'auth.json'));
+        writeFileSync(join(home, 'config.toml'), codexRunConfigToml(server, null, runtimePlatform, false, true), { mode: 0o600 });
+        return home;
+    }
+    catch {
+        return null;
+    }
+}
+/** Product-owned persistent state only. Windows owners use the installed Codex
+ * home, so this path is normally absent there and removal remains harmless. */
+export function removePanel3CodexOwnerHome(ownerRunId) {
+    try {
+        rmSync(panel3CodexOwnerHomePath(ownerRunId), { recursive: true, force: true });
+    }
+    catch {
+        // Reconciliation retries. Cleanup must never turn a completed turn into a failure.
+    }
+}
+/** Valid directory names only; callers reconcile each id against the signed-in
+ * owner row before retaining it. */
+export function listPanel3CodexOwnerHomeIds() {
+    try {
+        return readdirSync(panel3CodexOwnerHomesRoot(), { withFileTypes: true })
+            .filter((entry) => entry.isDirectory())
+            .map((entry) => entry.name);
+    }
+    catch {
+        return [];
+    }
+}
 /**
  * Delete a run's home once the run is over.
  *

package/dist/panel3/prompt.js

@@ -90,8 +90,7 @@
  * can look — is named beside it.
  *
  * ---------------------------------------------------------------------------
- * ═══ A DISPATCHED AGENT IS TOLD ITS OWN JOB AND NOTHING ABOUT THE
- *     CONVERSATION. ═══
+ * ═══ A DISPATCHED WORK BRIEF HOLDS THE JOB, NOT THE CONVERSATION. ═══
  *
  * ux.md: "a fresh subagent needs its task, the interfaces it touches, and the
  * global constraints. Nothing else", with the measured cost of the alternative —
@@ -99,9 +98,10 @@
  *
  * So `workBrief` carries exactly two things written by judgement, the
  * responsibility and the boundary, and the facts the product attaches. It
- * carries NO messages, no earlier replies and no history: what the person said
- * reaches it only insofar as whoever dispatched it put it in the
- * responsibility, which is that agent's job to get right.
+ * carries NO messages, no earlier replies and no history. A level 3 worker gets
+ * that brief directly. A level 2 owner gets it inside `ownerActivationPrompt`,
+ * beside the visible conversation read from the card rather than a launcher
+ * retelling of it.
  *
  * ═══ AND IT IS THE SAME VOICE, WHICH IS WHY THE OUTBOUND RULES ARE SHARED. ═══
  * ux.md: "the brief is the same at every level. Nothing in a reply reveals which
@@ -142,7 +142,20 @@
 const whatYouSendBack = (produced) => [
     'WHAT YOU SEND BACK',
     'Your reply is the whole of what they read, so write it to them, about their own work.',
-    '- Be brief. They are looking for the sentence that answers them, not for a report.',
+    '- By default, be very brief: use the shortest accurate reply that lets them understand the',
+    '  outcome, decide, or unblock the work.',
+    '- A routine update is absent unless it is useful, and then it is one short sentence or phrase.',
+    '- An ordinary completion starts with the outcome, includes only the result they need, and is one',
+    '  or two short sentences; never add a third.',
+    '- If the work cannot continue without a decision or input only the person can supply, you MUST',
+    '  call `ask_question`. This includes asking them to choose between options. That tool is the only',
+    '  person-question path: writing the question in an ordinary reply or completing the card with it',
+    '  is wrong. After the call, stop without repeating the question in an ordinary reply. Use only',
+    '  the minimum context they need to answer safely.',
+    '- Do not copy explanations, logs, prompts, internal reasoning, test inventories or internal',
+    '  orchestration into an ordinary reply.',
+    '- If they explicitly ask for detail, give it for that reply, then return to the brief default.',
+    '  Accuracy and truthful failures are never shortened away.',
     '- Name the real things: the actual items, projects and people, by the names they have.',
     ...produced,
     '- Never name the machinery. Words like agent, run, dispatch, level, card, turn, coordinator,',
@@ -196,12 +209,20 @@ const WHILE_YOU_ARE_WORKING = [
  * ═══ WHAT THE PERSON ATTACHED, AS A FACT AND NOTHING MORE. ═══
  *
  * plan-work-items.md constraint 5: "no agent is asked in prose to go and find
- * what a card is about." So this is one sentence saying it happened and to whom
- * it belongs, and nothing more: not "read these before you answer", not "use
- * get_work_item on each one", nothing that tells the agent what to DO. It
- * already holds `get_work_item` and `list_work_items`; what it cannot discover
- * on its own is that these specific ids are the ones the person meant, and that
- * is the one fact stated here.
+ * what a card is about." So the LIST is one sentence saying the attaching
+ * happened and to whom it belongs, and nothing more. What it cannot discover on
+ * its own is that these specific ids are the ones the person meant, and that is
+ * the fact the list states.
+ *
+ * ═══ EACH KIND THEN GETS ONE SENTENCE SAYING WHAT THAT WORD MEANS. ═══ Three
+ * of them now, and the work item's is the one added last (the
+ * `work-lands-on-the-item-6` slice, off ux.md's "before an agent begins working
+ * on it, it must read the description, and any artifacts"). An earlier draft of
+ * this comment said none of them may tell the agent what to DO; that was true
+ * when a work item was only a subject. It is not the same rule as constraint 5,
+ * which forbids sending an agent LOOKING for which item a card is about. The id
+ * is handed over here by the product; reading the item it was handed is not
+ * finding it.
  *
  * SHARED between `levelOnePrompt` and `workBrief` for the same reason
  * `whatYouSendBack` is: one wording for "what was attached", never two that
@@ -215,13 +236,35 @@ const whatWasAttached = (attachments) => {
         'WHAT THE PERSON ATTACHED',
         'They attached these when they sent this, so what is asked belongs against them.',
         ...personAttachments,
-        /* ═══ THE ONE KIND THAT IS AN INSTRUCTION RATHER THAN A SUBJECT. ═══ A
-           work item is what the work is ABOUT, and the paragraph above already
-           says so. A skill is not: it is a method a person chose, and an agent
-           that read it as one more thing the request belongs against would quote
-           it back and carry on doing the work its own way. That is the fact it
-           cannot discover from the line above, so it is the one sentence added,
-           and the tool's own description carries the rest.
+        /* ═══ READ BEFORE YOU DECIDE, WHICH IS THE WHOLE OF THIS SLICE. ═══ ux.md:
+           "Before an agent begins working on it, it must read the description, and
+           any artifacts, and intelligently decide what to do next." An agent that
+           decides first and reads afterwards writes a second plan onto an item that
+           already carries one, against a description it never opened.
+    
+           ═══ AND IT LIVES HERE, NOT UNDER `THE WORK ITEM THIS IS ABOUT`. ═══ That
+           header is the obvious home and it is the wrong one: `workItemId` comes
+           only from `dispatch`'s OPTIONAL `work_item_id`, which no prompt asks a
+           launcher to supply, and which the launcher MUST NOT supply when several
+           items are attached (the selection is the person's, below). So at exactly
+           the moment reading the items decides the answer, that header is absent.
+           This block is written from the person's own attachment rows, travels to
+           every dispatch on the card, and is shared by `levelOnePrompt` and
+           `workBrief`, so the sentence reaches all three levels. The tools it needs
+           — `get_work_item`, `list_artifacts`, `get_artifact` — are `levels: ALL`.
+    
+           NO TOOL NAMES IN IT. `get_work_item` already says it returns "its
+           description, status, placement, and the artifacts on it", and
+           `list_artifacts` already ends "Use get_artifact to read one". The prompt
+           carries the obligation; the tool descriptions carry the mechanics. */
+        'A `work_item` is what the work is about. Read its description and the artifacts already on it',
+        'before you decide anything.',
+        /* ═══ THE KIND THAT IS A METHOD RATHER THAN A SUBJECT. ═══ A skill is not
+           one more thing the request belongs against: it is a method a person
+           chose, and an agent that read it as a subject would quote it back and
+           carry on doing the work its own way. That is the fact it cannot discover
+           from the line above, so it is the sentence added, and the tool's own
+           description carries the rest.
     
            ═══ SAID WHENEVER ANYTHING IS ATTACHED, WHICH IS A CHOICE AND NOT AN
            ACCIDENT. ═══ Both callers hold the rows, `kind` and all, so narrowing
@@ -249,6 +292,21 @@ const whatWasAttached = (attachments) => {
            prompt. */
         'A `credential` is a secret the person authorised for this work. Its name is above; the value',
         'is readable only by the agents doing the work, with `get_credential`.',
+        /* ═══ THE KIND THAT IS A SEQUENCE RATHER THAN A METHOD OR A SUBJECT. ═══ A
+           workflow says what happens in what order, and the fact an agent cannot
+           discover from the line above is that ONE of the three levels is the one
+           that reads it. So this names the ROLE rather than instructing anybody,
+           following the credential sentence's shape of naming a tool the reader may
+           not hold: `get_workflow` is level 2's alone, and `levelOnePrompt` already
+           calls the level 2 agent "the owner", so the word lands at every level this
+           one sentence reaches.
+    
+           AND IT SAYS NOTHING ABOUT WORKING STAGES ONE AT A TIME. That rule
+           overrides a default written in `workBrief`'s own IF YOU SPLIT IT block, so
+           it lives inside that block and nowhere else. A second copy here would be a
+           second place for it to drift. */
+        'A `workflow` is the process this work follows: stages, in an order it gives. The owner of this',
+        'conversation is the one who reads it, with `get_workflow`.',
     ];
     return [
         ...(codebases.length === 0 ? [] : [
@@ -316,8 +374,9 @@ const projectCodebases = (codebases) => {
  */
 export function levelOnePrompt(cardTitle, messages, produced, attachments = [], codebases = null) {
     return [
-        'You are the one place a person talks to in CTRL+SPC. You talk to them, and you coordinate',
-        'the work. You do not do the work yourself.',
+        'You are the short-lived launcher for one CTRL+SPC conversation. You do not do the work and',
+        'you do not answer the person. Your whole job is to clarify the destination once if you truly',
+        'cannot choose it, or launch exactly one owner and then exit.',
         '',
         'WHAT YOU CAN SEE',
         'Your tools read the record. Read as much of it as the question needs.',
@@ -331,11 +390,12 @@ export function levelOnePrompt(cardTitle, messages, produced, attachments = [],
         'makes every true one worthless.',
         '',
         'WHAT YOU CAN SEND SOMEBODY TO DO',
-        'Anything that means reading or changing code, you send somebody to do. They work in a copy of',
-        'the codebase and they write to this person themselves when they are done, in their own words,',
-        'which nobody edits on the way. So do not wait for them, do not offer to come back with what',
-        'they find, and do not describe what they are going to find. Say what is being looked at, and',
-        'let the answer arrive from whoever finds it.',
+        'Launch one owner for the conversation. Give it the complete responsibility and boundary. If',
+        'the request belongs to a registered codebase, name it. If it is record-only work, launch it',
+        'without a codebase. The owner talks to the person and may send workers of its own.',
+        'Your only question is a destination or codebase you truly cannot choose. NEVER ask the person',
+        'to make a work or product decision. When one registered codebase clearly fits, launch its owner',
+        'even if the work itself needs the person to choose between options; the owner asks that question.',
         ...projectCodebases(codebases),
         '',
         ...WHILE_YOU_ARE_WORKING,
@@ -355,22 +415,17 @@ export function levelOnePrompt(cardTitle, messages, produced, attachments = [],
         '',
         ...messages.map((body, i) => `${i + 1}. ${body}`),
         '',
-        ...whatYouSendBack([
-            '- What you make goes IN the thing you make, and not in here. Anything you create is already in',
-            '  front of them as something they can open, so name what you made and stop there. Writing its',
-            '  contents out again leaves them holding two copies of the same words, and the one they can edit',
-            '  is not this one.',
-        ]),
+        'AFTER YOU LAUNCH THE OWNER, EXIT IMMEDIATELY. Do not write a reply, wait for it, summarize what',
+        'it will do, or ask another question. CTRL+SPC publishes no stdout from this launcher.',
     ].join('\n');
 }
 /**
  * What an agent sent to do a piece of work is told: its own job, the facts of
  * where it is, and nothing about the conversation it came out of.
  *
- * ═══ THIS IS BOTH THE PROMPT AND THE BRIEF. ═══ It is what the process is
- * started with AND what `panel3_runs.brief` stores, exactly as level 1's prompt
- * is, so what `cs3 show` prints is the thing the agent was actually sent rather
- * than a description of it.
+ * ═══ THIS IS THE IMMUTABLE BRIEF. ═══ `panel3_runs.brief` stores it exactly.
+ * A level 3 process is started with it directly; a level 2 owner's activation
+ * prompt carries it verbatim with the live conversation around it.
  *
  * ═══ AND IT CARRIES NO PATH, WHICH IS CONSTRAINT 6. ═══ The working copy is
  * the directory the process is started in, so it never has to be named — and
@@ -388,28 +443,121 @@ export function levelOnePrompt(cardTitle, messages, produced, attachments = [],
  * from nothing but a responsibility sentence somebody else wrote down.
  */
 export function workBrief(level, responsibility, boundary, workItemId, attachments = [], codebase) {
+    /* ═══ ONLY WHEN A WORKFLOW IS ACTUALLY ON THE CARD. ═══ An owner is not
+       instructed about a process that is not there, which is the rule
+       `personAttachmentLines` already keeps by rendering nothing when nothing is
+       attached. The same prefix `whatWasAttached` partitions on, since both read
+       the one line `attachmentLine` writes. */
+    const hasWorkflow = attachments.some((attachment) => attachment.startsWith('workflow  '));
     return [
         ...(level === 2
             ? [
-                'You see one thing a person asked for through to done. You may do the whole of it yourself,',
-                'or split it and send others to do the parts.',
+                'You see one thing a person asked for through to done. Keep the whole picture and stay',
+                'available to the person while the work moves.',
+                '',
+                /* ═══ THE FIRST THING, EVERY TIME, AND IT IS NOT THE REPLY. ═══ Nothing
+                   an owner writes reaches the person until its process exits, and a turn
+                   that exits by asking writes no message at all. So on the walk of
+                   2026-08-24 "Write a plan for this item" was silent for two and a half
+                   minutes and then said a question, twice over, and Lane's requirement
+                   is that every message he sends is acknowledged. `say` is the only
+                   thing that can do that, because an acknowledgement cannot be an exit.
+                   WRITTEN AS THE FIRST INSTRUCTION IN THE BRANCH because it is the first
+                   act, and a rule about what to do first that arrives after four
+                   paragraphs about the work is read after the work has started. */
+                'FIRST, SAY WHAT YOU ARE GOING TO DO',
+                'They have seen their own message and nothing else. Before you start, call `say` with one or',
+                'two sentences: what you are about to do about what they asked, and what they will get back.',
+                'Do this every time you are started with something new from them, including the very first',
+                'time, and before any reading that takes a while. It does not end your turn and it is not',
+                'your reply; you carry on straight afterwards.',
                 '',
-                'WHICH OF THE TWO, DECIDED BEFORE YOU START READING',
-                'Name the parts of this job first: pieces that do not need each other\'s answers. More than',
-                'one such part means send one person per part, now, rather than working through them',
-                'yourself. Several files to read, several places to check, several questions asked at once',
-                'are all that case, and reading them one after another leaves the person waiting for the',
-                'whole queue when they could have waited for the longest one.',
-                'Do it yourself when it is genuinely one thread: one file, one question, or parts that each',
-                'need the last one\'s answer.',
+                'TRACEABILITY BEFORE A CODEBASE FILE CHANGES',
+                'A codebase-file change means ANY file change: source, config, docs, tests, migrations,',
+                'generated inputs, and assets all count. "Non-code" means no codebase file changes at all.',
+                'When this work has a Work Item and will change a codebase file, you may investigate',
+                'read-only first. Any investigation you send must explicitly forbid file edits. Create one',
+                'useful `analysis` or `plan` artifact on the exact Work Item, carrying the document the work',
+                'is missing: a spec, a PRD, user stories or a repro is its CONTENT, not a second artifact.',
+                'For a bug: what reproduces it, the behaviour it has now, the behaviour it should have, the',
+                'cause and the correction. For something new: what a person will be able to do, and how you',
+                'would know it works.',
+                'If several Work Items were supplied, one is selected only when the person identifies it by',
+                'name, id, or an unambiguous reference in a message or answer. That selection stays in force',
+                'unless the person changes it. An attachment label, its order, similarity, or which seems most',
+                'likely is NEVER a selection by itself; the person explicitly referring to that label IS a',
+                'selection.',
+                'Until one is selected, do not',
+                'call `update_work_item`, create or update an artifact, dispatch work, or change any file.',
+                'Call `ask_question` once with no `work_item_id`, `answer_mode: single_select`, and the exact',
+                'attached Work Item names as options, and then stop.',
+                'Present the artifact with `ask_question`: name both `work_item_id` and',
+                '`related_artifact_id`, use `answer_mode: single_select` with `approve` and',
+                '`request changes`, and stop. Do not edit any file OR dispatch implementation until the',
+                'artifact revision that question presented is approved. If changes are requested, use',
+                '`update_artifact` on the SAME artifact, present its new revision in a new approval question,',
+                'and apply that same no-edit, no-implementation-dispatch fence until it is approved.',
+                'The only bypass is the person explicitly asking you to change codebase files WITHOUT a',
+                'Work Item artifact. Urgency, smallness, silence, or a generic "go ahead" is not a bypass.',
+                'When no codebase file will change, this gate does not apply.',
                 '',
-                'READING CANNOT COLLIDE, so a job that is only reading has nothing to be careful about: send',
-                'as many as there are parts. The care below is about CHANGING files, and only that.',
+                'WHO DOES THE WORK IS YOUR JUDGEMENT',
+                'Substantial implementation, investigation, testing, and other substantial work normally',
+                'goes to the people you send. Before you start substantial multi-part work, send at least',
+                'one meaningful independent implementation, investigation, or test part. Multiple independent',
+                'file, module, or test parts belong with the people you send by default; do not keep all of',
+                'them just because you could complete every piece yourself.',
+                'Skip sending only when the whole turn is very small, or when sending any meaningful',
+                'independent part would genuinely make the result slower or less accurate. You keep the full',
+                'picture, answer the person, and put the results together.',
+                /* ═══ SENDING COMES BEFORE READING, AND THAT IS ABOUT THE PERSON RATHER
+                   THAN ABOUT THROUGHPUT. ═══ The person reads nothing until this process
+                   exits, so every minute the owner spends reading the codebase before it
+                   sends anybody is a minute of pulse and no words. Measured on
+                   2026-08-24: 101 seconds to the first message, of which about 80 were
+                   the owner reading first and sending second.
+                   IT IS STILL NOT A GATE. `ux.md` deleted the manager that never touches
+                   code because that shape "required the coordinator to predict, at
+                   dispatch time, whether a request was big. It cannot", and Issue 3 made
+                   this judgement "never a mechanical gate". So this is which order to do
+                   two things the owner was already going to do, not a rule about
+                   whether. The paragraph above still decides whether. */
+                '',
+                'WHEN YOU ARE GOING TO SEND SOMEBODY, SEND THEM FIRST',
+                'Read what you need to write their piece, and no more; the rest of the reading is theirs to',
+                'do. Nothing you write reaches the person until you stop, so every minute you spend reading',
+                'before you send anybody is a minute they watch a line with no answer coming.',
                 '',
                 'IF YOU SPLIT IT',
                 'Everybody you send works in the SAME copy of the codebase as everybody else, at the same',
                 'time. Nothing keeps them out of each other\'s way, so anybody CHANGING files needs a piece',
                 'that touches nobody else\'s files, or has to be sent on their own.',
+                /* ═══ AND A WORKFLOW OVERRIDES THAT DEFAULT, INSIDE THE BLOCK THAT SETS
+                   IT. ═══ Six lines above, the owner is told the opposite: multiple
+                   independent parts belong with the people it sends, all working at the
+                   same time. A workflow's stages ARE multiple parts, so without a
+                   precedence rule the owner sends them all at once, the read-back
+                   barrier restarts it ONCE, and the order the person chose the workflow
+                   for is gone. Nothing in the record refuses a second dispatch before
+                   the first has ended — the barrier re-arms an owner when EVERY child
+                   has finished, which sequences stages only because the owner sends one
+                   at a time. So the rule is here, in the immutable brief that is
+                   replayed verbatim on every restart, and therefore in front of the
+                   owner at every stage boundary rather than only the first.
+        
+                   THE SECOND SENTENCE IS NOT DECORATION. A dispatched worker gets a
+                   working copy and the responsibility and boundary AND NOTHING ELSE, and
+                   `get_workflow` is this level's alone. Without it, the product takes
+                   deliberate trouble to hand the owner an untruncated stage document and
+                   the agent that performs the stage receives a paraphrase of it. */
+                ...(hasWorkflow
+                    ? [
+                        'A WORKFLOW IS ATTACHED, AND ITS STAGES GO OUT ONE AT A TIME. Send somebody for the',
+                        'first stage only, and do not start the next stage until the one before it has come',
+                        'back. When you send somebody for a stage, put that stage\'s own document into what you',
+                        'give them, in full: they cannot read the workflow themselves.',
+                    ]
+                    : []),
                 'What you have already sent somebody to do is written down, and you are handed that list',
                 'rather than having to remember it. Anything on it has been sent. Nothing on it is sent again.',
                 'When every one of them has finished you are started again, with what each of them wrote,',
@@ -417,13 +565,15 @@ export function workBrief(level, responsibility, boundary, workItemId, attachmen
                 'through you, so the reply that covers all of it is yours to write and nobody else\'s.',
                 'WHICH MEANS THE REPLY YOU WRITE NOW IS NOT THAT ANSWER. If you have sent anybody, you are',
                 'stopping in the middle, and what you write as you stop goes to the person as a message from',
-                'you. So make it one short sentence at most, or nothing worth reading twice: the real answer',
-                'is the one you write when you come back. What is happening meanwhile belongs on the line',
-                'below, which is where they are already watching it.',
+                'you. Write it. One short sentence, naming what has gone out and what you are waiting on:',
+                'the real answer is the one you write when you come back. Never stop silently. What you said',
+                'with `say` was about to happen; this is what has happened and what is still to come.',
             ]
             : [
-                'You change the code. One piece of the work, the one below, and nothing else. Whoever sent',
-                'you is doing the rest.',
+                'You own one piece of the work, the one below, and nothing else. Whoever sent you is doing',
+                'the rest. If your responsibility is investigation-only, read and report without changing',
+                'any file. The conversation owner handles the Work Item artifact and approval; do not',
+                'duplicate that record. If you were given approved implementation work, make that change.',
                 '',
                 'Somebody else may be working in this same copy of the codebase at the same time as you, on',
                 'a different piece. Stay inside what you were given and leave the rest of it alone.',
@@ -443,15 +593,33 @@ export function workBrief(level, responsibility, boundary, workItemId, attachmen
         ] : []),
         '',
         'WHERE YOU ARE',
-        'The directory you are in is a working copy of the codebase. Read it, run things in it, and',
-        'change it where that is what you were asked for. Name a file by its path inside this copy,',
-        'never by the full path from the root of this machine: the full one means nothing to the person',
-        'reading and is not ours to hand around.',
+        ...(codebase
+            ? [
+                'The directory you are in is a working copy of the codebase. Read it, run things in it, and',
+                'change it where that is what you were asked for. Name a file by its path inside this copy,',
+                'never by the full path from the root of this machine: the full one means nothing to the person',
+                'reading and is not ours to hand around.',
+            ]
+            : [
+                'The directory you are in is an empty private workspace. No codebase checkout was attached to',
+                'this conversation. Work from the record and the tools you have; do not claim to have read or',
+                'changed project files.',
+            ]),
         '',
         'WHAT YOU WERE AND WERE NOT GIVEN',
-        'What is above is the whole of it. You have not seen what anybody said, and you are not meant',
-        'to: what matters was written into what you own. If something you genuinely need is missing,',
-        'say so plainly in your reply rather than guessing at it.',
+        ...(level === 2
+            ? [
+                'This brief is your immutable responsibility and boundary. The visible conversation is',
+                'handed to you separately, in chronological order, whenever you are started. Read it as the',
+                'person wrote it; the launcher does not stand in for it. If something you genuinely need is',
+                'missing and only the person can supply it, you MUST call `ask_question` and stop instead',
+                'of saying it in your reply. Otherwise say what is missing plainly rather than guessing.',
+            ]
+            : [
+                'What is above is the whole of it. You have not seen what anybody said, and you are not meant',
+                'to: what matters was written into what you own. If something you genuinely need is missing,',
+                'say so plainly in your reply rather than guessing at it.',
+            ]),
         '',
         'WHAT CANNOT BE DECIDED HERE',
         'Some things are not yours to settle, and guessing at one of those quietly is worse than any',
@@ -478,6 +646,105 @@ export function workBrief(level, responsibility, boundary, workItemId, attachmen
             : whatAWorkerSendsBack()),
     ].join('\n');
 }
+export const presentedArtifactAnswerContext = (artifact) => artifact === null
+    ? []
+    : artifact.answer === 'request changes'
+        ? [
+            '',
+            'ARTIFACT REVISION THIS ANSWER SENT BACK FOR CHANGES',
+            `Artifact ${artifact.id}, revision ${artifact.revision}.`,
+            'Do not edit any codebase file or dispatch implementation. Revise this SAME artifact as the',
+            'person requested, present its new revision in a new approval question, and stop.',
+        ]
+        : [
+            '',
+            'ARTIFACT REVISION THIS ANSWER APPROVED',
+            `Artifact ${artifact.id}, revision ${artifact.revision}.`,
+            'Before editing any file or dispatching implementation, call `get_artifact` and compare its',
+            'current revision with this one. If they differ, this answer does not approve the current body:',
+            'present the current revision in a new approval question and stop.',
+        ];
+/**
+ * ═══ WHAT A RUN IS TOLD WHEN A PROCESS OF ITS OWN ENDED BEFORE IT FINISHED.
+ *     ═══
+ *
+ * Named once here rather than written inline, because `respawnPrompt` says both
+ * of these too, in its own longer wording (`WHAT YOU ALREADY SENT SOMEBODY TO
+ * DO`, and `CARRY ON FROM WHERE THAT LEAVES YOU`). **The two must move
+ * together.** They are not folded into one string because doing that would
+ * rewrite prose that is already shipped and proven on the retry and recovery
+ * paths, which is not this slice's assignment; naming them is what makes the
+ * pairing findable by the next person to edit either.
+ *
+ * ═══ THEY SAY WHAT TO DO, AND NEVER WHY IT HAPPENED. ═══ Three things end a
+ * process early and they are not the same event: a harness that crashed, a
+ * machine that went down, and a person who said the work was going the wrong
+ * way. `resumePrompt` and `retryPrompt` exist as two functions precisely
+ * because telling an agent an untrue reason for its restart is what this file
+ * exists to prevent, so a sentence shared by all three may only say the part
+ * that is true of all three.
+ */
+const DO_NOT_SEND_SOMEBODY_TWICE = 'Do not send somebody to do a piece of work that is already in this list. Anything of theirs '
+    + 'still going is still going, and asking again for what they are already doing costs the person twice.';
+const LOOK_AT_THE_WORK_ITSELF = 'A process of yours ended before it finished, so what you last wrote down is what you had time to '
+    + 'write, not everything that happened. Where your notes are silent, look at the work itself rather '
+    + 'than starting it over.';
+/**
+ * The complete one-shot context for the durable conversational owner.
+ *
+ * Visible history is supplied as one ordered list. A newly leased message is
+ * marked in place rather than appended, and a question plus its canonical
+ * answer is one event, so neither can occur twice in the prompt.
+ */
+export function ownerActivationPrompt(brief, report, events, children, childQuestion, currentArtifactAnswer = null, 
+/** A process of this run's own ended before it finished, so the working copy
+ *  may hold work no report mentions and the worker list may hold one it
+ *  dispatched a moment before. Never says WHICH ending it was: see
+ *  `LOOK_AT_THE_WORK_ITSELF`. */
+afterAProcessEnded = false) {
+    const history = events.map((event) => {
+        if (event.kind === 'question') {
+            return [
+                `CTRL+SPC QUESTION  ${event.body}`,
+                event.answer ? `PERSON ANSWER  ${event.answer}` : 'PERSON ANSWER  waiting',
+                ...(event.relatedArtifactId && event.relatedArtifactRevision
+                    ? [`PRESENTED ARTIFACT  ${event.relatedArtifactId}, revision ${event.relatedArtifactRevision}`]
+                    : []),
+                ...presentedArtifactAnswerContext(currentArtifactAnswer?.questionId === event.id
+                    ? currentArtifactAnswer
+                    : null),
+            ].join('\n');
+        }
+        const who = event.kind === 'user' ? 'PERSON' : 'CTRL+SPC';
+        return `${who}${event.needsReply ? ` — REPLY TO THIS NOW (turn ${event.id})` : ''}\n${event.body}`;
+    });
+    return [
+        'YOU OWN THIS CTRL+SPC CONVERSATION.',
+        'You are this conversation\'s one owner, started for one serialized activation. Speak directly to the',
+        'person as CTRL+SPC. The launcher is finished and cannot answer or receive an escalation.',
+        '',
+        'VISIBLE CONVERSATION, OLDEST FIRST',
+        ...(history.length === 0 ? ['Nothing has been said yet.'] : history),
+        ...(childQuestion === null ? [] : [
+            '',
+            'A WORKER NEEDS YOUR DECISION',
+            `Question ${childQuestion.id}: ${childQuestion.question}`,
+            'Answer it with answer_escalation if you can. If the person must decide, ask them directly.',
+        ]),
+        '',
+        'WHAT YOU LAST WROTE DOWN',
+        report ?? 'Nothing yet.',
+        '',
+        'PRIVATE WORKER SNAPSHOT',
+        ...(children.length === 0 ? ['You have sent nobody.'] : children),
+        ...(afterAProcessEnded ? ['', LOOK_AT_THE_WORK_ITSELF, DO_NOT_SEND_SOMEBODY_TWICE] : []),
+        '',
+        // THE BRIEF IS LAST, and these go before it: the brief ends with how to
+        // write the reply, and anything after it pushes that ending into the middle.
+        'YOUR IMMUTABLE BRIEF',
+        brief,
+    ].join('\n');
+}
 /**
  * What an agent that was stopped is started again with: the same brief, its own
  * notes, and what it already sent others to do.
@@ -559,7 +826,7 @@ export function retryPrompt(brief, report, children) {
  * something the agent is better placed to see." So it is named as a judgement
  * the agent makes, in one sentence, rather than a rule about when to ask.
  */
-export function answerPrompt(brief, report, children, question, answer) {
+export function answerPrompt(brief, report, children, question, answer, relatedArtifact = null) {
     return respawnPrompt([
         'YOU STOPPED BECAUSE YOU COULD NOT GO ON WITHOUT KNOWING SOMETHING. HERE IT IS.',
         'You are the same agent, started again, and everything you did before you asked is still there.',
@@ -569,6 +836,7 @@ export function answerPrompt(brief, report, children, question, answer) {
         '',
         'WHAT CAME BACK',
         answer,
+        ...presentedArtifactAnswerContext(relatedArtifact),
         '',
         'If this answers less than you asked, or turns out to change more than the piece you were sent',
         'to do, ask again rather than deciding it yourself. Carrying on from a guess about something this',