@ctrl-spc/cs 0.7.13 → 0.7.15

package/dist/orchestrator.js

@@ -1,11 +1,12 @@
 import { execFile, spawn as spawnChild } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
+import { beginOwnedClaim, ownedWorkAllowed, hasOwnedWorkContext, ownedWorkerClaimedAt, ownedWorkerExecutionHeld, reserveOwnedWork, legacyHeldTodoIds, interruptionReceipts, acknowledgeInterruption, legacySnapshotNeeded, saveLegacySnapshot, legacyTodoHolds, releaseLegacyTodoHold, recordExitedInterruption, beginRpcClaim, deferRpcClaim, pendingRpcClaims, recordRpcClaims, finishRpcClaims } from './daemon-processes.js';
 import { promisify } from 'node:util';
 import { agentPath, detectAgents } from './agents.js';
 /* 18a Slice 7: the two Windows spawn rules, in one module so a caller cannot
    take the shell and forget the quoting. `quoteForCmd` is re-exported because
    this module's own tests reach for it here. */
-import { killTree, needsShell, processIsAlive, quoteForCmd } from './win-shell.js';
+import { killTree, needsShell, processIsAlive, quoteForCmd, spawnOwnedProcess, releaseOwnedProcess } from './win-shell.js';
 export { quoteForCmd } from './win-shell.js';
 import { ORCHESTRATOR_MAX_CONCURRENT, ORCHESTRATOR_SPAWN_TIMEOUT_MS } from './env.js';
 import { agentDisplayName, plainFailureReason } from './failure-reason.js';
@@ -224,7 +225,7 @@ skipIds = []) {
        row rather than blocking or double-claiming. `userId` is no longer passed:
        the function scopes itself with `auth.uid()`, which is the same identity
        RLS uses and cannot be spoofed by a caller. */
-    const { data, error } = await client.rpc('cliv2_claim_next_loose_todo', {
+    const { data, error, operationId } = await cliClaim(client, 'cliv2_claim_next_loose_todo', {
         p_machine_id: machineId,
         p_agent: agent,
         p_skip_ids: skipIds,
@@ -240,40 +241,12 @@ skipIds = []) {
     const row = (data ?? [])[0];
     if (!row)
         return null;
-    /* ═══ 18d SLICE 4 — THE FENCE TOKEN FOR THIS DISPATCH. ═══
-  
-       `claimed_at` is what this run OWNS. It is read here, immediately after the
-       claim, rather than added to the RPC's return table, because that keeps the
-       shipped function's contract alone and needs no migration.
-  
-       WHY IT IS NEEDED. hand_off_stage clears the claim so the next stage is
-       dispatched to a fresh worker, and the handing-off worker then keeps talking
-       for as long as it takes to write its closing answer. Its exit path wrote
-       `state='done'` unconditionally, over a row a SECOND worker was already
-       working: the card read Done carrying stage 1's answer, and because the claim
-       RPC skips `done` rows the request could never be claimed again, so the
-       remaining stages were never run. Found by the gate's audit, and it matches
-       what the walk saw.
-  
-       Every terminal write is now fenced on this value, so a run that no longer
-       holds the claim writes NOTHING. Null is possible only if the row vanished
-       between claiming and reading it, and an unfenceable dispatch is treated as
-       already superseded rather than allowed to clobber. */
-    let claimedAt = null;
-    try {
-        const { data: claimRow } = await client
-            .from('cliv2_loose_todos')
-            .select('claimed_at')
-            .eq('id', row.id)
-            .maybeSingle();
-        claimedAt = claimRow?.claimed_at ?? null;
-    }
-    catch {
-        /* Unreadable is treated as unfenceable, which only loses the protection —
-           it never blocks the dispatch that was already claimed successfully. */
-    }
+    const claimedAt = row.claimed_at ?? null;
+    if (hasOwnedWorkContext() && !claimedAt)
+        throw new Error('The claim did not return an exact attempt identity. Update the database before starting work.');
     return {
         id: row.id,
+        ...(operationId ? { claimOperationId: operationId } : {}),
         instruction: row.instruction,
         /* `?? null` rather than trusting the shape: a daemon running against a
            database that has not taken this slice's migration yet gets neither
@@ -514,10 +487,13 @@ claimedAt) {
     const write = client
         .from('cliv2_loose_todos')
         .update({ answer, state: 'done' })
-        .eq('id', todoId);
-    const { error } = await (claimedAt ? write.eq('claimed_at', claimedAt) : write);
+        .eq('id', todoId)
+        .in('state', ['working', 'needs-input']);
+    const { data: written, error } = await (claimedAt ? write.eq('claimed_at', claimedAt) : write).select('id');
     if (error)
         throw error;
+    if (!written?.length)
+        return;
     /* 18c SLICE 1 — CLOSE OUT THE LAST ACTIVITY LINE.
      *
      * report_activity only ever flips the PREVIOUS 'doing' row to 'done' when a
@@ -888,7 +864,8 @@ claimedAt) {
         // `answer` is constrained nonblank-when-present, so '' must go in as null
         // rather than as an empty string the check would refuse.
         .update({ answer: trimmed || null, state: 'needs-input' })
-        .eq('id', todoId);
+        .eq('id', todoId)
+        .in('state', ['working', 'needs-input']);
     const { error } = await (claimedAt ? write.eq('claimed_at', claimedAt) : write);
     if (error)
         throw error;
@@ -934,12 +911,13 @@ export async function todoWasStopped(client, todoId) {
  * already hit Retry, the unit is `working` again and this matches nothing. That
  * is the Gherkin line "the daemon does not later overwrite that".
  */
-export async function releaseStoppedTodo(client, todoId) {
-    const { error } = await client
+export async function releaseStoppedTodo(client, todoId, claimedAt) {
+    const write = client
         .from('cliv2_loose_todos')
         .update({ claimed_machine_id: null, claimed_agent: null, claimed_at: null })
         .eq('id', todoId)
         .eq('state', 'stopped');
+    const { error } = await (claimedAt ? write.eq('claimed_at', claimedAt) : write);
     if (error)
         throw error;
 }
@@ -992,11 +970,12 @@ claimedAt) {
        already claimed by the run that replaced this one. */
     const current = data;
     if (claimedAt && current && current.claimed_at !== claimedAt) {
-        return { fate: 'released', attempts: current.attempts ?? 0 };
+        return { fate: 'stale', attempts: current.attempts ?? 0 };
     }
     const attempts = (current?.attempts ?? 0) + 1;
+    const expectedClaim = claimedAt ?? current?.claimed_at ?? null;
     if (attempts >= MAX_ATTEMPTS) {
-        const { error: failError } = await client
+        let failure = client
             .from('cliv2_loose_todos')
             .update({
             state: 'failed',
@@ -1010,16 +989,21 @@ claimedAt) {
                route back is Retry, which means now. */
             retry_after: null,
         })
-            .eq('id', todoId);
+            .eq('id', todoId)
+            .in('state', ['working', 'needs-input']);
+        failure = expectedClaim ? failure.eq('claimed_at', expectedClaim) : failure.is('claimed_at', null);
+        const { data: failed, error: failError } = await failure.select('id');
         if (failError)
             throw failError;
+        if (!failed?.length)
+            return { fate: 'stale', attempts: current?.attempts ?? 0 };
         return { fate: 'failed', attempts };
     }
     /* 18a SLICE 6: THE WAIT IS WRITTEN ON THE SAME STATEMENT AS THE COUNT, for
        the reason the count is on the same statement as the release: a wait that
        can fail on its own is a wait the daemon might not honour, and the failure
        mode is the fork bomb this bound exists to prevent. */
-    const { error: releaseError } = await client
+    let release = client
         .from('cliv2_loose_todos')
         .update({
         attempts,
@@ -1028,9 +1012,14 @@ claimedAt) {
         claimed_at: null,
         retry_after: new Date(nowMs + retryDelayMs(attempts)).toISOString(),
     })
-        .eq('id', todoId);
+        .eq('id', todoId)
+        .in('state', ['working', 'needs-input']);
+    release = expectedClaim ? release.eq('claimed_at', expectedClaim) : release.is('claimed_at', null);
+    const { data: released, error: releaseError } = await release.select('id');
     if (releaseError)
         throw releaseError;
+    if (!released?.length)
+        return { fate: 'stale', attempts: current?.attempts ?? 0 };
     return { fate: 'released', attempts };
 }
 /**
@@ -1172,11 +1161,13 @@ export async function scopeIsApproved(client, workItemId) {
  * See the call site for why the claim stays: an unclaimed todo is immediately
  * re-claimable, so releasing would spin the tick loop.
  */
-export async function parkTodoForScope(client, todoId) {
-    const { error } = await client
+export async function parkTodoForScope(client, todoId, claimedAt) {
+    const write = client
         .from('cliv2_loose_todos')
         .update({ state: 'needs-input' })
-        .eq('id', todoId);
+        .eq('id', todoId)
+        .in('state', ['working', 'needs-input']);
+    const { error } = await (claimedAt ? write.eq('claimed_at', claimedAt) : write);
     if (error)
         throw error;
 }
@@ -1319,14 +1310,16 @@ resolveContext = (claim) => resolveClaimContext(client, claim, warn)) {
        returns; what bounds a long answer is `state.answering`, keyed per run, and
        `state.maxAnswering`. This guard is back to meaning what it says: one take
        at a time, which is a few queries. */
-    if (state.takeInFlight)
+    if (state.takeInFlight || !ownedWorkAllowed())
         return;
+    const endClaim = beginOwnedClaim();
     state.takeInFlight = true;
     try {
         await takeRunMessagesInner(client, userId, machineId, agents, state, log, warn, spawn, resolveContext);
     }
     finally {
         state.takeInFlight = false;
+        endClaim();
     }
 }
 async function takeRunMessagesInner(client, userId, machineId, agents, state, log, warn, spawn, resolveContext) {
@@ -1342,6 +1335,7 @@ async function takeRunMessagesInner(client, userId, machineId, agents, state, lo
        old check survives on its own. */
     if (agents.length === 0)
         return;
+    const claimOperations = [];
     /* THE RUNS THIS MACHINE CLAIMS, which is what it may answer for. `claimed_at`
        is the real predicate rather than the state alone: `releaseStoppedTodo` and
        `releaseOrFail` null the claim on `stopped` and `failed`, while `answerTodo`
@@ -1412,13 +1406,17 @@ async function takeRunMessagesInner(client, userId, machineId, agents, state, lo
            which is the whole of the starvation this scoping removes. */
         const taken = [];
         if (ownTodoIds.length > 0) {
-            const own = await client.rpc('cliv2_take_run_messages', { p_todo_ids: ownTodoIds, p_machine_id: machineId });
+            const own = await cliClaim(client, 'cliv2_take_run_messages', { p_todo_ids: ownTodoIds, p_machine_id: machineId, p_skip_todo_ids: [...legacyHeldTodoIds(), ...state.answering] });
+            if (own.operationId)
+                claimOperations.push(own.operationId);
             if (own.error)
                 throw new Error(own.error.message);
             taken.push(...(own.data ?? []));
         }
         if (designated) {
-            const rest = await client.rpc('cliv2_take_run_messages', { p_todo_ids: null, p_machine_id: machineId });
+            const rest = await cliClaim(client, 'cliv2_take_run_messages', { p_todo_ids: null, p_machine_id: machineId, p_skip_todo_ids: [...legacyHeldTodoIds(), ...state.answering] });
+            if (rest.operationId)
+                claimOperations.push(rest.operationId);
             if (rest.error)
                 throw new Error(rest.error.message);
             /* DEDUPED BY ID rather than trusted to be disjoint. The database will not
@@ -1450,7 +1448,13 @@ async function takeRunMessagesInner(client, userId, machineId, agents, state, lo
            cover: the answer is not to a message, it is to an approval. Everything
            downstream already handles an empty id list — the covering RPC is skipped
            and the lease is not involved, because no message was leased. */
-        const granted = await readGrantedRuns(client, userId, warn);
+        const grants = await cliClaim(client, 'cliv2_take_granted_resumes', { p_todo_ids: designated ? null : ownTodoIds,
+            p_machine_id: machineId, p_skip_todo_ids: [...legacyHeldTodoIds(), ...state.answering] });
+        if (grants.operationId)
+            claimOperations.push(grants.operationId);
+        if (grants.error)
+            throw grants.error;
+        const granted = (grants.data ?? []);
         /* AN EMPTY PASS SAYS NOTHING. This runs every 10 seconds and the common case
            is nothing to take and nothing approved; a line each time would bury every
            useful one, the same rule `reportRole` and `reportNoTools` follow.
@@ -1495,7 +1499,8 @@ async function takeRunMessagesInner(client, userId, machineId, agents, state, lo
         }
         /* AND THE APPROVED RUNS JOIN THEM, with no message ids: there is nothing to
            cover, because the answer is to an approval rather than to a message. */
-        for (const todoId of granted) {
+        for (const grant of granted) {
+            const todoId = grant.todo_id;
             if (!byRun.has(todoId))
                 byRun.set(todoId, { messageIds: [], wasExpired: false });
         }
@@ -1553,7 +1558,10 @@ async function takeRunMessagesInner(client, userId, machineId, agents, state, lo
                `answerRunMessages` warns and returns false rather than throwing, and
                the pass's job is to have STARTED every answer. The `catch` is the
                daemon's never-throw contract, not a second failure path. */
-            void answerRunMessages(client, todoId, group.messageIds, { agent: plan.agent, cwd: context.checkout, workingCopyElsewhere: plan.workingCopyElsewhere }, state, spawn, warn).catch(err => {
+            void answerRunMessages(client, todoId, group.messageIds, { agent: plan.agent, cwd: context.checkout, workingCopyElsewhere: plan.workingCopyElsewhere }, state, spawn, warn, { surface: 'reply', todoId,
+                messageLeases: taken.filter((row) => row.todo_id === todoId).map((row) => ({ id: row.id, taken_at: row.taken_at })),
+                grantLeases: granted.filter((row) => row.todo_id === todoId).map((row) => ({ id: row.id, resume_taken_at: row.resume_taken_at })),
+                observedPendingMessageIds: null }, machineId).catch(err => {
                 warn(`[orchestrator] could not answer ${shortId(todoId)}: ${err.message}`);
             });
         }
@@ -1561,6 +1569,10 @@ async function takeRunMessagesInner(client, userId, machineId, agents, state, lo
     catch (err) {
         reportTakeFailed(state, err.message, warn);
     }
+    finally {
+        if (hasOwnedWorkContext())
+            finishRpcClaims(claimOperations);
+    }
 }
 /**
  * 18k Slice 10 — THE CODEBASE THIS RUN IS FOR, recovered the way the tick
@@ -2195,7 +2207,7 @@ plan, state,
 /** 18k Slice 10b — THE WORKER'S OWN SPAWN SHAPE, not a responder's. There is no
  *  second adapter any more: this is what `defaultSpawn(mcpServer)` returns, and
  *  the answerer differs from a dispatch only in passing no `alsoRunningIn`. */
-spawn, warn) {
+spawn, warn, attempt, machineId, owned) {
     /* ═══ 18k SLICE 10b — ONE ANSWER PER RUN AT A TIME. ═══
        DEPTH, NOT THE PRIMARY DEFENCE. `takeRunMessagesInner` subtracts
        `state.answering` from the scoped take's id list, so a run this machine is
@@ -2220,15 +2232,21 @@ spawn, warn) {
        into an inner function so the clear is in ONE place rather than repeated at
        every `return` below, which is the same shape `orchestratorTick` uses to
        release its own slot. */
+    if (hasOwnedWorkContext() && (!attempt || !machineId))
+        throw new Error('The reply has no exact source lease identity.');
+    owned = hasOwnedWorkContext() ? reserveOwnedWork(attempt, plan.agent) : undefined;
     state.answering.add(todoId);
     try {
-        return await answerRunMessagesInner(client, todoId, messageIds, plan, state, spawn, warn);
+        const answered = await answerRunMessagesInner(client, todoId, messageIds, plan, state, spawn, warn, attempt, machineId, owned);
+        owned?.complete();
+        return answered;
     }
     finally {
         state.answering.delete(todoId);
+        owned?.finishPreparation();
     }
 }
-async function answerRunMessagesInner(client, todoId, messageIds, plan, state, spawn, warn) {
+async function answerRunMessagesInner(client, todoId, messageIds, plan, state, spawn, warn, attempt, machineId, owned) {
     /* ALREADY GIVEN UP ON. Said ONCE, at the bound, and then silently skipped —
        the `reportTakeFailed` rule: a line every two minutes forever would bury
        every useful one. */
@@ -2287,6 +2305,12 @@ async function answerRunMessagesInner(client, todoId, messageIds, plan, state, s
        would either promise a boundary that never comes, or re-dispatch a worker
        for a change the agent already made itself. */
     const workerIsLive = await liveWorkerForTodo(client, todoId, warn);
+    // A stopped request may retain a claim even though its worker has ended.
+    // Capture it before answering so a late stopped reply cannot clear a newer one.
+    const current = await client.from('cliv2_loose_todos').select('claimed_at').eq('id', todoId).maybeSingle();
+    if (current.error)
+        throw current.error;
+    const replyingToClaim = current.data?.claimed_at ?? null;
     /* ═══ 18k SLICE 10b — SPAWNED AS A WORKER, WITH NO CLOCK ON IT. ═══
        The worker's own adapter, so the answerer holds the worker's toolset (ruling
        1) and no timeout at all (ruling 5) — an agent asked for a real change may
@@ -2304,166 +2328,58 @@ async function answerRunMessagesInner(client, todoId, messageIds, plan, state, s
        NO `alsoRunningIn`: the answerer works one run, in that run's own checkout.
        `runTodoId` IS the run, so a tool call it makes is attributed without
        depending on the agent repeating an id back to us. */
+    if (attempt) {
+        const pending = await client.from('cliv2_run_messages').select('id').eq('todo_id', todoId).is('answered_by', null);
+        if (pending.error)
+            throw pending.error;
+        attempt.observedPendingMessageIds = (pending.data ?? []).map((row) => row.id);
+        owned?.setReference(attempt);
+    }
     let spawnedPid = null;
     const result = await spawn(plan.agent, buildReplyPrompt(record, bodies, { hasCheckout: plan.cwd !== null, workingCopyElsewhere: plan.workingCopyElsewhere }, workerIsLive), undefined, plan.cwd, () => todoWasStopped(client, todoId), (pid) => {
         state.livePids.add(pid);
         spawnedPid = pid;
-    }, undefined, todoId);
+    }, undefined, todoId, owned);
     /* HOWEVER THE ANSWER ENDED. The pid must leave `livePids` on every path, or a
        dead child looks alive to the liveness watch forever. */
     if (spawnedPid !== null)
         state.livePids.delete(spawnedPid);
-    /* ═══ 18k SLICE 10b — THE USER STOPPED IT, AND THAT IS NOT A FAILURE. ═══
-       CHECKED BEFORE `!result.ok`, because a killed child also reports not-ok, and
-       falling through would count the user's own decision as an attempt and
-       re-spawn the very thing they cancelled — `dispatchClaimInner` makes the same
-       check for the same reason.
-  
-       BUT STOPPING ALONE WOULD BE AN INFINITE SPAWN LOOP. A stopped run stays
-       stopped, so the message stays uncovered, the lease lapses, the next take
-       spawns another answerer, and that one is stopped too — forever, burning no
-       budget because no attempt is counted. So the messages are COVERED, and
-       `cliv2_mark_messages_answered` needs a reply id, so one short reply is what
-       covers them. That is also the honest thread: it says the message was not
-       answered because the work was stopped, rather than showing "Queued" forever.
-       ux.md's north star forbids "this will never be answered", and an uncovered
-       stopped message is exactly that state.
-  
-       AND THE CLAIM. This function set no claim, but the run may carry one from an
-       earlier dispatch, and `releaseStoppedTodo` is the only thing that clears it —
-       without this call Retry cannot pick the run up. Its own `.eq('state','stopped')`
-       guard makes it a no-op when Retry has already re-armed the run. */
-    if (result.stopped) {
-        try {
-            const replyId = await writeRunReply(client, todoId, 'Stopped.');
-            const { error } = await client.rpc('cliv2_mark_messages_answered', {
-                p_reply_id: replyId,
-                p_message_ids: messageIds,
-            });
-            if (error)
-                throw new Error(error.message);
-            for (const id of messageIds)
-                state.replyAttempts.delete(id);
-        }
-        catch (err) {
-            warn(`[orchestrator] ${shortId(todoId)} was stopped and the conversation could not be closed off: ${err.message}`);
-        }
-        try {
-            await releaseStoppedTodo(client, todoId);
-        }
-        catch (err) {
-            warn(`[orchestrator] ${shortId(todoId)} was stopped and its claim could not be released: ${err.message}`);
-        }
+    if (result.interrupted)
         return false;
-    }
-    if (!result.ok) {
+    if (!result.ok && !result.stopped) {
         fail(result.error);
         return false;
     }
-    const body = result.output.trim();
-    if (body === '') {
+    const body = result.stopped ? 'Stopped.' : result.output.trim();
+    if (!body) {
         fail('it said nothing');
         return false;
     }
-    let replyId;
-    try {
-        replyId = await writeRunReply(client, todoId, body);
-    }
-    catch (err) {
-        fail(`the reply could not be saved: ${err.message}`);
+    if (!attempt || !machineId)
+        throw new Error('The reply has no exact source lease identity.');
+    const finished = await client.rpc('cliv2_finish_reply_attempt', {
+        p_todo_id: todoId, p_machine_id: machineId, p_message_leases: attempt.messageLeases,
+        p_grant_leases: attempt.grantLeases, p_body: body,
+    });
+    if (finished.error)
+        throw finished.error;
+    const outcome = finished.data?.[0]?.outcome;
+    if (outcome === 'stale')
         return false;
-    }
-    /* ANSWERED. The count is cleared so a LATER message on this run that fails
-       starts from zero rather than inheriting a spent budget.
-  
-       ═══ 18k SLICE 9: AND IT IS CLEARED HERE, BEFORE THE COVERING WRITE. ═══
-       The reply EXISTS from this line on, so the attempt is spent whatever happens
-       next, and the covering below must NOT go through `fail()`. `fail()`'s
-       contract is "nothing was written, so retry the whole thing", and that
-       contract does not hold once a reply is in the thread. Had the covering's
-       failure counted an attempt, three consecutive attribution failures — a reply
-       written EACH time — would exhaust `MAX_REPLY_ATTEMPTS` while `answered_by`
-       stayed null, so the take would keep re-offering the row forever and nothing
-       would ever spawn again: three replies, then permanent silence with "Queued"
-       showing. Strictly worse than the predicate this slice replaces, which at
-       least excluded such a message after the first reply. */
+    if (outcome !== 'accepted' && outcome !== 'already_settled')
+        throw new Error('The reply acknowledgement was incomplete.');
     for (const id of messageIds)
         state.replyAttempts.delete(id);
-    /* ═══ 18k SLICE 9: RECORD WHAT THE REPLY ANSWERED. ═══
-       "Was this message in front of the responder that wrote that reply" is known
-       only here, to the code that handed it over — no timestamp anywhere records
-       it, which is why 20260814190000's inference was wrong by the width of the
-       responder's runtime.
-  
-       REPLY FIRST, COVERING SECOND, DELIBERATELY. If the covering fails the reply
-       exists and the messages stay uncovered, so the next take re-takes them and
-       they get a second reply: visible duplication the user can see and react to.
-       The reverse order risks a covering for a reply that was never written — a
-       message marked answered by nothing, invisible forever. A visible duplicate
-       beats a silent drop, which is the north star's own ranking (ux.md:739).
-  
-       AND THE BOUND IS NOT LOST, IT MOVES: the RPC's own `answered_by is null`
-       term is what bounds a repeated failure here. Each retry round writes at most
-       one extra reply and rounds are one pass apart, so the user-visible bound is
-       duplicate replies at one per pass, never an unbounded spawn loop and never
-       permanent silence. A database that will not accept the mark is an outage,
-       and the honest behaviour under an outage is a visible duplicate rather than
-       a message that disappears. */
-    /* 18k Slice 10b — NOTHING TO ATTRIBUTE WHEN AN APPROVAL WOKE THIS. The reply
-       answers a grant, not a message, so there is no row to mark and the RPC is
-       skipped rather than called with an empty list. The grant's own `consumed_at`
-       is what stops it being offered again, stamped by the tool when the approved
-       call finally goes through. */
-    if (messageIds.length > 0) {
-        try {
-            const { error } = await client.rpc('cliv2_mark_messages_answered', {
-                p_reply_id: replyId,
-                p_message_ids: messageIds,
-            });
-            if (error)
-                throw new Error(error.message);
-        }
-        catch (err) {
-            warn(`[orchestrator] the reply to ${shortId(todoId)} could not be attributed, it will be answered again: ${err.message}`);
-            return false;
-        }
-    }
-    /* ═══ 18k SLICE 10b — CASE B: THE BOUNDARY. ═══
-       An agent was already working this checkout, so the reply said what would
-       happen rather than doing it. Clearing the claim is what makes that true: the
-       next tick dispatches a fresh worker, and `readRunDirection` hands it the
-       message. Nothing interrupts the live worker — it finishes what it is on, and
-       the change rides the NEXT dispatch, exactly as `hand_off_stage` already does
-       mid-run.
-  
-       AFTER THE REPLY AND ITS COVERING, NEVER BEFORE. Clearing first and then
-       failing to write the reply would re-dispatch a worker for a change nobody
-       was ever told about.
-  
-       GUARDED ON `working`/`needs-input`, for `releaseTodoForRedispatch`'s own
-       reason: a run that has since finished, failed or been stopped must not be
-       resurrected into `working` by a claim clear. And all three columns move
-       together — `cliv2_loose_todos_claim_complete_check` makes a half-release a
-       database error.
-  
-       BEST-EFFORT: the reply is in the thread whatever happens here, so a failed
-       clear costs the user a change that does not get dispatched — which the next
-       message re-raises — where throwing would lose the reply's own success. */
-    if (workerIsLive) {
-        try {
-            const { error } = await client
-                .from('cliv2_loose_todos')
-                .update({ claimed_machine_id: null, claimed_agent: null, claimed_at: null })
-                .eq('id', todoId)
-                .in('state', ['working', 'needs-input']);
-            if (error)
-                throw new Error(error.message);
-        }
-        catch (err) {
-            warn(`[orchestrator] ${shortId(todoId)} was answered but the change could not be scheduled: ${err.message}`);
-        }
-    }
-    return true;
+    if (result.stopped && replyingToClaim)
+        await releaseStoppedTodo(client, todoId, replyingToClaim);
+    else if (workerIsLive && replyingToClaim) {
+        const scheduled = await client.from('cliv2_loose_todos')
+            .update({ claimed_machine_id: null, claimed_agent: null, claimed_at: null })
+            .eq('id', todoId).eq('claimed_at', replyingToClaim).in('state', ['working', 'needs-input']);
+        if (scheduled.error)
+            throw scheduled.error;
+    }
+    return !result.stopped;
 }
 /** 18k Slice 7 — say ONCE that the take is failing, not every 10 seconds.
  *
@@ -2504,7 +2420,7 @@ export function reportTakeFailed(state, reason, warn) {
  * is the brake, exactly as it is for the scope park, and answering is what lets
  * it off.
  */
-export async function askWhichCodebase(client, todoId, projectName, remotes, warn) {
+export async function askWhichCodebase(client, todoId, projectName, remotes, warn, claimedAt) {
     try {
         const { error } = await client.rpc('cliv2_ask_about_request', {
             p_todo: todoId,
@@ -2517,7 +2433,7 @@ export async function askWhichCodebase(client, todoId, projectName, remotes, war
         });
         if (error)
             throw new Error(error.message);
-        await parkTodoForScope(client, todoId);
+        await parkTodoForScope(client, todoId, claimedAt);
         return true;
     }
     catch (err) {
@@ -2797,11 +2713,13 @@ export async function collisionForTodo(client, todoId, gitRemoteUrl, warn) {
         return null;
     }
 }
-export async function releaseTodo(client, todoId) {
-    const { error } = await client
+export async function releaseTodo(client, todoId, claimedAt) {
+    const write = client
         .from('cliv2_loose_todos')
         .update({ claimed_machine_id: null, claimed_agent: null, claimed_at: null })
-        .eq('id', todoId);
+        .eq('id', todoId)
+        .in('state', ['working', 'needs-input']);
+    const { error } = await (claimedAt ? write.eq('claimed_at', claimedAt) : write);
     if (error)
         throw error;
 }
@@ -3707,12 +3625,13 @@ run = spawnAgent) {
     alsoRunningIn, 
     /** 18c Slice 1 — the request this spawn is working, so
      *  `report_activity` lines can be attributed without the prompt. */
-    runTodoId) => 
-    /* !Cleanup Phase 6b (I42): NO TIMEOUT. `NO_SPAWN_TIMEOUT` disables the kill
-       entirely — a working agent is never killed for elapsed time (user ruling
-       2026-08-06). Liveness is watched from outside the run instead, by
-       `reapDeadWorkers` on the heartbeat. */
-    run(agent, prompt, NO_SPAWN_TIMEOUT, { onStep, mcpServer, cwd, stopRequested, onPid, alsoRunningIn, runTodoId });
+    runTodoId, owned) => {
+        /* !Cleanup Phase 6b (I42): NO TIMEOUT. `NO_SPAWN_TIMEOUT` disables the kill
+           entirely — a working agent is never killed for elapsed time (user ruling
+           2026-08-06). Liveness is watched from outside the run instead, by
+           `reapDeadWorkers` on the heartbeat. */
+        return run(agent, prompt, NO_SPAWN_TIMEOUT, { onStep, mcpServer, cwd, stopRequested, onPid, alsoRunningIn, runTodoId, owned });
+    };
 }
 /** 18k Slice 8 — how many times one message may be attempted before the daemon
  *  stops spawning for it.
@@ -3727,7 +3646,9 @@ export const MAX_REPLY_ATTEMPTS = 3;
 /** Bound on retained stdout. Generous — a real run's JSONL is a few hundred KB —
  *  but finite, so a runaway agent cannot exhaust memory. */
 const MAX_OUTPUT_BYTES = 32 * 1024 * 1024;
-export async function spawnAgent(agent, prompt, timeoutMs = ORCHESTRATOR_SPAWN_TIMEOUT_MS, { resolveBin = agentPath, exec, onStep, spawnProcess = spawnChild, maxOutputBytes = MAX_OUTPUT_BYTES, mcpServer = null, cwd = null, stopRequested, stopPollMs = STOP_POLL_MS, onPid, alsoRunningIn = [], runTodoId = null } = {}) {
+export async function spawnAgent(agent, prompt, timeoutMs = ORCHESTRATOR_SPAWN_TIMEOUT_MS, { resolveBin = agentPath, exec, onStep, spawnProcess = spawnChild, maxOutputBytes = MAX_OUTPUT_BYTES, mcpServer = null, cwd = null, stopRequested, stopPollMs = STOP_POLL_MS, onPid, alsoRunningIn = [], runTodoId = null, owned } = {}) {
+    if (owned?.interrupted())
+        return { ok: false, output: '', error: 'Work was interrupted by the service command.', interrupted: true };
     const bin = resolveBin(agent);
     if (!bin)
         return { ok: false, output: '', error: `${agent} is not installed on this machine` };
@@ -3741,7 +3662,7 @@ export async function spawnAgent(agent, prompt, timeoutMs = ORCHESTRATOR_SPAWN_T
        Windows path holds spaces (`C:\\Program Files\\…`) and the MCP config is
        JSON, so both would still be split by cmd.exe. */
     const viaShell = needsShell(bin);
-    const rawArgs = headlessAgentArgs(agent, prompt, mcpServer, alsoRunningIn, viaShell, runTodoId);
+    const rawArgs = headlessAgentArgs(agent, prompt, mcpServer, alsoRunningIn, true, runTodoId);
     const args = viaShell ? rawArgs.map(quoteForCmd) : rawArgs;
     /* !Cleanup Phase 2 (I5), CORRECTED BY 18b SLICE 2.
        It used to be `cwd ?? undefined`, and `undefined` means "inherit the
@@ -3829,13 +3750,18 @@ export async function spawnAgent(agent, prompt, timeoutMs = ORCHESTRATOR_SPAWN_T
     return new Promise((resolve) => {
         let child;
         try {
-            child = spawnProcess(bin, args, {
+            owned?.beforeSpawn();
+            const spawnExecution = owned && spawnProcess === spawnChild
+                ? (file, argv, options) => spawnOwnedProcess(file, argv, options, owned.id)
+                : spawnProcess;
+            child = spawnExecution(bin, args, {
                 // The repo-wide invariant for ANY child process (MEMORY: "Windows
                 // silence decision"). A user must never see a console flash.
                 windowsHide: true,
                 shell: viaShell,
                 // 18a Slice 7: stdin is a pipe only where the prompt travels down it.
-                stdio: [viaShell ? 'pipe' : 'ignore', 'pipe', 'pipe'],
+                stdio: ['pipe', 'pipe', 'pipe'],
+                detached: process.platform !== 'win32',
                 // !Cleanup Phase 2 (I5) — the worker starts inside the work item's own
                 // checkout instead of at the daemon's cwd (`/` under launchd).
                 cwd: childCwd,
@@ -3849,17 +3775,15 @@ export async function spawnAgent(agent, prompt, timeoutMs = ORCHESTRATOR_SPAWN_T
             /* Nothing was spawned, so nothing can still be holding the directory. */
             if (codexHome)
                 removeCodexRunHome(codexHome);
-            return resolve(spawnFailure(agent, err));
+            return resolve({ ...spawnFailure(agent, err), ...(owned?.interrupted() ? { interrupted: true } : {}) });
         }
         /* 18a SLICE 7 — AND THE PROMPT GOES DOWN IT, then the pipe is CLOSED.
            Both agents wait for end-of-input before they start, so leaving it open
            hangs the run forever. The write is best-effort in the same sense every
            other pipe operation here is: a child that died before reading raises
            EPIPE, and that is the child's exit to report, not this write's. */
-        if (viaShell && child.stdin) {
-            child.stdin.on('error', () => { });
-            child.stdin.end(prompt);
-        }
+        let registration = Promise.resolve();
+        child.stdin?.on('error', () => { });
         /* !Cleanup Phase 6b (I43) — hand the pid up the moment it exists, so the
            liveness watch can tell a dead agent from a quiet one. Guarded on
            `typeof`: a child that failed to spawn has no pid, and reporting
@@ -4020,9 +3944,24 @@ export async function spawnAgent(agent, prompt, timeoutMs = ORCHESTRATOR_SPAWN_T
                it stripped to '', the column would take null and the card would lose
                the context its question needs. `redactSecrets` is identity when the run
                read no credential, which is almost every run. */
-            resolve(result.output
-                ? { ...result, output: redactSecrets(runTodoId, result.output) }
-                : result);
+            void (async () => {
+                await registration.catch(() => { });
+                if (owned && typeof child.pid === 'number') {
+                    for (;;) {
+                        try {
+                            await owned.exited();
+                            break;
+                        }
+                        catch {
+                            await new Promise((done) => setTimeout(done, 250));
+                        }
+                    }
+                }
+                if (codexHome && owned)
+                    removeCodexRunHome(codexHome);
+                resolve({ ...(result.output ? { ...result, output: redactSecrets(runTodoId, result.output) } : result),
+                    ...(owned?.interrupted() ? { interrupted: true } : {}) });
+            })();
         };
         /* ═══ 18c SLICE 8 — THE HOME IS SWEPT WHEN THE CHILD IS GONE, NOT WHEN THE
                PROMISE SETTLES. ═══
@@ -4058,7 +3997,8 @@ export async function spawnAgent(agent, prompt, timeoutMs = ORCHESTRATOR_SPAWN_T
             sweptHome = true;
             removeCodexRunHome(codexHome);
         };
-        child.on('close', sweepHomeWhenChildIsGone);
+        if (!owned)
+            child.on('close', sweepHomeWhenChildIsGone);
         /* !Cleanup PHASE 6b (I42) — THE ELAPSED-TIME KILL IS OFF BY DEFAULT NOW.
            User ruling 2026-08-06: "No agent that is actively working should ever be
            killed automatically, regardless of how much time has elapsed."
@@ -4214,6 +4154,18 @@ export async function spawnAgent(agent, prompt, timeoutMs = ORCHESTRATOR_SPAWN_T
                way: anything parseable was already captured live above. */
             settle(finishSpawn(agent, stdout));
         });
+        registration = owned ? owned.register(child) : Promise.resolve();
+        void registration.then(() => {
+            if (!owned?.interrupted()) {
+                if (owned)
+                    releaseOwnedProcess(child);
+                child.stdin?.end(prompt);
+            }
+        }).catch((error) => {
+            child.stdin?.destroy();
+            killTree(child);
+            settle(spawnFailure(agent, error));
+        });
     });
 }
 /**
@@ -4412,7 +4364,8 @@ export async function updateWorker(client, workerId, state, error = null, warn =
         const { error: writeError } = await client
             .from('cliv2_workers')
             .update(patch)
-            .eq('id', workerId);
+            .eq('id', workerId)
+            .in('state', ['working', 'dispatching']);
         if (writeError)
             throw writeError;
     }
@@ -4596,6 +4549,11 @@ export async function reapDeadWorkers(client, machineId, livePids, now = () => n
         const cutoff = now().getTime() - STALE_WORKER_MS;
         let reaped = 0;
         for (const row of rows) {
+            if (hasOwnedWorkContext() && ownedWorkerExecutionHeld(row.id))
+                continue;
+            const claimedAt = hasOwnedWorkContext() ? ownedWorkerClaimedAt(row.id) : undefined;
+            if (claimedAt === null)
+                continue;
             /* CONDITION 1 — quiet. A worker that has written a step recently is
                working, and nothing else is even considered. */
             const seen = Date.parse(row.updated_at);
@@ -4641,7 +4599,9 @@ export async function reapDeadWorkers(client, machineId, livePids, now = () => n
                    card everything Slices 5 and 6 already draw (the attempt, the
                    reason, the countdown) for free, and at the bound it gives up and
                    says why instead of being fed back into the same machine. */
-                const { fate, attempts } = await releaseOrFail(client, row.todo_id, plain, now().getTime());
+                const { fate, attempts } = await releaseOrFail(client, row.todo_id, plain, now().getTime(), claimedAt);
+                if (fate === 'stale')
+                    continue;
                 /* 18c SLICE 9 (GAP 15): AND IT HOLDS NOTHING ANY MORE.
                    THIS PATH NEEDS ITS OWN CALL and is not covered by `dispatchClaim`'s
                    `finally`: the reaper exists precisely for a worker that died while
@@ -4705,6 +4665,7 @@ export async function reapDeadWorkers(client, machineId, livePids, now = () => n
  */
 export async function recoverStrandedWorkers(client, machineId, log = console.log, warn = console.warn) {
     try {
+        const lifecycleOwned = hasOwnedWorkContext();
         const { data, error } = await client
             .from('cliv2_workers')
             .update({
@@ -4732,7 +4693,11 @@ export async function recoverStrandedWorkers(client, machineId, log = console.lo
         /* The todo goes back in the queue. Order matters: the worker is closed
            FIRST, so there is no instant at which a claimable todo still has a live
            worker that would refuse the dispatch. */
-        for (const row of stranded) {
+        // Lifecycle startup has already reconciled exact attempt receipts. A stale
+        // worker row can outlive a newer claim, including one on another machine;
+        // closing that obsolete worker must never release the newer assignment.
+        // Keep the pre-lifecycle compatibility path only for its existing callers.
+        for (const row of lifecycleOwned ? [] : stranded) {
             try {
                 await releaseTodo(client, row.todo_id);
             }
@@ -5287,7 +5252,7 @@ export async function orchestratorTick(deps) {
        query, so a tick that cannot start anything costs nothing at all — no read,
        no claim, no log. Was `if (state.busy)`, which is why a second request typed
        three seconds after the first sat untouched until the first finished.
-  
+       *
        THE SLOT IS TAKEN HERE, NOT AFTER THE CLAIM, and that is not tidiness — it
        is the difference between a cap and a suggestion. `pollOrchestrator` is an
        interval that does NOT await, so ticks genuinely overlap, and there are
@@ -5297,7 +5262,7 @@ export async function orchestratorTick(deps) {
        the cap would bound nothing. Taking the slot before the first await makes
        the check-and-take atomic with respect to the event loop, because there is
        no suspension point between them.
-  
+       *
        EVERY early return below MUST give it back, which is why the whole body from
        here down is wrapped so the release is in one place rather than repeated at
        each `return`. */
@@ -5305,6 +5270,7 @@ export async function orchestratorTick(deps) {
         return 'busy';
     state.inFlight += 1;
     try {
+        await reconcileInterruptedWork(deps.client, deps.machineId);
         return await runTick(deps, state, now, log, warn);
     }
     finally {
@@ -5314,208 +5280,225 @@ export async function orchestratorTick(deps) {
 /** The tick body, with its concurrency slot already taken. Split out so the slot
  *  is released in exactly one place — see the caller. */
 async function runTick(deps, state, now, log, warn) {
-    /* Only what CHOOSING a unit needs. The spawn's own inputs (`spawn`,
-       `mcpServer`) are destructured in `dispatchClaim`, where they are used.
-       `resolveContext` is needed in BOTH: here it answers "which repo would this
-       touch" for the collision read, and there it answers "where does the worker
-       start" — deliberately the same resolver, so the two cannot disagree. */
-    const { client, userId, machineId, machineName, agents, resolveContext = (claim) => resolveClaimContext(client, claim, warn), } = deps;
-    /* 18a SLICE 6: THE BACKOFF USED TO BE CHECKED HERE, and returning from this
-       line is precisely what was wrong with it: a failing agent stopped the whole
-       daemon rather than stopping itself. The wait is now per request, on the row,
-       and the claim itself skips a request whose moment has not come. */
-    let role;
+    if (!ownedWorkAllowed())
+        return 'nothing-to-do';
+    const endClaim = beginOwnedClaim();
+    const claimOperations = [];
     try {
-        const { data, error } = await client
-            .from('cliv2_orchestrator_preference')
-            .select('machine_id, agent')
-            .eq('user_id', userId)
-            .maybeSingle();
-        if (error)
-            throw error;
-        role = resolveOrchestratorRole(data ?? null, machineId, agents);
-    }
-    catch (err) {
-        // Do NOT fall through to a claim on a failed read: an unreadable designation
-        // is not a designation, and guessing would be exactly the fleet-wide race
-        // the machine check exists to prevent.
-        warn(`orchestrator designation read failed, will retry: ${err.message}`);
-        return 'failed';
-    }
-    reportRole(state, role, machineName, log);
-    if (role.kind !== 'this-machine')
-        return 'not-designated';
-    /* ═══ 18d — NO TOOLS MEANS NO DISPATCH. ═══
-  
-       FOUND BY WALKING IT, 2026-08-12. A daemon restart raced its own port: the
-       replacement process came up while the old one still held 4579, so
-       `toolsServerStatus().running` was false, `presence.ts` passed
-       `mcpServer: null`, and the very next tick claimed a request and spawned a
-       worker WITH NO CTRL+SPC TOOLS AT ALL. That worker could not read the work
-       item, could not read its own stage document, could not call `ask_question`
-       and could not `hand_off_stage`. It did the only thing left: it wrote an
-       essay into its final answer explaining that the tools were missing, and the
-       request was burned — `attempts` spent, the user's card finished, and
-       nothing to show for it.
-  
-       Null is the RIGHT value there: the alternative that comment rejects is
-       letting the worker inherit the user's own agent config, where a second
-       CTRL+SPC server pointed at a DIFFERENT ACCOUNT was once found registered and
-       listening. That is worse. But there was a third option nobody took, which is
-       to not dispatch at all.
-  
-       WAITING IS FREE AND CORRECT. The request keeps its place, unclaimed and
-       unspent, and the tools server comes up moments later — the port race
-       resolves as soon as the old process lets go. A dispatch made in this window
-       cannot be retried usefully, because it is not the request that is broken.
-  
-       BEFORE THE CLAIM, deliberately: claiming and then refusing to spawn would
-       spend `attempts` on a condition that has nothing to do with the request.
-  
-       THE CONDITION IS "A REAL SPAWN WITH NO SERVER", not "no server". An injected
-       `spawn` is a caller who has taken over the launching entirely — every test in
-       the suite, and any future embedder — and for them `mcpServer` describes
-       nothing, because `defaultSpawn` is what turns it into an argv. Gating on the
-       null alone would refuse to dispatch in exactly the cases where the tools are
-       not in question, which is not a stricter check but a wrong one. */
-    if (!deps.mcpServer && !deps.spawn) {
-        reportNoTools(state, warn);
-        return 'no-tools';
-    }
-    state.warnedNoTools = false;
-    /* ═══ !Cleanup PHASE 7 SLICE 2: CLAIM PAST THE BLOCKED ONES. ═══
-  
-       A dependent unit must WAIT, and everything behind it must NOT. Those two
-       requirements together are why this is a loop rather than a single claim.
-  
-       The claim is this design's only queue position, and it takes the OLDEST
-       claimable row. So a blocked unit that is merely released is re-claimed FIRST
-       on the very next tick, forever — it stops being a waiting unit and becomes a
-       queue stopper. Releasing it AND telling the next claim to skip it is what
-       makes the rest of the queue reachable.
-  
-       BOUNDED BY THE NUMBER OF UNITS SKIPPED, not by a fixed count: each iteration
-       either dispatches (returns), finds nothing (returns), or adds exactly one id
-       to `skip`, and a skipped id can never be claimed again this tick. So the
-       loop runs at most once per blocked unit and then ends. No timeout needed,
-       because it cannot revisit a row.
-  
-       THE UNIT STAYS `working` AND UNCLAIMED, deliberately — it is NOT parked to
-       `needs-input` the way the scope gate parks. `needs-input` means "this needs
-       YOU", and a dependency needs nothing from the user: it resolves when the
-       blocker finishes. Parking it would put a card under "Needs you" offering no
-       action, which is precisely the defect Phase 1 existed to remove. The panel
-       reads the same `blocked_tasks` view and renders "Waiting on <name>" from it,
-       so the card explains itself without a state that lies. */
-    const skip = [];
-    let blockedCount = 0;
-    for (;;) {
-        let claim;
+        /* Only what CHOOSING a unit needs. The spawn's own inputs (`spawn`,
+           `mcpServer`) are destructured in `dispatchClaim`, where they are used.
+           `resolveContext` is needed in BOTH: here it answers "which repo would this
+           touch" for the collision read, and there it answers "where does the worker
+           start" — deliberately the same resolver, so the two cannot disagree. */
+        const { client, userId, machineId, machineName, agents, resolveContext = (claim) => resolveClaimContext(client, claim, warn), } = deps;
+        /* 18a SLICE 6: THE BACKOFF USED TO BE CHECKED HERE, and returning from this
+           line is precisely what was wrong with it: a failing agent stopped the whole
+           daemon rather than stopping itself. The wait is now per request, on the row,
+           and the claim itself skips a request whose moment has not come. */
+        let role;
         try {
-            claim = await claimNextTodo(client, machineId, role.agent, skip);
+            const { data, error } = await client
+                .from('cliv2_orchestrator_preference')
+                .select('machine_id, agent')
+                .eq('user_id', userId)
+                .maybeSingle();
+            if (error)
+                throw error;
+            role = resolveOrchestratorRole(data ?? null, machineId, agents);
         }
         catch (err) {
-            warn(`orchestrator poll failed, will retry: ${err.message}`);
+            // Do NOT fall through to a claim on a failed read: an unreadable designation
+            // is not a designation, and guessing would be exactly the fleet-wide race
+            // the machine check exists to prevent.
+            warn(`orchestrator designation read failed, will retry: ${err.message}`);
             return 'failed';
         }
-        if (!claim) {
-            /* Nothing claimable. If we skipped something, the queue is not empty —
-               it is WAITING, which is a different fact and must not be logged as
-               idleness. */
-            return blockedCount > 0 ? 'blocked' : 'nothing-to-do';
+        reportRole(state, role, machineName, log);
+        if (role.kind !== 'this-machine')
+            return 'not-designated';
+        /* ═══ 18d — NO TOOLS MEANS NO DISPATCH. ═══
+           *
+           FOUND BY WALKING IT, 2026-08-12. A daemon restart raced its own port: the
+           replacement process came up while the old one still held 4579, so
+           `toolsServerStatus().running` was false, `presence.ts` passed
+           `mcpServer: null`, and the very next tick claimed a request and spawned a
+           worker WITH NO CTRL+SPC TOOLS AT ALL. That worker could not read the work
+           item, could not read its own stage document, could not call `ask_question`
+           and could not `hand_off_stage`. It did the only thing left: it wrote an
+           essay into its final answer explaining that the tools were missing, and the
+           request was burned — `attempts` spent, the user's card finished, and
+           nothing to show for it.
+           *
+           Null is the RIGHT value there: the alternative that comment rejects is
+           letting the worker inherit the user's own agent config, where a second
+           CTRL+SPC server pointed at a DIFFERENT ACCOUNT was once found registered and
+           listening. That is worse. But there was a third option nobody took, which is
+           to not dispatch at all.
+           *
+           WAITING IS FREE AND CORRECT. The request keeps its place, unclaimed and
+           unspent, and the tools server comes up moments later — the port race
+           resolves as soon as the old process lets go. A dispatch made in this window
+           cannot be retried usefully, because it is not the request that is broken.
+           *
+           BEFORE THE CLAIM, deliberately: claiming and then refusing to spawn would
+           spend `attempts` on a condition that has nothing to do with the request.
+           *
+           THE CONDITION IS "A REAL SPAWN WITH NO SERVER", not "no server". An injected
+           `spawn` is a caller who has taken over the launching entirely — every test in
+           the suite, and any future embedder — and for them `mcpServer` describes
+           nothing, because `defaultSpawn` is what turns it into an argv. Gating on the
+           null alone would refuse to dispatch in exactly the cases where the tools are
+           not in question, which is not a stricter check but a wrong one. */
+        if (!deps.mcpServer && !deps.spawn) {
+            reportNoTools(state, warn);
+            return 'no-tools';
         }
-        /* ═══ THE TWO REASONS WORK WAITS, ASKED IN ORDER. ═══
-    
-           A DEPENDENCY IS ASKED FIRST, and the order is meaningful rather than
-           incidental: a dependency is a FACT about what must happen before what,
-           while a collision is a CHOICE to serialise safely. When both are true the
-           user is better told the one that will not change on its own — a collision
-           clears the moment the other agent releases, a dependency does not clear
-           until the blocker is finished.
-    
-           Slice 3 adds the second. Both hold the SAME WAY (release, skip, report
-           once), so the shared tail below is written once rather than twice. */
-        const blocker = await blockerForTodo(client, claim.id, warn);
-        /* THE CODEBASE COMES FROM `resolveContext`, the SAME resolver the dispatch
-           uses to choose the worker's working directory — not a second lookup that
-           could disagree with it. A reservation is scoped by `git_remote_url`, so
-           "which repo would this run touch" and "which repo will it start in" have
-           to be one answer. Only reached when there is no dependency, so an ordinary
-           dispatchable request costs one extra read, not two. */
-        /* ═══ 18b SLICE 4 — THE CODEBASE THE USER CHOSE, AND THE FAN-OUT. ═══
-    
-           Read BEFORE the context is resolved, because it is an input to it: given a
-           choice, the resolver treats the project as if that one codebase were its
-           only one, and the ambiguity never arises.
-    
-           MORE THAN ONE CHOSEN MEANS MORE THAN ONE RUN (user ruling, 2026-08-07).
-           This tick dispatches the FIRST; `spawnSiblingRuns` below creates a sibling
-           request for each of the rest, which the daemon then claims on its own
-           ticks exactly like any other request. Each run carries ONE codebase and
-           starts in that codebase's own checkout, wherever it is on disk — nothing
-           here reads folder layout, which is the whole of the location ruling.
-    
-           Nothing changes for a request that was never asked: `chosen` is empty, the
-           claim carries null, and every path below behaves as it did in Slice 2. */
-        /* A SIBLING ALREADY KNOWS ITS OWN, and asks nothing. `chosen_codebase` comes
-           down on the claim itself (this slice's migration), so a fanned-out run
-           needs no ask to read and cannot fan out again — which is what stops the
-           fan-out being infinite. Only a request that was ASKED reads the answer. */
-        const chosen = blocker
-            ? []
-            : claim.chosenCodebase
-                ? [claim.chosenCodebase]
-                : await readChosenCodebases(client, claim.id, warn);
-        const runClaim = chosen.length > 0
-            ? { ...claim, chosenCodebase: chosen[0] }
-            : claim;
-        const context = blocker ? null : await resolveContext(runClaim);
-        const collision = context
-            ? await collisionForTodo(client, claim.id, context.gitRemoteUrl, warn)
-            : null;
-        if (!blocker && !collision) {
-            /* NO LONGER WAITING, so the next time it does wait it is reported again.
-               Without this, a unit that blocked, ran, and blocked again on something
-               else would stay silent forever. */
-            state.reportedWaiting.delete(claim.id);
-            /* THE RESOLVED CONTEXT IS HANDED ON rather than resolved again. It reads
-               several tables and touches the filesystem, and the dispatch needs the
-               very same answer — resolving twice would both cost a second pass and
-               allow the collision check and the working directory to disagree. */
-            /* THE SIBLINGS ARE CREATED BEFORE THIS RUN DISPATCHES, so a user who chose
-               three codebases sees three cards immediately rather than one that
-               mysteriously multiplies later. Best-effort: a failed sibling costs that
-               codebase its run, and is logged; it must not cost the user the run that
-               is about to start. */
-            if (chosen.length > 1) {
-                await spawnSiblingRuns(client, claim, chosen.slice(1), log, warn);
+        state.warnedNoTools = false;
+        /* ═══ !Cleanup PHASE 7 SLICE 2: CLAIM PAST THE BLOCKED ONES. ═══
+           *
+           A dependent unit must WAIT, and everything behind it must NOT. Those two
+           requirements together are why this is a loop rather than a single claim.
+           *
+           The claim is this design's only queue position, and it takes the OLDEST
+           claimable row. So a blocked unit that is merely released is re-claimed FIRST
+           on the very next tick, forever — it stops being a waiting unit and becomes a
+           queue stopper. Releasing it AND telling the next claim to skip it is what
+           makes the rest of the queue reachable.
+           *
+           BOUNDED BY THE NUMBER OF UNITS SKIPPED, not by a fixed count: each iteration
+           either dispatches (returns), finds nothing (returns), or adds exactly one id
+           to `skip`, and a skipped id can never be claimed again this tick. So the
+           loop runs at most once per blocked unit and then ends. No timeout needed,
+           because it cannot revisit a row.
+           *
+           THE UNIT STAYS `working` AND UNCLAIMED, deliberately — it is NOT parked to
+           `needs-input` the way the scope gate parks. `needs-input` means "this needs
+           YOU", and a dependency needs nothing from the user: it resolves when the
+           blocker finishes. Parking it would put a card under "Needs you" offering no
+           action, which is precisely the defect Phase 1 existed to remove. The panel
+           reads the same `blocked_tasks` view and renders "Waiting on <name>" from it,
+           so the card explains itself without a state that lies. */
+        const skip = [];
+        let blockedCount = 0;
+        for (;;) {
+            let claim;
+            try {
+                claim = await claimNextTodo(client, machineId, role.agent, [...skip, ...legacyHeldTodoIds()]);
+                if (claim?.claimOperationId)
+                    claimOperations.push(claim.claimOperationId);
             }
-            return await dispatchClaim(deps, state, now, log, warn, role, runClaim, context, chosen);
-        }
-        /* SAID ONCE PER (unit, REASON) — see `reportedWaiting`. The tick runs every
-           3s and this branch is reached on every one of them for as long as the wait
-           holds. The key carries the reason, not just the unit, so a request that
-           stops waiting on a dependency and starts waiting on a FILE says so. */
-        const waitKey = blocker
-            ? `dep:${blocker.dependsOnId}`
-            : `path:${collision.heldBySessionId}:${collision.path}`;
-        const waitLine = blocker
-            ? `is waiting on "${blocker.dependsOnName}"`
-            : `is waiting on the same files as "${collision.heldByInstruction ?? 'another run'}"`
-                + ` (${collision.path}${collision.pathCount > 1 ? ` and ${collision.pathCount - 1} more` : ''})`;
-        if (state.reportedWaiting.get(claim.id) !== waitKey) {
-            state.reportedWaiting.set(claim.id, waitKey);
-            log(`[orchestrator] "${claim.instruction}" (${shortId(claim.id)}) ${waitLine} — not dispatching`);
+            catch (err) {
+                warn(`orchestrator poll failed, will retry: ${err.message}`);
+                return 'failed';
+            }
+            if (!claim) {
+                /* Nothing claimable. If we skipped something, the queue is not empty —
+                   it is WAITING, which is a different fact and must not be logged as
+                   idleness. */
+                return blockedCount > 0 ? 'blocked' : 'nothing-to-do';
+            }
+            /* ═══ THE TWO REASONS WORK WAITS, ASKED IN ORDER. ═══
+             *
+               A DEPENDENCY IS ASKED FIRST, and the order is meaningful rather than
+               incidental: a dependency is a FACT about what must happen before what,
+               while a collision is a CHOICE to serialise safely. When both are true the
+               user is better told the one that will not change on its own — a collision
+               clears the moment the other agent releases, a dependency does not clear
+               until the blocker is finished.
+             *
+               Slice 3 adds the second. Both hold the SAME WAY (release, skip, report
+               once), so the shared tail below is written once rather than twice. */
+            const blocker = await blockerForTodo(client, claim.id, warn);
+            /* THE CODEBASE COMES FROM `resolveContext`, the SAME resolver the dispatch
+               uses to choose the worker's working directory — not a second lookup that
+               could disagree with it. A reservation is scoped by `git_remote_url`, so
+               "which repo would this run touch" and "which repo will it start in" have
+               to be one answer. Only reached when there is no dependency, so an ordinary
+               dispatchable request costs one extra read, not two. */
+            /* ═══ 18b SLICE 4 — THE CODEBASE THE USER CHOSE, AND THE FAN-OUT. ═══
+             *
+               Read BEFORE the context is resolved, because it is an input to it: given a
+               choice, the resolver treats the project as if that one codebase were its
+               only one, and the ambiguity never arises.
+             *
+               MORE THAN ONE CHOSEN MEANS MORE THAN ONE RUN (user ruling, 2026-08-07).
+               This tick dispatches the FIRST; `spawnSiblingRuns` below creates a sibling
+               request for each of the rest, which the daemon then claims on its own
+               ticks exactly like any other request. Each run carries ONE codebase and
+               starts in that codebase's own checkout, wherever it is on disk — nothing
+               here reads folder layout, which is the whole of the location ruling.
+             *
+               Nothing changes for a request that was never asked: `chosen` is empty, the
+               claim carries null, and every path below behaves as it did in Slice 2. */
+            /* A SIBLING ALREADY KNOWS ITS OWN, and asks nothing. `chosen_codebase` comes
+               down on the claim itself (this slice's migration), so a fanned-out run
+               needs no ask to read and cannot fan out again — which is what stops the
+               fan-out being infinite. Only a request that was ASKED reads the answer. */
+            const chosen = blocker
+                ? []
+                : claim.chosenCodebase
+                    ? [claim.chosenCodebase]
+                    : await readChosenCodebases(client, claim.id, warn);
+            const runClaim = chosen.length > 0
+                ? { ...claim, chosenCodebase: chosen[0] }
+                : claim;
+            const context = blocker ? null : await resolveContext(runClaim);
+            const collision = context
+                ? await collisionForTodo(client, claim.id, context.gitRemoteUrl, warn)
+                : null;
+            if (!blocker && !collision) {
+                /* NO LONGER WAITING, so the next time it does wait it is reported again.
+                   Without this, a unit that blocked, ran, and blocked again on something
+                   else would stay silent forever. */
+                state.reportedWaiting.delete(claim.id);
+                /* THE RESOLVED CONTEXT IS HANDED ON rather than resolved again. It reads
+                   several tables and touches the filesystem, and the dispatch needs the
+                   very same answer — resolving twice would both cost a second pass and
+                   allow the collision check and the working directory to disagree. */
+                /* THE SIBLINGS ARE CREATED BEFORE THIS RUN DISPATCHES, so a user who chose
+                   three codebases sees three cards immediately rather than one that
+                   mysteriously multiplies later. Best-effort: a failed sibling costs that
+                   codebase its run, and is logged; it must not cost the user the run that
+                   is about to start. */
+                if (chosen.length > 1) {
+                    await spawnSiblingRuns(client, claim, chosen.slice(1), log, warn);
+                }
+                const dispatched = dispatchClaim(deps, state, now, log, warn, role, runClaim, context, chosen);
+                if (hasOwnedWorkContext())
+                    finishRpcClaims(claimOperations);
+                endClaim();
+                return await dispatched;
+            }
+            /* SAID ONCE PER (unit, REASON) — see `reportedWaiting`. The tick runs every
+               3s and this branch is reached on every one of them for as long as the wait
+               holds. The key carries the reason, not just the unit, so a request that
+               stops waiting on a dependency and starts waiting on a FILE says so. */
+            const waitKey = blocker
+                ? `dep:${blocker.dependsOnId}`
+                : `path:${collision.heldBySessionId}:${collision.path}`;
+            const waitLine = blocker
+                ? `is waiting on "${blocker.dependsOnName}"`
+                : `is waiting on the same files as "${collision.heldByInstruction ?? 'another run'}"`
+                    + ` (${collision.path}${collision.pathCount > 1 ? ` and ${collision.pathCount - 1} more` : ''})`;
+            if (state.reportedWaiting.get(claim.id) !== waitKey) {
+                state.reportedWaiting.set(claim.id, waitKey);
+                log(`[orchestrator] "${claim.instruction}" (${shortId(claim.id)}) ${waitLine} — not dispatching`);
+            }
+            /* RELEASED, so that the moment the blocker is done the ordinary claim picks
+               it up with no user action and no special path. That is the Gherkin line
+               "123.1 starts without my intervention", and it is why this must not keep
+               the claim the way `parkTodoForScope` does. */
+            await releaseTodo(client, claim.id, claim.claimedAt).catch((err) => {
+                warn(`could not release a blocked todo: ${err.message}`);
+            });
+            skip.push(claim.id);
+            blockedCount += 1;
         }
-        /* RELEASED, so that the moment the blocker is done the ordinary claim picks
-           it up with no user action and no special path. That is the Gherkin line
-           "123.1 starts without my intervention", and it is why this must not keep
-           the claim the way `parkTodoForScope` does. */
-        await releaseTodo(client, claim.id).catch((err) => {
-            warn(`could not release a blocked todo: ${err.message}`);
-        });
-        skip.push(claim.id);
-        blockedCount += 1;
+    }
+    finally {
+        if (hasOwnedWorkContext())
+            finishRpcClaims(claimOperations);
+        endClaim();
     }
 }
 /**
@@ -5549,10 +5532,14 @@ async function runTick(deps, state, now, log, warn) {
  * returns is not a funnel.
  */
 async function dispatchClaim(deps, state, now, log, warn, role, claim, context, chosenCodebases = []) {
+    const owned = hasOwnedWorkContext() ? reserveOwnedWork({ surface: 'worker', todoId: claim.id, workerId: null, claimedAt: claim.claimedAt, observedPendingMessageIds: null }, role.agent) : undefined;
     try {
-        return await dispatchClaimInner(deps, state, now, log, warn, role, claim, context, chosenCodebases);
+        const outcome = await dispatchClaimInner(deps, state, now, log, warn, role, claim, context, chosenCodebases, owned);
+        owned?.complete();
+        return outcome;
     }
     finally {
+        owned?.finishPreparation();
         /* THE RUN IS OVER, SO IT HOLDS NOTHING, however it ended and wherever it
            returned from. Best-effort by contract: `releaseTodoReservations` never
            throws, so this cannot change what the body returned, and a `finally`
@@ -5577,7 +5564,7 @@ context,
 /** 18b Slice 4 — every codebase the user chose, including this run's own. The
  *  siblings are derived from it below; empty on every request that was never
  *  asked, which is the ordinary case. */
-chosenCodebases = []) {
+chosenCodebases = [], owned) {
     const { client, machineId, mcpServer = null, spawn = defaultSpawn(mcpServer), } = deps;
     /* ═══ 16g SLICE 1 — THE SECOND ENFORCEMENT POINT. ═══
        `No approved scope-version pointer → no execution write and no coding lane.`
@@ -5638,7 +5625,7 @@ chosenCodebases = []) {
            uses the mirror of this: answering an ask CLEARS the claim to make the
            work dispatchable again — so approving scope re-dispatches through the
            path that already exists, with no new mechanism. */
-        await parkTodoForScope(client, claim.id).catch((err) => {
+        await parkTodoForScope(client, claim.id, claim.claimedAt).catch((err) => {
             warn(`could not park an unapproved todo: ${err.message}`);
         });
         return 'nothing-to-do';
@@ -5665,7 +5652,7 @@ chosenCodebases = []) {
        hold a dead end too. Building stays held exactly as shipped. */
     if (targeted && building && await todoIsHeldForScope(client, claim.id)) {
         log(`[orchestrator] "${claim.instruction}" has an unresolved scope change — not dispatching`);
-        await parkTodoForScope(client, claim.id).catch((err) => {
+        await parkTodoForScope(client, claim.id, claim.claimedAt).catch((err) => {
             warn(`could not park a held todo: ${err.message}`);
         });
         return 'nothing-to-do';
@@ -5801,7 +5788,7 @@ chosenCodebases = []) {
            with the words it had in Slice 2: never parked with no question on it,
            which the user could only clear with Stop. */
         if (context.miss?.kind === 'ambiguous-codebase' && instructionNeedsCheckout(claim.instruction)) {
-            const asked = await askWhichCodebase(client, claim.id, context.miss.projectName, context.miss.gitRemoteUrls, warn);
+            const asked = await askWhichCodebase(client, claim.id, context.miss.projectName, context.miss.gitRemoteUrls, warn, claim.claimedAt);
             if (asked) {
                 log(`[orchestrator] asking which codebase "${claim.instruction}" should run in`);
                 await updateWorker(client, workerId, 'died', 'waiting for the user to choose a codebase', warn);
@@ -5811,7 +5798,7 @@ chosenCodebases = []) {
         if (context.miss && instructionNeedsCheckout(claim.instruction)) {
             log(`[orchestrator] "${claim.instruction}" needs the code, which is not on this machine`);
             await updateWorker(client, workerId, 'died', 'the codebase is not available on this machine', warn);
-            await answerTodo(client, claim.id, checkoutMissAnswer(context.miss));
+            await answerTodo(client, claim.id, checkoutMissAnswer(context.miss), claim.claimedAt);
             return 'answered';
         }
         /* ═══ 18d SLICE 4 — ONE STAGE PER DISPATCH (user ruling, 2026-08-12). ═══
@@ -5823,6 +5810,15 @@ chosenCodebases = []) {
         if (stage) {
             log(`[orchestrator] ${shortId(claim.id)} is working stage ${stage.position}/${stage.total}: ${stage.title}`);
         }
+        if (owned) {
+            if (!claim.claimedAt || !workerId)
+                throw new Error('The worker has no exact attempt identity.');
+            const pending = await client.from('cliv2_run_messages').select('id').eq('todo_id', claim.id).is('answered_by', null);
+            if (pending.error)
+                throw pending.error;
+            owned.setReference({ surface: 'worker', todoId: claim.id, workerId, claimedAt: claim.claimedAt,
+                observedPendingMessageIds: (pending.data ?? []).map((row) => row.id) });
+        }
         const result = await spawn(role.agent, buildPrompt(claim.instruction, claim.id, answered, targeted && scopeVersion ? { workItemId: targeted, version: scopeVersion } : null, replies, context, planningOnly, interrupted, selectedTools, stage, directed), (step) => steps.offer(step), context.checkout, 
         // !Cleanup Phase 6 (I17) — polled by the child; true kills it.
         () => todoWasStopped(client, claim.id), 
@@ -5850,15 +5846,17 @@ chosenCodebases = []) {
            not the prompt, so report_activity attributes without depending on
            agent cooperation (ux.md § Corrections: codex dropped a prompt-carried
            id twice). */
-        claim.id);
+        claim.id, owned);
         /* !Cleanup PHASE 6 (I17) — THE USER STOPPED IT, and that is not a failure.
            Checked BEFORE `!result.ok`, because a killed child also reports not-ok:
            falling through would count the user's own decision as an attempt and
            retry the very thing they cancelled. Nothing is written but the claim
            release — the browser already set `stopped`. */
+        if (result.interrupted)
+            return 'nothing-to-do';
         if (result.stopped) {
             await updateWorker(client, workerId, 'died', 'stopped by the user', warn);
-            await releaseStoppedTodo(client, claim.id);
+            await releaseStoppedTodo(client, claim.id, claim.claimedAt);
             log(`[orchestrator] ${shortId(claim.id)} was stopped by the user`);
             return 'released';
         }
@@ -5878,6 +5876,8 @@ chosenCodebases = []) {
                `failed` with the reason instead, which is what stops the unit being
                re-claimed forever while reading as Working. */
             const { fate, attempts } = await releaseOrFail(client, claim.id, plain, now().getTime(), claim.claimedAt);
+            if (fate === 'stale')
+                return 'nothing-to-do';
             if (fate === 'failed') {
                 warn(`[orchestrator] ${result.error} — ${shortId(claim.id)} failed after ${MAX_ATTEMPTS} attempts`);
                 return 'failed';
@@ -5940,6 +5940,8 @@ chosenCodebases = []) {
                action to hand on and nothing for the next agent to resume from. */
             await updateWorker(client, workerId, 'died', NOTHING_RECORDED_REASON, warn);
             const { fate, attempts } = await releaseOrFail(client, claim.id, NOTHING_RECORDED_REASON, now().getTime(), claim.claimedAt);
+            if (fate === 'stale')
+                return 'nothing-to-do';
             if (fate === 'failed') {
                 warn(`[orchestrator] ${shortId(claim.id)} recorded nothing and failed after ${MAX_ATTEMPTS} attempts`);
                 return 'failed';
@@ -5979,6 +5981,8 @@ chosenCodebases = []) {
                repeatedly by a durable cause — a reverted migration, an RLS change —
                and before the bound it was the same forever-loop as a failed spawn. */
             const { fate, attempts } = await releaseOrFail(client, claim.id, err.message, now().getTime(), claim.claimedAt);
+            if (fate === 'stale')
+                return 'nothing-to-do';
             warn(fate === 'failed'
                 ? `[orchestrator] ${shortId(claim.id)} failed after ${MAX_ATTEMPTS} attempts`
                 : `[orchestrator] retrying ${shortId(claim.id)} in ${Math.round(retryDelayMs(attempts) / 1000)}s`);
@@ -6009,3 +6013,191 @@ chosenCodebases = []) {
 export function liveAgents() {
     return detectAgents();
 }
+function cliClaimReferences(action, result) {
+    if (!Array.isArray(result))
+        throw new Error('The claim journal returned no complete result.');
+    return result.map((row) => {
+        if (action === 'cliv2_claim_next_loose_todo') {
+            const attempt = row?._attempt;
+            if (!attempt || typeof attempt.todo_id !== 'string' || typeof attempt.claimed_at !== 'string')
+                throw new Error('The claim journal returned an incomplete request identity.');
+            return { surface: 'worker', todoId: attempt.todo_id, workerId: null, claimedAt: attempt.claimed_at, observedPendingMessageIds: null };
+        }
+        if (typeof row?.id !== 'string' || typeof row?.todo_id !== 'string')
+            throw new Error('The claim journal returned an incomplete reply source.');
+        if (action === 'cliv2_take_run_messages' && typeof row.taken_at === 'string')
+            return {
+                surface: 'reply', todoId: row.todo_id, messageLeases: [{ id: row.id, taken_at: row.taken_at }], grantLeases: [], observedPendingMessageIds: null,
+            };
+        if (action === 'cliv2_take_granted_resumes' && typeof row.resume_taken_at === 'string')
+            return {
+                surface: 'reply', todoId: row.todo_id, messageLeases: [], grantLeases: [{ id: row.id, resume_taken_at: row.resume_taken_at }], observedPendingMessageIds: null,
+            };
+        throw new Error('The claim journal returned an unrecognized lease identity.');
+    });
+}
+async function cliClaim(client, action, args) {
+    if (!hasOwnedWorkContext())
+        return { ...await client.rpc(action, args), operationId: undefined };
+    const operationId = beginRpcClaim('cli', action);
+    try {
+        const response = await client.rpc(action, { ...args, p_operation_id: operationId });
+        if (!response.error) {
+            const journal = await client.rpc('cliv2_reconcile_claim', { p_machine_id: args.p_machine_id, p_operation_id: operationId });
+            if (journal.error)
+                throw journal.error;
+            const row = journal.data?.[0];
+            if (row?.outcome !== 'completed' || row.action !== action)
+                throw new Error('The claim was cancelled before it could start.');
+            recordRpcClaims(operationId, cliClaimReferences(action, row.result));
+        }
+        if (response.error)
+            deferRpcClaim(operationId);
+        return { ...response, operationId };
+    }
+    catch (error) {
+        deferRpcClaim(operationId);
+        throw error;
+    }
+}
+/** Read every legacy source before committing a baseline; a failed page keeps admission closed. */
+async function legacyRows(client, table, columns, todoId) {
+    const rows = [];
+    let after = null;
+    for (;;) {
+        let query = client.from(table).select(columns).order('id').limit(500);
+        if (todoId)
+            query = query.eq('todo_id', todoId);
+        if (after)
+            query = query.gt('id', after);
+        const { data, error } = await query;
+        if (error)
+            throw error;
+        if (!Array.isArray(data))
+            throw new Error('The old work snapshot did not return a complete page.');
+        rows.push(...data);
+        if (data.length < 500)
+            return rows;
+        after = data[data.length - 1].id;
+        if (typeof after !== 'string')
+            throw new Error('The old work snapshot has no continuation identity.');
+    }
+}
+export async function reconcileInterruptedWork(client, machineId) {
+    if (!hasOwnedWorkContext())
+        return;
+    const capability = await client.rpc('cliv2_interrupt_machine_work', { p_machine_id: machineId,
+        p_operation_id: randomUUID(), p_interrupted_at: new Date().toISOString(), p_workers: [], p_replies: [] });
+    if (capability.error)
+        throw capability.error;
+    for (const claim of pendingRpcClaims('cli')) {
+        const journal = await client.rpc('cliv2_reconcile_claim', { p_machine_id: machineId, p_operation_id: claim.id });
+        if (journal.error)
+            throw journal.error;
+        const row = journal.data?.[0];
+        if (row?.outcome === 'cancelled')
+            recordRpcClaims(claim.id, [], true);
+        else if (row?.outcome === 'completed' && row.action === claim.action)
+            recordRpcClaims(claim.id, cliClaimReferences(claim.action, row.result), true);
+        else
+            throw new Error('The pending claim could not be reconciled.');
+    }
+    if (legacySnapshotNeeded()) {
+        const todos = await legacyRows(client, 'cliv2_loose_todos', 'id,claimed_at,claimed_machine_id');
+        const workers = await legacyRows(client, 'cliv2_workers', 'id,todo_id,machine_id,state');
+        const messages = await legacyRows(client, 'cliv2_run_messages', 'id,todo_id,taken_at,taken_machine_id,answered_by');
+        const permissions = await legacyRows(client, 'cliv2_permission_requests', 'id,todo_id,state,consumed_at,resume_taken_at,resume_machine_id,resume_answered_by');
+        const holds = new Map();
+        const hold = (todoId) => {
+            let value = holds.get(todoId);
+            if (!value) {
+                value = { todoId, messageIds: [], messageSources: [], permissionSources: [] };
+                holds.set(todoId, value);
+            }
+            return value;
+        };
+        for (const message of messages) {
+            if (message.answered_by != null || message.taken_machine_id && message.taken_machine_id !== machineId)
+                continue;
+            const pending = hold(message.todo_id);
+            pending.messageIds.push(message.id);
+            if (message.taken_at)
+                pending.messageSources.push({ id: message.id, taken_at: message.taken_at });
+            if (message.taken_machine_id === machineId && message.taken_at)
+                recordExitedInterruption({
+                    surface: 'reply', todoId: message.todo_id, messageLeases: [{ id: message.id, taken_at: message.taken_at }],
+                    grantLeases: [], observedPendingMessageIds: null,
+                });
+        }
+        for (const permission of permissions) {
+            if (!permission.todo_id || permission.state !== 'granted' || permission.resume_answered_by != null
+                || permission.resume_machine_id && permission.resume_machine_id !== machineId)
+                continue;
+            hold(permission.todo_id).permissionSources.push({ id: permission.id, state: permission.state, consumed_at: permission.consumed_at });
+            if (permission.resume_machine_id === machineId && permission.resume_taken_at)
+                recordExitedInterruption({
+                    surface: 'reply', todoId: permission.todo_id, messageLeases: [],
+                    grantLeases: [{ id: permission.id, resume_taken_at: permission.resume_taken_at }], observedPendingMessageIds: null,
+                });
+        }
+        for (const worker of workers) {
+            if (worker.machine_id !== machineId || !['working', 'dispatching'].includes(worker.state))
+                continue;
+            const todo = todos.find((row) => row.id === worker.todo_id);
+            if (!todo || todo.claimed_machine_id !== machineId || !todo.claimed_at)
+                continue;
+            recordExitedInterruption({ surface: 'worker', todoId: todo.id, workerId: worker.id,
+                claimedAt: todo.claimed_at, observedPendingMessageIds: null });
+        }
+        for (const baseline of holds.values())
+            baseline.messageIds = messages.filter((row) => row.todo_id === baseline.todoId).map((row) => row.id);
+        saveLegacySnapshot([...holds.values()]);
+    }
+    for (const surface of ['worker', 'reply']) {
+        for (const receipt of interruptionReceipts(surface)) {
+            const ref = receipt.reference;
+            const workers = ref.surface === 'worker' ? [{ worker_id: ref.workerId, todo_id: ref.todoId,
+                    claimed_at: ref.claimedAt, observed_pending_message_ids: ref.observedPendingMessageIds }] : [];
+            const replies = ref.surface === 'reply' ? [{ todo_id: ref.todoId, message_leases: ref.messageLeases,
+                    grant_leases: ref.grantLeases, observed_pending_message_ids: ref.observedPendingMessageIds }] : [];
+            const { data, error } = await client.rpc('cliv2_interrupt_machine_work', {
+                p_machine_id: machineId, p_operation_id: receipt.operationId, p_interrupted_at: receipt.interruptedAt,
+                p_workers: workers, p_replies: replies,
+            });
+            if (error)
+                throw error;
+            const expected = ref.surface === 'worker' ? [{ kind: ref.workerId ? 'worker' : 'claim', id: ref.workerId ?? ref.todoId }] : ref.surface === 'reply'
+                ? [...ref.messageLeases.map((source) => ({ kind: 'message', id: source.id })), ...ref.grantLeases.map((source) => ({ kind: 'grant', id: source.id }))] : [];
+            const results = data;
+            if (!Array.isArray(results) || expected.some((expectedRow) => !results.some((row) => row.id === expectedRow.id && row.kind === expectedRow.kind
+                && ['interrupted', 'already_interrupted', 'already_settled', 'continued', 'stale'].includes(row.outcome)))) {
+                throw new Error('Interrupted work was not fully acknowledged. Work remains protected.');
+            }
+            acknowledgeInterruption(receipt.id);
+        }
+    }
+    await refreshLegacyTodoHolds(client, machineId);
+}
+export async function refreshLegacyTodoHolds(client, machineId) {
+    for (const hold of legacyTodoHolds()) {
+        const todo = await client.from('cliv2_loose_todos').select('id,claimed_machine_id').eq('id', hold.todoId).maybeSingle();
+        if (todo.error)
+            throw todo.error;
+        if (!todo.data) {
+            releaseLegacyTodoHold(hold.todoId);
+            continue;
+        }
+        const messages = { data: await legacyRows(client, 'cliv2_run_messages', 'id,answered_by,taken_at,taken_machine_id', hold.todoId) };
+        if (messages.data.some((row) => !hold.messageIds.includes(row.id))) {
+            releaseLegacyTodoHold(hold.todoId);
+            continue;
+        }
+        const permissions = { data: await legacyRows(client, 'cliv2_permission_requests', 'id,state,consumed_at,resume_answered_by,resume_machine_id', hold.todoId) };
+        const messagesRemain = messages.data.some((row) => hold.messageIds.includes(row.id) && row.answered_by === null
+            && (!row.taken_machine_id || row.taken_machine_id === machineId));
+        const grantsRemain = permissions.data.some((row) => hold.permissionSources.some((source) => source.id === row.id)
+            && row.state === 'granted' && row.resume_answered_by === null && (!row.resume_machine_id || row.resume_machine_id === machineId));
+        if (!messagesRemain && !grantsRemain)
+            releaseLegacyTodoHold(hold.todoId);
+    }
+}