@ctrl-spc/cs 0.7.0 → 0.7.2

package/dist/panel3/run.js

@@ -8,7 +8,7 @@
  * `startPanel`'s own comment at the foot of this file carries the reasoning.
  *
  * ---------------------------------------------------------------------------
- * WHAT THIS IS. `cs3 say` puts a card and a user turn on the record and returns,
+ * WHAT THIS IS. `cs say` puts a card and a user turn on the record and returns,
  * because ux.md requires the acknowledgement never to wait for a spawn. This is
  * the other half: the loop that notices the turn, leases it, writes a run row,
  * starts a real agent, and puts what that agent said back on the card.
@@ -132,18 +132,21 @@
 // and takes the leading comment with it, so a file whose first statement is
 // `import type` loses its v3 header in the published `dist/`.
 import { out, returned, signedInClient } from './client.js';
-import { answerPrompt, escalationPrompt, levelOnePrompt, readBackPrompt, resumePrompt, retryPrompt, } from './prompt.js';
-import { attachmentLine, loadAttachments, loadOutputNames, outputOf } from './show.js';
+import { answerPrompt, escalationPrompt, levelOnePrompt, ownerActivationPrompt, readBackPrompt, landingOutcomeContext, presentedArtifactAnswerContext, resumePrompt, retryPrompt, standingRules, whatWasAttached, workingRules, } from './prompt.js';
+import { ASK_CONTENT_COLUMNS, attachmentLine, gitRulesFor, loadAttachments, loadOutputNames, outputOf, recordBaseProtection, standingRulesFor, withAskContent, } from './show.js';
 import { forgetSecrets, redactSecrets } from './secrets.js';
 import { sayListening, stopListening } from './presence.js';
-import { checkoutForCodebase, hasCheckoutForCodebase } from './checkout.js';
+import { designatedCoordinator } from './coordinator.js';
+import { baseBranchState, checkoutForCodebase, commitCardWork, detectBaseProtection, folderIsBranch, hasCheckoutForCodebase, mergeIntoBase, releaseBaseBranch, settleCardWorktree, worktreeForCard, worktreesOnThisMachine, } from './checkout.js';
 import { harness, startAgent } from './spawn.js';
+import { establishOwnerSession, listOwnerSessionIds, OWNER_SESSION_GRACE_MS, readOwnerSession, removeOwnerSession, validSessionUuid, writeOwnerSession, } from './session.js';
 import { startToolsServer } from './tools.js';
+import { listPanel3CodexOwnerHomeIds, removePanel3CodexOwnerHome, } from '../codex-home.js';
 import { getMachineIdentity, scratchDir } from '../config.js';
 import { listCodebases } from '../codebases.js';
-import { processIsAlive } from '../win-shell.js';
+import { killTree, processIsAlive } from '../win-shell.js';
 import { hostname, uptime } from 'node:os';
-const USAGE = 'usage: cs3 run [--once]';
+const USAGE = 'usage: run [--once]';
 /** How long between takes. Short, because it is the whole delay between a user
  *  sending and a card showing an agent on it, and the take is one small indexed
  *  read against the user's own rows. */
@@ -200,6 +203,84 @@ export const MAX_ATTEMPTS = 3;
  *  because an agent asked for it, and its level comes off the row
  *  `panel3_dispatch` wrote rather than from anything here. */
 const LEVEL = 1;
+const artifactAnswer = (id, revision, selected) => {
+    if (!id || revision === null || revision === undefined || selected?.length !== 1)
+        return null;
+    const answer = selected[0]?.trim().toLowerCase();
+    return answer === 'approve' || answer === 'request changes'
+        ? { id, revision, answer }
+        : null;
+};
+export function deliveredArtifactAnswer(events, delivered) {
+    if (!delivered.mine || delivered.ask_id === null)
+        return null;
+    const event = events.find((candidate) => candidate.kind === 'question' && candidate.id === delivered.ask_id);
+    const answer = artifactAnswer(event?.relatedArtifactId, event?.relatedArtifactRevision, event?.artifactAnswer ? [event.artifactAnswer] : null);
+    return answer === null ? null : { questionId: delivered.ask_id, ...answer };
+}
+async function rearmedArtifactAnswer(client, askId) {
+    const asks = await withAskContent(client, await returned(client.from('panel3_asks').select(`id, ${ASK_CONTENT_COLUMNS}`).eq('id', askId), 'read', `question ${askId}`));
+    const ask = asks[0];
+    return ask === undefined
+        ? null
+        : artifactAnswer(ask.related_artifact_id, ask.related_artifact_revision, ask.selected_options);
+}
+const LAND = 'Put this work on the main branch';
+const LEAVE = 'Leave it on its branch';
+export async function landingOffer(client, askId) {
+    const asks = await withAskContent(client, await returned(client.from('panel3_asks').select(`id, offers_landing, ${ASK_CONTENT_COLUMNS}`).eq('id', askId), 'read', `question ${askId}`));
+    const ask = asks[0];
+    if (ask === undefined || ask.offers_landing !== true)
+        return null;
+    const selected = ask.selected_options ?? [];
+    if (selected.length !== 1)
+        return 'unclear';
+    return selected[0] === LAND ? 'land' : selected[0] === LEAVE ? 'leave' : 'unclear';
+}
+/**
+ * ═══ THE PRODUCT PERFORMS THE LANDING, HERE, BEFORE THE AGENT THAT WILL SPEAK
+ *     ABOUT IT STARTS. ═══
+ *
+ * Not a tool, because a tool means an agent decides whether a yes takes effect,
+ * and an agent that finishes the card instead leaves a person who clicked yes
+ * with nothing. Not the poll's sweep, because the sweep cannot tell the agent
+ * what it did.
+ *
+ * ═══ AND A FAILURE DOES NOT END THE RUN. ═══ The agent has to be started to
+ * tell the person, so what happened is returned as the sentence it will be
+ * handed rather than written to `failed_because`.
+ */
+export function landCardWork(where, outcome) {
+    const card = where.card;
+    if (outcome !== 'land')
+        return { outcome, branch: card?.branch ?? null, base: card?.base ?? null };
+    if (card === null) {
+        return { outcome: 'refused', because: 'This card has no working copy on this machine, so there is nothing to put back.' };
+    }
+    if (card.landing !== 'main') {
+        return {
+            outcome: 'refused',
+            because: `Finished work in ${card.codebaseName} does not go onto ${card.base}, so nothing `
+                + 'was merged. The work is on its branch.',
+        };
+    }
+    try {
+        /* THE COMMIT FIRST, AND ITS ABSENCE IS NOT A FAILURE. Between the answer and
+           this re-arm every run on the card has ended, so the sweep may already have
+           committed the copy and taken it away; `workingDirectory` has just rebuilt
+           it from the branch, and the only difference is that there is nothing left
+           to commit. */
+        commitCardWork(card.folder, `${card.codebaseName}'s copy of this card on branch ${card.branch}`);
+        mergeIntoBase(card.source, card.branch, card.base, card.codebaseName);
+        return { outcome: 'landed', branch: card.branch, base: card.base };
+    }
+    catch (error) {
+        return {
+            outcome: 'refused',
+            because: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 /**
  * ═══ NOTHING IN THIS FILE STAMPS A COLUMN FROM THIS MACHINE'S CLOCK ANY MORE,
@@ -268,7 +349,7 @@ function byCard(taken) {
  * `levelOnePrompt` for the measured failure this closes.
  *
  * THE NAME IS RESOLVED, NOT READ OFF THE RECEIPT, through the one function
- * `cs3 show` uses for it. `label` is written when the thing is made and the
+ * `cs show` uses for it. `label` is written when the thing is made and the
  * coordinator may rename the thing on the next turn; printing the label then
  * hands the agent the name of a different, real object. One owner for that,
  * because two would eventually disagree about which name a card is showing.
@@ -320,6 +401,75 @@ export const briefFor = (title, turns, produced, attachments, codebases = null)
     identity: codebase.gitRemoteUrl,
     located: hasCheckoutForCodebase(codebase),
 })) ?? null);
+/**
+ * ═══ THE MANDATE IN FRONT OF THE PROMPT, AT EVERY ONE OF THE FIVE STARTS. ═══
+ *
+ * 19/project-context-7b, contract point 1: everything written under Agent
+ * instructions reaches every panel agent, at levels 1, 2 and 3, before it acts.
+ * Five call sites start a process (`answerCard`, `startChild`, `resumeRun`,
+ * `startRearmed`, `activateOwner`), and this is the one place the block and a
+ * prompt are put together, so the wording and the ordering cannot drift between
+ * them. The READ is `standingRulesFor` and the WORDS are `standingRules`; this
+ * is only the join.
+ *
+ * ═══ AND IT IS APPLIED TO WHAT `startAgent` IS HANDED, NEVER TO WHAT
+ *     `recordProcess` WRITES. ═══ Contract point 2 lives or dies on that
+ * distinction. `panel3_runs.brief` is the immutable brief and every respawn
+ * replays it, so a block folded into the stored brief would be a snapshot of the
+ * rules as they stood at dispatch, replayed on top of a fresh copy at every
+ * later start — two sets of rules in one prompt, the stale one first. Keeping it
+ * out means the stored brief is byte-identical with and without this feature,
+ * which is asserted rather than assumed.
+ *
+ * ═══ NO WRAPPER AROUND THE FIVE STARTS. ═══ `startAgent` is synchronous and the
+ * five sites have five different endings (see `run.ts`'s own note at the level 1
+ * start: `endRun` with a level fork at two of them, `giveUp` at two more). The
+ * READ therefore sits inside each site's existing `try`, taking that site's
+ * ending, so a failure to read the mandate ends the run the way that path
+ * already ends runs and never starts a process without it (contract point 3).
+ * What is shared is the loader and the builder — which is where drift would
+ * actually happen.
+ */
+// Exported for the same reason `briefFor` is: the seam this feature crosses is
+// the string handed to `startAgent`, and a test over `toolHandler('dispatch')`
+// would prove nothing about it — `caller.dispatch` is injected, so it stops
+// upstream of this composer.
+export const withStandingRules = (documents, prompt, 
+/* ═══ OPTIONAL, SO THE FOUR SITES WITH A CODEBASE GAIN IT AND NOTHING ELSE
+   MOVES. ═══ worktrees-8's three sentences about the card's own copy join
+   here rather than in the brief, for the same reason the rules do: the brief
+   is immutable and replayed, and the branch is not known when it is composed.
+   Under the rules, because a standing rule the people wrote outranks a fact
+   about the machine. */
+whereYouAre = [], 
+/* ═══ WHAT THE PERSON HAS ATTACHED, RIGHT NOW, FOR THE OWNER THAT LIVES FOR
+   THE WHOLE CARD. ═══ attaching-after-the-fact-10. Its own parameter rather
+   than folded into `whereYouAre`, which is worktrees-8's sentences about the
+   card's copy of the codebase: what is attached is not a fact about the
+   machine, and `where.block` is `[]` for a level 2 owner on a record-only
+   card, so folding in would produce a leading blank with no separator.
+
+   ═══ ABOVE THE RULES, BECAUSE THE RULES SAY IT OUTRANKS THEM. ═══
+   `standingRules`' own precedence line ranks what the person attached above
+   the rules; rendering it underneath would put it below a block saying it
+   wins. Already carries its own header and its own leading blank, which this
+   join absorbs the same way it absorbs `whereYouAre`'s. */
+whatIsAttached = []) => {
+    /* `whatWasAttached` begins its array with a blank, since its two other
+       callers join it onto lines already above it. Here it is the first thing in
+       the prompt, and a prompt that opens on an empty line is a prompt with a
+       stray blank at the top, so the leading blanks are dropped and the separator
+       below is this join's own. */
+    const attached = [...whatIsAttached];
+    while (attached[0] === '')
+        attached.shift();
+    const block = [
+        ...(attached.length === 0 ? [] : [...attached, '']),
+        ...standingRules(documents),
+        ...(whereYouAre.length === 0 ? [] : ['', ...whereYouAre]),
+    ];
+    return block.length === 0 ? prompt : [...block, '', prompt].join('\n');
+};
 // ---------------------------------------------------------------------------
 // WRITES. Every one goes through the shared guard in `client.ts`, which returns
 // the rows or throws. `.select()` on each is what makes that possible: a
@@ -344,12 +494,16 @@ export const briefFor = (title, turns, produced, attachments, codebases = null)
  * the run has no pid, so once this daemon is gone recovery treats it as dead —
  * which errs towards answering again rather than stranding.
  */
-async function recordProcess(client, runId, pid, brief) {
-    await returned(client
+async function recordProcess(client, runId, pid, brief, processToken) {
+    let query = client
         .from('panel3_runs')
         .update({ pid, ...(brief === undefined ? {} : { brief }) })
-        .eq('id', runId)
-        .select('id'), 'record what is running', `run ${runId}`);
+        .eq('id', runId);
+    if (processToken !== undefined)
+        query = query.eq('process_token', processToken);
+    const written = await returned(query.select('id'), 'record what is running', `run ${runId}`);
+    if (written.length === 0)
+        throw new Error(`could not record what is running for run ${runId}: its activation has ended`);
 }
 /**
  * ═══ A RUN GIVEN UP ON: ENDED, ITS TURNS HANDED BACK, ITS CARD IN HAND. ═══
@@ -364,15 +518,19 @@ async function recordProcess(client, runId, pid, brief) {
  * there first. It is a fact about the record rather than a failure, so it does
  * not go through `returned()`, exactly as the answer's own null does not.
  */
-async function giveUp(client, runId, reason) {
+async function giveUp(client, runId, reason, processToken) {
     const { data, error } = await client
-        .rpc('panel3_give_up', { p_run_id: runId, p_reason: reason });
+        .rpc('panel3_give_up', {
+        p_run_id: runId,
+        p_reason: reason,
+        ...(processToken === undefined ? {} : { p_process_token: processToken }),
+    });
     if (error)
         throw new Error(`could not give up run ${runId}: ${error.message}`);
     /* THE RUN IS OVER, so whatever it read is dropped. Every ending does this —
        here, `failRun` and `writeAnswer` — because a daemon stays up for days and
        has no business holding Tuesday's secret. */
-    forgetSecrets(runId);
+    forgetSecrets(processToken === undefined ? runId : `${runId}:${processToken}`);
     return data;
 }
 /**
@@ -411,7 +569,7 @@ async function giveUp(client, runId, reason) {
  * a run can be the last thing live on it — but no turn is written, exactly as
  * none is written for a run that stopped to ask.
  */
-async function writeAnswer(client, runId, cardId, text) {
+async function writeAnswer(client, runId, cardId, text, processToken) {
     /* ═══ THE SECOND OF THE TWO CHOKEPOINTS THE CREDENTIAL RULE RESTS ON. ═══
        This is the ONE path an agent's own words take to a hosted row — a turn on
        the card at levels 1 and 2, and a level 3's `panel3_runs.report`, which
@@ -419,7 +577,11 @@ async function writeAnswer(client, runId, cardId, text) {
        `buildServer`. Identity for a run that read no credential, so every existing
        exact-string assertion is byte-identical. */
     const { data: turnId, error } = await client
-        .rpc('panel3_answer', { p_run_id: runId, p_body: text === null ? null : redactSecrets(runId, text) });
+        .rpc('panel3_answer', {
+        p_run_id: runId,
+        p_body: text === null ? null : redactSecrets(processToken === undefined ? runId : `${runId}:${processToken}`, text),
+        ...(processToken === undefined ? {} : { p_process_token: processToken }),
+    });
     if (error) {
         /* Thrown, not settled as failed. The run stays `running` with a process
            that has now exited, so recovery reaps it: at level 1 the turns are
@@ -433,7 +595,7 @@ async function writeAnswer(client, runId, cardId, text) {
        credential again through `get_credential`. What it is handed to start from —
        its own report, and the card — went through this same substitution, so there
        is nothing left for a stale entry to protect. */
-    forgetSecrets(runId);
+    forgetSecrets(processToken === undefined ? runId : `${runId}:${processToken}`);
     if (turnId === null) {
         /* NO TURN WAS WRITTEN, and there are FOUR reasons, which mean different
            things and must not be printed as one line.
@@ -469,6 +631,9 @@ async function writeAnswer(client, runId, cardId, text) {
         else if (run.state !== 'finished') {
             said(`run ${runId} was ${run.state}, so its answer was not written to card ${cardId}`);
         }
+        else if (run.level === 1 && run.conversationOwnerId !== null) {
+            out(`settled  card ${cardId}  run ${runId}  assigned the conversation, so it wrote nothing here`);
+        }
         else if (text === null) {
             out(`settled  card ${cardId}  run ${runId}  answered a question, so it wrote nothing here`);
         }
@@ -481,16 +646,32 @@ async function writeAnswer(client, runId, cardId, text) {
                away. */
             said(`run ${runId} had already ended, so its answer was not written to card ${cardId}`);
         }
-        return;
+        return ownerSettlementAccepted(run, processToken);
     }
     out(`answered card ${cardId}  run ${runId}  ${text?.length ?? 0} characters`);
+    return true;
+}
+export function ownerSettlementAccepted(run, processToken) {
+    return (run.state === 'asked' || run.state === 'finished')
+        && (processToken === undefined || run.processToken === processToken);
 }
 /** What the record says a run is now, and at what level. Read only to say the
  *  right sentence about something that has already happened; nothing branches on
  *  it that could have gone the other way. */
 async function runNow(client, runId) {
-    const runs = await returned(client.from('panel3_runs').select('state, level').eq('id', runId), 'read', `the state of run ${runId}`);
-    return runs[0] ?? { state: 'no longer on the record', level: null };
+    const runs = await returned(client
+        .from('panel3_runs')
+        .select('state, level, process_token, card:panel3_cards!panel3_runs_card_id_fkey(conversation_run_id)')
+        .eq('id', runId), 'read', `the state of run ${runId}`);
+    const run = runs[0];
+    return run
+        ? {
+            state: run.state,
+            level: run.level,
+            conversationOwnerId: run.card?.conversation_run_id ?? null,
+            processToken: run.process_token,
+        }
+        : { state: 'no longer on the record', level: null, conversationOwnerId: null, processToken: null };
 }
 /**
  * A run whose process failed, ended with the reason ON ITS OWN COLUMN, and its
@@ -499,7 +680,7 @@ async function runNow(client, runId) {
  * ═══ NEVER INTO `report`, WHICH IS THE RUN'S OWN WORDS. ═══ `report` is what a
  * respawn is handed, and this build starts settled runs again — an answered
  * question does exactly that — so a reason written there would destroy the state
- * the next attempt was going to resume from, and `cs3 show` would print the
+ * the next attempt was going to resume from, and `cs show` would print the
  * daemon's sentence under a heading that says the run wrote it. One owner per
  * column: the run writes `report`, whoever ended it writes `failed_because`.
  *
@@ -560,7 +741,7 @@ async function setCardState(client, cardId, state) {
  * ═══ THERE IS NOTHING TO UNDO HERE, AND THAT IS THE POINT. ═══ The take wrote
  * the run row in the same statement that leased the turns, so this function is
  * never in the position of holding a lease it cannot honour: whatever it fails
- * at, the row exists, `cs3 show` can see it, and recovery can reach it. The
+ * at, the row exists, `cs show` can see it, and recovery can reach it. The
  * earlier version wrote the row two round trips later and had to hand the turns
  * back on failure — which covered a thrown error and not a kill, and a kill in
  * that window stranded the card forever.
@@ -583,7 +764,43 @@ async function answerCard(client, tools, machineId, cardId, turns) {
        attachments read carries the same rule: a failed read here must not read
        as "nothing is attached", which is a different card than the one that was
        actually sent. */
-    const brief = briefFor(turns[0].card_title, turns, await receiptsFor(client, cardId), await attachmentsFor(client, cardId), await codebasesForRun(client, runId));
+    /* ═══ AND A FAILURE HERE ENDS THE RUN, RATHER THAN LEAVING IT RUNNING WITH NO
+       PROCESS. ═══ The take already wrote the run row in the statement that leased
+       the turns, so a throw between here and `startAgent` leaves a run reading
+       `running` with a null pid and nothing on stderr the person can see.
+       `recoverStranded` then reads that as a machine that went away, hands the
+       message back, and `panel3_take_turns` leases it to A BRAND NEW RUN whose
+       attempts start again at one — so a permanent failure, such as a read this
+       build cannot make against the current schema, repeats forever while the card
+       says Working and never says why. This is the sixth of `endRun`'s endings and
+       the last one that was missing: `resumeRun` and `startRearmed` already end
+       their two post-claim failures this way for exactly this reason.
+       THE REASON IS SHAREABLE. All three reads are `returned()` calls against the
+       database, whose messages name tables and columns and never a local path, so
+       constraint 6 is satisfied without a level fork here. */
+    let brief;
+    /* WHERE IT RUNS AND WHAT IT IS TOLD ABOUT THE CODEBASES, THROUGH THE SAME
+       SEAM AS EVERY OTHER SPAWN. A level 1 run works in an empty directory of the
+       user's own, and it is the fifth start site rather than a special case: the
+       generated git block reaches every level, and one place resolving it is what
+       makes that true without four copies of the read. */
+    let where;
+    /* THE MANDATE IS READ IN THE SAME WINDOW AND UNDER THE SAME RULE. A launcher
+       is an agent like any other and gets the project's standing rules before it
+       decides anything, and a read that fails must not read as "this project has
+       no rules" — that is a different project than the one the person is on. So it
+       joins the three reads above inside this ending rather than beside it. */
+    let rules;
+    try {
+        brief = briefFor(turns[0].card_title, turns, await receiptsFor(client, cardId), await attachmentsFor(client, cardId), await codebasesForRun(client, runId));
+        rules = await standingRulesFor(client, runId);
+        where = await workingDirectory(client, runId, LEVEL, false);
+    }
+    catch (error) {
+        const why = error instanceof Error ? error.message : String(error);
+        await endRun(client, LEVEL, runId, cardId, why);
+        throw new Error(`NO AGENT IS RUNNING: ${why}`);
+    }
     /* ═══ THE RUN ID IS ON THE URL, AND THAT IS THE WHOLE OF WHAT THE AGENT IS
        TOLD ABOUT ITS OWN STANDING. ═══ The tools server reads the level off the
        run row this id names, so the daemon does not tell the child what it may do
@@ -593,9 +810,12 @@ async function answerCard(client, tools, machineId, cardId, turns) {
     /* AN EMPTY DIRECTORY OF THE USER'S OWN, because level 1 has no code tool to
        use a real one with, and the daemon's inherited cwd under a launchd login
        item is the filesystem root. */
-    const started = startAgent(brief, LEVEL, tools.urlFor(runId), scratchDir());
+    const started = startAgent(withStandingRules(rules, brief, where.block), LEVEL, tools.urlFor(runId), where.cwd);
     out(`run      ${runId}  level ${LEVEL}  ${started.pid ? `pid ${started.pid}` : 'no process'}`);
     try {
+        /* THE BRIEF, NOT WHAT THE PROCESS WAS HANDED. The rules are current at the
+           activation and the brief is immutable, so storing the composed string
+           would freeze one inside the other and every respawn would replay it. */
         await recordProcess(client, runId, started.pid, brief);
     }
     catch (error) {
@@ -603,7 +823,7 @@ async function answerCard(client, tools, machineId, cardId, turns) {
         // agent is not killed over it.
         said(`${error instanceof Error ? error.message : String(error)} (the run is still going)`);
     }
-    return settle(client, tools, machineId, LEVEL, runId, cardId, started);
+    return settle(client, tools, machineId, LEVEL, runId, cardId, started, false);
 }
 /**
  * WHICH PROJECT A RUN'S CARD IS FILED UNDER, or null when the card has none.
@@ -620,7 +840,7 @@ async function answerCard(client, tools, machineId, cardId, turns) {
  * project's code.
  */
 async function projectOfRun(client, runId) {
-    const rows = await returned(client.from('panel3_runs').select('card:panel3_cards(project_id)').eq('id', runId), 'read', 'which project this run belongs to');
+    const rows = await returned(client.from('panel3_runs').select('card:panel3_cards!panel3_runs_card_id_fkey(project_id)').eq('id', runId), 'read', 'which project this run belongs to');
     return rows[0]?.card?.project_id ?? null;
 }
 async function codebasesForRun(client, runId) {
@@ -630,7 +850,7 @@ async function codebasesForRun(client, runId) {
 async function codebaseOfRun(client, runId) {
     const rows = await returned(client
         .from('panel3_runs')
-        .select('codebase_id, card:panel3_cards(project_id)')
+        .select('codebase_id, card:panel3_cards!panel3_runs_card_id_fkey(project_id)')
         .eq('id', runId), 'read', `which codebase run ${runId} belongs to`);
     const row = rows[0];
     if (!row?.codebase_id || !row.card?.project_id) {
@@ -643,6 +863,179 @@ async function codebaseOfRun(client, runId) {
     }
     return codebase;
 }
+/**
+ * ═══ THE CARD'S OWN COPY, AND THE BRANCH IT IS ON, STAMPED BEFORE IT IS USED.
+ *     ═══
+ *
+ * The card is the unit of isolation, so the branch is derived from the card and
+ * every run on that card resolves to the same one. A run that finds a branch
+ * already stamped by a sibling takes it rather than deriving again: the
+ * derivation is pure today and stops being pure the moment the pattern becomes
+ * a setting, and one card on two branches is the defect this whole slice exists
+ * to prevent.
+ *
+ * ═══ THE STAMP IS WRITTEN HERE, WHERE ITS FAILURE CAN STOP THE RUN. ═══ Not in
+ * `recordProcess`, whose failure is deliberately non-fatal at all five sites: a
+ * stamp allowed to silently not happen cannot carry "a resumed run returns to
+ * the same copy". This is before `startAgent`, so a failure to write it is a run
+ * that never started rather than a run whose copy nobody can find again.
+ */
+async function cardWorktree(client, runId, codebase) {
+    const rows = await returned(client.from('panel3_runs')
+        .select('card_id, branch, base, card:panel3_cards!panel3_runs_card_id_fkey(title)')
+        .eq('id', runId), 'read', `which card and branch run ${runId} is on`);
+    const row = rows[0];
+    if (!row)
+        throw new Error(`run ${runId} is not on the record any more`);
+    /* THE CARD'S OWN ANSWER FIRST, from whichever of its runs has one. Asked only
+       when this run has none of its own, so a resumed run costs one read. The
+       BASE travels with the branch, in one row and one read: they were written
+       together and a card cut from `develop` may not be told later that it goes
+       back to `main` because a teammate changed the setting. */
+    const sibling = row.branch !== null ? null : (await returned(client.from('panel3_runs')
+        .select('branch, base')
+        .eq('card_id', row.card_id)
+        .not('branch', 'is', null)
+        .limit(1), 'read', `the branch card ${row.card_id} is working on`))[0] ?? null;
+    const stamped = {
+        branch: row.branch ?? sibling?.branch ?? null,
+        base: row.base ?? sibling?.base ?? null,
+    };
+    /* ═══ THE TEAM'S RULES, READ AT THE START AND NOT CARRIED. ═══ Same argument
+       as the standing rules beside them: a rule edited while a conversation is
+       running has to govern the rest of it, and the only way that is true is if
+       the read happens here rather than once, at dispatch. */
+    /* THE PROJECT COMES OFF THE RUN'S OWN CARD, which is where the codebase came
+       from too: the rules are the organization's, and the organization is reached
+       through the project rather than through the codebase row, which `panel3/`
+       may not name. */
+    const projectId = await projectOfRun(client, runId);
+    if (!projectId) {
+        /* UNREACHABLE THROUGH `codebaseOfRun`, WHICH REFUSES A RUN WITH NO PROJECT,
+           and said out loud rather than papered over with an empty id: the rules are
+           the organization's, and there is no organization without a project. */
+        throw new Error('This code work is not filed under a project, so its codebase has no rules.');
+    }
+    const rules = await gitRulesFor(client, codebase.id, projectId);
+    const { folder, branch, base, source } = worktreeForCard(codebase, row.card_id, row.card?.title ?? '', stamped, hostname(), { baseBranch: rules.base_branch, branchPattern: rules.branchPattern });
+    if (row.branch !== branch || row.base !== base) {
+        await returned(client.from('panel3_runs').update({ branch, base }).eq('id', runId).select('id'), 'record which branch this run is on', `run ${runId}`);
+    }
+    await refreshBaseProtection(client, codebase, rules, source, base);
+    return {
+        cwd: folder,
+        block: workingRules({
+            codebase: codebase.name,
+            branch,
+            base,
+            landing: rules.landing,
+            branchPattern: rules.branchPattern,
+        }),
+        /* ═══ HANDED BACK RATHER THAN DISCARDED. ═══ The landing needs the folder,
+           the branch, the base and the repository the copy was made from, all of
+           which have just been resolved here. Resolving them again at the ending
+           would be a second answer to one question, free to disagree with this one. */
+        card: { folder, branch, base, source, landing: rules.landing, codebaseName: codebase.name },
+    };
+}
+/**
+ * ═══ WHETHER THE BASE BRANCH IS PROTECTED, ASKED WHILE THIS MACHINE IS ALREADY
+ *     HOLDING THE REPOSITORY OPEN. ═══
+ *
+ * The browser cannot answer it and the product stores no platform credential, so
+ * the machine with the checkout answers it through the developer's own `gh`.
+ * Asked only when the record has no answer, so a codebase whose protection is
+ * known costs nothing, and never turned into a SETTING: it is an observation
+ * that feeds the detected default, and `landing` stays null until a person
+ * chooses.
+ *
+ * ═══ SAID, NEVER FATAL. ═══ This is a fact about the remote, not about the
+ * work. A card that could not record an observation still runs.
+ */
+async function refreshBaseProtection(client, codebase, rules, source, base) {
+    if (rules.base_protected !== null)
+        return;
+    try {
+        const observed = detectBaseProtection(source, base);
+        if (observed !== null)
+            await recordBaseProtection(client, codebase.id, observed);
+    }
+    catch (error) {
+        said(`could not check whether ${base} is protected: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+/**
+ * ═══ WHAT THE COORDINATOR IS TOLD ABOUT EACH CODEBASE IT MAY SEND WORK TO. ═══
+ *
+ * Story 6 scenario 4: levels 1, 2 and 3 each receive the block verbatim. A level
+ * 1 run has no codebase of its own by design, and the block is codebase-scoped,
+ * so at level 1 it is rendered once PER REGISTERED CODEBASE. That is the same
+ * text rather than a summary of it, and it is what stops a coordinator writing a
+ * brief that contradicts the rules the worker it dispatches will be handed.
+ *
+ * ═══ AND IT CARRIES THE ONE QUESTION ONLY THE COORDINATOR CAN ASK. ═══ Story 3
+ * scenario 3: a codebase whose base branch is genuinely ambiguous has to be
+ * settled by a person, once, and the daemon cannot ask anybody. The coordinator
+ * can, it holds `ask_question` already, and it needs the fact BEFORE it
+ * dispatches. So the fact and the options arrive here, at the activation, beside
+ * the block.
+ *
+ * ═══ NOT THROUGH `briefFor`. ═══ That output is `panel3_runs.brief`, which is
+ * immutable and replayed at every respawn, so a coordinator resumed a week later
+ * would be told to ask about a branch somebody settled on Tuesday.
+ */
+async function coordinatorGitBlock(client, runId) {
+    const projectId = await projectOfRun(client, runId);
+    /* A CARD FILED UNDER NO PROJECT HAS NO CODEBASES AND NO RULES, which is a
+       fact rather than a failure: level 1 answers plenty of cards that never touch
+       code. */
+    if (!projectId)
+        return [];
+    const codebases = await listCodebases(client, projectId);
+    if (codebases.length === 0)
+        return [];
+    const blocks = [];
+    for (const codebase of codebases) {
+        const rules = await gitRulesFor(client, codebase.id, projectId);
+        /* A CODEBASE THIS MACHINE HAS NOT LOCATED ANSWERS NEITHER WAY, and is left
+           out rather than guessed at: `briefFor` already tells the coordinator which
+           codebases are located here, and inventing rules for one nobody can see
+           would be a block about a repository this run cannot reach. */
+        const state = baseBranchState(codebase, rules.base_branch);
+        if (state === null)
+            continue;
+        blocks.push([
+            ...workingRules({
+                codebase: codebase.name,
+                branch: null,
+                base: 'settled' in state ? state.settled : null,
+                landing: rules.landing,
+                branchPattern: rules.branchPattern,
+            }),
+            ...('candidates' in state ? [
+                `Nobody has said which branch finished work in ${codebase.name} should go back to, and this`,
+                'machine cannot tell. Before you send anybody into it, ask the person with `ask_question`,',
+                'once, offering these as the options and using no git word except "branch":',
+                state.candidates.join(', '),
+                `Then record their answer with \`set_main_branch\` for codebase id ${codebase.id}. It is`,
+                'stored on the codebase, so nobody is asked again.',
+            ] : []),
+        ]);
+    }
+    return blocks.flatMap((block, index) => (index === 0 ? block : ['', ...block]));
+}
+/** One directory rule for every spawn whose level and ownership are known. */
+async function workingDirectory(client, runId, level, isOwner, knownCodebase) {
+    if (level === 1) {
+        return { cwd: scratchDir(), block: await coordinatorGitBlock(client, runId), card: null };
+    }
+    if (knownCodebase === null) {
+        if (level === 2 && isOwner)
+            return { cwd: scratchDir(), block: [], card: null };
+        throw new Error('This code work does not name a registered project codebase.');
+    }
+    return cardWorktree(client, runId, knownCodebase ?? await codebaseOfRun(client, runId));
+}
 /**
  * ═══ ONE AGENT, STARTED UNDER ANOTHER THAT IS STILL RUNNING. ═══
  *
@@ -658,13 +1051,14 @@ async function codebaseOfRun(client, runId) {
  * Then the row, then the process, then the pid — constraint 8, in the only order
  * that satisfies it.
  */
-async function startChild(client, tools, machineId, parentRunId, brief, codebase) {
+async function startChild(client, tools, machineId, parentRunId, brief, codebase, parentProcessToken) {
     const { data, error } = await client.rpc('panel3_dispatch', {
         p_parent_run_id: parentRunId,
         p_brief: brief,
         p_machine_id: machineId,
-        p_codebase_id: codebase.id,
-        p_codebase_label: codebase.name,
+        p_codebase_id: codebase?.id ?? null,
+        p_codebase_label: codebase?.name ?? null,
+        ...(parentProcessToken === undefined ? {} : { p_process_token: parentProcessToken }),
     });
     if (error)
         throw new Error(`could not start an agent under run ${parentRunId}: ${error.message}`);
@@ -673,8 +1067,8 @@ async function startChild(client, tools, machineId, parentRunId, brief, codebase
         /* NOTHING WAS WRITTEN AND NOTHING IS RUNNING, and the two reasons are said
            together because the caller cannot tell them apart from here and both mean
            the same thing to it. */
-        throw new Error(`NO AGENT WAS STARTED and nothing was written: run ${parentRunId} has ended, or it is already `
-            + 'as deep as anything may be sent from.');
+        throw new Error(`NO AGENT WAS STARTED and nothing was written: run ${parentRunId} has ended, is already as `
+            + 'deep as anything may be sent from, or this conversation already has its owner. Exit now.');
     }
     if (row.run_level !== 2 && row.run_level !== 3) {
         /* UNREACHABLE, AND STILL SETTLED. `panel3_dispatch` writes `parent.level + 1`
@@ -684,20 +1078,31 @@ async function startChild(client, tools, machineId, parentRunId, brief, codebase
            recovery sweep wait out the pid grace window to conclude what is already
            known. */
         const why = `run ${row.run_id} was written at level ${row.run_level}, which cannot be spawned`;
-        await giveUp(client, row.run_id, why);
+        await giveUp(client, row.run_id, why, row.process_token ?? undefined);
         throw new Error(why);
     }
     const level = row.run_level;
-    let cwd;
+    let where;
+    let prompt;
+    /* READ AGAINST THE CHILD'S OWN RUN ROW, NOT THE PARENT'S. The row already
+       exists (`panel3_dispatch` wrote it above) and it carries this child's
+       codebase, which is what decides which codebase-scoped rules it is under. */
+    let rules;
     try {
-        cwd = checkoutForCodebase(codebase, hostname());
+        where = await workingDirectory(client, row.run_id, level, level === 2, codebase);
+        prompt = level === 2
+            ? await initialOwnerPrompt(client, row.run_card_id, parentRunId, brief)
+            : brief;
+        rules = await standingRulesFor(client, row.run_id);
     }
     catch (error) {
         const why = error instanceof Error ? error.message : String(error);
-        await giveUp(client, row.run_id, why);
+        await giveUp(client, row.run_id, why, row.process_token ?? undefined);
         throw new Error(`NO AGENT IS RUNNING: ${why}`);
     }
-    const started = startAgent(brief, level, tools.urlFor(row.run_id), cwd);
+    const processToken = row.process_token ?? undefined;
+    const isOwner = level === 2;
+    const started = startAgent(withStandingRules(rules, prompt, where.block), level, tools.urlFor(row.run_id, processToken), where.cwd, isOwner ? { ownerId: row.run_id } : undefined);
     if (started.pid === null) {
         /* THERE IS A ROW AND THERE IS NO PROCESS, which is the one shape the record
            must never be left in quietly. The answer is already settled — nothing ran
@@ -705,12 +1110,12 @@ async function startChild(client, tools, machineId, parentRunId, brief, codebase
            and the tool call fails saying no agent was started. */
         const answer = await started.answered;
         const reason = answer.ok ? 'the process ended before it could be identified' : answer.reason;
-        await giveUp(client, row.run_id, reason);
+        await giveUp(client, row.run_id, reason, processToken);
         throw new Error(`NO AGENT IS RUNNING: ${reason}`);
     }
     out(`dispatch run ${row.run_id}  level ${level}  under ${parentRunId}  pid ${started.pid}`);
     try {
-        await recordProcess(client, row.run_id, started.pid);
+        await recordProcess(client, row.run_id, started.pid, undefined, processToken);
     }
     catch (error) {
         // Said, not fatal, exactly as at level 1: the agent is running and killing
@@ -719,7 +1124,9 @@ async function startChild(client, tools, machineId, parentRunId, brief, codebase
     }
     return {
         runId: row.run_id,
-        settled: settle(client, tools, machineId, level, row.run_id, row.run_card_id, started),
+        settled: settle(client, tools, machineId, level, row.run_id, row.run_card_id, started, true, processToken, isOwner && processToken
+            ? ownerSessionLifecycle(started, row.run_id, harness(), processToken)
+            : undefined),
     };
 }
 /**
@@ -763,11 +1170,13 @@ async function attemptsSoFar(client, runId) {
  * ends through `panel3_end_run`, which hands no turns back, and the card says
  * failed.
  *
- * ═══ AND THE FORK LIVES HERE AND NOWHERE ELSE. ═══ FIVE places end a run this
- * way: the settle, and the two failures after the claim in each of `resumeRun`
- * and `startRearmed`. A copy of this rule in each is five places for it to
- * drift, and it drifted the first time it could: those two functions hold the
- * same pair of endings and only one pair was looked at.
+ * ═══ AND THE FORK LIVES HERE AND NOWHERE ELSE. ═══ SIX places end a run this
+ * way: the settle, the two failures after the claim in each of `resumeRun` and
+ * `startRearmed`, and the pre-spawn failure in `answerCard`. A copy of this rule
+ * in each is six places for it to drift, and it drifted the first time it could:
+ * those two functions hold the same pair of endings and only one pair was looked
+ * at. `answerCard`'s was missing outright, which is how a build that could not
+ * read a card's project turned every take into a silent take/recover loop.
  *
  * ALL FIVE CAN SEE LEVEL 1. `resumeRun` serving the retry is what opened its
  * two. `startRearmed`'s were always reachable, because a re-arm has always
@@ -834,7 +1243,44 @@ async function endRun(client, level, runId, cardId, why) {
  * cannot end the same way. What `answerCard` always did is what level 1 still
  * does, and the only thing that has moved is where it is written.
  */
-function settle(client, tools, machineId, level, runId, cardId, started, speaksToTheCard = true) {
+function ownerSessionLifecycle(started, ownerId, ownerHarness, processToken, expectedSessionId) {
+    const pending = started.session.then((nativeSessionId) => {
+        if (nativeSessionId === null)
+            return false;
+        if (expectedSessionId && nativeSessionId !== expectedSessionId) {
+            said(`the resumed harness returned a different conversation for owner ${ownerId}; it will not be reused`);
+            return false;
+        }
+        try {
+            writeOwnerSession({
+                ownerId,
+                harness: ownerHarness,
+                nativeSessionId,
+                processToken,
+                state: 'pending',
+            });
+            return true;
+        }
+        catch (error) {
+            said(`could not save the local conversation for owner ${ownerId}: ${error instanceof Error ? error.message : String(error)}`);
+            return false;
+        }
+    });
+    // Start observing immediately; Codex reports thread.started before its answer.
+    void pending;
+    return {
+        established: async () => {
+            if (await pending)
+                establishOwnerSession(ownerId, processToken);
+        },
+        failed: async () => {
+            // A failed or rejected generation stays pending and therefore cannot be
+            // resumed. Reconciliation is the sole owner of stable-state deletion.
+            await pending;
+        },
+    };
+}
+function settle(client, tools, machineId, level, runId, cardId, started, speaksToTheCard = true, processToken, ownerSession) {
     return started.answered.then(async (answer) => {
         /* ═══ A RUN THAT STOPPED TO ASK DID NOT DIE, WHATEVER THE HARNESS PRINTED
            ON ITS WAY OUT. ═══
@@ -860,11 +1306,27 @@ function settle(client, tools, machineId, level, runId, cardId, started, speaksT
            into an ordinary ending, and then handed to `writeAnswer` — which already
            owns this case and already prints its sentence — rather than to a second
            ending written here beside it. */
-        if (!answer.ok && (await runNow(client, runId)).state === 'asked') {
-            await writeAnswer(client, runId, cardId, null);
-            return;
+        if (!answer.ok) {
+            const run = await runNow(client, runId);
+            if (run.state === 'asked') {
+                const accepted = await writeAnswer(client, runId, cardId, null, processToken);
+                if (accepted)
+                    await ownerSession?.established();
+                else
+                    await ownerSession?.failed();
+                return;
+            }
+            /* Level 1's only successful result is the owner pointer written by
+               dispatch. Its stdout is deliberately hidden, and Codex may therefore
+               exit cleanly without an agent message after the tool succeeds. The
+               record, not prose the launcher was told not to write, decides success. */
+            if (level === 1 && run.conversationOwnerId !== null) {
+                await writeAnswer(client, runId, cardId, null, processToken);
+                return;
+            }
         }
         if (!answer.ok) {
+            await ownerSession?.failed();
             /* ═══ A PROCESS THAT STARTED AND THEN DIED BADLY IS STARTED AGAIN. ═══
                recovery-1/ux.md, Slice 3: "the agent's harness fails on something that
                is nobody's fault: a rate limit, a dropped connection, a provider
@@ -904,7 +1366,9 @@ function settle(client, tools, machineId, level, runId, cardId, started, speaksT
             const attempts = await attemptsSoFar(client, runId);
             if (started.pid !== null && attempts < MAX_ATTEMPTS) {
                 out(`retry    run ${runId}  attempt ${attempts} of ${MAX_ATTEMPTS} died: ${answer.reason}`);
-                const again = await resumeRun(client, tools, machineId, runId, started.pid);
+                const again = processToken === undefined
+                    ? await resumeRun(client, tools, machineId, runId, started.pid)
+                    : await activateOwner(client, tools, machineId, runId, processToken, started.pid);
                 if (again)
                     return again.settled;
                 /* ═══ THE CLAIM MATCHED NOTHING, AND THAT IS NOT ALWAYS SOMEBODY ELSE
@@ -937,7 +1401,9 @@ function settle(client, tools, machineId, level, runId, cardId, started, speaksT
                both already read, so the count reaches a person from one place rather
                than two. */
             const why = attempts > 1 ? `${answer.reason} (after ${attempts} attempts)` : answer.reason;
-            const ended = await endRun(client, level, runId, cardId, why);
+            const ended = processToken === undefined
+                ? await endRun(client, level, runId, cardId, why)
+                : (await giveUp(client, runId, why, processToken)) !== null;
             if (!ended) {
                 /* IT WAS ALREADY SETTLED, by recovery, which decided this process was
                    gone before it said so itself, or by the person's Stop. Nothing was
@@ -954,7 +1420,11 @@ function settle(client, tools, machineId, level, runId, cardId, started, speaksT
         /* ═══ ITS OWN WORDS, ONTO THE CARD, THROUGH THE SAME STATEMENT EVERY LEVEL
            USES. ═══ Nothing reads them, nothing shortens them and nothing waits to
            approve them: ux.md's "whoever did the work writes the answer". */
-        await writeAnswer(client, runId, cardId, speaksToTheCard ? answer.text : null);
+        const accepted = await writeAnswer(client, runId, cardId, speaksToTheCard ? answer.text : null, processToken);
+        if (accepted)
+            await ownerSession?.established();
+        else
+            await ownerSession?.failed();
     });
 }
 /**
@@ -1014,14 +1484,20 @@ function settle(client, tools, machineId, level, runId, cardId, started, speaksT
  * about the failure it was holding.
  */
 async function resumeRun(client, tools, machineId, runId, afterPid) {
-    /* ═══ THE SWEEP RESOLVES ITS WORKING COPY BEFORE THE CLAIM AND THE RETRY
-       CANNOT, AND `afterPid` IS THE WHOLE OF WHAT DECIDES IT. ═══ Said once, here.
-       See the header for both halves of the argument: a machine with no checkout
-       must not take a run it cannot start, and the level a retry needs the answer
-       for is not known until the claim returns. */
-    const sweptCwd = afterPid === null
-        ? checkoutForCodebase(await codebaseOfRun(client, runId), hostname())
-        : null;
+    /* ═══ THE SWEEP CHECKS BEFORE THE CLAIM AND THE RETRY CANNOT, AND `afterPid`
+       IS THE WHOLE OF WHAT DECIDES IT. ═══ Said once, here. See the header for
+       both halves of the argument: a machine with no checkout must not take a run
+       it cannot start, and the level a retry needs the answer for is not known
+       until the claim returns.
+  
+       ═══ IT IS THE EXISTENCE CHECK AND NOTHING MORE, WHICH IS WHAT CHANGED IN
+       worktrees-8. ═══ Resolving the working copy now CREATES a branch, a folder
+       and a row write, and every poll tick that loses the claim race would leave
+       that debris behind for a run it never took. So the pre-claim question stays
+       "does this machine have this codebase at all", which is the only question
+       this position was ever asking, and the copy is made after the claim. */
+    if (afterPid === null)
+        checkoutForCodebase(await codebaseOfRun(client, runId), hostname());
     const { data, error } = await client.rpc('panel3_resume', {
         p_run_id: runId,
         p_machine_id: machineId,
@@ -1042,41 +1518,34 @@ async function resumeRun(client, tools, machineId, runId, afterPid) {
         await giveUp(client, runId, why);
         throw new Error(why);
     }
-    /* NON-NULL EXACTLY WHEN THE SWEEP RESOLVED ONE, which is the rule stated at
-       the assignment above. Branching on the VALUE rather than testing `afterPid`
-       a second time is what keeps the resolution and its use from being able to
-       disagree: whatever the sweep resolved is what the sweep runs in. */
-    let cwd;
-    if (sweptCwd !== null) {
-        cwd = sweptCwd;
+    /* ONE RESOLUTION FOR BOTH PATHS, AFTER THE CLAIM. It used to fork on whether
+       the sweep had already resolved a folder before the claim; since the copy is
+       the card's own and making it writes, both paths make it here, in the branch
+       that can end the run when it cannot be made. */
+    let where;
+    try {
+        where = await workingDirectory(client, runId, level, false);
     }
-    else {
-        try {
-            cwd = level === 1
-                ? scratchDir()
-                : checkoutForCodebase(await codebaseOfRun(client, runId), hostname());
-        }
-        catch (error) {
-            /* ═══ THE REASON IS WRITTEN TO THE DATABASE, SO IT MAY NOT CARRY A PATH.
-               ═══ Constraint 6, and `startRearmed`'s own handling of the same two
-               calls: `workingCopy()` is already careful about this and says so;
-               `scratchDir()` is not, because it is `mkdirSync`, whose EACCES and
-               ENOTDIR messages name the directory they failed on. So the machine's own
-               error is kept for stderr and the record is told only what is true and
-               shareable. */
-            const stderrOnly = error instanceof Error ? error.message : String(error);
-            const why = level === 1
-                ? 'this machine could not make the empty directory this runs in'
-                : stderrOnly;
-            /* ═══ AND IT ENDS THE WAY A RUN OF THIS LEVEL ENDS. ═══ It was
-               `panel3_give_up` outright, which was right while only a dispatched run
-               could reach this function and is a leak now that the retry brings level
-               1 here: handing the person's message back mints a new run with its
-               attempts at one, which is the bound the retry is under, undone by the
-               one path that could not start. See `endRun`. */
-            await endRun(client, level, runId, claimed.run_card_id, why);
-            throw new Error(`NO AGENT IS RUNNING: ${level === 1 ? stderrOnly : why}`);
-        }
+    catch (error) {
+        /* ═══ THE REASON IS WRITTEN TO THE DATABASE, SO IT MAY NOT CARRY A PATH.
+           ═══ Constraint 6, and `startRearmed`'s own handling of the same two
+           calls: `worktreeForCard()` is already careful about this and says so;
+           `scratchDir()` is not, because it is `mkdirSync`, whose EACCES and
+           ENOTDIR messages name the directory they failed on. So the machine's own
+           error is kept for stderr and the record is told only what is true and
+           shareable. */
+        const stderrOnly = error instanceof Error ? error.message : String(error);
+        const why = level === 1
+            ? 'this machine could not make the empty directory this runs in'
+            : stderrOnly;
+        /* ═══ AND IT ENDS THE WAY A RUN OF THIS LEVEL ENDS. ═══ It was
+           `panel3_give_up` outright, which was right while only a dispatched run
+           could reach this function and is a leak now that the retry brings level
+           1 here: handing the person's message back mints a new run with its
+           attempts at one, which is the bound the retry is under, undone by the
+           one path that could not start. See `endRun`. */
+        await endRun(client, level, runId, claimed.run_card_id, why);
+        throw new Error(`NO AGENT IS RUNNING: ${level === 1 ? stderrOnly : why}`);
     }
     /* WHAT IT SENT OTHERS TO DO, FROM THE RECORD. Level 3 has no `dispatch`, so it
        has no children to have: null says that, where an empty list would say it
@@ -1089,14 +1558,36 @@ async function resumeRun(client, tools, machineId, runId, afterPid) {
        time: ux.md's single most expensive failure. `startRearmed` reads it the
        same way, for the same reason. */
     const children = level === 3 ? null : await childrenOf(client, runId);
+    /* ═══ READ AGAIN ON EVERY START, WHICH IS THE WHOLE OF CONTRACT POINT 2. ═══
+       A resumed or retried run is handed the rules AS THEY STAND NOW, not as they
+       stood when it first began: a rule edited while the conversation was running
+       governs the rest of it, and a rule deleted while it was running stops
+       applying to it. That is only true because this read happens here rather than
+       once, at the top of the run's life.
+  
+       ═══ AND IT ENDS THE WAY THIS PATH ALREADY ENDS. ═══ The claim has already
+       happened, so a throw here would leave a run reading `running` with no
+       process. `endRun` with the level fork is this path's own ending (see the cwd
+       branch above for why level 1 may not simply be given up on), and the reason
+       is a `returned()` message naming tables and columns, which carries no local
+       path and is therefore shareable. */
+    let rules;
+    try {
+        rules = await standingRulesFor(client, runId);
+    }
+    catch (error) {
+        const why = error instanceof Error ? error.message : String(error);
+        await endRun(client, level, runId, claimed.run_card_id, why);
+        throw new Error(`NO AGENT IS RUNNING: ${why}`);
+    }
     const started = startAgent(
     /* ═══ WHY IT DIED IS WHAT DIFFERS, AND IT IS TOLD THE TRUTH ABOUT IT. ═══
        `resumePrompt` opens by saying the machine went down, which is true of the
        sweep and false of a retry: the daemon that watched this harness exit is
        still running. See `retryPrompt`. */
-    afterPid === null
+    withStandingRules(rules, afterPid === null
         ? resumePrompt(claimed.run_brief, claimed.run_report, children)
-        : retryPrompt(claimed.run_brief, claimed.run_report, children), level, tools.urlFor(runId), cwd);
+        : retryPrompt(claimed.run_brief, claimed.run_report, children), where.block), level, tools.urlFor(runId), where.cwd);
     if (started.pid === null) {
         /* THE CLAIM HAPPENED AND NO PROCESS DID, which is the one shape the record
            must never be left in quietly. Same handling as a dispatch that could not
@@ -1144,7 +1635,7 @@ async function resumeRun(client, tools, machineId, runId, afterPid) {
  * what stops one question, or one set of finished workers, spawning forever. The cost is that this cannot decline afterwards: a run claimed and not
  * started would sit `running` with no process and its question already spent. So
  * every failure below ends the run with its reason, which is visible on the card
- * and in `cs3 show`, rather than quietly hoping the next poll finds it.
+ * and in `cs show`, rather than quietly hoping the next poll finds it.
  */
 async function startRearmed(client, tools, machineId, row) {
     const level = row.run_level === 1 ? 1 : row.run_level === 2 ? 2 : 3;
@@ -1153,18 +1644,16 @@ async function startRearmed(client, tools, machineId, row) {
         await giveUp(client, row.run_id, why);
         throw new Error(why);
     }
-    let cwd;
+    let where;
     try {
-        cwd = level === 1
-            ? scratchDir()
-            : checkoutForCodebase(await codebaseOfRun(client, row.run_id), hostname());
+        where = await workingDirectory(client, row.run_id, level, false);
     }
     catch (error) {
         /* ═══ THE REASON IS WRITTEN TO THE DATABASE, SO IT MAY NOT CARRY A PATH.
            ═══ Constraint 6. `workingCopy()` is already careful about this and says
            so; `scratchDir()` is not — it is `mkdirSync`, whose EACCES and ENOTDIR
            messages name the directory they failed on — and `failed_because` is a
-           column `cs3 show` prints. So the machine's own error is kept for stderr
+           column `cs show` prints. So the machine's own error is kept for stderr
            and the record is told only what is true and shareable. */
         const said = error instanceof Error ? error.message : String(error);
         const why = level === 1
@@ -1180,6 +1669,17 @@ async function startRearmed(client, tools, machineId, row) {
        POSSIBLE. Level 3 has no `dispatch`, so it has no children to have: null
        says that, where an empty list would say it chose to send nobody. */
     const children = level === 3 ? null : await childrenOf(client, row.run_id);
+    const deliveredArtifact = row.ask_id !== null && row.mine
+        ? await rearmedArtifactAnswer(client, row.ask_id)
+        : null;
+    /* ═══ THE MERGE HAPPENS HERE, OFF THE MARK ON THE ASK, BEFORE THE AGENT THAT
+       WILL SPEAK ABOUT IT IS STARTED. ═══ The re-arm is the last thing that runs
+       before the spawn, which is why it is the only place the outcome can reach
+       the prompt. See `landCardWork`. */
+    const offered = row.ask_id !== null && row.mine
+        ? await landingOffer(client, row.ask_id)
+        : null;
+    const landing = offered === null ? null : landCardWork(where, offered);
     /* ═══ THREE REASONS, AND THE ROW SAYS WHICH. ═══ No question is ux.md's third
        re-arm: everybody it sent has finished, and it is started to read them back.
        `children` cannot be null on that path — only a run with children is ever
@@ -1188,9 +1688,21 @@ async function startRearmed(client, tools, machineId, row) {
     const prompt = row.ask_id === null
         ? readBackPrompt(row.run_brief, row.run_report, children ?? [])
         : row.mine
-            ? answerPrompt(row.run_brief, row.run_report, children, row.question ?? '', row.answer ?? '')
+            ? answerPrompt(row.run_brief, row.run_report, children, row.question ?? '', row.answer ?? '', deliveredArtifact, landing)
             : escalationPrompt(row.run_brief, row.run_report, children, row.ask_id, row.question ?? '');
-    const started = startAgent(prompt, level, tools.urlFor(row.run_id), cwd);
+    /* CURRENT AT THIS ACTIVATION, exactly as on the resume path, and ended the
+       same way: the re-arm's claim has already happened, so a failure here ends
+       the run with its reason rather than leaving it claimed with no process. */
+    let rules;
+    try {
+        rules = await standingRulesFor(client, row.run_id);
+    }
+    catch (error) {
+        const why = error instanceof Error ? error.message : String(error);
+        await endRun(client, level, row.run_id, row.run_card_id, why);
+        throw new Error(`NO AGENT IS RUNNING: ${why}`);
+    }
+    const started = startAgent(withStandingRules(rules, prompt, where.block), level, tools.urlFor(row.run_id), where.cwd);
     if (started.pid === null) {
         const answer = await started.answered;
         const reason = answer.ok ? 'the process ended before it could be identified' : answer.reason;
@@ -1263,6 +1775,374 @@ async function childrenOf(client, runId) {
             : c.report.split('\n').map((l) => `    ${l}`)),
     ]);
 }
+/** Private owner context: enough to continue or stop work, without hierarchy or activity text. */
+async function ownerChildren(client, runId) {
+    const children = await returned(client.from('panel3_runs').select('id, state, report, failed_because')
+        .eq('parent_run_id', runId).order('started_at'), 'read', `what owner ${runId} sent others to do`);
+    return children.map((child) => [
+        `${child.id}  ${child.state}`,
+        ...(child.failed_because ? [`ended: ${child.failed_because}`] : []),
+        child.report ?? 'no report',
+    ].join('\n'));
+}
+async function ownerConversation(client, cardId, leased, initialLeaseRunId) {
+    const [turns, rawAsks] = await Promise.all([
+        returned(client.from('panel3_turns').select('id, role, body, created_at, lease_id')
+            .eq('card_id', cardId).order('created_at'), 'read', `the visible conversation on card ${cardId}`),
+        returned(client.from('panel3_asks').select(`id, created_at, ${ASK_CONTENT_COLUMNS}`)
+            .eq('card_id', cardId).not('decision_id', 'is', null).order('created_at'), 'read', `the visible questions on card ${cardId}`),
+    ]);
+    const asks = await withAskContent(client, rawAsks);
+    const events = [
+        ...turns.map((turn) => ({
+            at: turn.created_at,
+            kind: turn.role,
+            id: turn.id,
+            body: turn.body,
+            needsReply: turn.role === 'user'
+                && (leased.has(turn.id) || turn.lease_id === initialLeaseRunId),
+        })),
+        ...asks.map((ask) => ({
+            at: ask.created_at,
+            kind: 'question',
+            id: ask.id,
+            body: ask.question ?? '(question unavailable)',
+            answer: ask.answer,
+            relatedArtifactId: ask.related_artifact_id,
+            relatedArtifactRevision: ask.related_artifact_revision,
+            artifactAnswer: artifactAnswer(ask.related_artifact_id, ask.related_artifact_revision, ask.selected_options)?.answer ?? null,
+        })),
+    ];
+    return events.sort((a, b) => a.at.localeCompare(b.at) || a.id.localeCompare(b.id));
+}
+/** The first owner gets the same durable context as every later activation. */
+export async function initialOwnerPrompt(client, cardId, launcherRunId, brief) {
+    const events = await ownerConversation(client, cardId, new Set(), launcherRunId);
+    return ownerActivationPrompt(brief, null, events, [], null);
+}
+/** Only facts delivered by this activation enter an already-resumed native
+ * conversation. Older visible turns are already in that conversation. */
+export function ownerContinuationPrompt(brief, report, events, children, delivered, landing = null) {
+    const messages = events.filter((event) => event.kind === 'user' && event.needsReply);
+    return [
+        'CONTINUE THE CTRL+SPC CONVERSATION YOU ALREADY OWN.',
+        'Use only the new facts below as the new turn. Keep coordinating the whole card and speak as CTRL+SPC.',
+        '',
+        'NEW USER MESSAGES',
+        ...(messages.length === 0
+            ? ['None.']
+            : messages.flatMap((event) => [`Turn ${event.id}`, event.body])),
+        ...(delivered === null ? [] : delivered.mine ? [
+            '',
+            'ANSWER TO YOUR QUESTION',
+            `Question ${delivered.id}: ${delivered.question}`,
+            `Answer: ${delivered.answer ?? '(no answer text)'}`,
+            ...presentedArtifactAnswerContext(delivered.artifactAnswer),
+            ...landingOutcomeContext(landing),
+        ] : [
+            '',
+            'A WORKER NEEDS YOUR DECISION',
+            `Question ${delivered.id}: ${delivered.question}`,
+            'Answer it with answer_escalation if you can. If the person must decide, ask them directly.',
+        ]),
+        '',
+        'CURRENT PRIVATE WORKER SNAPSHOT — THIS REPLACES THE PREVIOUS SNAPSHOT',
+        ...(children.length === 0 ? ['You have sent nobody.'] : children),
+        '',
+        'YOUR CURRENT DURABLE REPORT',
+        report ?? 'Nothing yet.',
+        '',
+        'YOUR IMMUTABLE RESPONSIBILITY',
+        brief,
+    ].join('\n');
+}
+async function ownerCandidate(client, runId) {
+    const candidates = await returned(client.from('panel3_runs')
+        .select('id, card_id, codebase_id, machine_id, harness, state, ended_at, attempts, pid, started_at, resumed_at, process_token, handed_back_at, card:panel3_cards!panel3_runs_card_id_fkey(conversation_run_id, state)')
+        .eq('id', runId), 'read', `conversation owner ${runId}`);
+    const candidate = candidates[0];
+    return candidate?.card?.conversation_run_id === candidate?.id ? candidate : null;
+}
+async function ownerDirectory(client, candidate) {
+    return workingDirectory(client, candidate.id, 2, true, candidate.codebase_id === null ? null : undefined);
+}
+export function resumableOwnerSessionId(candidate, machineId, machineHarness) {
+    const local = readOwnerSession(candidate.id);
+    return candidate.machine_id === machineId
+        && candidate.harness === machineHarness
+        && local?.state === 'established'
+        && local.harness === machineHarness
+        && local.processToken === candidate.process_token
+        ? local.nativeSessionId
+        : undefined;
+}
+async function activateOwner(client, tools, machineId, runId, afterProcessToken = null, afterPid = null) {
+    const candidate = await ownerCandidate(client, runId);
+    if (!candidate)
+        return null;
+    const machineHarness = harness();
+    const resumeSessionId = resumableOwnerSessionId(candidate, machineId, machineHarness);
+    /* ═══ THE EXISTENCE CHECK BEFORE THE CLAIM, AND THE COPY AFTER IT. ═══ This
+       was the whole resolution, which was right while resolving meant reading a
+       folder out of a file. Since worktrees-8 it also CREATES one, and a daemon
+       that lost the activation race would leave a branch and a folder behind for
+       an owner it never activated. The refusal this position exists for — a
+       machine that does not have this codebase must not take the activation —
+       is unchanged, because it is the located checkout that answers it. */
+    if (candidate.codebase_id !== null) {
+        checkoutForCodebase(await codebaseOfRun(client, candidate.id), hostname());
+    }
+    const { data, error } = await client.rpc('panel3_take_owner_activation', {
+        p_run_id: runId,
+        p_machine_id: machineId,
+        p_agent: machineHarness,
+        p_after_process_token: afterProcessToken,
+        p_after_pid: afterPid,
+    });
+    if (error)
+        throw new Error(`could not activate conversation owner ${runId}: ${error.message}`);
+    const claimed = data?.[0];
+    if (!claimed)
+        return null;
+    const [events, children] = await Promise.all([
+        ownerConversation(client, claimed.run_card_id, new Set(claimed.turn_ids ?? [])),
+        ownerChildren(client, runId),
+    ]);
+    const currentArtifactAnswer = deliveredArtifactAnswer(events, claimed);
+    const delivered = claimed.ask_id === null ? null : {
+        id: claimed.ask_id,
+        question: claimed.question ?? '(question unavailable)',
+        answer: claimed.answer,
+        mine: claimed.mine === true,
+        artifactAnswer: currentArtifactAnswer,
+    };
+    /* ═══ AFTER THE CLAIM, SO THE ENDING IS THE ONE THIS PATH HAS. ═══ Every
+       failure below the claim ends the activation with `giveUp` and its process
+       token; a throw above it would merely be an activation that did not happen.
+  
+       ═══ AND IT MATTERS MOST HERE. ═══ This is the owner, which lives for the
+       whole card and whose native session is RESUMED, so it is the one agent that
+       can be running while a person edits or deletes a rule. Reading at every
+       activation is what makes an edit govern the rest of the conversation, and
+       the block's own supersession sentence is what makes a DELETION take effect
+       in a session that still holds the older copy.
+  
+       ═══ AND IT IS BEFORE THE PROMPT SINCE worktrees-8 C1, because the prompt now
+       says what the product DID with the person's answer, and the landing needs
+       the card's copy. Nothing in the prompt depended on it before. */
+    let rules;
+    /* THE CARD'S COPY IS MADE IN THE SAME WINDOW AND UNDER THE SAME ENDING, for
+       the reason the check above gives: it writes, so it happens after the claim,
+       and a failure to make it is an activation that ends rather than one that
+       sits `running` with no process. */
+    let where;
+    /* ═══ AND WHAT IS ATTACHED, READ IN THE SAME WINDOW AND UNDER THE SAME
+       ENDING. ═══ attaching-after-the-fact-10: a person may attach to a card that
+       is already running, and the owner's brief is immutable, so the only account
+       of attachments it would otherwise get is the one frozen at dispatch. Read
+       at every activation, exactly as the rules are, and for the same reason a
+       failed read ends the activation rather than continuing: "nothing is
+       attached" is a different card from the one the person sent.
+  
+       THE CODEBASE LINES ARE DROPPED. `whatWasAttached` partitions those into a
+       section whose own text says "its one codebase is named separately below",
+       a forward reference to something `workBrief` supplies and an owner
+       activation does not. This block carries the PERSON's attachments; where the
+       owner is working is `where.block`'s answer. */
+    let attached;
+    try {
+        where = await ownerDirectory(client, candidate);
+        rules = await standingRulesFor(client, runId);
+        attached = whatWasAttached((await attachmentsFor(client, claimed.run_card_id))
+            .filter((line) => !line.startsWith('codebase  ')));
+    }
+    catch (error) {
+        const why = error instanceof Error ? error.message : String(error);
+        await giveUp(client, runId, why, claimed.process_token);
+        throw new Error(`NO AGENT IS RUNNING: ${why}`);
+    }
+    /* THE MERGE, OFF THE MARK ON THE ASK, BEFORE THE AGENT THAT WILL SPEAK ABOUT
+       IT IS STARTED. The owner reaches an answer by this route as often as by the
+       re-arm, which is why the artifact answer is read on both and this is too. */
+    const offered = claimed.ask_id !== null && claimed.mine === true
+        ? await landingOffer(client, claimed.ask_id)
+        : null;
+    const landing = offered === null ? null : landCardWork(where, offered);
+    const prompt = resumeSessionId
+        ? ownerContinuationPrompt(claimed.run_brief, claimed.run_report, events, children, delivered, landing)
+        : ownerActivationPrompt(claimed.run_brief, claimed.run_report, events, children, delivered !== null && !delivered.mine
+            ? { id: delivered.id, question: delivered.question }
+            : null, currentArtifactAnswer, 
+        /* ═══ A PROCESS OF ITS OWN ENDED BEFORE IT FINISHED. ═══ `afterPid` is the
+           fact, and it is non-null on all three paths that follow one: a harness
+           that crashed, a machine that went down, and now a person's correction.
+           The sentences it adds say what to do and never why, because those three
+           are not the same event and `prompt.ts` exists to stop an agent being
+           told an untrue reason for its own restart. */
+        afterPid !== null, landing);
+    const started = startAgent(withStandingRules(rules, prompt, where.block, attached), 2, tools.urlFor(runId, claimed.process_token), where.cwd, { ownerId: runId, ...(resumeSessionId ? { resumeSessionId } : {}) });
+    if (started.pid === null) {
+        const answer = await started.answered;
+        const reason = answer.ok ? 'the process ended before it could be identified' : answer.reason;
+        await giveUp(client, runId, reason, claimed.process_token);
+        throw new Error(`NO AGENT IS RUNNING: ${reason}`);
+    }
+    try {
+        await recordProcess(client, runId, started.pid, undefined, claimed.process_token);
+    }
+    catch (error) {
+        said(`${error instanceof Error ? error.message : String(error)} (the run is still going)`);
+    }
+    return {
+        settled: settle(client, tools, machineId, 2, runId, claimed.run_card_id, started, true, claimed.process_token, ownerSessionLifecycle(started, runId, machineHarness, claimed.process_token, resumeSessionId)),
+    };
+}
+/** The only owner rows the normal poll may try, including an explicit hand-back move. */
+export function ownerPollClaim(candidate) {
+    if (candidate.state === 'running') {
+        if (candidate.handed_back_at === null || candidate.process_token === null)
+            return null;
+        return { afterProcessToken: candidate.process_token, afterPid: null };
+    }
+    if (candidate.state === 'finished' || candidate.state === 'asked') {
+        return { afterProcessToken: null, afterPid: null };
+    }
+    return null;
+}
+/**
+ * ═══ THE PROCESS A PERSON'S CORRECTION CANNOT HAVE REACHED. ═══
+ *
+ * redirect-5/ux.md: stop ends work, and changing its direction mid-flight did
+ * not exist. ux.md's mechanism is "redirect is stop plus respawn", and the
+ * respawn half is already built: a process that dies is started again as itself
+ * by `settle`, and the claim it goes through leases every unaddressed person
+ * turn on its way. **So the only thing missing was the ending**, and this is it.
+ *
+ * ═══ IT IS A MIRROR OF THE RETRY CLAIM, AND MUST BE CHANGED WITH IT. ═══
+ * `20260914090000`'s retry branch requires the token, `running`, `ended_at` null,
+ * the pid, and `attempts < 3`. The kill is the ONE irreversible act in this file:
+ * every other predicate here pre-filters an RPC that can refuse harmlessly, and
+ * a claim refused AFTER a kill falls through `settle` to `giveUp`, which turns a
+ * person's correction into a FAILED CARD. So every condition below is either
+ * that mirror, or a product rule with a named cost.
+ *
+ * Two things are NOT here, because neither is a property of the row: whether
+ * this run owns its card, and whether this daemon holds its process. Both are
+ * the caller's, and `mine` is what makes the respawn possible at all.
+ */
+export function redirectedProcess(candidate, machineId, 
+/** The newest unaddressed person turn per card. MAX, never first-seen: a turn
+ *  left unaddressed while a question was open would otherwise pin its card
+ *  below `resumed_at` for good and nothing on it could ever redirect. */
+waiting, cardId, booted) {
+    // The claim's own five, mirrored.
+    if (candidate.state !== 'running' || candidate.ended_at !== null)
+        return null;
+    if (candidate.attempts >= MAX_ATTEMPTS)
+        return null;
+    // The person moved this card to another machine. Killing here makes `settle`
+    // retry locally and the claim clears `handed_back_at`, silently reversing them.
+    if (candidate.handed_back_at !== null)
+        return null;
+    // `mine` is not enough: a takeover moves the row while this daemon still holds
+    // a promise for it, and the claim then refuses on the machine predicate.
+    if (candidate.machine_id !== machineId)
+        return null;
+    /* ═══ A CARD THAT NEEDS THE PERSON IS NOT A CARD THEY ARE REDIRECTING. ═══
+       The claim refuses to lease turns while a person's question is open, so a
+       kill here would destroy the work and NOT deliver the correction. The card's
+       state is written from a character-identical predicate by the
+       `panel3_prepare_user_turn` trigger on every person message, so it is the
+       same fact, one read earlier. */
+    if (candidate.card_state !== 'working')
+        return null;
+    /* ═══ AND IT HAS TO BE A MESSAGE THIS PROCESS CANNOT HAVE SEEN. ═══ The rule
+       `panel3_take_turns` already applies one level up. Measured against the
+       attempt that is running NOW, which is also what stops a replacement being
+       killed by the very message that caused it. */
+    const said = waiting.get(cardId);
+    if (said === undefined)
+        return null;
+    if (new Date(said).getTime() <= new Date(candidate.resumed_at ?? candidate.started_at).getTime()) {
+        return null;
+    }
+    return runProcessIsAlive(candidate, booted) ? candidate.pid : null;
+}
+export function pendingOwnerSessionWithinGrace(candidate, now = Date.now()) {
+    const local = readOwnerSession(candidate.id);
+    return !!local
+        && local.state === 'pending'
+        && local.harness === candidate.harness
+        && local.processToken === candidate.process_token
+        && now - new Date(local.updatedAt).getTime() < OWNER_SESSION_GRACE_MS;
+}
+async function takeOwnerActivations(client, tools, machineId, mine, hold) {
+    /* ═══ THE MESSAGES NOBODY HAS TAKEN, READ BEFORE THE RUNS, DELIBERATELY. ═══
+       A claim landing between these two reads stamps a `resumed_at` NEWER than
+       every turn it just leased, so the redirect below refuses and nothing is
+       killed. In the other order the same claim leaves a stale `resumed_at` beside
+       a turn that now reads unaddressed, and the daemon kills the replacement it
+       has just started. One narrow indexed read (`panel3_turns_takeable_idx`),
+       unconditional because that ordering is the whole point of it. */
+    const outstanding = await returned(client.from('panel3_turns')
+        .select('card_id, created_at')
+        .eq('role', 'user')
+        .is('addressed_at', null), 'read', 'the messages nobody has taken yet');
+    const waiting = new Map();
+    for (const turn of outstanding) {
+        // THE NEWEST PER CARD. See `redirectedProcess`: first-wins would pin a card
+        // below its own `resumed_at` for good.
+        const held = waiting.get(turn.card_id);
+        if (held === undefined || turn.created_at > held)
+            waiting.set(turn.card_id, turn.created_at);
+    }
+    const candidates = await returned(client.from('panel3_runs')
+        .select('id, card_id, codebase_id, machine_id, harness, state, ended_at, attempts, pid, started_at, resumed_at, process_token, handed_back_at, card:panel3_cards!panel3_runs_card_id_fkey(conversation_run_id, state)')
+        .in('state', ['finished', 'asked', 'running']), 'read', 'conversation owners that may be ready');
+    for (const candidate of candidates) {
+        if (candidate.card?.conversation_run_id !== candidate.id)
+            continue;
+        /* ═══ A RUN THIS DAEMON IS HOLDING IS THE ONLY ONE A CORRECTION CAN
+           REDIRECT. ═══ Not because of the claim, which is not made here at all, but
+           because of what happens AFTER the kill: the respawn is the dying process's
+           own `settle`, and only the daemon that started it has one. Kill anything
+           else and there is a dead process, a row still reading `running` and a card
+           still saying `working`, with nothing local to retry it. */
+        if (mine.has(candidate.id)) {
+            const pid = redirectedProcess({ ...candidate, card_state: candidate.card?.state ?? null }, machineId, waiting, candidate.card_id, bootedAt());
+            if (pid !== null) {
+                killTree({ pid, kill: (signal) => process.kill(pid, signal) });
+                /* ═══ SIGNALLED, NOT KILLED, AND THE WORD IS THE POINT. ═══ `killTree`
+                   swallows a refused signal on both platforms, so saying "killed" would
+                   claim a death this daemon never observed. A process that survives is
+                   still running, still held, and its turn is still unaddressed and still
+                   newer than `resumed_at`, so the next poll signals it again — the same
+                   rule `killStopped` states two hundred lines below. */
+                out(`redirect card ${candidate.card_id}  run ${candidate.id}  signalled pid ${pid}`);
+            }
+            continue;
+        }
+        if (pendingOwnerSessionWithinGrace(candidate))
+            continue;
+        if (candidate.handed_back_at !== null
+            && candidate.machine_id === machineId
+            && (runProcessIsAlive(candidate, bootedAt())
+                || (candidate.pid === null
+                    && Date.now() - new Date(candidate.resumed_at ?? candidate.started_at).getTime() < PID_GRACE_MS)))
+            continue;
+        const claim = ownerPollClaim(candidate);
+        if (!claim)
+            continue;
+        try {
+            const activated = await activateOwner(client, tools, machineId, candidate.id, claim.afterProcessToken, claim.afterPid);
+            if (activated)
+                hold(candidate.id, activated.settled);
+        }
+        catch (error) {
+            said(`could not activate owner ${candidate.id}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+}
 // ---------------------------------------------------------------------------
 /**
  * ═══ THE TWO ENDS THE PERSON CAUSES, WHICH ARE THE TWO THIS DAEMON KILLS. ═══
@@ -1300,6 +2180,46 @@ function runProcessIsAlive(run, booted) {
         return false;
     return processIsAlive(run.pid);
 }
+/** Reconcile only CTRL+SPC-owned local session state. Native Claude and Windows
+ * Codex transcripts live in harness-owned locations and are deliberately not
+ * touched here. A current owner row, live PID, in-flight process, or fresh
+ * pid-null claim always defers cleanup. Stable state is removed only after the
+ * owner row disappears, becomes terminal, or no longer owns its card. */
+export async function reconcileOwnerSessions(client, machineId, _machineHarness, inFlightOwnerIds = new Set()) {
+    const mappingIds = listOwnerSessionIds();
+    const homeIds = listPanel3CodexOwnerHomeIds();
+    const all = [...new Set([...mappingIds, ...homeIds])];
+    const invalid = all.filter((id) => !validSessionUuid(id));
+    for (const id of invalid)
+        removePanel3CodexOwnerHome(id);
+    const ids = all.filter(validSessionUuid);
+    if (ids.length === 0)
+        return;
+    const rows = await returned(client.from('panel3_runs')
+        .select('id, machine_id, harness, state, pid, started_at, resumed_at, ended_at, process_token, card:panel3_cards!panel3_runs_card_id_fkey(conversation_run_id)')
+        .in('id', ids), 'read', 'which local conversation sessions still have an owner');
+    const byId = new Map(rows.map((row) => [row.id, row]));
+    for (const id of ids) {
+        if (inFlightOwnerIds.has(id))
+            continue;
+        const row = byId.get(id);
+        const localProcessInUse = !!row
+            && row.machine_id === machineId
+            && ((row.pid !== null && processIsAlive(row.pid))
+                || (row.state === 'running'
+                    && row.ended_at === null
+                    && row.pid === null
+                    && Date.now() - new Date(row.resumed_at ?? row.started_at).getTime() < PID_GRACE_MS));
+        const rowStillOwnsConversation = !!row
+            && row.card?.conversation_run_id === id
+            && ['running', 'asked', 'finished'].includes(row.state);
+        if (localProcessInUse || rowStillOwnsConversation)
+            continue;
+        removeOwnerSession(id);
+        if (homeIds.includes(id))
+            removePanel3CodexOwnerHome(id);
+    }
+}
 /**
  * ═══ THE USER STOPPED IT, OR THEIR NEXT MESSAGE REPLACED IT, SO THE PROCESS
  *     STOPS. ═══
@@ -1441,7 +2361,7 @@ async function killStopped(client, machineId) {
 async function recoverStranded(client, tools, machineId, mine, hold) {
     const live = await returned(client
         .from('panel3_runs')
-        .select('id, card_id, parent_run_id, state, pid, started_at, resumed_at')
+        .select('id, card_id, parent_run_id, state, pid, started_at, resumed_at, process_token, card:panel3_cards!panel3_runs_card_id_fkey(conversation_run_id)')
         .eq('machine_id', machineId)
         /* ═══ AND A RUN THAT STOPPED TO ASK IS SWEPT TOO, WHICH IS WHAT MAKES THE
            RE-ARM'S OWN PREDICATE SAFE. ═══ `panel3_take_rearms` will only start a run
@@ -1468,6 +2388,23 @@ async function recoverStranded(client, tools, machineId, mine, hold) {
             continue;
         if (runProcessIsAlive(run, booted))
             continue;
+        const isOwner = run.card?.conversation_run_id === run.id && run.process_token !== null;
+        if (isOwner) {
+            try {
+                if (run.state === 'asked') {
+                    await writeAnswer(client, run.id, run.card_id, null, run.process_token ?? undefined);
+                }
+                else {
+                    const resumed = await activateOwner(client, tools, machineId, run.id, run.process_token, run.pid);
+                    if (resumed)
+                        hold(run.id, resumed.settled);
+                }
+            }
+            catch (error) {
+                said(`could not recover owner ${run.id}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            continue;
+        }
         if (run.state === 'asked') {
             /* ═══ ITS END IS STAMPED AND ITS TURNS ARE LEFT ALONE. ═══ This run is not
                handed back and is not started again from here: its continuation is the
@@ -1662,7 +2599,7 @@ export async function takeHandedBack(client, tools, machineId, mine, hold) {
        whether its pid means anything here. See the header. */
     const offered = await returned(client
         .from('panel3_runs')
-        .select('id, card_id, machine_id, pid, started_at, resumed_at')
+        .select('id, card_id, machine_id, pid, started_at, resumed_at, process_token, card:panel3_cards!panel3_runs_card_id_fkey(conversation_run_id)')
         .not('handed_back_at', 'is', null)
         /* WHAT THE OFFER MEANS, RESTATED IN THE READ. `panel3_hand_back` only ever
            stamps a dispatched run that is still going, and `panel3_resume` refuses
@@ -1708,7 +2645,9 @@ export async function takeHandedBack(client, tools, machineId, mine, hold) {
             continue;
         }
         try {
-            const resumed = await resumeRun(client, tools, machineId, run.id, null);
+            const resumed = run.card?.conversation_run_id === run.id && run.process_token !== null
+                ? await activateOwner(client, tools, machineId, run.id, run.process_token, null)
+                : await resumeRun(client, tools, machineId, run.id, null);
             if (resumed)
                 hold(run.id, resumed.settled);
             else
@@ -1729,7 +2668,7 @@ export async function takeHandedBack(client, tools, machineId, mine, hold) {
  *
  * ═══ ONE LOOP, TWO CALLERS, AND THAT IS THE WHOLE OF recovery-1 SLICE 4. ═══
  * `startPanel` below is `cs start`'s entry and hands in the session the
- * installed CLI already holds. `cs3 run` is the acceptance harness's entry and
+ * installed CLI already holds. `panel3/cli.js run` is the acceptance harness's entry and
  * signs in from the environment against its own isolated account. Neither is a
  * copy of the other: a second poll loop would be two things leasing the same
  * turns with two ideas of what recovery may reap.
@@ -1738,6 +2677,135 @@ export async function takeHandedBack(client, tools, machineId, mine, hold) {
  * already has one. Its presence is also what says THIS PROCESS IS NOT v3's, so
  * the signals belong to somebody else — see the handler block below.
  */
+/**
+ * ═══ THE CARD IS OVER, SO ITS COPY GOES — AND THE BRANCH STAYS. ═══
+ *
+ * A SWEEP ON THE DAEMON'S OWN LOOP RATHER THAN A HOOK ON A RUN ENDING, and the
+ * reason is that there is no place the daemon learns a card ended. The `done`
+ * transition happens inside SQL, and `settle` fires per PROCESS at every level:
+ * a level 3 worker exiting while its level 2 owner is still editing the same
+ * tree would take the tree out from under it. So the question is asked of the
+ * record, of every run on the card, and a card with anything still running is
+ * passed over.
+ *
+ * ═══ THE FILESYSTEM IS ASKED FIRST, SO A MACHINE WITH NO COPIES ASKS NOTHING.
+ *     ═══ And the folders it finds are what bounds the query: only the codebases
+ * this machine actually holds a copy for.
+ *
+ * A folder no row explains is LEFT ALONE. Nothing here deletes something it
+ * cannot account for.
+ */
+async function sweepFinishedWorktrees(client) {
+    const held = worktreesOnThisMachine();
+    if (held.length === 0)
+        return;
+    /* ═══ ASKED IN TWO STEPS, BECAUSE THE TWO QUESTIONS ARE NOT THE SAME ONE.
+       ═══ WHICH CARD a folder belongs to is answered by the runs that carry a
+       branch, which are the runs in a codebase. WHETHER THAT CARD IS STILL BEING
+       WORKED is answered by ALL of its runs, and its level 1 coordinator has no
+       codebase at all — so a single query filtered by codebase would call a card
+       finished while the agent coordinating it was still going.
+  
+       Neither is filtered to this machine. The FOLDERS are this machine's, and
+       only a run here can be inside one, but "the card is over" is a fact about
+       the card, and a card dispatched across machines has runs elsewhere. */
+    const stamped = await returned(client.from('panel3_runs')
+        .select('card_id, codebase_id, branch')
+        .in('codebase_id', [...new Set(held.map((one) => one.codebaseId))])
+        .not('branch', 'is', null), 'read', 'which cards the copies on this machine belong to');
+    const cardOfFolder = new Map(held.map((one) => [one.folder, [...new Set(stamped
+                .filter((row) => (row.codebase_id === one.codebaseId && row.branch !== null && folderIsBranch(one.slug, row.branch)))
+                .map((row) => row.card_id))]]));
+    const cards = [...new Set([...cardOfFolder.values()].flat())];
+    if (cards.length === 0)
+        return;
+    const live = new Set((await returned(client.from('panel3_runs')
+        .select('card_id')
+        .in('card_id', cards)
+        .is('ended_at', null), 'read', 'which of those cards still have an agent going')).map((row) => row.card_id));
+    const touched = new Set();
+    for (const one of held) {
+        const cardIds = cardOfFolder.get(one.folder) ?? [];
+        if (cardIds.length === 0 || cardIds.some((cardId) => live.has(cardId)))
+            continue;
+        try {
+            settleCardWorktree(one.folder);
+            touched.add(one.codebaseId);
+            out(`cleaned  card copy for ${cardIds.join(', ')}`);
+        }
+        catch (error) {
+            /* SAID, NOT FATAL, AND NOT RETRIED HARDER. The work is committed or it is
+               not; either way the copy is still there and the next poll tries again.
+               Taking the daemon's loop down over cleanup would stop every card. */
+            said(`could not clean up a finished card's copy: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /* THE BASE LOCK LAST, AND ONLY WHERE SOMETHING WAS REMOVED. It is what makes
+       the refusal real for every other card in that codebase, so it survives
+       until none of them is left. */
+    for (const codebaseId of touched) {
+        try {
+            releaseBaseBranch(codebaseId);
+        }
+        catch { /* it is held, which is safe */ }
+    }
+}
+/** The last mismatch state this daemon said out loud, so a poll every two
+ *  seconds does not narrate the same standing fact thirty times a minute.
+ *
+ *  ═══ SAID ONCE PER STATE, NOT ONCE PER PROCESS. ═══ The same discipline v2's
+ *  `roleKey` (`orchestrator.ts`) uses for its own designation lines, and for the
+ *  same reason: the person re-designates while the daemon is running, so
+ *  "matching again" is a genuinely different state that they must hear about
+ *  too, while the unchanged one repeated is noise that buries every useful
+ *  line. Null means nothing has been said yet. */
+let saidHarnessState = null;
+/**
+ * ═══ THE DESIGNATION NAMES A HARNESS THIS DAEMON IS NOT, AND SOMEBODY HAS TO
+ *     SAY SO. ═══
+ *
+ * The take's agent filter lives in SQL and answers with zero rows, which is
+ * right — a daemon may not act outside its designation — but zero rows is also
+ * what "nothing is waiting" looks like, and the two are indistinguishable from
+ * the outside. This is the one place they can be told apart, because it is the
+ * only place that holds BOTH facts at once: the harness this process actually
+ * runs, and the harness the person has designated.
+ *
+ * ═══ IT DOES NOT REFUSE, RETRY OR RE-READ THE HARNESS. ═══ `CTRL_SPC_V3_AGENT`
+ * is fixed for the life of the process by design (`spawn.ts`: reported, never
+ * chosen), and honouring a switch by silently spawning the other binary would
+ * attribute a whole session of results to a harness that never ran. So the
+ * daemon keeps polling, keeps taking whatever it legitimately may, and says the
+ * one true sentence about why this particular work is not moving.
+ *
+ * ═══ AND A FAILED READ IS NOT A MISMATCH. ═══ Constraint 4, the same rule
+ * `designatedCoordinator` states: a read that failed does not mean nobody is
+ * designated, and it must not produce a sentence claiming to know which harness
+ * was chosen. It throws, and the poll's own catch treats it as a poll that did
+ * not finish — the next one is two seconds away.
+ */
+async function reportHarnessMismatch(client, machineId, machineHarness) {
+    const designation = await designatedCoordinator(client);
+    /* Nobody designated, or somebody else's machine: neither is this daemon
+       failing to honour anything. `panel3_take_turns` lets ANY machine take when
+       nothing is designated, and a designation naming another machine is that
+       machine's business — v2's own listener already says both of those
+       (`roleLine`'s 'none' and 'other-machine'), and repeating them here would be
+       two voices on one fact. */
+    const mismatched = designation !== null
+        && designation.machineId === machineId
+        && designation.agent !== machineHarness;
+    const state = mismatched ? `mismatch:${designation.agent}` : 'ok';
+    if (state === saidHarnessState)
+        return;
+    saidHarnessState = state;
+    if (!mismatched)
+        return;
+    said(`${designation.agent} is designated to coordinate on this machine, and this daemon runs `
+        + `${machineHarness}, so it will not pick work up. Nothing will act on what you send until `
+        + `this daemon is restarted with CTRL_SPC_V3_AGENT=${designation.agent}, or ${machineHarness} `
+        + 'is designated in the app.');
+}
 export async function run(args, injected) {
     let once = false;
     for (const arg of args) {
@@ -1794,8 +2862,8 @@ export async function run(args, injected) {
        `tools` is referenced inside the callback it is being given, which is safe
        for the plain reason that the callback can only run once a request has
        arrived at a server that by then exists. */
-    const tools = await startToolsServer(client, async (parentRunId, brief, codebase) => {
-        const child = await startChild(client, tools, machineId, parentRunId, brief, codebase);
+    const tools = await startToolsServer(client, async (parentRunId, brief, codebase, processToken) => {
+        const child = await startChild(client, tools, machineId, parentRunId, brief, codebase, processToken);
         hold(child.runId, child.settled);
         return { runId: child.runId };
     });
@@ -1834,7 +2902,7 @@ export async function run(args, injected) {
     for (;;) {
         /* ═══ ONE POLL FAILING IS NOT THE DAEMON FAILING. ═══ Every read and write
            here throws on a network or database error, by design (constraint 7), and
-           until Slice 4 that threw straight out of `cs3 run` and exited the process.
+           until Slice 4 that threw straight out of `panel3/cli.js run` and exited the process.
            Inside `cs start` that is no longer an honest outcome twice over: it would
            take the v2 presence heartbeat down with it, and it would leave a stranded
            card printing `cs start` at a person who IS running `cs start`, which is
@@ -1856,7 +2924,13 @@ export async function run(args, injected) {
                to run first: `panel3_stop_card` has already ended the runs, so recovery
                cannot see them and neither take can start them. */
             await killStopped(client, machineId);
+            await reconcileOwnerSessions(client, machineId, machineHarness, new Set(inFlight.keys()));
             await recoverStranded(client, tools, machineId, new Set(inFlight.keys()), hold);
+            /* ═══ AND THE COPIES OF CARDS THAT ARE OVER. ═══ After recovery,
+               deliberately: a run this machine is about to resume is one whose card is
+               not finished, and the sweep asks the record after recovery has had its
+               say about what is really still running. */
+            await sweepFinishedWorktrees(client);
             /* ═══ AND THEN WHAT SOMEBODY ELSE'S MACHINE WAS HOLDING, IF A PERSON HANDED
                IT BACK. ═══ AFTER the sweep, deliberately: this machine settles its own
                runs on local, pid-accurate evidence before it looks at anybody's, and a
@@ -1868,6 +2942,27 @@ export async function run(args, injected) {
                with a brief and a report behind it, comes before work that has not
                started. */
             await takeHandedBack(client, tools, machineId, new Set(inFlight.keys()), hold);
+            /* Every reason a conversational owner may continue is claimed together.
+               The legacy turn and re-arm takes exclude named owners in the database. */
+            await takeOwnerActivations(client, tools, machineId, new Set(inFlight.keys()), hold);
+            /* ═══ AND IF THE DESIGNATION NAMES A HARNESS THIS DAEMON IS NOT, IT SAYS
+               SO BEFORE TAKING NOTHING. ═══
+               `panel3_take_turns` and `panel3_take_rearms` compare `p_agent` against
+               `cliv2_orchestrator_preference` in SQL, and a mismatch is not an error
+               there — it is zero rows, which is correct and which is also exactly what
+               a quiet machine with no work waiting looks like. Proven on the record
+               (.bugs/.resolved/20260826-daemon-ignores-the-harness-switch): with the
+               designation on `codex` and this daemon on `claude`, a waiting turn was
+               never claimed for over two minutes, the daemon printed nothing, and the
+               card sat under `Working` with a healthy machine online.
+      
+               `harness()` is read once at startup and cannot change under a running
+               process (see `machineHarness` above), while the designation is a chip a
+               person clicks in the app at any moment. So the two CAN disagree, and
+               ux.md's forbidden state — "nothing will act on it and nothing on screen
+               says so" — is reached the moment they do. This is the daemon's own
+               screen saying so. */
+            await reportHarnessMismatch(client, machineId, machineHarness);
             /* THE MACHINE ID GOES IN because the take writes the run row, and a run has
                to say where it is running: the exclusion is cross-machine and recovery is
                per-machine, so a row with nobody's machine on it could be neither. */