@ctrl-spc/cs 0.7.1 → 0.7.3

package/dist/panel3/run.js

@@ -8,7 +8,7 @@
  * `startPanel`'s own comment at the foot of this file carries the reasoning.
  *
  * ---------------------------------------------------------------------------
- * WHAT THIS IS. `cs3 say` puts a card and a user turn on the record and returns,
+ * WHAT THIS IS. `cs say` puts a card and a user turn on the record and returns,
  * because ux.md requires the acknowledgement never to wait for a spawn. This is
  * the other half: the loop that notices the turn, leases it, writes a run row,
  * starts a real agent, and puts what that agent said back on the card.
@@ -132,11 +132,12 @@
 // and takes the leading comment with it, so a file whose first statement is
 // `import type` loses its v3 header in the published `dist/`.
 import { out, returned, signedInClient } from './client.js';
-import { answerPrompt, escalationPrompt, levelOnePrompt, ownerActivationPrompt, readBackPrompt, presentedArtifactAnswerContext, resumePrompt, retryPrompt, } from './prompt.js';
-import { ASK_CONTENT_COLUMNS, attachmentLine, loadAttachments, loadOutputNames, outputOf, withAskContent, } from './show.js';
+import { answerPrompt, escalationPrompt, levelOnePrompt, ownerActivationPrompt, readBackPrompt, landingOutcomeContext, presentedArtifactAnswerContext, resumePrompt, retryPrompt, standingRules, whatWasAttached, workingRules, } from './prompt.js';
+import { ASK_CONTENT_COLUMNS, attachmentLine, gitRulesFor, loadAttachments, loadOutputNames, outputOf, recordBaseProtection, standingRulesFor, withAskContent, } from './show.js';
 import { forgetSecrets, redactSecrets } from './secrets.js';
 import { sayListening, stopListening } from './presence.js';
-import { checkoutForCodebase, hasCheckoutForCodebase } from './checkout.js';
+import { designatedCoordinator } from './coordinator.js';
+import { baseBranchState, checkoutForCodebase, commitCardWork, detectBaseProtection, folderIsBranch, hasCheckoutForCodebase, mergeIntoBase, releaseBaseBranch, settleCardWorktree, worktreeForCard, worktreesOnThisMachine, } from './checkout.js';
 import { harness, startAgent } from './spawn.js';
 import { establishOwnerSession, listOwnerSessionIds, OWNER_SESSION_GRACE_MS, readOwnerSession, removeOwnerSession, validSessionUuid, writeOwnerSession, } from './session.js';
 import { startToolsServer } from './tools.js';
@@ -145,7 +146,7 @@ import { getMachineIdentity, scratchDir } from '../config.js';
 import { listCodebases } from '../codebases.js';
 import { killTree, processIsAlive } from '../win-shell.js';
 import { hostname, uptime } from 'node:os';
-const USAGE = 'usage: cs3 run [--once]';
+const USAGE = 'usage: run [--once]';
 /** How long between takes. Short, because it is the whole delay between a user
  *  sending and a card showing an agent on it, and the take is one small indexed
  *  read against the user's own rows. */
@@ -224,6 +225,62 @@ async function rearmedArtifactAnswer(client, askId) {
         ? null
         : artifactAnswer(ask.related_artifact_id, ask.related_artifact_revision, ask.selected_options);
 }
+const LAND = 'Put this work on the main branch';
+const LEAVE = 'Leave it on its branch';
+export async function landingOffer(client, askId) {
+    const asks = await withAskContent(client, await returned(client.from('panel3_asks').select(`id, offers_landing, ${ASK_CONTENT_COLUMNS}`).eq('id', askId), 'read', `question ${askId}`));
+    const ask = asks[0];
+    if (ask === undefined || ask.offers_landing !== true)
+        return null;
+    const selected = ask.selected_options ?? [];
+    if (selected.length !== 1)
+        return 'unclear';
+    return selected[0] === LAND ? 'land' : selected[0] === LEAVE ? 'leave' : 'unclear';
+}
+/**
+ * ═══ THE PRODUCT PERFORMS THE LANDING, HERE, BEFORE THE AGENT THAT WILL SPEAK
+ *     ABOUT IT STARTS. ═══
+ *
+ * Not a tool, because a tool means an agent decides whether a yes takes effect,
+ * and an agent that finishes the card instead leaves a person who clicked yes
+ * with nothing. Not the poll's sweep, because the sweep cannot tell the agent
+ * what it did.
+ *
+ * ═══ AND A FAILURE DOES NOT END THE RUN. ═══ The agent has to be started to
+ * tell the person, so what happened is returned as the sentence it will be
+ * handed rather than written to `failed_because`.
+ */
+export function landCardWork(where, outcome) {
+    const card = where.card;
+    if (outcome !== 'land')
+        return { outcome, branch: card?.branch ?? null, base: card?.base ?? null };
+    if (card === null) {
+        return { outcome: 'refused', because: 'This card has no working copy on this machine, so there is nothing to put back.' };
+    }
+    if (card.landing !== 'main') {
+        return {
+            outcome: 'refused',
+            because: `Finished work in ${card.codebaseName} does not go onto ${card.base}, so nothing `
+                + 'was merged. The work is on its branch.',
+        };
+    }
+    try {
+        /* THE COMMIT FIRST, AND ITS ABSENCE IS NOT A FAILURE. Between the answer and
+           this re-arm every run on the card has ended, so the sweep may already have
+           committed the copy and taken it away; `workingDirectory` has just rebuilt
+           it from the branch, and the only difference is that there is nothing left
+           to commit. */
+        commitCardWork(card.folder, `${card.codebaseName}'s copy of this card on branch ${card.branch}`);
+        mergeIntoBase(card.source, card.branch, card.base, card.codebaseName);
+        return { outcome: 'landed', branch: card.branch, base: card.base };
+    }
+    catch (error) {
+        return {
+            outcome: 'refused',
+            because: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 /**
  * ═══ NOTHING IN THIS FILE STAMPS A COLUMN FROM THIS MACHINE'S CLOCK ANY MORE,
@@ -292,7 +349,7 @@ function byCard(taken) {
  * `levelOnePrompt` for the measured failure this closes.
  *
  * THE NAME IS RESOLVED, NOT READ OFF THE RECEIPT, through the one function
- * `cs3 show` uses for it. `label` is written when the thing is made and the
+ * `cs show` uses for it. `label` is written when the thing is made and the
  * coordinator may rename the thing on the next turn; printing the label then
  * hands the agent the name of a different, real object. One owner for that,
  * because two would eventually disagree about which name a card is showing.
@@ -344,6 +401,75 @@ export const briefFor = (title, turns, produced, attachments, codebases = null)
     identity: codebase.gitRemoteUrl,
     located: hasCheckoutForCodebase(codebase),
 })) ?? null);
+/**
+ * ═══ THE MANDATE IN FRONT OF THE PROMPT, AT EVERY ONE OF THE FIVE STARTS. ═══
+ *
+ * 19/project-context-7b, contract point 1: everything written under Agent
+ * instructions reaches every panel agent, at levels 1, 2 and 3, before it acts.
+ * Five call sites start a process (`answerCard`, `startChild`, `resumeRun`,
+ * `startRearmed`, `activateOwner`), and this is the one place the block and a
+ * prompt are put together, so the wording and the ordering cannot drift between
+ * them. The READ is `standingRulesFor` and the WORDS are `standingRules`; this
+ * is only the join.
+ *
+ * ═══ AND IT IS APPLIED TO WHAT `startAgent` IS HANDED, NEVER TO WHAT
+ *     `recordProcess` WRITES. ═══ Contract point 2 lives or dies on that
+ * distinction. `panel3_runs.brief` is the immutable brief and every respawn
+ * replays it, so a block folded into the stored brief would be a snapshot of the
+ * rules as they stood at dispatch, replayed on top of a fresh copy at every
+ * later start — two sets of rules in one prompt, the stale one first. Keeping it
+ * out means the stored brief is byte-identical with and without this feature,
+ * which is asserted rather than assumed.
+ *
+ * ═══ NO WRAPPER AROUND THE FIVE STARTS. ═══ `startAgent` is synchronous and the
+ * five sites have five different endings (see `run.ts`'s own note at the level 1
+ * start: `endRun` with a level fork at two of them, `giveUp` at two more). The
+ * READ therefore sits inside each site's existing `try`, taking that site's
+ * ending, so a failure to read the mandate ends the run the way that path
+ * already ends runs and never starts a process without it (contract point 3).
+ * What is shared is the loader and the builder — which is where drift would
+ * actually happen.
+ */
+// Exported for the same reason `briefFor` is: the seam this feature crosses is
+// the string handed to `startAgent`, and a test over `toolHandler('dispatch')`
+// would prove nothing about it — `caller.dispatch` is injected, so it stops
+// upstream of this composer.
+export const withStandingRules = (documents, prompt, 
+/* ═══ OPTIONAL, SO THE FOUR SITES WITH A CODEBASE GAIN IT AND NOTHING ELSE
+   MOVES. ═══ worktrees-8's three sentences about the card's own copy join
+   here rather than in the brief, for the same reason the rules do: the brief
+   is immutable and replayed, and the branch is not known when it is composed.
+   Under the rules, because a standing rule the people wrote outranks a fact
+   about the machine. */
+whereYouAre = [], 
+/* ═══ WHAT THE PERSON HAS ATTACHED, RIGHT NOW, FOR THE OWNER THAT LIVES FOR
+   THE WHOLE CARD. ═══ attaching-after-the-fact-10. Its own parameter rather
+   than folded into `whereYouAre`, which is worktrees-8's sentences about the
+   card's copy of the codebase: what is attached is not a fact about the
+   machine, and `where.block` is `[]` for a level 2 owner on a record-only
+   card, so folding in would produce a leading blank with no separator.
+
+   ═══ ABOVE THE RULES, BECAUSE THE RULES SAY IT OUTRANKS THEM. ═══
+   `standingRules`' own precedence line ranks what the person attached above
+   the rules; rendering it underneath would put it below a block saying it
+   wins. Already carries its own header and its own leading blank, which this
+   join absorbs the same way it absorbs `whereYouAre`'s. */
+whatIsAttached = []) => {
+    /* `whatWasAttached` begins its array with a blank, since its two other
+       callers join it onto lines already above it. Here it is the first thing in
+       the prompt, and a prompt that opens on an empty line is a prompt with a
+       stray blank at the top, so the leading blanks are dropped and the separator
+       below is this join's own. */
+    const attached = [...whatIsAttached];
+    while (attached[0] === '')
+        attached.shift();
+    const block = [
+        ...(attached.length === 0 ? [] : [...attached, '']),
+        ...standingRules(documents),
+        ...(whereYouAre.length === 0 ? [] : ['', ...whereYouAre]),
+    ];
+    return block.length === 0 ? prompt : [...block, '', prompt].join('\n');
+};
 // ---------------------------------------------------------------------------
 // WRITES. Every one goes through the shared guard in `client.ts`, which returns
 // the rows or throws. `.select()` on each is what makes that possible: a
@@ -554,7 +680,7 @@ async function runNow(client, runId) {
  * ═══ NEVER INTO `report`, WHICH IS THE RUN'S OWN WORDS. ═══ `report` is what a
  * respawn is handed, and this build starts settled runs again — an answered
  * question does exactly that — so a reason written there would destroy the state
- * the next attempt was going to resume from, and `cs3 show` would print the
+ * the next attempt was going to resume from, and `cs show` would print the
  * daemon's sentence under a heading that says the run wrote it. One owner per
  * column: the run writes `report`, whoever ended it writes `failed_because`.
  *
@@ -615,7 +741,7 @@ async function setCardState(client, cardId, state) {
  * ═══ THERE IS NOTHING TO UNDO HERE, AND THAT IS THE POINT. ═══ The take wrote
  * the run row in the same statement that leased the turns, so this function is
  * never in the position of holding a lease it cannot honour: whatever it fails
- * at, the row exists, `cs3 show` can see it, and recovery can reach it. The
+ * at, the row exists, `cs show` can see it, and recovery can reach it. The
  * earlier version wrote the row two round trips later and had to hand the turns
  * back on failure — which covered a thrown error and not a kill, and a kill in
  * that window stranded the card forever.
@@ -653,8 +779,22 @@ async function answerCard(client, tools, machineId, cardId, turns) {
        database, whose messages name tables and columns and never a local path, so
        constraint 6 is satisfied without a level fork here. */
     let brief;
+    /* WHERE IT RUNS AND WHAT IT IS TOLD ABOUT THE CODEBASES, THROUGH THE SAME
+       SEAM AS EVERY OTHER SPAWN. A level 1 run works in an empty directory of the
+       user's own, and it is the fifth start site rather than a special case: the
+       generated git block reaches every level, and one place resolving it is what
+       makes that true without four copies of the read. */
+    let where;
+    /* THE MANDATE IS READ IN THE SAME WINDOW AND UNDER THE SAME RULE. A launcher
+       is an agent like any other and gets the project's standing rules before it
+       decides anything, and a read that fails must not read as "this project has
+       no rules" — that is a different project than the one the person is on. So it
+       joins the three reads above inside this ending rather than beside it. */
+    let rules;
     try {
         brief = briefFor(turns[0].card_title, turns, await receiptsFor(client, cardId), await attachmentsFor(client, cardId), await codebasesForRun(client, runId));
+        rules = await standingRulesFor(client, runId);
+        where = await workingDirectory(client, runId, LEVEL, false);
     }
     catch (error) {
         const why = error instanceof Error ? error.message : String(error);
@@ -670,9 +810,12 @@ async function answerCard(client, tools, machineId, cardId, turns) {
     /* AN EMPTY DIRECTORY OF THE USER'S OWN, because level 1 has no code tool to
        use a real one with, and the daemon's inherited cwd under a launchd login
        item is the filesystem root. */
-    const started = startAgent(brief, LEVEL, tools.urlFor(runId), scratchDir());
+    const started = startAgent(withStandingRules(rules, brief, where.block), LEVEL, tools.urlFor(runId), where.cwd);
     out(`run      ${runId}  level ${LEVEL}  ${started.pid ? `pid ${started.pid}` : 'no process'}`);
     try {
+        /* THE BRIEF, NOT WHAT THE PROCESS WAS HANDED. The rules are current at the
+           activation and the brief is immutable, so storing the composed string
+           would freeze one inside the other and every respawn would replay it. */
         await recordProcess(client, runId, started.pid, brief);
     }
     catch (error) {
@@ -720,16 +863,178 @@ async function codebaseOfRun(client, runId) {
     }
     return codebase;
 }
+/**
+ * ═══ THE CARD'S OWN COPY, AND THE BRANCH IT IS ON, STAMPED BEFORE IT IS USED.
+ *     ═══
+ *
+ * The card is the unit of isolation, so the branch is derived from the card and
+ * every run on that card resolves to the same one. A run that finds a branch
+ * already stamped by a sibling takes it rather than deriving again: the
+ * derivation is pure today and stops being pure the moment the pattern becomes
+ * a setting, and one card on two branches is the defect this whole slice exists
+ * to prevent.
+ *
+ * ═══ THE STAMP IS WRITTEN HERE, WHERE ITS FAILURE CAN STOP THE RUN. ═══ Not in
+ * `recordProcess`, whose failure is deliberately non-fatal at all five sites: a
+ * stamp allowed to silently not happen cannot carry "a resumed run returns to
+ * the same copy". This is before `startAgent`, so a failure to write it is a run
+ * that never started rather than a run whose copy nobody can find again.
+ */
+async function cardWorktree(client, runId, codebase) {
+    const rows = await returned(client.from('panel3_runs')
+        .select('card_id, branch, base, card:panel3_cards!panel3_runs_card_id_fkey(title)')
+        .eq('id', runId), 'read', `which card and branch run ${runId} is on`);
+    const row = rows[0];
+    if (!row)
+        throw new Error(`run ${runId} is not on the record any more`);
+    /* THE CARD'S OWN ANSWER FIRST, from whichever of its runs has one. Asked only
+       when this run has none of its own, so a resumed run costs one read. The
+       BASE travels with the branch, in one row and one read: they were written
+       together and a card cut from `develop` may not be told later that it goes
+       back to `main` because a teammate changed the setting. */
+    const sibling = row.branch !== null ? null : (await returned(client.from('panel3_runs')
+        .select('branch, base')
+        .eq('card_id', row.card_id)
+        .not('branch', 'is', null)
+        .limit(1), 'read', `the branch card ${row.card_id} is working on`))[0] ?? null;
+    const stamped = {
+        branch: row.branch ?? sibling?.branch ?? null,
+        base: row.base ?? sibling?.base ?? null,
+    };
+    /* ═══ THE TEAM'S RULES, READ AT THE START AND NOT CARRIED. ═══ Same argument
+       as the standing rules beside them: a rule edited while a conversation is
+       running has to govern the rest of it, and the only way that is true is if
+       the read happens here rather than once, at dispatch. */
+    /* THE PROJECT COMES OFF THE RUN'S OWN CARD, which is where the codebase came
+       from too: the rules are the organization's, and the organization is reached
+       through the project rather than through the codebase row, which `panel3/`
+       may not name. */
+    const projectId = await projectOfRun(client, runId);
+    if (!projectId) {
+        /* UNREACHABLE THROUGH `codebaseOfRun`, WHICH REFUSES A RUN WITH NO PROJECT,
+           and said out loud rather than papered over with an empty id: the rules are
+           the organization's, and there is no organization without a project. */
+        throw new Error('This code work is not filed under a project, so its codebase has no rules.');
+    }
+    const rules = await gitRulesFor(client, codebase.id, projectId);
+    const { folder, branch, base, source } = worktreeForCard(codebase, row.card_id, row.card?.title ?? '', stamped, hostname(), { baseBranch: rules.base_branch, branchPattern: rules.branchPattern });
+    if (row.branch !== branch || row.base !== base) {
+        await returned(client.from('panel3_runs').update({ branch, base }).eq('id', runId).select('id'), 'record which branch this run is on', `run ${runId}`);
+    }
+    await refreshBaseProtection(client, codebase, rules, source, base);
+    return {
+        cwd: folder,
+        block: workingRules({
+            codebase: codebase.name,
+            branch,
+            base,
+            landing: rules.landing,
+            branchPattern: rules.branchPattern,
+        }),
+        /* ═══ HANDED BACK RATHER THAN DISCARDED. ═══ The landing needs the folder,
+           the branch, the base and the repository the copy was made from, all of
+           which have just been resolved here. Resolving them again at the ending
+           would be a second answer to one question, free to disagree with this one. */
+        card: { folder, branch, base, source, landing: rules.landing, codebaseName: codebase.name },
+    };
+}
+/**
+ * ═══ WHETHER THE BASE BRANCH IS PROTECTED, ASKED WHILE THIS MACHINE IS ALREADY
+ *     HOLDING THE REPOSITORY OPEN. ═══
+ *
+ * The browser cannot answer it and the product stores no platform credential, so
+ * the machine with the checkout answers it through the developer's own `gh`.
+ * Asked only when the record has no answer, so a codebase whose protection is
+ * known costs nothing, and never turned into a SETTING: it is an observation
+ * that feeds the detected default, and `landing` stays null until a person
+ * chooses.
+ *
+ * ═══ SAID, NEVER FATAL. ═══ This is a fact about the remote, not about the
+ * work. A card that could not record an observation still runs.
+ */
+async function refreshBaseProtection(client, codebase, rules, source, base) {
+    if (rules.base_protected !== null)
+        return;
+    try {
+        const observed = detectBaseProtection(source, base);
+        if (observed !== null)
+            await recordBaseProtection(client, codebase.id, observed);
+    }
+    catch (error) {
+        said(`could not check whether ${base} is protected: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+/**
+ * ═══ WHAT THE COORDINATOR IS TOLD ABOUT EACH CODEBASE IT MAY SEND WORK TO. ═══
+ *
+ * Story 6 scenario 4: levels 1, 2 and 3 each receive the block verbatim. A level
+ * 1 run has no codebase of its own by design, and the block is codebase-scoped,
+ * so at level 1 it is rendered once PER REGISTERED CODEBASE. That is the same
+ * text rather than a summary of it, and it is what stops a coordinator writing a
+ * brief that contradicts the rules the worker it dispatches will be handed.
+ *
+ * ═══ AND IT CARRIES THE ONE QUESTION ONLY THE COORDINATOR CAN ASK. ═══ Story 3
+ * scenario 3: a codebase whose base branch is genuinely ambiguous has to be
+ * settled by a person, once, and the daemon cannot ask anybody. The coordinator
+ * can, it holds `ask_question` already, and it needs the fact BEFORE it
+ * dispatches. So the fact and the options arrive here, at the activation, beside
+ * the block.
+ *
+ * ═══ NOT THROUGH `briefFor`. ═══ That output is `panel3_runs.brief`, which is
+ * immutable and replayed at every respawn, so a coordinator resumed a week later
+ * would be told to ask about a branch somebody settled on Tuesday.
+ */
+async function coordinatorGitBlock(client, runId) {
+    const projectId = await projectOfRun(client, runId);
+    /* A CARD FILED UNDER NO PROJECT HAS NO CODEBASES AND NO RULES, which is a
+       fact rather than a failure: level 1 answers plenty of cards that never touch
+       code. */
+    if (!projectId)
+        return [];
+    const codebases = await listCodebases(client, projectId);
+    if (codebases.length === 0)
+        return [];
+    const blocks = [];
+    for (const codebase of codebases) {
+        const rules = await gitRulesFor(client, codebase.id, projectId);
+        /* A CODEBASE THIS MACHINE HAS NOT LOCATED ANSWERS NEITHER WAY, and is left
+           out rather than guessed at: `briefFor` already tells the coordinator which
+           codebases are located here, and inventing rules for one nobody can see
+           would be a block about a repository this run cannot reach. */
+        const state = baseBranchState(codebase, rules.base_branch);
+        if (state === null)
+            continue;
+        blocks.push([
+            ...workingRules({
+                codebase: codebase.name,
+                branch: null,
+                base: 'settled' in state ? state.settled : null,
+                landing: rules.landing,
+                branchPattern: rules.branchPattern,
+            }),
+            ...('candidates' in state ? [
+                `Nobody has said which branch finished work in ${codebase.name} should go back to, and this`,
+                'machine cannot tell. Before you send anybody into it, ask the person with `ask_question`,',
+                'once, offering these as the options and using no git word except "branch":',
+                state.candidates.join(', '),
+                `Then record their answer with \`set_main_branch\` for codebase id ${codebase.id}. It is`,
+                'stored on the codebase, so nobody is asked again.',
+            ] : []),
+        ]);
+    }
+    return blocks.flatMap((block, index) => (index === 0 ? block : ['', ...block]));
+}
 /** One directory rule for every spawn whose level and ownership are known. */
 async function workingDirectory(client, runId, level, isOwner, knownCodebase) {
-    if (level === 1)
-        return scratchDir();
+    if (level === 1) {
+        return { cwd: scratchDir(), block: await coordinatorGitBlock(client, runId), card: null };
+    }
     if (knownCodebase === null) {
         if (level === 2 && isOwner)
-            return scratchDir();
+            return { cwd: scratchDir(), block: [], card: null };
         throw new Error('This code work does not name a registered project codebase.');
     }
-    return checkoutForCodebase(knownCodebase ?? await codebaseOfRun(client, runId), hostname());
+    return cardWorktree(client, runId, knownCodebase ?? await codebaseOfRun(client, runId));
 }
 /**
  * ═══ ONE AGENT, STARTED UNDER ANOTHER THAT IS STILL RUNNING. ═══
@@ -777,13 +1082,18 @@ async function startChild(client, tools, machineId, parentRunId, brief, codebase
         throw new Error(why);
     }
     const level = row.run_level;
-    let cwd;
+    let where;
     let prompt;
+    /* READ AGAINST THE CHILD'S OWN RUN ROW, NOT THE PARENT'S. The row already
+       exists (`panel3_dispatch` wrote it above) and it carries this child's
+       codebase, which is what decides which codebase-scoped rules it is under. */
+    let rules;
     try {
-        cwd = await workingDirectory(client, row.run_id, level, level === 2, codebase);
+        where = await workingDirectory(client, row.run_id, level, level === 2, codebase);
         prompt = level === 2
             ? await initialOwnerPrompt(client, row.run_card_id, parentRunId, brief)
             : brief;
+        rules = await standingRulesFor(client, row.run_id);
     }
     catch (error) {
         const why = error instanceof Error ? error.message : String(error);
@@ -792,7 +1102,7 @@ async function startChild(client, tools, machineId, parentRunId, brief, codebase
     }
     const processToken = row.process_token ?? undefined;
     const isOwner = level === 2;
-    const started = startAgent(prompt, level, tools.urlFor(row.run_id, processToken), cwd, isOwner ? { ownerId: row.run_id } : undefined);
+    const started = startAgent(withStandingRules(rules, prompt, where.block), level, tools.urlFor(row.run_id, processToken), where.cwd, isOwner ? { ownerId: row.run_id } : undefined);
     if (started.pid === null) {
         /* THERE IS A ROW AND THERE IS NO PROCESS, which is the one shape the record
            must never be left in quietly. The answer is already settled — nothing ran
@@ -1174,14 +1484,20 @@ function settle(client, tools, machineId, level, runId, cardId, started, speaksT
  * about the failure it was holding.
  */
 async function resumeRun(client, tools, machineId, runId, afterPid) {
-    /* ═══ THE SWEEP RESOLVES ITS WORKING COPY BEFORE THE CLAIM AND THE RETRY
-       CANNOT, AND `afterPid` IS THE WHOLE OF WHAT DECIDES IT. ═══ Said once, here.
-       See the header for both halves of the argument: a machine with no checkout
-       must not take a run it cannot start, and the level a retry needs the answer
-       for is not known until the claim returns. */
-    const sweptCwd = afterPid === null
-        ? checkoutForCodebase(await codebaseOfRun(client, runId), hostname())
-        : null;
+    /* ═══ THE SWEEP CHECKS BEFORE THE CLAIM AND THE RETRY CANNOT, AND `afterPid`
+       IS THE WHOLE OF WHAT DECIDES IT. ═══ Said once, here. See the header for
+       both halves of the argument: a machine with no checkout must not take a run
+       it cannot start, and the level a retry needs the answer for is not known
+       until the claim returns.
+  
+       ═══ IT IS THE EXISTENCE CHECK AND NOTHING MORE, WHICH IS WHAT CHANGED IN
+       worktrees-8. ═══ Resolving the working copy now CREATES a branch, a folder
+       and a row write, and every poll tick that loses the claim race would leave
+       that debris behind for a run it never took. So the pre-claim question stays
+       "does this machine have this codebase at all", which is the only question
+       this position was ever asking, and the copy is made after the claim. */
+    if (afterPid === null)
+        checkoutForCodebase(await codebaseOfRun(client, runId), hostname());
     const { data, error } = await client.rpc('panel3_resume', {
         p_run_id: runId,
         p_machine_id: machineId,
@@ -1202,39 +1518,34 @@ async function resumeRun(client, tools, machineId, runId, afterPid) {
         await giveUp(client, runId, why);
         throw new Error(why);
     }
-    /* NON-NULL EXACTLY WHEN THE SWEEP RESOLVED ONE, which is the rule stated at
-       the assignment above. Branching on the VALUE rather than testing `afterPid`
-       a second time is what keeps the resolution and its use from being able to
-       disagree: whatever the sweep resolved is what the sweep runs in. */
-    let cwd;
-    if (sweptCwd !== null) {
-        cwd = sweptCwd;
+    /* ONE RESOLUTION FOR BOTH PATHS, AFTER THE CLAIM. It used to fork on whether
+       the sweep had already resolved a folder before the claim; since the copy is
+       the card's own and making it writes, both paths make it here, in the branch
+       that can end the run when it cannot be made. */
+    let where;
+    try {
+        where = await workingDirectory(client, runId, level, false);
     }
-    else {
-        try {
-            cwd = await workingDirectory(client, runId, level, false);
-        }
-        catch (error) {
-            /* ═══ THE REASON IS WRITTEN TO THE DATABASE, SO IT MAY NOT CARRY A PATH.
-               ═══ Constraint 6, and `startRearmed`'s own handling of the same two
-               calls: `workingCopy()` is already careful about this and says so;
-               `scratchDir()` is not, because it is `mkdirSync`, whose EACCES and
-               ENOTDIR messages name the directory they failed on. So the machine's own
-               error is kept for stderr and the record is told only what is true and
-               shareable. */
-            const stderrOnly = error instanceof Error ? error.message : String(error);
-            const why = level === 1
-                ? 'this machine could not make the empty directory this runs in'
-                : stderrOnly;
-            /* ═══ AND IT ENDS THE WAY A RUN OF THIS LEVEL ENDS. ═══ It was
-               `panel3_give_up` outright, which was right while only a dispatched run
-               could reach this function and is a leak now that the retry brings level
-               1 here: handing the person's message back mints a new run with its
-               attempts at one, which is the bound the retry is under, undone by the
-               one path that could not start. See `endRun`. */
-            await endRun(client, level, runId, claimed.run_card_id, why);
-            throw new Error(`NO AGENT IS RUNNING: ${level === 1 ? stderrOnly : why}`);
-        }
+    catch (error) {
+        /* ═══ THE REASON IS WRITTEN TO THE DATABASE, SO IT MAY NOT CARRY A PATH.
+           ═══ Constraint 6, and `startRearmed`'s own handling of the same two
+           calls: `worktreeForCard()` is already careful about this and says so;
+           `scratchDir()` is not, because it is `mkdirSync`, whose EACCES and
+           ENOTDIR messages name the directory they failed on. So the machine's own
+           error is kept for stderr and the record is told only what is true and
+           shareable. */
+        const stderrOnly = error instanceof Error ? error.message : String(error);
+        const why = level === 1
+            ? 'this machine could not make the empty directory this runs in'
+            : stderrOnly;
+        /* ═══ AND IT ENDS THE WAY A RUN OF THIS LEVEL ENDS. ═══ It was
+           `panel3_give_up` outright, which was right while only a dispatched run
+           could reach this function and is a leak now that the retry brings level
+           1 here: handing the person's message back mints a new run with its
+           attempts at one, which is the bound the retry is under, undone by the
+           one path that could not start. See `endRun`. */
+        await endRun(client, level, runId, claimed.run_card_id, why);
+        throw new Error(`NO AGENT IS RUNNING: ${level === 1 ? stderrOnly : why}`);
     }
     /* WHAT IT SENT OTHERS TO DO, FROM THE RECORD. Level 3 has no `dispatch`, so it
        has no children to have: null says that, where an empty list would say it
@@ -1247,14 +1558,36 @@ async function resumeRun(client, tools, machineId, runId, afterPid) {
        time: ux.md's single most expensive failure. `startRearmed` reads it the
        same way, for the same reason. */
     const children = level === 3 ? null : await childrenOf(client, runId);
+    /* ═══ READ AGAIN ON EVERY START, WHICH IS THE WHOLE OF CONTRACT POINT 2. ═══
+       A resumed or retried run is handed the rules AS THEY STAND NOW, not as they
+       stood when it first began: a rule edited while the conversation was running
+       governs the rest of it, and a rule deleted while it was running stops
+       applying to it. That is only true because this read happens here rather than
+       once, at the top of the run's life.
+  
+       ═══ AND IT ENDS THE WAY THIS PATH ALREADY ENDS. ═══ The claim has already
+       happened, so a throw here would leave a run reading `running` with no
+       process. `endRun` with the level fork is this path's own ending (see the cwd
+       branch above for why level 1 may not simply be given up on), and the reason
+       is a `returned()` message naming tables and columns, which carries no local
+       path and is therefore shareable. */
+    let rules;
+    try {
+        rules = await standingRulesFor(client, runId);
+    }
+    catch (error) {
+        const why = error instanceof Error ? error.message : String(error);
+        await endRun(client, level, runId, claimed.run_card_id, why);
+        throw new Error(`NO AGENT IS RUNNING: ${why}`);
+    }
     const started = startAgent(
     /* ═══ WHY IT DIED IS WHAT DIFFERS, AND IT IS TOLD THE TRUTH ABOUT IT. ═══
        `resumePrompt` opens by saying the machine went down, which is true of the
        sweep and false of a retry: the daemon that watched this harness exit is
        still running. See `retryPrompt`. */
-    afterPid === null
+    withStandingRules(rules, afterPid === null
         ? resumePrompt(claimed.run_brief, claimed.run_report, children)
-        : retryPrompt(claimed.run_brief, claimed.run_report, children), level, tools.urlFor(runId), cwd);
+        : retryPrompt(claimed.run_brief, claimed.run_report, children), where.block), level, tools.urlFor(runId), where.cwd);
     if (started.pid === null) {
         /* THE CLAIM HAPPENED AND NO PROCESS DID, which is the one shape the record
            must never be left in quietly. Same handling as a dispatch that could not
@@ -1302,7 +1635,7 @@ async function resumeRun(client, tools, machineId, runId, afterPid) {
  * what stops one question, or one set of finished workers, spawning forever. The cost is that this cannot decline afterwards: a run claimed and not
  * started would sit `running` with no process and its question already spent. So
  * every failure below ends the run with its reason, which is visible on the card
- * and in `cs3 show`, rather than quietly hoping the next poll finds it.
+ * and in `cs show`, rather than quietly hoping the next poll finds it.
  */
 async function startRearmed(client, tools, machineId, row) {
     const level = row.run_level === 1 ? 1 : row.run_level === 2 ? 2 : 3;
@@ -1311,16 +1644,16 @@ async function startRearmed(client, tools, machineId, row) {
         await giveUp(client, row.run_id, why);
         throw new Error(why);
     }
-    let cwd;
+    let where;
     try {
-        cwd = await workingDirectory(client, row.run_id, level, false);
+        where = await workingDirectory(client, row.run_id, level, false);
     }
     catch (error) {
         /* ═══ THE REASON IS WRITTEN TO THE DATABASE, SO IT MAY NOT CARRY A PATH.
            ═══ Constraint 6. `workingCopy()` is already careful about this and says
            so; `scratchDir()` is not — it is `mkdirSync`, whose EACCES and ENOTDIR
            messages name the directory they failed on — and `failed_because` is a
-           column `cs3 show` prints. So the machine's own error is kept for stderr
+           column `cs show` prints. So the machine's own error is kept for stderr
            and the record is told only what is true and shareable. */
         const said = error instanceof Error ? error.message : String(error);
         const why = level === 1
@@ -1339,6 +1672,14 @@ async function startRearmed(client, tools, machineId, row) {
     const deliveredArtifact = row.ask_id !== null && row.mine
         ? await rearmedArtifactAnswer(client, row.ask_id)
         : null;
+    /* ═══ THE MERGE HAPPENS HERE, OFF THE MARK ON THE ASK, BEFORE THE AGENT THAT
+       WILL SPEAK ABOUT IT IS STARTED. ═══ The re-arm is the last thing that runs
+       before the spawn, which is why it is the only place the outcome can reach
+       the prompt. See `landCardWork`. */
+    const offered = row.ask_id !== null && row.mine
+        ? await landingOffer(client, row.ask_id)
+        : null;
+    const landing = offered === null ? null : landCardWork(where, offered);
     /* ═══ THREE REASONS, AND THE ROW SAYS WHICH. ═══ No question is ux.md's third
        re-arm: everybody it sent has finished, and it is started to read them back.
        `children` cannot be null on that path — only a run with children is ever
@@ -1347,9 +1688,21 @@ async function startRearmed(client, tools, machineId, row) {
     const prompt = row.ask_id === null
         ? readBackPrompt(row.run_brief, row.run_report, children ?? [])
         : row.mine
-            ? answerPrompt(row.run_brief, row.run_report, children, row.question ?? '', row.answer ?? '', deliveredArtifact)
+            ? answerPrompt(row.run_brief, row.run_report, children, row.question ?? '', row.answer ?? '', deliveredArtifact, landing)
             : escalationPrompt(row.run_brief, row.run_report, children, row.ask_id, row.question ?? '');
-    const started = startAgent(prompt, level, tools.urlFor(row.run_id), cwd);
+    /* CURRENT AT THIS ACTIVATION, exactly as on the resume path, and ended the
+       same way: the re-arm's claim has already happened, so a failure here ends
+       the run with its reason rather than leaving it claimed with no process. */
+    let rules;
+    try {
+        rules = await standingRulesFor(client, row.run_id);
+    }
+    catch (error) {
+        const why = error instanceof Error ? error.message : String(error);
+        await endRun(client, level, row.run_id, row.run_card_id, why);
+        throw new Error(`NO AGENT IS RUNNING: ${why}`);
+    }
+    const started = startAgent(withStandingRules(rules, prompt, where.block), level, tools.urlFor(row.run_id), where.cwd);
     if (started.pid === null) {
         const answer = await started.answered;
         const reason = answer.ok ? 'the process ended before it could be identified' : answer.reason;
@@ -1469,7 +1822,7 @@ export async function initialOwnerPrompt(client, cardId, launcherRunId, brief) {
 }
 /** Only facts delivered by this activation enter an already-resumed native
  * conversation. Older visible turns are already in that conversation. */
-export function ownerContinuationPrompt(brief, report, events, children, delivered) {
+export function ownerContinuationPrompt(brief, report, events, children, delivered, landing = null) {
     const messages = events.filter((event) => event.kind === 'user' && event.needsReply);
     return [
         'CONTINUE THE CTRL+SPC CONVERSATION YOU ALREADY OWN.',
@@ -1485,6 +1838,7 @@ export function ownerContinuationPrompt(brief, report, events, children, deliver
             `Question ${delivered.id}: ${delivered.question}`,
             `Answer: ${delivered.answer ?? '(no answer text)'}`,
             ...presentedArtifactAnswerContext(delivered.artifactAnswer),
+            ...landingOutcomeContext(landing),
         ] : [
             '',
             'A WORKER NEEDS YOUR DECISION',
@@ -1528,7 +1882,16 @@ async function activateOwner(client, tools, machineId, runId, afterProcessToken
         return null;
     const machineHarness = harness();
     const resumeSessionId = resumableOwnerSessionId(candidate, machineId, machineHarness);
-    const cwd = await ownerDirectory(client, candidate);
+    /* ═══ THE EXISTENCE CHECK BEFORE THE CLAIM, AND THE COPY AFTER IT. ═══ This
+       was the whole resolution, which was right while resolving meant reading a
+       folder out of a file. Since worktrees-8 it also CREATES one, and a daemon
+       that lost the activation race would leave a branch and a folder behind for
+       an owner it never activated. The refusal this position exists for — a
+       machine that does not have this codebase must not take the activation —
+       is unchanged, because it is the located checkout that answers it. */
+    if (candidate.codebase_id !== null) {
+        checkoutForCodebase(await codebaseOfRun(client, candidate.id), hostname());
+    }
     const { data, error } = await client.rpc('panel3_take_owner_activation', {
         p_run_id: runId,
         p_machine_id: machineId,
@@ -1553,8 +1916,60 @@ async function activateOwner(client, tools, machineId, runId, afterProcessToken
         mine: claimed.mine === true,
         artifactAnswer: currentArtifactAnswer,
     };
+    /* ═══ AFTER THE CLAIM, SO THE ENDING IS THE ONE THIS PATH HAS. ═══ Every
+       failure below the claim ends the activation with `giveUp` and its process
+       token; a throw above it would merely be an activation that did not happen.
+  
+       ═══ AND IT MATTERS MOST HERE. ═══ This is the owner, which lives for the
+       whole card and whose native session is RESUMED, so it is the one agent that
+       can be running while a person edits or deletes a rule. Reading at every
+       activation is what makes an edit govern the rest of the conversation, and
+       the block's own supersession sentence is what makes a DELETION take effect
+       in a session that still holds the older copy.
+  
+       ═══ AND IT IS BEFORE THE PROMPT SINCE worktrees-8 C1, because the prompt now
+       says what the product DID with the person's answer, and the landing needs
+       the card's copy. Nothing in the prompt depended on it before. */
+    let rules;
+    /* THE CARD'S COPY IS MADE IN THE SAME WINDOW AND UNDER THE SAME ENDING, for
+       the reason the check above gives: it writes, so it happens after the claim,
+       and a failure to make it is an activation that ends rather than one that
+       sits `running` with no process. */
+    let where;
+    /* ═══ AND WHAT IS ATTACHED, READ IN THE SAME WINDOW AND UNDER THE SAME
+       ENDING. ═══ attaching-after-the-fact-10: a person may attach to a card that
+       is already running, and the owner's brief is immutable, so the only account
+       of attachments it would otherwise get is the one frozen at dispatch. Read
+       at every activation, exactly as the rules are, and for the same reason a
+       failed read ends the activation rather than continuing: "nothing is
+       attached" is a different card from the one the person sent.
+  
+       THE CODEBASE LINES ARE DROPPED. `whatWasAttached` partitions those into a
+       section whose own text says "its one codebase is named separately below",
+       a forward reference to something `workBrief` supplies and an owner
+       activation does not. This block carries the PERSON's attachments; where the
+       owner is working is `where.block`'s answer. */
+    let attached;
+    try {
+        where = await ownerDirectory(client, candidate);
+        rules = await standingRulesFor(client, runId);
+        attached = whatWasAttached((await attachmentsFor(client, claimed.run_card_id))
+            .filter((line) => !line.startsWith('codebase  ')));
+    }
+    catch (error) {
+        const why = error instanceof Error ? error.message : String(error);
+        await giveUp(client, runId, why, claimed.process_token);
+        throw new Error(`NO AGENT IS RUNNING: ${why}`);
+    }
+    /* THE MERGE, OFF THE MARK ON THE ASK, BEFORE THE AGENT THAT WILL SPEAK ABOUT
+       IT IS STARTED. The owner reaches an answer by this route as often as by the
+       re-arm, which is why the artifact answer is read on both and this is too. */
+    const offered = claimed.ask_id !== null && claimed.mine === true
+        ? await landingOffer(client, claimed.ask_id)
+        : null;
+    const landing = offered === null ? null : landCardWork(where, offered);
     const prompt = resumeSessionId
-        ? ownerContinuationPrompt(claimed.run_brief, claimed.run_report, events, children, delivered)
+        ? ownerContinuationPrompt(claimed.run_brief, claimed.run_report, events, children, delivered, landing)
         : ownerActivationPrompt(claimed.run_brief, claimed.run_report, events, children, delivered !== null && !delivered.mine
             ? { id: delivered.id, question: delivered.question }
             : null, currentArtifactAnswer, 
@@ -1564,8 +1979,8 @@ async function activateOwner(client, tools, machineId, runId, afterProcessToken
            The sentences it adds say what to do and never why, because those three
            are not the same event and `prompt.ts` exists to stop an agent being
            told an untrue reason for its own restart. */
-        afterPid !== null);
-    const started = startAgent(prompt, 2, tools.urlFor(runId, claimed.process_token), cwd, { ownerId: runId, ...(resumeSessionId ? { resumeSessionId } : {}) });
+        afterPid !== null, landing);
+    const started = startAgent(withStandingRules(rules, prompt, where.block, attached), 2, tools.urlFor(runId, claimed.process_token), where.cwd, { ownerId: runId, ...(resumeSessionId ? { resumeSessionId } : {}) });
     if (started.pid === null) {
         const answer = await started.answered;
         const reason = answer.ok ? 'the process ended before it could be identified' : answer.reason;
@@ -2253,7 +2668,7 @@ export async function takeHandedBack(client, tools, machineId, mine, hold) {
  *
  * ═══ ONE LOOP, TWO CALLERS, AND THAT IS THE WHOLE OF recovery-1 SLICE 4. ═══
  * `startPanel` below is `cs start`'s entry and hands in the session the
- * installed CLI already holds. `cs3 run` is the acceptance harness's entry and
+ * installed CLI already holds. `panel3/cli.js run` is the acceptance harness's entry and
  * signs in from the environment against its own isolated account. Neither is a
  * copy of the other: a second poll loop would be two things leasing the same
  * turns with two ideas of what recovery may reap.
@@ -2262,6 +2677,135 @@ export async function takeHandedBack(client, tools, machineId, mine, hold) {
  * already has one. Its presence is also what says THIS PROCESS IS NOT v3's, so
  * the signals belong to somebody else — see the handler block below.
  */
+/**
+ * ═══ THE CARD IS OVER, SO ITS COPY GOES — AND THE BRANCH STAYS. ═══
+ *
+ * A SWEEP ON THE DAEMON'S OWN LOOP RATHER THAN A HOOK ON A RUN ENDING, and the
+ * reason is that there is no place the daemon learns a card ended. The `done`
+ * transition happens inside SQL, and `settle` fires per PROCESS at every level:
+ * a level 3 worker exiting while its level 2 owner is still editing the same
+ * tree would take the tree out from under it. So the question is asked of the
+ * record, of every run on the card, and a card with anything still running is
+ * passed over.
+ *
+ * ═══ THE FILESYSTEM IS ASKED FIRST, SO A MACHINE WITH NO COPIES ASKS NOTHING.
+ *     ═══ And the folders it finds are what bounds the query: only the codebases
+ * this machine actually holds a copy for.
+ *
+ * A folder no row explains is LEFT ALONE. Nothing here deletes something it
+ * cannot account for.
+ */
+async function sweepFinishedWorktrees(client) {
+    const held = worktreesOnThisMachine();
+    if (held.length === 0)
+        return;
+    /* ═══ ASKED IN TWO STEPS, BECAUSE THE TWO QUESTIONS ARE NOT THE SAME ONE.
+       ═══ WHICH CARD a folder belongs to is answered by the runs that carry a
+       branch, which are the runs in a codebase. WHETHER THAT CARD IS STILL BEING
+       WORKED is answered by ALL of its runs, and its level 1 coordinator has no
+       codebase at all — so a single query filtered by codebase would call a card
+       finished while the agent coordinating it was still going.
+  
+       Neither is filtered to this machine. The FOLDERS are this machine's, and
+       only a run here can be inside one, but "the card is over" is a fact about
+       the card, and a card dispatched across machines has runs elsewhere. */
+    const stamped = await returned(client.from('panel3_runs')
+        .select('card_id, codebase_id, branch')
+        .in('codebase_id', [...new Set(held.map((one) => one.codebaseId))])
+        .not('branch', 'is', null), 'read', 'which cards the copies on this machine belong to');
+    const cardOfFolder = new Map(held.map((one) => [one.folder, [...new Set(stamped
+                .filter((row) => (row.codebase_id === one.codebaseId && row.branch !== null && folderIsBranch(one.slug, row.branch)))
+                .map((row) => row.card_id))]]));
+    const cards = [...new Set([...cardOfFolder.values()].flat())];
+    if (cards.length === 0)
+        return;
+    const live = new Set((await returned(client.from('panel3_runs')
+        .select('card_id')
+        .in('card_id', cards)
+        .is('ended_at', null), 'read', 'which of those cards still have an agent going')).map((row) => row.card_id));
+    const touched = new Set();
+    for (const one of held) {
+        const cardIds = cardOfFolder.get(one.folder) ?? [];
+        if (cardIds.length === 0 || cardIds.some((cardId) => live.has(cardId)))
+            continue;
+        try {
+            settleCardWorktree(one.folder);
+            touched.add(one.codebaseId);
+            out(`cleaned  card copy for ${cardIds.join(', ')}`);
+        }
+        catch (error) {
+            /* SAID, NOT FATAL, AND NOT RETRIED HARDER. The work is committed or it is
+               not; either way the copy is still there and the next poll tries again.
+               Taking the daemon's loop down over cleanup would stop every card. */
+            said(`could not clean up a finished card's copy: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /* THE BASE LOCK LAST, AND ONLY WHERE SOMETHING WAS REMOVED. It is what makes
+       the refusal real for every other card in that codebase, so it survives
+       until none of them is left. */
+    for (const codebaseId of touched) {
+        try {
+            releaseBaseBranch(codebaseId);
+        }
+        catch { /* it is held, which is safe */ }
+    }
+}
+/** The last mismatch state this daemon said out loud, so a poll every two
+ *  seconds does not narrate the same standing fact thirty times a minute.
+ *
+ *  ═══ SAID ONCE PER STATE, NOT ONCE PER PROCESS. ═══ The same discipline v2's
+ *  `roleKey` (`orchestrator.ts`) uses for its own designation lines, and for the
+ *  same reason: the person re-designates while the daemon is running, so
+ *  "matching again" is a genuinely different state that they must hear about
+ *  too, while the unchanged one repeated is noise that buries every useful
+ *  line. Null means nothing has been said yet. */
+let saidHarnessState = null;
+/**
+ * ═══ THE DESIGNATION NAMES A HARNESS THIS DAEMON IS NOT, AND SOMEBODY HAS TO
+ *     SAY SO. ═══
+ *
+ * The take's agent filter lives in SQL and answers with zero rows, which is
+ * right — a daemon may not act outside its designation — but zero rows is also
+ * what "nothing is waiting" looks like, and the two are indistinguishable from
+ * the outside. This is the one place they can be told apart, because it is the
+ * only place that holds BOTH facts at once: the harness this process actually
+ * runs, and the harness the person has designated.
+ *
+ * ═══ IT DOES NOT REFUSE, RETRY OR RE-READ THE HARNESS. ═══ `CTRL_SPC_V3_AGENT`
+ * is fixed for the life of the process by design (`spawn.ts`: reported, never
+ * chosen), and honouring a switch by silently spawning the other binary would
+ * attribute a whole session of results to a harness that never ran. So the
+ * daemon keeps polling, keeps taking whatever it legitimately may, and says the
+ * one true sentence about why this particular work is not moving.
+ *
+ * ═══ AND A FAILED READ IS NOT A MISMATCH. ═══ Constraint 4, the same rule
+ * `designatedCoordinator` states: a read that failed does not mean nobody is
+ * designated, and it must not produce a sentence claiming to know which harness
+ * was chosen. It throws, and the poll's own catch treats it as a poll that did
+ * not finish — the next one is two seconds away.
+ */
+async function reportHarnessMismatch(client, machineId, machineHarness) {
+    const designation = await designatedCoordinator(client);
+    /* Nobody designated, or somebody else's machine: neither is this daemon
+       failing to honour anything. `panel3_take_turns` lets ANY machine take when
+       nothing is designated, and a designation naming another machine is that
+       machine's business — v2's own listener already says both of those
+       (`roleLine`'s 'none' and 'other-machine'), and repeating them here would be
+       two voices on one fact. */
+    const mismatched = designation !== null
+        && designation.machineId === machineId
+        && designation.agent !== machineHarness;
+    const state = mismatched ? `mismatch:${designation.agent}` : 'ok';
+    if (state === saidHarnessState)
+        return;
+    saidHarnessState = state;
+    if (!mismatched)
+        return;
+    said(`${designation.agent} is designated to coordinate on this machine, and this daemon runs `
+        + `${machineHarness}, so it will not pick work up. Nothing will act on what you send until `
+        + `this daemon is restarted with CTRL_SPC_V3_AGENT=${designation.agent}, or ${machineHarness} `
+        + 'is designated in the app.');
+}
 export async function run(args, injected) {
     let once = false;
     for (const arg of args) {
@@ -2358,7 +2902,7 @@ export async function run(args, injected) {
     for (;;) {
         /* ═══ ONE POLL FAILING IS NOT THE DAEMON FAILING. ═══ Every read and write
            here throws on a network or database error, by design (constraint 7), and
-           until Slice 4 that threw straight out of `cs3 run` and exited the process.
+           until Slice 4 that threw straight out of `panel3/cli.js run` and exited the process.
            Inside `cs start` that is no longer an honest outcome twice over: it would
            take the v2 presence heartbeat down with it, and it would leave a stranded
            card printing `cs start` at a person who IS running `cs start`, which is
@@ -2382,6 +2926,11 @@ export async function run(args, injected) {
             await killStopped(client, machineId);
             await reconcileOwnerSessions(client, machineId, machineHarness, new Set(inFlight.keys()));
             await recoverStranded(client, tools, machineId, new Set(inFlight.keys()), hold);
+            /* ═══ AND THE COPIES OF CARDS THAT ARE OVER. ═══ After recovery,
+               deliberately: a run this machine is about to resume is one whose card is
+               not finished, and the sweep asks the record after recovery has had its
+               say about what is really still running. */
+            await sweepFinishedWorktrees(client);
             /* ═══ AND THEN WHAT SOMEBODY ELSE'S MACHINE WAS HOLDING, IF A PERSON HANDED
                IT BACK. ═══ AFTER the sweep, deliberately: this machine settles its own
                runs on local, pid-accurate evidence before it looks at anybody's, and a
@@ -2396,6 +2945,24 @@ export async function run(args, injected) {
             /* Every reason a conversational owner may continue is claimed together.
                The legacy turn and re-arm takes exclude named owners in the database. */
             await takeOwnerActivations(client, tools, machineId, new Set(inFlight.keys()), hold);
+            /* ═══ AND IF THE DESIGNATION NAMES A HARNESS THIS DAEMON IS NOT, IT SAYS
+               SO BEFORE TAKING NOTHING. ═══
+               `panel3_take_turns` and `panel3_take_rearms` compare `p_agent` against
+               `cliv2_orchestrator_preference` in SQL, and a mismatch is not an error
+               there — it is zero rows, which is correct and which is also exactly what
+               a quiet machine with no work waiting looks like. Proven on the record
+               (.bugs/.resolved/20260826-daemon-ignores-the-harness-switch): with the
+               designation on `codex` and this daemon on `claude`, a waiting turn was
+               never claimed for over two minutes, the daemon printed nothing, and the
+               card sat under `Working` with a healthy machine online.
+      
+               `harness()` is read once at startup and cannot change under a running
+               process (see `machineHarness` above), while the designation is a chip a
+               person clicks in the app at any moment. So the two CAN disagree, and
+               ux.md's forbidden state — "nothing will act on it and nothing on screen
+               says so" — is reached the moment they do. This is the daemon's own
+               screen saying so. */
+            await reportHarnessMismatch(client, machineId, machineHarness);
             /* THE MACHINE ID GOES IN because the take writes the run row, and a run has
                to say where it is running: the exclusion is cross-machine and recovery is
                per-machine, so a row with nobody's machine on it could be neither. */