@ctrl-spc/cs 0.7.11 → 0.7.12

package/dist/panel3/run.js

@@ -137,7 +137,7 @@ import { answerPrompt, escalationPrompt, levelOnePrompt, ownerActivationPrompt,
 import { ASK_CONTENT_COLUMNS, attachmentLine, gitRulesFor, loadAttachments, loadOutputNames, outputOf, recordBaseProtection, standingRulesFor, withAskContent, } from './show.js';
 import { forgetSecrets, redactSecrets } from './secrets.js';
 import { sayListening, stopListening } from './presence.js';
-import { designatedCoordinator } from './coordinator.js';
+import { selectedHarness } from './coordinator.js';
 import { baseBranchState, checkoutForCodebase, commitCardWork, detectBaseProtection, folderIsBranch, hasCheckoutForCodebase, mergeIntoBase, releaseBaseBranch, settleCardWorktree, worktreeForCard, worktreesOnThisMachine, } from './checkout.js';
 import { harness, startAgent } from './spawn.js';
 import { establishOwnerSession, listOwnerSessionIds, OWNER_SESSION_GRACE_MS, readOwnerSession, removeOwnerSession, validSessionUuid, writeOwnerSession, } from './session.js';
@@ -894,8 +894,8 @@ async function codebaseOfRun(client, runId) {
  *     ═══
  *
  * The card is the unit of isolation, so the branch is derived from the card and
- * every run on that card resolves to the same one. A run that finds a branch
- * already stamped by a sibling takes it rather than deriving again: the
+ * every run on that card in the same codebase resolves to the same one. A run
+ * that finds a branch already stamped by a sibling in that codebase takes it rather than deriving again: the
  * derivation is pure today and stops being pure the moment the pattern becomes
  * a setting, and one card on two branches is the defect this whole slice exists
  * to prevent.
@@ -921,6 +921,7 @@ async function cardWorktree(client, runId, codebase) {
     const sibling = row.branch !== null ? null : (await returned(client.from('panel3_runs')
         .select('branch, base')
         .eq('card_id', row.card_id)
+        .eq('codebase_id', codebase.id)
         .not('branch', 'is', null)
         .limit(1), 'read', `the branch card ${row.card_id} is working on`))[0] ?? null;
     const stamped = {
@@ -1012,8 +1013,8 @@ async function refreshBaseProtection(client, codebase, rules, source, base) {
  *
  * ═══ AND INSIDE `git rev-parse --git-dir`, WHICH IS THE PART THAT WAS MEASURED
  *     RATHER THAN REASONED ABOUT. ═══ A folder in the working tree shows as `??`
- * in `git status`, and `settleCardWorktree` commits unconditionally — so a
- * picture left there is a picture committed onto the card's branch. And
+ * in `git status`, so an explicit landing would commit a picture left there
+ * onto the card's branch. And
  * `.git/info/exclude` cannot be used: in a linked worktree `.git` is a FILE
  * holding a `gitdir:` pointer, and `git rev-parse --git-path info/exclude`
  * resolves to the SHARED repository's exclude file, so writing it would alter
@@ -1258,7 +1259,7 @@ async function startChild(client, tools, machineId, parentRunId, brief, codebase
     return {
         runId: row.run_id,
         settled: settle(client, tools, machineId, level, row.run_id, row.run_card_id, started, true, processToken, isOwner && processToken
-            ? ownerSessionLifecycle(started, row.run_id, harness(), processToken)
+            ? ownerSessionLifecycle(started, row.run_id, settings.harness ?? harness(), processToken)
             : undefined),
     };
 }
@@ -1460,44 +1461,12 @@ function settle(client, tools, machineId, level, runId, cardId, started, speaksT
         }
         if (!answer.ok) {
             await ownerSession?.failed();
-            /* ═══ A PROCESS THAT STARTED AND THEN DIED BADLY IS STARTED AGAIN. ═══
-               recovery-1/ux.md, Slice 3: "the agent's harness fails on something that
-               is nobody's fault: a rate limit, a dropped connection, a provider
-               outage. The product tries again rather than failing the card."
-      
-               `started.pid` IS THE WHOLE OF THE DISTINCTION, and it is a fact rather
-               than a reading of a string. What reaches here as `{ ok: false }` is
-               never a verdict about the work. An agent that ran and concluded it
-               could not do the thing exits 0 having said so, and that is an ANSWER,
-               written to the card below. So what is left to separate is a process that
-               ran and died from one that never existed, and `Started.pid` answers it:
-               `could not start claude on this machine: ENOENT` and `claude is not
-               installed` are facts about this machine that will be identical in two
-               seconds and are fixed by a person, while `claude exited 1: API Error:
-               529 Overloaded` is what a rate limit, a dropped connection and a
-               provider outage all look like from here. plan-slice-3.md section 1.2
-               measured the alternative and rejected it: the provider's own words reach
-               this daemon as a 500 character tail of one of two streams, absent
-               entirely for a rate limit, and different again next release.
-      
-               WHAT THIS DELIBERATELY GIVES UP is that a genuinely deterministic
-               harness crash costs two extra spawns before the card fails. That is
-               bounded, and it is the price of not depending on a string.
-      
-               THE RESPAWN IS `resumeRun`, WHICH ALREADY EXISTS. ux.md: "two features
-               owning one respawn is how two respawns are born." Nothing new starts a
-               process here; the failure calls the sweep's own respawn, fenced by the
-               pid this daemon watched exit, and AWAITS it, so the daemon's one
-               `inFlight` entry covers the whole chain and `--once` waits for the last
-               attempt rather than exiting mid-retry.
-      
-               AND THE OLD RULING HERE IS AMENDED RATHER THAN DELETED. It read: "a
-               process that started and then failed is a failure of the work, not of
-               the machine: resuming it would put the same agent back on the same brief
-               to fail the same way, FOREVER." The half that survives is forever, and
-               the bound is what now provides it. */
+            /* Retry a started process using the existing bounded recovery path,
+               except when the harness identifies a permanent provider rejection.
+               Repeating an invalid model/effort request cannot repair it. Unknown
+               process deaths retain the existing recovery policy. */
             const attempts = await attemptsSoFar(client, runId);
-            if (started.pid !== null && attempts < MAX_ATTEMPTS) {
+            if (answer.retryable !== false && started.pid !== null && attempts < MAX_ATTEMPTS) {
                 out(`retry    run ${runId}  attempt ${attempts} of ${MAX_ATTEMPTS} died: ${answer.reason}`);
                 const again = processToken === undefined
                     ? await resumeRun(client, tools, machineId, runId, started.pid)
@@ -2034,7 +2003,13 @@ async function activateOwner(client, tools, machineId, runId, afterProcessToken
     const candidate = await ownerCandidate(client, runId);
     if (!candidate)
         return null;
-    const machineHarness = harness();
+    // Existing conversations retain their agent; an explicit hand-back follows
+    // the new selection. Never reuse a native session across different agents.
+    if (candidate.handed_back_at === null && candidate.machine_id !== machineId)
+        return null;
+    const machineHarness = candidate.handed_back_at === null && candidate.harness !== null
+        ? harness({ CTRL_SPC_V3_AGENT: candidate.harness })
+        : await selectedHarness(client, machineId);
     const resumeSessionId = resumableOwnerSessionId(candidate, machineId, machineHarness);
     /* ═══ THE EXISTENCE CHECK BEFORE THE CLAIM, AND THE COPY AFTER IT. ═══ This
        was the whole resolution, which was right while resolving meant reading a
@@ -2959,13 +2934,13 @@ export async function sweepFinishedWorktrees(client) {
         if (!cardIds.every((cardId) => over.has(cardId) && !live.has(cardId)))
             continue;
         try {
-            settleCardWorktree(one.folder);
+            if (!settleCardWorktree(one.folder))
+                continue;
             touched.add(one.codebaseId);
             out(`cleaned  card copy for ${cardIds.join(', ')}`);
         }
         catch (error) {
-            /* SAID, NOT FATAL, AND NOT RETRIED HARDER. The work is committed or it is
-               not; either way the copy is still there and the next poll tries again.
+            /* A failed cleanup leaves the copy in place; the next poll can retry.
                Taking the daemon's loop down over cleanup would stop every card. */
             said(`could not clean up a finished card's copy: ${error instanceof Error ? error.message : String(error)}`);
         }
@@ -2980,62 +2955,6 @@ export async function sweepFinishedWorktrees(client) {
         catch { /* it is held, which is safe */ }
     }
 }
-/** The last mismatch state this daemon said out loud, so a poll every two
- *  seconds does not narrate the same standing fact thirty times a minute.
- *
- *  ═══ SAID ONCE PER STATE, NOT ONCE PER PROCESS. ═══ The same discipline v2's
- *  `roleKey` (`orchestrator.ts`) uses for its own designation lines, and for the
- *  same reason: the person re-designates while the daemon is running, so
- *  "matching again" is a genuinely different state that they must hear about
- *  too, while the unchanged one repeated is noise that buries every useful
- *  line. Null means nothing has been said yet. */
-let saidHarnessState = null;
-/**
- * ═══ THE DESIGNATION NAMES A HARNESS THIS DAEMON IS NOT, AND SOMEBODY HAS TO
- *     SAY SO. ═══
- *
- * The take's agent filter lives in SQL and answers with zero rows, which is
- * right — a daemon may not act outside its designation — but zero rows is also
- * what "nothing is waiting" looks like, and the two are indistinguishable from
- * the outside. This is the one place they can be told apart, because it is the
- * only place that holds BOTH facts at once: the harness this process actually
- * runs, and the harness the person has designated.
- *
- * ═══ IT DOES NOT REFUSE, RETRY OR RE-READ THE HARNESS. ═══ `CTRL_SPC_V3_AGENT`
- * is fixed for the life of the process by design (`spawn.ts`: reported, never
- * chosen), and honouring a switch by silently spawning the other binary would
- * attribute a whole session of results to a harness that never ran. So the
- * daemon keeps polling, keeps taking whatever it legitimately may, and says the
- * one true sentence about why this particular work is not moving.
- *
- * ═══ AND A FAILED READ IS NOT A MISMATCH. ═══ Constraint 4, the same rule
- * `designatedCoordinator` states: a read that failed does not mean nobody is
- * designated, and it must not produce a sentence claiming to know which harness
- * was chosen. It throws, and the poll's own catch treats it as a poll that did
- * not finish — the next one is two seconds away.
- */
-async function reportHarnessMismatch(client, machineId, machineHarness) {
-    const designation = await designatedCoordinator(client);
-    /* Nobody designated, or somebody else's machine: neither is this daemon
-       failing to honour anything. `panel3_take_turns` lets ANY machine take when
-       nothing is designated, and a designation naming another machine is that
-       machine's business — v2's own listener already says both of those
-       (`roleLine`'s 'none' and 'other-machine'), and repeating them here would be
-       two voices on one fact. */
-    const mismatched = designation !== null
-        && designation.machineId === machineId
-        && designation.agent !== machineHarness;
-    const state = mismatched ? `mismatch:${designation.agent}` : 'ok';
-    if (state === saidHarnessState)
-        return;
-    saidHarnessState = state;
-    if (!mismatched)
-        return;
-    said(`${designation.agent} is designated to coordinate on this machine, and this daemon runs `
-        + `${machineHarness}, so it will not pick work up. Nothing will act on what you send until `
-        + `this daemon is restarted with CTRL_SPC_V3_AGENT=${designation.agent}, or ${machineHarness} `
-        + 'is designated in the app.');
-}
 /**
  * ═══ THE ONE PLACE THE TWO SHAPES OF CALLER BECOME ONE SHAPE. ═══
  *
@@ -3061,7 +2980,7 @@ async function reportHarnessMismatch(client, machineId, machineHarness) {
 export function clientReader(injected) {
     return typeof injected === 'function' ? injected : () => injected;
 }
-export async function run(args, injected) {
+export async function run(args, injected, signal) {
     let once = false;
     for (const arg of args) {
         if (arg === '--once')
@@ -3090,14 +3009,8 @@ export async function run(args, injected) {
        captured in one place and not another. */
     const current = clientReader(injected ?? await signedInClient(true));
     const machineId = getMachineIdentity().id;
-    /* THE NAME AND THE HARNESS, RESOLVED ONCE, AT STARTUP, RATHER THAN PER POLL.
-       Both are properties of this machine for the life of this process: the
-       hostname does not change under it, and neither does `CTRL_SPC_V3_AGENT`.
-       Resolving `harness()` here means a machine misconfigured with a name this
-       build cannot spawn (constraint 7: reported, never chosen) fails before it
-       ever says it is listening, rather than on its first poll. */
     const machineName = hostname();
-    const machineHarness = harness();
+    let listeningHarness = null;
     /* THE RUNS THIS PROCESS IS HOLDING RIGHT NOW, so recovery cannot declare its
        own live work dead in the moment before a pid is recorded. It covers THIS
        daemon only, which is why `PID_GRACE_MS` exists for the other ones. Keyed by
@@ -3151,7 +3064,10 @@ export async function run(args, injected) {
     if (!once && !injected) {
         for (const signal of ['SIGINT', 'SIGTERM']) {
             process.once(signal, () => {
-                void stopListening(current(), machineId, machineHarness).finally(() => {
+                const stopped = listeningHarness === null
+                    ? Promise.resolve()
+                    : stopListening(current(), machineId, listeningHarness);
+                void stopped.finally(() => {
                     /* The exit code a signal is supposed to produce, and the reason it is
                        said explicitly: `process.once` REPLACES node's default handler, so
                        without this a Ctrl-C would leave the daemon polling forever. */
@@ -3160,138 +3076,146 @@ export async function run(args, injected) {
             });
         }
     }
-    for (;;) {
-        /* ═══ ONE POLL FAILING IS NOT THE DAEMON FAILING. ═══ Every read and write
-           here throws on a network or database error, by design (constraint 7), and
-           until Slice 4 that threw straight out of `panel3/cli.js run` and exited the process.
-           Inside `cs start` that is no longer an honest outcome twice over: it would
-           take the v2 presence heartbeat down with it, and it would leave a stranded
-           card printing `cs start` at a person who IS running `cs start`, which is
-           the exact lie this slice exists to end. A dropped connection is a poll
-           that did not happen; the next one is two seconds away.
-    
-           `--once` still fails loudly, because the acceptance harness reads the exit
-           code and a swallowed failure there would make a broken suite look green. */
-        try {
-            /* ═══ THE FIRST THING EVERY POLL, BECAUSE IT IS WHAT MAKES THE OTHER THINGS
-               LEGIBLE. ═══ A card with an untaken turn reads the same whether a daemon
-               is two seconds away or nobody has one running; this row is the only place
-               the difference exists. It is written before the takes rather than after
-               so that a machine which is up but busy still reads as up. */
-            await sayListening(current(), machineId, machineName, machineHarness);
-            /* ═══ THE USER'S STOP IS HONOURED BEFORE ANYTHING ELSE ON THE POLL. ═══ It
-               is the only thing here that a person is waiting on, and the two takes
-               below can spend the rest of the poll starting agents. Nothing else needs
-               to run first: `panel3_stop_card` has already ended the runs, so recovery
-               cannot see them and neither take can start them. */
-            await killStopped(current(), machineId);
-            await reconcileOwnerSessions(current(), machineId, machineHarness, new Set(inFlight.keys()));
-            await recoverStranded(current(), tools, machineId, new Set(inFlight.keys()), hold);
-            /* ═══ AND THE COPIES OF CARDS THAT ARE OVER. ═══ After recovery,
-               deliberately: a run this machine is about to resume is one whose card is
-               not finished, and the sweep asks the record after recovery has had its
-               say about what is really still running. */
-            await sweepFinishedWorktrees(current());
-            /* ═══ AND THEN WHAT SOMEBODY ELSE'S MACHINE WAS HOLDING, IF A PERSON HANDED
-               IT BACK. ═══ AFTER the sweep, deliberately: this machine settles its own
-               runs on local, pid-accurate evidence before it looks at anybody's, and a
-               run of its own that was offered while it was quiet is dealt with there on
-               the better evidence: resumed if its process is really gone, which spends
-               the offer, and skipped if it is not, which is what `mine` then honours
-               here. The set is rebuilt rather than reused because the sweep adds to it.
-               BEFORE both takes, for the reason the sweep is: work that already exists,
-               with a brief and a report behind it, comes before work that has not
-               started. */
-            await takeHandedBack(current(), tools, machineId, new Set(inFlight.keys()), hold);
-            /* Every reason a conversational owner may continue is claimed together.
-               The legacy turn and re-arm takes exclude named owners in the database. */
-            await takeOwnerActivations(current(), tools, machineId, new Set(inFlight.keys()), hold);
-            /* ═══ AND IF THE DESIGNATION NAMES A HARNESS THIS DAEMON IS NOT, IT SAYS
-               SO BEFORE TAKING NOTHING. ═══
-               `panel3_take_turns` and `panel3_take_rearms` compare `p_agent` against
-               `cliv2_orchestrator_preference` in SQL, and a mismatch is not an error
-               there — it is zero rows, which is correct and which is also exactly what
-               a quiet machine with no work waiting looks like. Proven on the record
-               (.bugs/.resolved/20260826-daemon-ignores-the-harness-switch): with the
-               designation on `codex` and this daemon on `claude`, a waiting turn was
-               never claimed for over two minutes, the daemon printed nothing, and the
-               card sat under `Working` with a healthy machine online.
-      
-               `harness()` is read once at startup and cannot change under a running
-               process (see `machineHarness` above), while the designation is a chip a
-               person clicks in the app at any moment. So the two CAN disagree, and
-               ux.md's forbidden state — "nothing will act on it and nothing on screen
-               says so" — is reached the moment they do. This is the daemon's own
-               screen saying so. */
-            await reportHarnessMismatch(current(), machineId, machineHarness);
-            /* THE MACHINE ID GOES IN because the take writes the run row, and a run has
-               to say where it is running: the exclusion is cross-machine and recovery is
-               per-machine, so a row with nobody's machine on it could be neither. */
-            const taken = await returned(current().rpc('panel3_take_turns', { p_machine_id: machineId, p_agent: machineHarness }), 'take', 'turns');
-            /* ═══ THE OTHER KIND OF TAKEABLE WORK. ═══ ux.md's re-arm: an answered
-               question makes the branch that asked it takeable again, and a question
-               still walking up makes the run it reached takeable so that level gets its
-               turn. Same poll, same machine id, same holding: only the reason a run is
-               started differs, and the record decides that rather than this file.
+    try {
+        while (!signal?.aborted) {
+            /* ═══ ONE POLL FAILING IS NOT THE DAEMON FAILING. ═══ Every read and write
+               here throws on a network or database error, by design (constraint 7), and
+               until Slice 4 that threw straight out of `panel3/cli.js run` and exited the process.
+               Inside `cs start` that is no longer an honest outcome twice over: it would
+               take the v2 presence heartbeat down with it, and it would leave a stranded
+               card printing `cs start` at a person who IS running `cs start`, which is
+               the exact lie this slice exists to end. A dropped connection is a poll
+               that did not happen; the next one is two seconds away.
       
-               AFTER THE TURNS ARE TAKEN, deliberately, because the take WRITES the run
-               row it leases to. A person who answered and then typed something else has
-               both waiting, and in this order the message's level 1 is already on the
-               record, so the re-arm leaves that card's coordinator alone and comes back
-               to it on a later poll rather than putting two of them on one card. The
-               other order would decide the same question from a snapshot taken before
-               the run existed. */
-            const rearmed = await returned(current().rpc('panel3_take_rearms', { p_machine_id: machineId, p_agent: machineHarness }), 'take', 'runs that can carry on');
-            for (const row of rearmed) {
-                /* NOT AWAITED PAST THE SPAWN, exactly as a taken card is not: the work is a
-                   real agent and holding the poll open for it would put every other card
-                   behind it. A throw here is caught rather than taking the loop down,
-                   because one run that could not be started must not stop the others. */
+               `--once` still fails loudly, because the acceptance harness reads the exit
+               code and a swallowed failure there would make a broken suite look green. */
+            try {
+                /* ═══ THE USER'S STOP IS HONOURED BEFORE ANYTHING ELSE ON THE POLL. ═══ It
+                   is the only thing here that a person is waiting on, and the two takes
+                   below can spend the rest of the poll starting agents. Nothing else needs
+                   to run first: `panel3_stop_card` has already ended the runs, so recovery
+                   cannot see them and neither take can start them. */
+                await killStopped(current(), machineId);
+                /* Publish readiness before claiming work. A card with an untaken turn reads the same whether a daemon
+                   is two seconds away or nobody has one running; this row is the only place
+                   the difference exists. It is written before the takes rather than after
+                   so that a machine which is up but busy still reads as up. */
+                // Resolve before claiming work. A failed read or missing binary must not
+                // leave the previous agent advertised as ready for new assignments.
+                let machineHarness;
                 try {
-                    hold(row.run_id, (await startRearmed(current(), tools, machineId, row)).settled);
+                    machineHarness = await selectedHarness(current(), machineId);
                 }
                 catch (error) {
-                    said(`could not start run ${row.run_id} again: ${error instanceof Error ? error.message : String(error)}`);
+                    if (listeningHarness !== null) {
+                        await stopListening(current(), machineId, listeningHarness);
+                        listeningHarness = null;
+                    }
+                    throw error;
+                }
+                if (signal?.aborted)
+                    break;
+                if (listeningHarness !== null && listeningHarness !== machineHarness) {
+                    await stopListening(current(), machineId, listeningHarness);
+                }
+                listeningHarness = machineHarness;
+                await sayListening(current(), machineId, machineName, machineHarness);
+                await reconcileOwnerSessions(current(), machineId, machineHarness, new Set(inFlight.keys()));
+                await recoverStranded(current(), tools, machineId, new Set(inFlight.keys()), hold);
+                /* ═══ AND THE COPIES OF CARDS THAT ARE OVER. ═══ After recovery,
+                   deliberately: a run this machine is about to resume is one whose card is
+                   not finished, and the sweep asks the record after recovery has had its
+                   say about what is really still running. */
+                await sweepFinishedWorktrees(current());
+                /* ═══ AND THEN WHAT SOMEBODY ELSE'S MACHINE WAS HOLDING, IF A PERSON HANDED
+                   IT BACK. ═══ AFTER the sweep, deliberately: this machine settles its own
+                   runs on local, pid-accurate evidence before it looks at anybody's, and a
+                   run of its own that was offered while it was quiet is dealt with there on
+                   the better evidence: resumed if its process is really gone, which spends
+                   the offer, and skipped if it is not, which is what `mine` then honours
+                   here. The set is rebuilt rather than reused because the sweep adds to it.
+                   BEFORE both takes, for the reason the sweep is: work that already exists,
+                   with a brief and a report behind it, comes before work that has not
+                   started. */
+                await takeHandedBack(current(), tools, machineId, new Set(inFlight.keys()), hold);
+                /* Every reason a conversational owner may continue is claimed together.
+                   The legacy turn and re-arm takes exclude named owners in the database. */
+                await takeOwnerActivations(current(), tools, machineId, new Set(inFlight.keys()), hold);
+                if (signal?.aborted)
+                    break;
+                /* THE MACHINE ID GOES IN because the take writes the run row, and a run has
+                   to say where it is running: the exclusion is cross-machine and recovery is
+                   per-machine, so a row with nobody's machine on it could be neither. */
+                const taken = await returned(current().rpc('panel3_take_turns', { p_machine_id: machineId, p_agent: machineHarness }), 'take', 'turns');
+                /* ═══ THE OTHER KIND OF TAKEABLE WORK. ═══ ux.md's re-arm: an answered
+                   question makes the branch that asked it takeable again, and a question
+                   still walking up makes the run it reached takeable so that level gets its
+                   turn. Same poll, same machine id, same holding: only the reason a run is
+                   started differs, and the record decides that rather than this file.
+                 *
+                   AFTER THE TURNS ARE TAKEN, deliberately, because the take WRITES the run
+                   row it leases to. A person who answered and then typed something else has
+                   both waiting, and in this order the message's level 1 is already on the
+                   record, so the re-arm leaves that card's coordinator alone and comes back
+                   to it on a later poll rather than putting two of them on one card. The
+                   other order would decide the same question from a snapshot taken before
+                   the run existed. */
+                const rearmed = await returned(current().rpc('panel3_take_rearms', { p_machine_id: machineId, p_agent: machineHarness }), 'take', 'runs that can carry on');
+                for (const row of rearmed) {
+                    /* NOT AWAITED PAST THE SPAWN, exactly as a taken card is not: the work is a
+                       real agent and holding the poll open for it would put every other card
+                       behind it. A throw here is caught rather than taking the loop down,
+                       because one run that could not be started must not stop the others. */
+                    try {
+                        hold(row.run_id, (await startRearmed(current(), tools, machineId, row)).settled);
+                    }
+                    catch (error) {
+                        said(`could not start run ${row.run_id} again: ${error instanceof Error ? error.message : String(error)}`);
+                    }
+                }
+                for (const [cardId, turns] of byCard(taken)) {
+                    const runId = turns[0].run_id;
+                    out(`took     card ${cardId}  ${turns.length} turn${turns.length === 1 ? '' : 's'}  run ${runId}`);
+                    /* NOT AWAITED HERE. A run is a real agent doing real work, and awaiting it
+                       in the poll would put every other card behind it — v2's own measured
+                       defect (env.ts, I21/I24: "a second request typed seconds after the first
+                       sat untouched until the first finished"). Nothing is needed to stop the
+                       same card being taken twice, because that is the database's job and it
+                       has already been done by the take. */
+                    // The catch inside `hold` is the last resort. A run left `running` by a
+                    // throw is not lost: its process has exited, so the next sweep reaps it
+                    // and the turns are answered again. It is there so the reason is printed
+                    // rather than becoming an unhandled rejection.
+                    hold(runId, answerCard(current(), tools, machineId, cardId, turns));
+                }
+                if (once) {
+                    /* ═══ UNTIL NOTHING IS LEFT, NOT ONCE OVER WHAT WAS THERE. ═══ A level 1
+                       run dispatches WHILE it is being waited on, so the child appears in
+                       `inFlight` after the first wait started. Closing then would kill the
+                       tools server under an agent that had just been started, and `--once`
+                       would report a card answered while the work on it was still going. */
+                    while (inFlight.size > 0)
+                        await Promise.all([...inFlight.values()]);
+                    return;
                 }
             }
-            for (const [cardId, turns] of byCard(taken)) {
-                const runId = turns[0].run_id;
-                out(`took     card ${cardId}  ${turns.length} turn${turns.length === 1 ? '' : 's'}  run ${runId}`);
-                /* NOT AWAITED HERE. A run is a real agent doing real work, and awaiting it
-                   in the poll would put every other card behind it — v2's own measured
-                   defect (env.ts, I21/I24: "a second request typed seconds after the first
-                   sat untouched until the first finished"). Nothing is needed to stop the
-                   same card being taken twice, because that is the database's job and it
-                   has already been done by the take. */
-                // The catch inside `hold` is the last resort. A run left `running` by a
-                // throw is not lost: its process has exited, so the next sweep reaps it
-                // and the turns are answered again. It is there so the reason is printed
-                // rather than becoming an unhandled rejection.
-                hold(runId, answerCard(current(), tools, machineId, cardId, turns));
-            }
-            if (once) {
-                /* ═══ UNTIL NOTHING IS LEFT, NOT ONCE OVER WHAT WAS THERE. ═══ A level 1
-                   run dispatches WHILE it is being waited on, so the child appears in
-                   `inFlight` after the first wait started. Closing then would kill the
-                   tools server under an agent that had just been started, and `--once`
-                   would report a card answered while the work on it was still going. */
-                while (inFlight.size > 0)
-                    await Promise.all([...inFlight.values()]);
-                // The listener would otherwise keep this process alive after its one poll
-                // was done, which is the whole point of `--once` being testable.
-                await tools.close();
-                // This machine is not listening any more, and it knows that here rather
-                // than fifteen seconds from now. Same reason as the signal handlers above.
-                await stopListening(current(), machineId, machineHarness);
-                return;
+            catch (error) {
+                if (once)
+                    throw error;
+                said(`this poll did not finish: ${error instanceof Error ? error.message : String(error)}`);
             }
+            if (!signal?.aborted)
+                await sleep(POLL_INTERVAL_MS);
         }
-        catch (error) {
-            if (once)
-                throw error;
-            said(`this poll did not finish: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    finally {
+        try {
+            if (listeningHarness !== null)
+                await stopListening(current(), machineId, listeningHarness);
+        }
+        finally {
+            await tools.close();
         }
-        await sleep(POLL_INTERVAL_MS);
     }
 }
 // ---------------------------------------------------------------------------
@@ -3337,24 +3261,10 @@ export async function run(args, injected) {
  * heartbeating rather than killing the process around it.
  */
 export function startPanel(injected) {
-    const current = clientReader(injected);
-    /* Both resolved HERE as well as inside the loop, deliberately: `stop` has to
-       name the same row the loop's heartbeat writes, and it must be able to do
-       that after the loop has thrown. They are the two facts about this machine
-       that cannot change under a running process — the hardware-derived id and
-       `CTRL_SPC_V3_AGENT` — so reading them twice cannot disagree. */
-    const machineId = getMachineIdentity().id;
-    const machineHarness = harness();
-    /* THE GETTER, NOT `current()`. Passing the read itself is what keeps ONE
-       normalisation in this process: `run` calls `clientReader` on whatever it is
-       given, a getter passes through unchanged, and the loop reads the same live
-       client `stop` does. Passing `current()` here would resolve it once and hand
-       the loop the very snapshot this parameter was widened to stop producing. */
-    void run([], current).catch((error) => {
+    const controller = new AbortController();
+    const running = run([], injected, controller.signal).catch((error) => {
         said(`the agent panel stopped polling: ${error instanceof Error ? error.message : String(error)}`);
     });
-    /* `stopListening` is already best-effort and swallows its own failure: a
-       process on its way out must not hang or fail, and the freshness window
-       covers every way a machine can leave without getting here. */
-    return { stop: () => stopListening(current(), machineId, machineHarness) };
+    // The loop owns its current presence row, including shutdown after a switch.
+    return { stop: async () => { controller.abort(); await running; } };
 }

package/dist/panel3/spawn.js

@@ -322,6 +322,15 @@ export function codexAnswer(stdout, exitCode = 0, stderr = '') {
         }
     }
     if (failure !== null) {
+        // Codex wraps provider errors in turn.failed.error.message. A rejected
+        // request cannot recover by sending the same model and effort again.
+        try {
+            const provider = JSON.parse(failure);
+            if (provider?.status === 400 && provider?.error?.type === 'invalid_request_error') {
+                return { ok: false, reason: `codex could not finish the turn: ${provider.error.message ?? failure}`, retryable: false };
+            }
+        }
+        catch { /* Ordinary native failure text keeps the existing recovery policy. */ }
         return { ok: false, reason: `codex could not finish the turn${failure ? `: ${failure}` : ''}` };
     }
     if (exitCode !== 0) {
@@ -332,6 +341,17 @@ export function codexAnswer(stdout, exitCode = 0, stderr = '') {
     }
     return { ok: true, text: text.trim() };
 }
+/** Claude prints provider/model rejections on stdout, even with a nonzero exit. */
+export function claudeAnswer(stdout, exitCode = 0, stderr = '') {
+    if (/^\[claude-code:unrecognized_model\]/m.test(stdout + '\n' + stderr)) {
+        return { ok: false, retryable: false, reason: 'Claude rejected the selected model. Choose an available model and retry.' };
+    }
+    if (exitCode !== 0)
+        return { ok: false, reason: `claude exited ${exitCode}${tail(stderr) || tail(stdout)}` };
+    if (stdout.trim() === '')
+        return { ok: false, reason: `claude exited 0 and said nothing${tail(stderr)}` };
+    return { ok: true, text: stdout.trim() };
+}
 /** Enough for any answer a person reads, and a ceiling so a runaway process
  *  cannot exhaust this daemon's memory. */
 const MAX_OUTPUT_CHARS = 1_000_000;
@@ -547,22 +567,11 @@ export function startAgent(prompt, level, toolsUrl, cwd, ownerSession, settings
                 // 'Reading prompt from stdin' on stderr, including on non-zero exits.
                 finish(codexAnswer(stdout, code ?? 1, stderr));
             }
-            else if (code !== 0) {
-                /* STDOUT WHEN STDERR IS EMPTY, because `claude -p` prints its own
-                   failure on stdout and exits non-zero having written nothing to
-                   stderr. Reporting only "exited 1" would throw away the one sentence
-                   that says what went wrong. */
-                finish({ ok: false, reason: `${agent} exited ${code}${tail(stderr) || tail(stdout)}` });
-            }
-            else if (stdout.trim() === '') {
-                finish({ ok: false, reason: `${agent} exited 0 and said nothing${tail(stderr)}` });
-            }
             else {
-                const text = stdout.trim();
-                finish({
-                    ok: true,
-                    text: truncated ? `${text}\n\n[cut off at ${MAX_OUTPUT_CHARS} characters]` : text,
-                });
+                const answer = claudeAnswer(stdout, code ?? 1, stderr);
+                finish(answer.ok && truncated
+                    ? { ...answer, text: `${answer.text}\n\n[cut off at ${MAX_OUTPUT_CHARS} characters]` }
+                    : answer);
             }
         });
         /* THE PROMPT, AND THEN END OF INPUT, because `claude -p` reads stdin to the