@ctrl-spc/cs 0.7.14 → 0.7.15

package/dist/panel3/run.js

@@ -146,11 +146,168 @@ import { listPanel3CodexOwnerHomeIds, removePanel3CodexOwnerHome, } from '../cod
 import { getMachineIdentity, scratchDir } from '../config.js';
 import { listCodebases } from '../codebases.js';
 import { killTree, processIsAlive } from '../win-shell.js';
+import { randomUUID } from 'node:crypto';
 import { hostname, uptime } from 'node:os';
 import { execFileSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { mkdir, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
+function recoveryAttempt(run) {
+    return { runId: run.id, processToken: run.process_token, startedAt: run.started_at, resumedAt: run.resumed_at };
+}
+async function startTrackedAgent(client, runId, preparation, work, ...args) {
+    if (!preparation)
+        return startAgent(...args);
+    const claimed = work?.claimAttempt(runId);
+    if (!claimed)
+        throw new Error('This run no longer belongs to the claimed attempt.');
+    preparation.setAttempt(claimed);
+    let preparationFailed = false;
+    let failureReason = '';
+    const execution = {
+        ...preparation.execution,
+        register: async (child, agent) => {
+            await preparation.execution.register(child, agent);
+            // An ordinary stop can reopen admission after a refusal. Every such
+            // wait needs a fresh cloud check before the prompt is authorized.
+            try {
+                let waited;
+                do {
+                    const { data, error } = await client.from('panel3_runs')
+                        .select('process_token,started_at,resumed_at,state,ended_at').eq('id', runId).single();
+                    if (error)
+                        throw error;
+                    if (!data || data.state !== 'running' || data.ended_at !== null
+                        || claimed.processToken !== (data.process_token ?? null) || claimed.startedAt !== data.started_at
+                        || claimed.resumedAt !== (data.resumed_at ?? null)) {
+                        throw new Error('This run no longer belongs to the claimed attempt.');
+                    }
+                    waited = await preparation.execution.waitForPromptAdmission();
+                } while (waited);
+            }
+            catch (error) {
+                if (!preparation.execution.interrupted()) {
+                    const reason = error instanceof Error ? error.message : String(error);
+                    preparation.deferFailure(reason, args[1]);
+                    preparationFailed = true;
+                    failureReason = reason;
+                }
+                throw error;
+            }
+        },
+    };
+    const started = startAgent(args[0], args[1], args[2], args[3], args[4], args[5], execution);
+    // Do not hold the claim barrier while registration waits for an ordinary
+    // stop to be refused. The original answer promises proven process closure.
+    const answered = started.answered.then(async (answer) => {
+        if (preparationFailed && !preparation.execution.interrupted()) {
+            await endRun(client, args[1], runId, claimed.cardId, failureReason, claimed);
+            preparation.execution.complete();
+        }
+        return answer;
+    });
+    void answered.catch(() => { }); // The caller records the PID before awaiting settlement.
+    return { ...started, answered, attempt: claimed, preparationFailed: () => preparationFailed };
+}
+function panelClaimAttempts(result) {
+    if (!Array.isArray(result))
+        throw new Error('The claim journal returned no complete result.');
+    const unique = new Map();
+    for (const row of result) {
+        const attempt = row?._attempt;
+        if (!attempt || typeof attempt.run_id !== 'string' || typeof attempt.card_id !== 'string' || typeof attempt.started_at !== 'string') {
+            throw new Error('The claim journal returned an incomplete run identity.');
+        }
+        unique.set(attempt.run_id, { runId: attempt.run_id, cardId: attempt.card_id, processToken: attempt.process_token ?? null,
+            pid: attempt.pid ?? null, startedAt: attempt.started_at, resumedAt: attempt.resumed_at ?? null,
+            observedPendingTurnIds: attempt.observed_pending_turn_ids ?? null });
+    }
+    return [...unique.values()];
+}
+async function panelClaim(client, work, action, args) {
+    if (!work)
+        return { ...await client.rpc(action, args), operationId: undefined };
+    const operationId = work.beginRpc(action);
+    try {
+        const response = await client.rpc(action, { ...args, p_operation_id: operationId });
+        if (!response.error) {
+            const journal = await client.rpc('panel3_reconcile_claim', { p_machine_id: args.p_machine_id, p_operation_id: operationId });
+            if (journal.error)
+                throw journal.error;
+            const row = journal.data?.[0];
+            if (row?.outcome !== 'completed' || row.action !== action)
+                throw new Error('The claim was cancelled before it could start.');
+            work.recordRpc(operationId, panelClaimAttempts(row.result), false);
+        }
+        if (response.error)
+            work.deferRpc(operationId);
+        return { ...response, operationId };
+    }
+    catch (error) {
+        work.deferRpc(operationId);
+        throw error;
+    }
+}
+async function reconcilePanelInterruptions(client, machineId, work) {
+    const capability = await client.rpc('panel3_interrupt_machine_runs', { p_machine_id: machineId,
+        p_operation_id: randomUUID(), p_interrupted_at: new Date().toISOString(), p_attempts: [] });
+    if (capability.error)
+        throw capability.error;
+    for (const failure of work.failedPreparations()) {
+        await endRun(client, failure.level, failure.attempt.runId, failure.attempt.cardId, failure.reason, failure.attempt);
+        work.acknowledgePreparationFailure(failure.id);
+    }
+    for (const claim of work.pendingRpcs()) {
+        const journal = await client.rpc('panel3_reconcile_claim', { p_machine_id: machineId, p_operation_id: claim.id });
+        if (journal.error)
+            throw journal.error;
+        const row = journal.data?.[0];
+        if (row?.outcome === 'cancelled')
+            work.recordRpc(claim.id, [], true);
+        else if (row?.outcome === 'completed' && row.action === claim.action)
+            work.recordRpc(claim.id, panelClaimAttempts(row.result), true);
+        else
+            throw new Error('The pending claim could not be reconciled.');
+    }
+    if (work.legacyRequired()) {
+        const attempts = [];
+        for (let offset = 0;; offset += 500) {
+            const { data, error } = await client.from('panel3_runs')
+                .select('id,card_id,process_token,pid,started_at,resumed_at')
+                .eq('machine_id', machineId).is('ended_at', null).order('id').range(offset, offset + 499);
+            if (error)
+                throw error;
+            if (!Array.isArray(data))
+                throw new Error('The old run snapshot did not return a complete page.');
+            for (const row of data) {
+                if (typeof row.started_at !== 'string')
+                    throw new Error('An old run has no exact attempt identity.');
+                attempts.push({ runId: row.id, cardId: row.card_id, processToken: row.process_token ?? null,
+                    pid: row.pid ?? null, startedAt: row.started_at, resumedAt: row.resumed_at ?? null, observedPendingTurnIds: null });
+            }
+            if (data.length < 500)
+                break;
+        }
+        for (const attempt of attempts)
+            work.recordLegacy(attempt);
+        work.legacyComplete();
+    }
+    for (const receipt of work.receipts()) {
+        const attempt = receipt.attempt;
+        const { data, error } = await client.rpc('panel3_interrupt_machine_runs', {
+            p_machine_id: machineId, p_operation_id: receipt.operationId, p_interrupted_at: receipt.interruptedAt,
+            p_attempts: [{ run_id: attempt.runId, process_token: attempt.processToken, pid: receipt.pid ?? attempt.pid ?? null,
+                    started_at: attempt.startedAt, resumed_at: attempt.resumedAt, observed_pending_turn_ids: attempt.observedPendingTurnIds }],
+        });
+        if (error)
+            throw error;
+        const result = data?.[0];
+        if (!result || result.run_id !== attempt.runId || !['interrupted', 'already_interrupted', 'continued', 'stale'].includes(result.outcome)) {
+            throw new Error('The interrupted run was not acknowledged. Work remains protected.');
+        }
+        work.acknowledge(receipt.id);
+    }
+}
 const USAGE = 'usage: run [--once]';
 /** How long between takes. Short, because it is the whole delay between a user
  *  sending and a card showing an agent on it, and the take is one small indexed
@@ -550,18 +707,24 @@ pictures = []) => {
  * a dispatch knows the brief before the row exists and writes it there. Passing
  * it again would be rewriting a brief that ux.md fixes at dispatch.
  *
- * A failure here is NOT fatal. The agent is already running and killing it over
- * a bookkeeping write would cost the user the work. What is lost is precision:
- * the run has no pid, so once this daemon is gone recovery treats it as dead —
- * which errs towards answering again rather than stranding.
+ * A bookkeeping failure does not discard the locally tracked execution. Exact
+ * activation predicates prevent a delayed write from reviving an ended run or
+ * attaching this process to a later continuation.
  */
-async function recordProcess(client, runId, pid, brief, processToken) {
+async function recordProcess(client, runId, pid, brief, processToken, attempt) {
     let query = client
         .from('panel3_runs')
         .update({ pid, ...(brief === undefined ? {} : { brief }) })
-        .eq('id', runId);
+        .eq('id', runId)
+        .eq('state', 'running')
+        .is('ended_at', null);
     if (processToken !== undefined)
         query = query.eq('process_token', processToken);
+    if (attempt) {
+        query = query.eq('started_at', attempt.startedAt);
+        query = attempt.resumedAt === null ? query.is('resumed_at', null) : query.eq('resumed_at', attempt.resumedAt);
+        query = attempt.processToken === null ? query.is('process_token', null) : query.eq('process_token', attempt.processToken);
+    }
     const written = await returned(query.select('id'), 'record what is running', `run ${runId}`);
     if (written.length === 0)
         throw new Error(`could not record what is running for run ${runId}: its activation has ended`);
@@ -579,15 +742,21 @@ async function recordProcess(client, runId, pid, brief, processToken) {
  * there first. It is a fact about the record rather than a failure, so it does
  * not go through `returned()`, exactly as the answer's own null does not.
  */
-async function giveUp(client, runId, reason, processToken) {
+async function giveUp(client, runId, reason, processToken, attempt) {
     const { data, error } = await client
         .rpc('panel3_give_up', {
         p_run_id: runId,
         p_reason: reason,
         ...(processToken === undefined ? {} : { p_process_token: processToken }),
+        ...(attempt ? { p_process_token: attempt.processToken, p_expected_attempt: {
+                started_at: attempt.startedAt, resumed_at: attempt.resumedAt,
+            } } : {}),
     });
     if (error)
         throw new Error(`could not give up run ${runId}: ${error.message}`);
+    if (attempt && data !== null && (!Number.isInteger(data) || data < 0)) {
+        throw new Error(`could not give up run ${runId}: no ending was acknowledged`);
+    }
     /* THE RUN IS OVER, so whatever it read is dropped. Every ending does this —
        here, `failRun` and `writeAnswer` — because a daemon stays up for days and
        has no business holding Tuesday's secret. */
@@ -828,76 +997,82 @@ export async function settingsForRun(client, runId) {
  * the level is what tells it how a run of this shape ends.
  */
 async function answerCard(client, tools, machineId, cardId, turns) {
-    const runId = turns[0].run_id;
-    /* BEFORE THE SPAWN, AND ITS FAILURE IS THE SPAWN'S FAILURE. The receipts are
-       part of what the agent is sent, so a read that fails must not be papered
-       over with an empty list: that reads as a card that has made nothing, which
-       is how an agent creates a second epic beside the one it cannot see. The
-       attachments read carries the same rule: a failed read here must not read
-       as "nothing is attached", which is a different card than the one that was
-       actually sent. */
-    /* ═══ AND A FAILURE HERE ENDS THE RUN, RATHER THAN LEAVING IT RUNNING WITH NO
-       PROCESS. ═══ The take already wrote the run row in the statement that leased
-       the turns, so a throw between here and `startAgent` leaves a run reading
-       `running` with a null pid and nothing on stderr the person can see.
-       `recoverStranded` then reads that as a machine that went away, hands the
-       message back, and `panel3_take_turns` leases it to A BRAND NEW RUN whose
-       attempts start again at one — so a permanent failure, such as a read this
-       build cannot make against the current schema, repeats forever while the card
-       says Working and never says why. This is the sixth of `endRun`'s endings and
-       the last one that was missing: `resumeRun` and `startRearmed` already end
-       their two post-claim failures this way for exactly this reason.
-       THE REASON IS SHAREABLE. All three reads are `returned()` calls against the
-       database, whose messages name tables and columns and never a local path, so
-       constraint 6 is satisfied without a level fork here. */
-    let brief;
-    /* WHERE IT RUNS AND WHAT IT IS TOLD ABOUT THE CODEBASES, THROUGH THE SAME
-       SEAM AS EVERY OTHER SPAWN. A level 1 run works in an empty directory of the
-       user's own, and it is the fifth start site rather than a special case: the
-       generated git block reaches every level, and one place resolving it is what
-       makes that true without four copies of the read. */
-    let where;
-    /* THE MANDATE IS READ IN THE SAME WINDOW AND UNDER THE SAME RULE. A launcher
-       is an agent like any other and gets the project's standing rules before it
-       decides anything, and a read that fails must not read as "this project has
-       no rules" — that is a different project than the one the person is on. So it
-       joins the three reads above inside this ending rather than beside it. */
-    let rules;
-    let settings;
-    try {
-        brief = briefFor(turns[0].card_title, turns, await receiptsFor(client, cardId), await attachmentsFor(client, cardId), await codebasesForRun(client, runId));
-        rules = await standingRulesFor(client, runId);
-        settings = await settingsForRun(client, runId);
-        where = await workingDirectory(client, runId, LEVEL, false);
-    }
-    catch (error) {
-        const why = error instanceof Error ? error.message : String(error);
-        await endRun(client, LEVEL, runId, cardId, why);
-        throw new Error(`NO AGENT IS RUNNING: ${why}`);
-    }
-    /* ═══ THE RUN ID IS ON THE URL, AND THAT IS THE WHOLE OF WHAT THE AGENT IS
-       TOLD ABOUT ITS OWN STANDING. ═══ The tools server reads the level off the
-       run row this id names, so the daemon does not tell the child what it may do
-       and the child has nothing to claim. `LEVEL` below decides argv only — which
-       of the harness's own tools the process gets — and the two can never disagree
-       about the record, because only one of them consults it. */
-    /* AN EMPTY DIRECTORY OF THE USER'S OWN, because level 1 has no code tool to
-       use a real one with, and the daemon's inherited cwd under a launchd login
-       item is the filesystem root. */
-    const started = startAgent(withStandingRules(rules, brief, where.block), LEVEL, tools.urlFor(runId), where.cwd, undefined, settings);
-    out(`run      ${runId}  level ${LEVEL}  ${started.pid ? `pid ${started.pid}` : 'no process'}`);
+    const preparation = tools.work?.prepare(turns[0].run_id);
     try {
-        /* THE BRIEF, NOT WHAT THE PROCESS WAS HANDED. The rules are current at the
-           activation and the brief is immutable, so storing the composed string
-           would freeze one inside the other and every respawn would replay it. */
-        await recordProcess(client, runId, started.pid, brief);
+        const runId = turns[0].run_id;
+        /* BEFORE THE SPAWN, AND ITS FAILURE IS THE SPAWN'S FAILURE. The receipts are
+           part of what the agent is sent, so a read that fails must not be papered
+           over with an empty list: that reads as a card that has made nothing, which
+           is how an agent creates a second epic beside the one it cannot see. The
+           attachments read carries the same rule: a failed read here must not read
+           as "nothing is attached", which is a different card than the one that was
+           actually sent. */
+        /* ═══ AND A FAILURE HERE ENDS THE RUN, RATHER THAN LEAVING IT RUNNING WITH NO
+           PROCESS. ═══ The take already wrote the run row in the statement that leased
+           the turns, so a throw between here and `startAgent` leaves a run reading
+           `running` with a null pid and nothing on stderr the person can see.
+           `recoverStranded` then reads that as a machine that went away, hands the
+           message back, and `panel3_take_turns` leases it to A BRAND NEW RUN whose
+           attempts start again at one — so a permanent failure, such as a read this
+           build cannot make against the current schema, repeats forever while the card
+           says Working and never says why. This is the sixth of `endRun`'s endings and
+           the last one that was missing: `resumeRun` and `startRearmed` already end
+           their two post-claim failures this way for exactly this reason.
+           THE REASON IS SHAREABLE. All three reads are `returned()` calls against the
+           database, whose messages name tables and columns and never a local path, so
+           constraint 6 is satisfied without a level fork here. */
+        let brief;
+        /* WHERE IT RUNS AND WHAT IT IS TOLD ABOUT THE CODEBASES, THROUGH THE SAME
+           SEAM AS EVERY OTHER SPAWN. A level 1 run works in an empty directory of the
+           user's own, and it is the fifth start site rather than a special case: the
+           generated git block reaches every level, and one place resolving it is what
+           makes that true without four copies of the read. */
+        let where;
+        /* THE MANDATE IS READ IN THE SAME WINDOW AND UNDER THE SAME RULE. A launcher
+           is an agent like any other and gets the project's standing rules before it
+           decides anything, and a read that fails must not read as "this project has
+           no rules" — that is a different project than the one the person is on. So it
+           joins the three reads above inside this ending rather than beside it. */
+        let rules;
+        let settings;
+        try {
+            brief = briefFor(turns[0].card_title, turns, await receiptsFor(client, cardId), await attachmentsFor(client, cardId), await codebasesForRun(client, runId));
+            rules = await standingRulesFor(client, runId);
+            settings = await settingsForRun(client, runId);
+            where = await workingDirectory(client, runId, LEVEL, false);
+        }
+        catch (error) {
+            const why = error instanceof Error ? error.message : String(error);
+            await endRun(client, LEVEL, runId, cardId, why);
+            throw new Error(`NO AGENT IS RUNNING: ${why}`);
+        }
+        /* ═══ THE RUN ID IS ON THE URL, AND THAT IS THE WHOLE OF WHAT THE AGENT IS
+           TOLD ABOUT ITS OWN STANDING. ═══ The tools server reads the level off the
+           run row this id names, so the daemon does not tell the child what it may do
+           and the child has nothing to claim. `LEVEL` below decides argv only — which
+           of the harness's own tools the process gets — and the two can never disagree
+           about the record, because only one of them consults it. */
+        /* AN EMPTY DIRECTORY OF THE USER'S OWN, because level 1 has no code tool to
+           use a real one with, and the daemon's inherited cwd under a launchd login
+           item is the filesystem root. */
+        const started = await startTrackedAgent(client, runId, preparation, tools.work, withStandingRules(rules, brief, where.block), LEVEL, tools.urlFor(runId), where.cwd, undefined, settings);
+        out(`run      ${runId}  level ${LEVEL}  ${started.pid ? `pid ${started.pid}` : 'no process'}`);
+        try {
+            /* THE BRIEF, NOT WHAT THE PROCESS WAS HANDED. The rules are current at the
+               activation and the brief is immutable, so storing the composed string
+               would freeze one inside the other and every respawn would replay it. */
+            await recordProcess(client, runId, started.pid, brief, undefined, started.attempt);
+        }
+        catch (error) {
+            // Said, not fatal. See `recordProcess` for what this costs and why the
+            // agent is not killed over it.
+            said(`${error instanceof Error ? error.message : String(error)} (the run is still going)`);
+        }
+        return settle(client, tools, machineId, LEVEL, runId, cardId, started, false);
     }
-    catch (error) {
-        // Said, not fatal. See `recordProcess` for what this costs and why the
-        // agent is not killed over it.
-        said(`${error instanceof Error ? error.message : String(error)} (the run is still going)`);
+    finally {
+        preparation?.finish();
     }
-    return settle(client, tools, machineId, LEVEL, runId, cardId, started, false);
 }
 /**
  * WHICH PROJECT A RUN'S CARD IS FILED UNDER, or null when the card has none.
@@ -1225,91 +1400,104 @@ async function workingDirectory(client, runId, level, isOwner, knownCodebase) {
  * that satisfies it.
  */
 async function startChild(client, tools, machineId, parentRunId, brief, codebase, parentProcessToken, choice = {}) {
-    const { data, error } = await client.rpc('panel3_dispatch', {
-        p_parent_run_id: parentRunId,
-        p_brief: brief,
-        p_machine_id: machineId,
-        p_codebase_id: codebase?.id ?? null,
-        p_codebase_label: codebase?.name ?? null,
-        p_process_token: parentProcessToken ?? null,
-        p_model: choice.model ?? null,
-        p_effort: choice.effort ?? null,
-    });
-    if (error)
-        throw new Error(`could not start an agent under run ${parentRunId}: ${readableWriteError(error.message)}`);
-    const row = data?.[0];
-    if (!row) {
-        /* NOTHING WAS WRITTEN AND NOTHING IS RUNNING, and the two reasons are said
-           together because the caller cannot tell them apart from here and both mean
-           the same thing to it. */
-        throw new Error(`NO AGENT WAS STARTED and nothing was written: run ${parentRunId} has ended, is already as `
-            + 'deep as anything may be sent from, or this conversation already has its owner. Exit now.');
-    }
-    if (row.run_level !== 2 && row.run_level !== 3) {
-        /* UNREACHABLE, AND STILL SETTLED. `panel3_dispatch` writes `parent.level + 1`
-           from a parent it has just checked is below 3, so there is no level here
-           this cannot spawn. If that ever stops being true, the row exists and
-           nothing will ever start for it, and leaving it `running` would make a
-           recovery sweep wait out the pid grace window to conclude what is already
-           known. */
-        const why = `run ${row.run_id} was written at level ${row.run_level}, which cannot be spawned`;
-        await giveUp(client, row.run_id, why, row.process_token ?? undefined);
-        throw new Error(why);
-    }
-    const level = row.run_level;
-    let where;
-    let prompt;
-    let pictures;
-    /* READ AGAINST THE CHILD'S OWN RUN ROW, NOT THE PARENT'S. The row already
-       exists (`panel3_dispatch` wrote it above) and it carries this child's
-       codebase, which is what decides which codebase-scoped rules it is under. */
-    let rules;
-    let settings;
+    let claimOperationId;
+    const preparation = tools.work?.prepare();
     try {
-        where = await workingDirectory(client, row.run_id, level, level === 2, codebase);
-        prompt = level === 2
-            ? await initialOwnerPrompt(client, row.run_card_id, parentRunId, brief)
-            : brief;
-        rules = await standingRulesFor(client, row.run_id);
-        settings = await settingsForRun(client, row.run_id);
-        /* Inside this site's own try, for `standingRulesFor`'s reason: a failure to
-           assemble what the agent needs ends the run the way this path already ends
-           runs, rather than starting a process that is missing it. */
-        pictures = await picturesOnDisk(client, row.run_card_id, where, level);
-    }
-    catch (error) {
-        const why = error instanceof Error ? error.message : String(error);
-        await giveUp(client, row.run_id, why, row.process_token ?? undefined);
-        throw new Error(`NO AGENT IS RUNNING: ${why}`);
-    }
-    const processToken = row.process_token ?? undefined;
-    const isOwner = level === 2;
-    const started = startAgent(withStandingRules(rules, prompt, where.block, [], pictures), level, tools.urlFor(row.run_id, processToken), where.cwd, isOwner ? { ownerId: row.run_id } : undefined, settings);
-    if (started.pid === null) {
-        /* THERE IS A ROW AND THERE IS NO PROCESS, which is the one shape the record
-           must never be left in quietly. The answer is already settled — nothing ran
-           — so the reason is read off it, the run is ended with that reason on it,
-           and the tool call fails saying no agent was started. */
-        const answer = await started.answered;
-        const reason = answer.ok ? 'the process ended before it could be identified' : answer.reason;
-        await giveUp(client, row.run_id, reason, processToken);
-        throw new Error(`NO AGENT IS RUNNING: ${reason}`);
-    }
-    out(`dispatch run ${row.run_id}  level ${level}  under ${parentRunId}  pid ${started.pid}`);
-    try {
-        await recordProcess(client, row.run_id, started.pid, undefined, processToken);
+        const response = await panelClaim(client, tools.work, 'panel3_dispatch', {
+            p_parent_run_id: parentRunId,
+            p_brief: brief,
+            p_machine_id: machineId,
+            p_codebase_id: codebase?.id ?? null,
+            p_codebase_label: codebase?.name ?? null,
+            p_process_token: parentProcessToken ?? null,
+            p_model: choice.model ?? null,
+            p_effort: choice.effort ?? null,
+        });
+        const { data, error, operationId } = response;
+        claimOperationId = operationId;
+        if (error)
+            throw new Error(`could not start an agent under run ${parentRunId}: ${readableWriteError(error.message)}`);
+        const row = data?.[0];
+        if (!row) {
+            /* NOTHING WAS WRITTEN AND NOTHING IS RUNNING, and the two reasons are said
+               together because the caller cannot tell them apart from here and both mean
+               the same thing to it. */
+            throw new Error(`NO AGENT WAS STARTED and nothing was written: run ${parentRunId} has ended, is already as `
+                + 'deep as anything may be sent from, or this conversation already has its owner. Exit now.');
+        }
+        if (row.run_level !== 2 && row.run_level !== 3) {
+            /* UNREACHABLE, AND STILL SETTLED. `panel3_dispatch` writes `parent.level + 1`
+               from a parent it has just checked is below 3, so there is no level here
+               this cannot spawn. If that ever stops being true, the row exists and
+               nothing will ever start for it, and leaving it `running` would make a
+               recovery sweep wait out the pid grace window to conclude what is already
+               known. */
+            const why = `run ${row.run_id} was written at level ${row.run_level}, which cannot be spawned`;
+            await giveUp(client, row.run_id, why, row.process_token ?? undefined);
+            throw new Error(why);
+        }
+        const level = row.run_level;
+        let where;
+        let prompt;
+        let pictures;
+        /* READ AGAINST THE CHILD'S OWN RUN ROW, NOT THE PARENT'S. The row already
+           exists (`panel3_dispatch` wrote it above) and it carries this child's
+           codebase, which is what decides which codebase-scoped rules it is under. */
+        let rules;
+        let settings;
+        try {
+            where = await workingDirectory(client, row.run_id, level, level === 2, codebase);
+            prompt = level === 2
+                ? await initialOwnerPrompt(client, row.run_card_id, parentRunId, brief)
+                : brief;
+            rules = await standingRulesFor(client, row.run_id);
+            settings = await settingsForRun(client, row.run_id);
+            /* Inside this site's own try, for `standingRulesFor`'s reason: a failure to
+               assemble what the agent needs ends the run the way this path already ends
+               runs, rather than starting a process that is missing it. */
+            pictures = await picturesOnDisk(client, row.run_card_id, where, level);
+        }
+        catch (error) {
+            const why = error instanceof Error ? error.message : String(error);
+            await giveUp(client, row.run_id, why, row.process_token ?? undefined);
+            throw new Error(`NO AGENT IS RUNNING: ${why}`);
+        }
+        const processToken = row.process_token ?? undefined;
+        const isOwner = level === 2;
+        const started = await startTrackedAgent(client, row.run_id, preparation, tools.work, withStandingRules(rules, prompt, where.block, [], pictures), level, tools.urlFor(row.run_id, processToken), where.cwd, isOwner ? { ownerId: row.run_id } : undefined, settings);
+        if (started.pid === null) {
+            if (started.interrupted?.())
+                throw new Error('Work was interrupted by the service command.');
+            /* THERE IS A ROW AND THERE IS NO PROCESS, which is the one shape the record
+               must never be left in quietly. The answer is already settled — nothing ran
+               — so the reason is read off it, the run is ended with that reason on it,
+               and the tool call fails saying no agent was started. */
+            const answer = await started.answered;
+            const reason = answer.ok ? 'the process ended before it could be identified' : answer.reason;
+            await giveUp(client, row.run_id, reason, processToken);
+            throw new Error(`NO AGENT IS RUNNING: ${reason}`);
+        }
+        out(`dispatch run ${row.run_id}  level ${level}  under ${parentRunId}  pid ${started.pid}`);
+        try {
+            await recordProcess(client, row.run_id, started.pid, undefined, processToken, started.attempt);
+        }
+        catch (error) {
+            // Said, not fatal, exactly as at level 1: the agent is running and killing
+            // it over a bookkeeping write would cost the user the work.
+            said(`${error instanceof Error ? error.message : String(error)} (the run is still going)`);
+        }
+        return {
+            runId: row.run_id,
+            settled: settle(client, tools, machineId, level, row.run_id, row.run_card_id, started, true, processToken, isOwner && processToken
+                ? ownerSessionLifecycle(started, row.run_id, settings.harness ?? harness(), processToken)
+                : undefined),
+        };
     }
-    catch (error) {
-        // Said, not fatal, exactly as at level 1: the agent is running and killing
-        // it over a bookkeeping write would cost the user the work.
-        said(`${error instanceof Error ? error.message : String(error)} (the run is still going)`);
+    finally {
+        preparation?.finish();
+        if (claimOperationId)
+            tools.work?.finishRpcs([claimOperationId]);
     }
-    return {
-        runId: row.run_id,
-        settled: settle(client, tools, machineId, level, row.run_id, row.run_card_id, started, true, processToken, isOwner && processToken
-            ? ownerSessionLifecycle(started, row.run_id, settings.harness ?? harness(), processToken)
-            : undefined),
-    };
 }
 /**
  * HOW MANY PROCESSES HAVE BEEN STARTED FOR THIS RUN, counting the first.
@@ -1377,9 +1565,21 @@ async function attemptsSoFar(client, runId) {
  * Returns whether THIS call is what ended it. False is a fact about the record,
  * not a failure: the run had already ended, and the caller says so.
  */
-async function endRun(client, level, runId, cardId, why) {
+async function endRun(client, level, runId, cardId, why, attempt) {
     if (level !== 1)
-        return (await giveUp(client, runId, why)) !== null;
+        return (await giveUp(client, runId, why, undefined, attempt)) !== null;
+    if (attempt) {
+        const { data, error } = await client.rpc('panel3_end_run', {
+            p_run_id: runId, p_reason: why, p_process_token: attempt.processToken,
+            p_expected_attempt: { started_at: attempt.startedAt, resumed_at: attempt.resumedAt },
+        });
+        if (error)
+            throw new Error(`could not end run ${runId}: ${error.message}`);
+        if (typeof data !== 'boolean')
+            throw new Error(`could not end run ${runId}: no ending was acknowledged`);
+        forgetSecrets(runId);
+        return data;
+    }
     /* ═══ THE RUN FIRST, AND THE CARD ONLY IF THIS RUN WAS STILL THE CARD'S TO
        FAIL. ═══
        The card used to be written first, and the argument for that was a daemon
@@ -1464,6 +1664,8 @@ function ownerSessionLifecycle(started, ownerId, ownerHarness, processToken, exp
 }
 function settle(client, tools, machineId, level, runId, cardId, started, speaksToTheCard = true, processToken, ownerSession) {
     return started.answered.then(async (answer) => {
+        if (started.interrupted?.() || started.preparationFailed?.())
+            return;
         /* ═══ A RUN THAT STOPPED TO ASK DID NOT DIE, WHATEVER THE HARNESS PRINTED
            ON ITS WAY OUT. ═══
     
@@ -1575,7 +1777,7 @@ function settle(client, tools, machineId, level, runId, cardId, started, speaksT
             await ownerSession?.established();
         else
             await ownerSession?.failed();
-    });
+    }).then(() => { started.completed?.(); });
 }
 /**
  * ═══ ONE RUN, STARTED AGAIN AS ITSELF, WITH WHAT IT WAS SENT AND WHAT IT HAD
@@ -1639,7 +1841,7 @@ async function resumeRun(client, tools, machineId, runId, afterPid) {
        both halves of the argument: a machine with no checkout must not take a run
        it cannot start, and the level a retry needs the answer for is not known
        until the claim returns.
-  
+       *
        ═══ IT IS THE EXISTENCE CHECK AND NOTHING MORE, WHICH IS WHAT CHANGED IN
        worktrees-8. ═══ Resolving the working copy now CREATES a branch, a folder
        and a row write, and every poll tick that loses the claim race would leave
@@ -1648,126 +1850,138 @@ async function resumeRun(client, tools, machineId, runId, afterPid) {
        this position was ever asking, and the copy is made after the claim. */
     if (afterPid === null)
         checkoutForCodebase(await codebaseOfRun(client, runId), hostname());
-    const { data, error } = await client.rpc('panel3_resume', {
-        p_run_id: runId,
-        p_machine_id: machineId,
-        p_after_pid: afterPid,
-    });
-    if (error)
-        throw new Error(`could not start run ${runId} again: ${error.message}`);
-    const claimed = data?.[0];
-    if (!claimed)
-        return null;
-    const level = claimed.run_level === 1 ? 1 : claimed.run_level === 2 ? 2 : 3;
-    if (claimed.run_level !== level) {
-        /* UNREACHABLE, AND STILL SETTLED, exactly as in `startChild`: the level
-           column is checked at three, so there is no level here this cannot spawn.
-           The claim has already happened, so leaving it would strand the run for a
-           whole grace window before anything looked at it again. */
-        const why = `run ${runId} is at level ${claimed.run_level}, which cannot be spawned`;
-        await giveUp(client, runId, why);
-        throw new Error(why);
-    }
-    /* ONE RESOLUTION FOR BOTH PATHS, AFTER THE CLAIM. It used to fork on whether
-       the sweep had already resolved a folder before the claim; since the copy is
-       the card's own and making it writes, both paths make it here, in the branch
-       that can end the run when it cannot be made. */
-    let where;
-    try {
-        where = await workingDirectory(client, runId, level, false);
-    }
-    catch (error) {
-        /* ═══ THE REASON IS WRITTEN TO THE DATABASE, SO IT MAY NOT CARRY A PATH.
-           ═══ Constraint 6, and `startRearmed`'s own handling of the same two
-           calls: `worktreeForCard()` is already careful about this and says so;
-           `scratchDir()` is not, because it is `mkdirSync`, whose EACCES and
-           ENOTDIR messages name the directory they failed on. So the machine's own
-           error is kept for stderr and the record is told only what is true and
-           shareable. */
-        const stderrOnly = error instanceof Error ? error.message : String(error);
-        const why = level === 1
-            ? 'this machine could not make the empty directory this runs in'
-            : stderrOnly;
-        /* ═══ AND IT ENDS THE WAY A RUN OF THIS LEVEL ENDS. ═══ It was
-           `panel3_give_up` outright, which was right while only a dispatched run
-           could reach this function and is a leak now that the retry brings level
-           1 here: handing the person's message back mints a new run with its
-           attempts at one, which is the bound the retry is under, undone by the
-           one path that could not start. See `endRun`. */
-        await endRun(client, level, runId, claimed.run_card_id, why);
-        throw new Error(`NO AGENT IS RUNNING: ${level === 1 ? stderrOnly : why}`);
-    }
-    /* WHAT IT SENT OTHERS TO DO, FROM THE RECORD. Level 3 has no `dispatch`, so it
-       has no children to have: null says that, where an empty list would say it
-       chose to send nobody.
-  
-       ═══ AND LEVEL 1 HAS THEM TOO, WHICH ONLY THE RETRY CAN REACH. ═══ This read
-       used to be `level === 2`, which was correct only because nothing at level 1
-       ever got here. Left alone it would hand a coordinator a null child list, and
-       a coordinator that came back to no children dispatches its workers a second
-       time: ux.md's single most expensive failure. `startRearmed` reads it the
-       same way, for the same reason. */
-    const children = level === 3 ? null : await childrenOf(client, runId);
-    /* ═══ READ AGAIN ON EVERY START, WHICH IS THE WHOLE OF CONTRACT POINT 2. ═══
-       A resumed or retried run is handed the rules AS THEY STAND NOW, not as they
-       stood when it first began: a rule edited while the conversation was running
-       governs the rest of it, and a rule deleted while it was running stops
-       applying to it. That is only true because this read happens here rather than
-       once, at the top of the run's life.
-  
-       ═══ AND IT ENDS THE WAY THIS PATH ALREADY ENDS. ═══ The claim has already
-       happened, so a throw here would leave a run reading `running` with no
-       process. `endRun` with the level fork is this path's own ending (see the cwd
-       branch above for why level 1 may not simply be given up on), and the reason
-       is a `returned()` message naming tables and columns, which carries no local
-       path and is therefore shareable. */
-    let rules;
-    let settings;
-    let pictures;
+    let claimOperationId;
+    const preparation = tools.work?.prepare();
     try {
-        rules = await standingRulesFor(client, runId);
-        settings = await settingsForRun(client, runId);
-        /* ═══ WRITTEN AGAIN ON EVERY START, LIKE THE RULES. ═══ A resumed process is
-           a NEW process with a new copy of the working directory, so the files a
-           previous one was handed are not there any more, and the stored brief this
-           path replays cannot carry a path that was not known when it was written. */
-        pictures = await picturesOnDisk(client, claimed.run_card_id, where, level);
-    }
-    catch (error) {
-        const why = error instanceof Error ? error.message : String(error);
-        await endRun(client, level, runId, claimed.run_card_id, why);
-        throw new Error(`NO AGENT IS RUNNING: ${why}`);
-    }
-    const started = startAgent(
-    /* ═══ WHY IT DIED IS WHAT DIFFERS, AND IT IS TOLD THE TRUTH ABOUT IT. ═══
-       `resumePrompt` opens by saying the machine went down, which is true of the
-       sweep and false of a retry: the daemon that watched this harness exit is
-       still running. See `retryPrompt`. */
-    withStandingRules(rules, afterPid === null
-        ? resumePrompt(claimed.run_brief, claimed.run_report, children)
-        : retryPrompt(claimed.run_brief, claimed.run_report, children), where.block, [], pictures), level, tools.urlFor(runId), where.cwd, undefined, settings);
-    if (started.pid === null) {
-        /* THE CLAIM HAPPENED AND NO PROCESS DID, which is the one shape the record
-           must never be left in quietly. Same handling as a dispatch that could not
-           start: the reason is read off the settled answer and the run is ended with
-           it. */
-        const answer = await started.answered;
-        const reason = answer.ok ? 'the process ended before it could be identified' : answer.reason;
-        // The same level fork, for the same reason. See `endRun`.
-        await endRun(client, level, runId, claimed.run_card_id, reason);
-        throw new Error(`NO AGENT IS RUNNING: ${reason}`);
-    }
-    out(`resume   run ${runId}  level ${level}  pid ${started.pid}  `
-        + `${claimed.run_report === null ? 'no report to carry' : 'carrying its report'}`);
-    try {
-        await recordProcess(client, runId, started.pid);
+        const response = await panelClaim(client, tools.work, 'panel3_resume', {
+            p_run_id: runId,
+            p_machine_id: machineId,
+            p_after_pid: afterPid,
+        });
+        const { data, error, operationId } = response;
+        claimOperationId = operationId;
+        if (error)
+            throw new Error(`could not start run ${runId} again: ${error.message}`);
+        const claimed = data?.[0];
+        if (!claimed)
+            return null;
+        const level = claimed.run_level === 1 ? 1 : claimed.run_level === 2 ? 2 : 3;
+        if (claimed.run_level !== level) {
+            /* UNREACHABLE, AND STILL SETTLED, exactly as in `startChild`: the level
+               column is checked at three, so there is no level here this cannot spawn.
+               The claim has already happened, so leaving it would strand the run for a
+               whole grace window before anything looked at it again. */
+            const why = `run ${runId} is at level ${claimed.run_level}, which cannot be spawned`;
+            await giveUp(client, runId, why);
+            throw new Error(why);
+        }
+        /* ONE RESOLUTION FOR BOTH PATHS, AFTER THE CLAIM. It used to fork on whether
+           the sweep had already resolved a folder before the claim; since the copy is
+           the card's own and making it writes, both paths make it here, in the branch
+           that can end the run when it cannot be made. */
+        let where;
+        try {
+            where = await workingDirectory(client, runId, level, false);
+        }
+        catch (error) {
+            /* ═══ THE REASON IS WRITTEN TO THE DATABASE, SO IT MAY NOT CARRY A PATH.
+               ═══ Constraint 6, and `startRearmed`'s own handling of the same two
+               calls: `worktreeForCard()` is already careful about this and says so;
+               `scratchDir()` is not, because it is `mkdirSync`, whose EACCES and
+               ENOTDIR messages name the directory they failed on. So the machine's own
+               error is kept for stderr and the record is told only what is true and
+               shareable. */
+            const stderrOnly = error instanceof Error ? error.message : String(error);
+            const why = level === 1
+                ? 'this machine could not make the empty directory this runs in'
+                : stderrOnly;
+            /* ═══ AND IT ENDS THE WAY A RUN OF THIS LEVEL ENDS. ═══ It was
+               `panel3_give_up` outright, which was right while only a dispatched run
+               could reach this function and is a leak now that the retry brings level
+               1 here: handing the person's message back mints a new run with its
+               attempts at one, which is the bound the retry is under, undone by the
+               one path that could not start. See `endRun`. */
+            await endRun(client, level, runId, claimed.run_card_id, why);
+            throw new Error(`NO AGENT IS RUNNING: ${level === 1 ? stderrOnly : why}`);
+        }
+        /* WHAT IT SENT OTHERS TO DO, FROM THE RECORD. Level 3 has no `dispatch`, so it
+           has no children to have: null says that, where an empty list would say it
+           chose to send nobody.
+           *
+           ═══ AND LEVEL 1 HAS THEM TOO, WHICH ONLY THE RETRY CAN REACH. ═══ This read
+           used to be `level === 2`, which was correct only because nothing at level 1
+           ever got here. Left alone it would hand a coordinator a null child list, and
+           a coordinator that came back to no children dispatches its workers a second
+           time: ux.md's single most expensive failure. `startRearmed` reads it the
+           same way, for the same reason. */
+        const children = level === 3 ? null : await childrenOf(client, runId);
+        /* ═══ READ AGAIN ON EVERY START, WHICH IS THE WHOLE OF CONTRACT POINT 2. ═══
+           A resumed or retried run is handed the rules AS THEY STAND NOW, not as they
+           stood when it first began: a rule edited while the conversation was running
+           governs the rest of it, and a rule deleted while it was running stops
+           applying to it. That is only true because this read happens here rather than
+           once, at the top of the run's life.
+           *
+           ═══ AND IT ENDS THE WAY THIS PATH ALREADY ENDS. ═══ The claim has already
+           happened, so a throw here would leave a run reading `running` with no
+           process. `endRun` with the level fork is this path's own ending (see the cwd
+           branch above for why level 1 may not simply be given up on), and the reason
+           is a `returned()` message naming tables and columns, which carries no local
+           path and is therefore shareable. */
+        let rules;
+        let settings;
+        let pictures;
+        try {
+            rules = await standingRulesFor(client, runId);
+            settings = await settingsForRun(client, runId);
+            /* ═══ WRITTEN AGAIN ON EVERY START, LIKE THE RULES. ═══ A resumed process is
+               a NEW process with a new copy of the working directory, so the files a
+               previous one was handed are not there any more, and the stored brief this
+               path replays cannot carry a path that was not known when it was written. */
+            pictures = await picturesOnDisk(client, claimed.run_card_id, where, level);
+        }
+        catch (error) {
+            const why = error instanceof Error ? error.message : String(error);
+            await endRun(client, level, runId, claimed.run_card_id, why);
+            throw new Error(`NO AGENT IS RUNNING: ${why}`);
+        }
+        /* ═══ WHY IT DIED IS WHAT DIFFERS, AND IT IS TOLD THE TRUTH ABOUT IT. ═══
+             `resumePrompt` opens by saying the machine went down, which is true of the
+             sweep and false of a retry: the daemon that watched this harness exit is
+             still running. See `retryPrompt`. */
+        const started = await startTrackedAgent(client, runId, preparation, tools.work, withStandingRules(rules, afterPid === null
+            ? resumePrompt(claimed.run_brief, claimed.run_report, children)
+            : retryPrompt(claimed.run_brief, claimed.run_report, children), where.block, [], pictures), level, tools.urlFor(runId), where.cwd, undefined, settings);
+        if (started.pid === null) {
+            if (started.interrupted?.())
+                throw new Error('Work was interrupted by the service command.');
+            /* THE CLAIM HAPPENED AND NO PROCESS DID, which is the one shape the record
+               must never be left in quietly. Same handling as a dispatch that could not
+               start: the reason is read off the settled answer and the run is ended with
+               it. */
+            const answer = await started.answered;
+            const reason = answer.ok ? 'the process ended before it could be identified' : answer.reason;
+            // The same level fork, for the same reason. See `endRun`.
+            await endRun(client, level, runId, claimed.run_card_id, reason);
+            throw new Error(`NO AGENT IS RUNNING: ${reason}`);
+        }
+        out(`resume   run ${runId}  level ${level}  pid ${started.pid}  `
+            + `${claimed.run_report === null ? 'no report to carry' : 'carrying its report'}`);
+        try {
+            await recordProcess(client, runId, started.pid, undefined, undefined, started.attempt);
+        }
+        catch (error) {
+            // Said, not fatal, as everywhere else: the agent is running and killing it
+            // over a bookkeeping write would cost the user the work a second time.
+            said(`${error instanceof Error ? error.message : String(error)} (the run is still going)`);
+        }
+        return { settled: settle(client, tools, machineId, level, runId, claimed.run_card_id, started) };
     }
-    catch (error) {
-        // Said, not fatal, as everywhere else: the agent is running and killing it
-        // over a bookkeeping write would cost the user the work a second time.
-        said(`${error instanceof Error ? error.message : String(error)} (the run is still going)`);
+    finally {
+        preparation?.finish();
+        if (claimOperationId)
+            tools.work?.finishRpcs([claimOperationId]);
     }
-    return { settled: settle(client, tools, machineId, level, runId, claimed.run_card_id, started) };
 }
 /**
  * ═══ ONE RUN, STARTED AGAIN BECAUSE SOMETHING IT WAS WAITING ON EXISTS NOW. ═══
@@ -1796,105 +2010,113 @@ async function resumeRun(client, tools, machineId, runId, afterPid) {
  * and in `cs show`, rather than quietly hoping the next poll finds it.
  */
 async function startRearmed(client, tools, machineId, row) {
-    const level = row.run_level === 1 ? 1 : row.run_level === 2 ? 2 : 3;
-    if (row.run_level !== level) {
-        const why = `run ${row.run_id} is at level ${row.run_level}, which cannot be spawned`;
-        await giveUp(client, row.run_id, why);
-        throw new Error(why);
-    }
-    let where;
-    try {
-        where = await workingDirectory(client, row.run_id, level, false);
-    }
-    catch (error) {
-        /* ═══ THE REASON IS WRITTEN TO THE DATABASE, SO IT MAY NOT CARRY A PATH.
-           ═══ Constraint 6. `workingCopy()` is already careful about this and says
-           so; `scratchDir()` is not — it is `mkdirSync`, whose EACCES and ENOTDIR
-           messages name the directory they failed on — and `failed_because` is a
-           column `cs show` prints. So the machine's own error is kept for stderr
-           and the record is told only what is true and shareable. */
-        const said = error instanceof Error ? error.message : String(error);
-        const why = level === 1
-            ? 'this machine could not make the empty directory this runs in'
-            : said;
-        // The level fork, which this path needs for the same reason `resumeRun`'s
-        // two do: a re-arm serves level 1, and a level 1 run holds the person's
-        // message. See `endRun`.
-        await endRun(client, level, row.run_id, row.run_card_id, why);
-        throw new Error(`NO AGENT IS RUNNING: ${level === 1 ? said : why}`);
-    }
-    /* WHAT IT SENT OTHERS TO DO AND WHAT THEY WROTE, FROM THE RECORD, AS LATE AS
-       POSSIBLE. Level 3 has no `dispatch`, so it has no children to have: null
-       says that, where an empty list would say it chose to send nobody. */
-    const children = level === 3 ? null : await childrenOf(client, row.run_id);
-    const deliveredArtifact = row.ask_id !== null && row.mine
-        ? await rearmedArtifactAnswer(client, row.ask_id)
-        : null;
-    /* ═══ THE MERGE HAPPENS HERE, OFF THE MARK ON THE ASK, BEFORE THE AGENT THAT
-       WILL SPEAK ABOUT IT IS STARTED. ═══ The re-arm is the last thing that runs
-       before the spawn, which is why it is the only place the outcome can reach
-       the prompt. See `landCardWork`. */
-    const offered = row.ask_id !== null && row.mine
-        ? await landingOffer(client, row.ask_id)
-        : null;
-    const landing = offered === null ? null : landCardWork(where, offered);
-    /* ═══ THREE REASONS, AND THE ROW SAYS WHICH. ═══ No question is ux.md's third
-       re-arm: everybody it sent has finished, and it is started to read them back.
-       `children` cannot be null on that path — only a run with children is ever
-       claimed for it — and the prompt takes the list rather than the maybe-list so
-       that is a fact of the signature rather than of a comment. */
-    const prompt = row.ask_id === null
-        ? readBackPrompt(row.run_brief, row.run_report, children ?? [])
-        : row.mine
-            ? answerPrompt(row.run_brief, row.run_report, children, row.question ?? '', row.answer ?? '', deliveredArtifact, landing)
-            : escalationPrompt(row.run_brief, row.run_report, children, row.ask_id, row.question ?? '');
-    /* CURRENT AT THIS ACTIVATION, exactly as on the resume path, and ended the
-       same way: the re-arm's claim has already happened, so a failure here ends
-       the run with its reason rather than leaving it claimed with no process. */
-    let rules;
-    let settings;
-    let pictures;
+    const preparation = tools.work?.prepare(row.run_id);
     try {
-        rules = await standingRulesFor(client, row.run_id);
-        settings = await settingsForRun(client, row.run_id);
-        pictures = await picturesOnDisk(client, row.run_card_id, where, level);
-    }
-    catch (error) {
-        const why = error instanceof Error ? error.message : String(error);
-        await endRun(client, level, row.run_id, row.run_card_id, why);
-        throw new Error(`NO AGENT IS RUNNING: ${why}`);
-    }
-    const started = startAgent(withStandingRules(rules, prompt, where.block, [], pictures), level, tools.urlFor(row.run_id), where.cwd, undefined, settings);
-    if (started.pid === null) {
-        const answer = await started.answered;
-        const reason = answer.ok ? 'the process ended before it could be identified' : answer.reason;
-        // The same level fork, for the same reason. See `endRun`.
-        await endRun(client, level, row.run_id, row.run_card_id, reason);
-        throw new Error(`NO AGENT IS RUNNING: ${reason}`);
-    }
-    out(`rearm    run ${row.run_id}  level ${level}  pid ${started.pid}  `
-        + `${row.ask_id === null
-            ? 'to read back everybody it sent'
+        const level = row.run_level === 1 ? 1 : row.run_level === 2 ? 2 : 3;
+        if (row.run_level !== level) {
+            const why = `run ${row.run_id} is at level ${row.run_level}, which cannot be spawned`;
+            await giveUp(client, row.run_id, why);
+            throw new Error(why);
+        }
+        let where;
+        try {
+            where = await workingDirectory(client, row.run_id, level, false);
+        }
+        catch (error) {
+            /* ═══ THE REASON IS WRITTEN TO THE DATABASE, SO IT MAY NOT CARRY A PATH.
+               ═══ Constraint 6. `workingCopy()` is already careful about this and says
+               so; `scratchDir()` is not — it is `mkdirSync`, whose EACCES and ENOTDIR
+               messages name the directory they failed on — and `failed_because` is a
+               column `cs show` prints. So the machine's own error is kept for stderr
+               and the record is told only what is true and shareable. */
+            const said = error instanceof Error ? error.message : String(error);
+            const why = level === 1
+                ? 'this machine could not make the empty directory this runs in'
+                : said;
+            // The level fork, which this path needs for the same reason `resumeRun`'s
+            // two do: a re-arm serves level 1, and a level 1 run holds the person's
+            // message. See `endRun`.
+            await endRun(client, level, row.run_id, row.run_card_id, why);
+            throw new Error(`NO AGENT IS RUNNING: ${level === 1 ? said : why}`);
+        }
+        /* WHAT IT SENT OTHERS TO DO AND WHAT THEY WROTE, FROM THE RECORD, AS LATE AS
+           POSSIBLE. Level 3 has no `dispatch`, so it has no children to have: null
+           says that, where an empty list would say it chose to send nobody. */
+        const children = level === 3 ? null : await childrenOf(client, row.run_id);
+        const deliveredArtifact = row.ask_id !== null && row.mine
+            ? await rearmedArtifactAnswer(client, row.ask_id)
+            : null;
+        /* ═══ THE MERGE HAPPENS HERE, OFF THE MARK ON THE ASK, BEFORE THE AGENT THAT
+           WILL SPEAK ABOUT IT IS STARTED. ═══ The re-arm is the last thing that runs
+           before the spawn, which is why it is the only place the outcome can reach
+           the prompt. See `landCardWork`. */
+        const offered = row.ask_id !== null && row.mine
+            ? await landingOffer(client, row.ask_id)
+            : null;
+        const landing = offered === null ? null : landCardWork(where, offered);
+        /* ═══ THREE REASONS, AND THE ROW SAYS WHICH. ═══ No question is ux.md's third
+           re-arm: everybody it sent has finished, and it is started to read them back.
+           `children` cannot be null on that path — only a run with children is ever
+           claimed for it — and the prompt takes the list rather than the maybe-list so
+           that is a fact of the signature rather than of a comment. */
+        const prompt = row.ask_id === null
+            ? readBackPrompt(row.run_brief, row.run_report, children ?? [])
             : row.mine
-                ? 'with the answer to its own question'
-                : 'with a question it has to settle'}`);
-    try {
-        await recordProcess(client, row.run_id, started.pid);
+                ? answerPrompt(row.run_brief, row.run_report, children, row.question ?? '', row.answer ?? '', deliveredArtifact, landing)
+                : escalationPrompt(row.run_brief, row.run_report, children, row.ask_id, row.question ?? '');
+        /* CURRENT AT THIS ACTIVATION, exactly as on the resume path, and ended the
+           same way: the re-arm's claim has already happened, so a failure here ends
+           the run with its reason rather than leaving it claimed with no process. */
+        let rules;
+        let settings;
+        let pictures;
+        try {
+            rules = await standingRulesFor(client, row.run_id);
+            settings = await settingsForRun(client, row.run_id);
+            pictures = await picturesOnDisk(client, row.run_card_id, where, level);
+        }
+        catch (error) {
+            const why = error instanceof Error ? error.message : String(error);
+            await endRun(client, level, row.run_id, row.run_card_id, why);
+            throw new Error(`NO AGENT IS RUNNING: ${why}`);
+        }
+        const started = await startTrackedAgent(client, row.run_id, preparation, tools.work, withStandingRules(rules, prompt, where.block, [], pictures), level, tools.urlFor(row.run_id), where.cwd, undefined, settings);
+        if (started.pid === null) {
+            if (started.interrupted?.())
+                throw new Error('Work was interrupted by the service command.');
+            const answer = await started.answered;
+            const reason = answer.ok ? 'the process ended before it could be identified' : answer.reason;
+            // The same level fork, for the same reason. See `endRun`.
+            await endRun(client, level, row.run_id, row.run_card_id, reason);
+            throw new Error(`NO AGENT IS RUNNING: ${reason}`);
+        }
+        out(`rearm    run ${row.run_id}  level ${level}  pid ${started.pid}  `
+            + `${row.ask_id === null
+                ? 'to read back everybody it sent'
+                : row.mine
+                    ? 'with the answer to its own question'
+                    : 'with a question it has to settle'}`);
+        try {
+            await recordProcess(client, row.run_id, started.pid, undefined, undefined, started.attempt);
+        }
+        catch (error) {
+            // Said, not fatal, as everywhere else: the agent is running and killing it
+            // over a bookkeeping write would cost the user the work.
+            said(`${error instanceof Error ? error.message : String(error)} (the run is still going)`);
+        }
+        /* ═══ AND IT SPEAKS TO THE CARD ONLY IF IT IS DOING THE PERSON'S WORK. ═══
+           Exactly the distinction ux.md draws: a run carrying on with its own work has
+           something to say when it finishes, and a run started only to settle somebody
+           else's question does not. A run started to read back everybody it sent is
+           the first kind and the clearest case of it — that reply IS the answer to the
+           request. See `settle`. */
+        return {
+            settled: settle(client, tools, machineId, level, row.run_id, row.run_card_id, started, row.ask_id === null || !!row.mine),
+        };
+    }
+    finally {
+        preparation?.finish();
     }
-    catch (error) {
-        // Said, not fatal, as everywhere else: the agent is running and killing it
-        // over a bookkeeping write would cost the user the work.
-        said(`${error instanceof Error ? error.message : String(error)} (the run is still going)`);
-    }
-    /* ═══ AND IT SPEAKS TO THE CARD ONLY IF IT IS DOING THE PERSON'S WORK. ═══
-       Exactly the distinction ux.md draws: a run carrying on with its own work has
-       something to say when it finishes, and a run started only to settle somebody
-       else's question does not. A run started to read back everybody it sent is
-       the first kind and the clearest case of it — that reply IS the answer to the
-       request. See `settle`. */
-    return {
-        settled: settle(client, tools, machineId, level, row.run_id, row.run_card_id, started, row.ask_id === null || !!row.mine),
-    };
 }
 /**
  * The runs one run dispatched, AND WHAT EACH OF THEM WROTE, in the words the
@@ -2048,139 +2270,151 @@ export function resumableOwnerSessionId(candidate, machineId, machineHarness) {
         : undefined;
 }
 async function activateOwner(client, tools, machineId, runId, afterProcessToken = null, afterPid = null) {
-    const candidate = await ownerCandidate(client, runId);
-    if (!candidate)
-        return null;
-    // Existing conversations retain their agent; an explicit hand-back follows
-    // the new selection. Never reuse a native session across different agents.
-    if (candidate.handed_back_at === null && candidate.machine_id !== machineId)
-        return null;
-    const machineHarness = candidate.handed_back_at === null && candidate.harness !== null
-        ? harness({ CTRL_SPC_V3_AGENT: candidate.harness })
-        : await selectedHarness(client, machineId);
-    const resumeSessionId = resumableOwnerSessionId(candidate, machineId, machineHarness);
-    /* ═══ THE EXISTENCE CHECK BEFORE THE CLAIM, AND THE COPY AFTER IT. ═══ This
-       was the whole resolution, which was right while resolving meant reading a
-       folder out of a file. Since worktrees-8 it also CREATES one, and a daemon
-       that lost the activation race would leave a branch and a folder behind for
-       an owner it never activated. The refusal this position exists for — a
-       machine that does not have this codebase must not take the activation —
-       is unchanged, because it is the located checkout that answers it. */
-    if (candidate.codebase_id !== null) {
-        checkoutForCodebase(await codebaseOfRun(client, candidate.id), hostname());
-    }
-    const { data, error } = await client.rpc('panel3_take_owner_activation', {
-        p_run_id: runId,
-        p_machine_id: machineId,
-        p_agent: machineHarness,
-        p_after_process_token: afterProcessToken,
-        p_after_pid: afterPid,
-    });
-    if (error)
-        throw new Error(`could not activate conversation owner ${runId}: ${error.message}`);
-    const claimed = data?.[0];
-    if (!claimed)
-        return null;
-    const [events, children] = await Promise.all([
-        ownerConversation(client, claimed.run_card_id, new Set(claimed.turn_ids ?? [])),
-        ownerChildren(client, runId),
-    ]);
-    const currentArtifactAnswer = deliveredArtifactAnswer(events, claimed);
-    const delivered = claimed.ask_id === null ? null : {
-        id: claimed.ask_id,
-        question: claimed.question ?? '(question unavailable)',
-        answer: claimed.answer,
-        mine: claimed.mine === true,
-        artifactAnswer: currentArtifactAnswer,
-    };
-    /* ═══ AFTER THE CLAIM, SO THE ENDING IS THE ONE THIS PATH HAS. ═══ Every
-       failure below the claim ends the activation with `giveUp` and its process
-       token; a throw above it would merely be an activation that did not happen.
-  
-       ═══ AND IT MATTERS MOST HERE. ═══ This is the owner, which lives for the
-       whole card and whose native session is RESUMED, so it is the one agent that
-       can be running while a person edits or deletes a rule. Reading at every
-       activation is what makes an edit govern the rest of the conversation, and
-       the block's own supersession sentence is what makes a DELETION take effect
-       in a session that still holds the older copy.
-  
-       ═══ AND IT IS BEFORE THE PROMPT SINCE worktrees-8 C1, because the prompt now
-       says what the product DID with the person's answer, and the landing needs
-       the card's copy. Nothing in the prompt depended on it before. */
-    let rules;
-    let settings;
-    /* THE CARD'S COPY IS MADE IN THE SAME WINDOW AND UNDER THE SAME ENDING, for
-       the reason the check above gives: it writes, so it happens after the claim,
-       and a failure to make it is an activation that ends rather than one that
-       sits `running` with no process. */
-    let where;
-    /* ═══ AND WHAT IS ATTACHED, READ IN THE SAME WINDOW AND UNDER THE SAME
-       ENDING. ═══ attaching-after-the-fact-10: a person may attach to a card that
-       is already running, and the owner's brief is immutable, so the only account
-       of attachments it would otherwise get is the one frozen at dispatch. Read
-       at every activation, exactly as the rules are, and for the same reason a
-       failed read ends the activation rather than continuing: "nothing is
-       attached" is a different card from the one the person sent.
-  
-       THE CODEBASE LINES ARE DROPPED. `whatWasAttached` partitions those into a
-       section whose own text says "its one codebase is named separately below",
-       a forward reference to something `workBrief` supplies and an owner
-       activation does not. This block carries the PERSON's attachments; where the
-       owner is working is `where.block`'s answer. */
-    let attached;
-    let pictures;
+    let claimOperationId;
+    const preparation = tools.work?.prepare();
     try {
-        where = await ownerDirectory(client, candidate);
-        rules = await standingRulesFor(client, runId);
-        settings = await settingsForRun(client, runId);
-        attached = whatWasAttached((await attachmentsFor(client, claimed.run_card_id))
-            .filter((line) => !line.startsWith('codebase  ')));
-        /* ═══ THE OWNER'S OWN ACTIVATION, WHICH IS WHERE MOST PICTURES ARRIVE. ═══
-           The person sends one and this is the run that reads it. Written on every
-           activation rather than once, so an owner resumed into an existing native
-           conversation is told again about a directory a previous process wrote. */
-        pictures = await picturesOnDisk(client, claimed.run_card_id, where, 2);
-    }
-    catch (error) {
-        const why = error instanceof Error ? error.message : String(error);
-        await giveUp(client, runId, why, claimed.process_token);
-        throw new Error(`NO AGENT IS RUNNING: ${why}`);
-    }
-    /* THE MERGE, OFF THE MARK ON THE ASK, BEFORE THE AGENT THAT WILL SPEAK ABOUT
-       IT IS STARTED. The owner reaches an answer by this route as often as by the
-       re-arm, which is why the artifact answer is read on both and this is too. */
-    const offered = claimed.ask_id !== null && claimed.mine === true
-        ? await landingOffer(client, claimed.ask_id)
-        : null;
-    const landing = offered === null ? null : landCardWork(where, offered);
-    const prompt = resumeSessionId
-        ? ownerContinuationPrompt(claimed.run_brief, claimed.run_report, events, children, delivered, landing)
-        : ownerActivationPrompt(claimed.run_brief, claimed.run_report, events, children, delivered !== null && !delivered.mine
-            ? { id: delivered.id, question: delivered.question }
-            : null, currentArtifactAnswer, 
+        const candidate = await ownerCandidate(client, runId);
+        if (!candidate)
+            return null;
+        // Existing conversations retain their agent; an explicit hand-back follows
+        // the new selection. Never reuse a native session across different agents.
+        if (candidate.handed_back_at === null && candidate.machine_id !== machineId)
+            return null;
+        const machineHarness = candidate.handed_back_at === null && candidate.harness !== null
+            ? harness({ CTRL_SPC_V3_AGENT: candidate.harness })
+            : await selectedHarness(client, machineId);
+        const resumeSessionId = resumableOwnerSessionId(candidate, machineId, machineHarness);
+        /* ═══ THE EXISTENCE CHECK BEFORE THE CLAIM, AND THE COPY AFTER IT. ═══ This
+           was the whole resolution, which was right while resolving meant reading a
+           folder out of a file. Since worktrees-8 it also CREATES one, and a daemon
+           that lost the activation race would leave a branch and a folder behind for
+           an owner it never activated. The refusal this position exists for — a
+           machine that does not have this codebase must not take the activation —
+           is unchanged, because it is the located checkout that answers it. */
+        if (candidate.codebase_id !== null) {
+            checkoutForCodebase(await codebaseOfRun(client, candidate.id), hostname());
+        }
+        const response = await panelClaim(client, tools.work, 'panel3_take_owner_activation', {
+            p_run_id: runId,
+            p_machine_id: machineId,
+            p_agent: machineHarness,
+            p_after_process_token: afterProcessToken,
+            p_after_pid: afterPid,
+        });
+        const { data, error, operationId } = response;
+        claimOperationId = operationId;
+        if (error)
+            throw new Error(`could not activate conversation owner ${runId}: ${error.message}`);
+        const claimed = data?.[0];
+        if (!claimed)
+            return null;
+        const [events, children] = await Promise.all([
+            ownerConversation(client, claimed.run_card_id, new Set(claimed.turn_ids ?? [])),
+            ownerChildren(client, runId),
+        ]);
+        const currentArtifactAnswer = deliveredArtifactAnswer(events, claimed);
+        const delivered = claimed.ask_id === null ? null : {
+            id: claimed.ask_id,
+            question: claimed.question ?? '(question unavailable)',
+            answer: claimed.answer,
+            mine: claimed.mine === true,
+            artifactAnswer: currentArtifactAnswer,
+        };
+        /* ═══ AFTER THE CLAIM, SO THE ENDING IS THE ONE THIS PATH HAS. ═══ Every
+           failure below the claim ends the activation with `giveUp` and its process
+           token; a throw above it would merely be an activation that did not happen.
+           *
+           ═══ AND IT MATTERS MOST HERE. ═══ This is the owner, which lives for the
+           whole card and whose native session is RESUMED, so it is the one agent that
+           can be running while a person edits or deletes a rule. Reading at every
+           activation is what makes an edit govern the rest of the conversation, and
+           the block's own supersession sentence is what makes a DELETION take effect
+           in a session that still holds the older copy.
+           *
+           ═══ AND IT IS BEFORE THE PROMPT SINCE worktrees-8 C1, because the prompt now
+           says what the product DID with the person's answer, and the landing needs
+           the card's copy. Nothing in the prompt depended on it before. */
+        let rules;
+        let settings;
+        /* THE CARD'S COPY IS MADE IN THE SAME WINDOW AND UNDER THE SAME ENDING, for
+           the reason the check above gives: it writes, so it happens after the claim,
+           and a failure to make it is an activation that ends rather than one that
+           sits `running` with no process. */
+        let where;
+        /* ═══ AND WHAT IS ATTACHED, READ IN THE SAME WINDOW AND UNDER THE SAME
+           ENDING. ═══ attaching-after-the-fact-10: a person may attach to a card that
+           is already running, and the owner's brief is immutable, so the only account
+           of attachments it would otherwise get is the one frozen at dispatch. Read
+           at every activation, exactly as the rules are, and for the same reason a
+           failed read ends the activation rather than continuing: "nothing is
+           attached" is a different card from the one the person sent.
+           *
+           THE CODEBASE LINES ARE DROPPED. `whatWasAttached` partitions those into a
+           section whose own text says "its one codebase is named separately below",
+           a forward reference to something `workBrief` supplies and an owner
+           activation does not. This block carries the PERSON's attachments; where the
+           owner is working is `where.block`'s answer. */
+        let attached;
+        let pictures;
+        try {
+            where = await ownerDirectory(client, candidate);
+            rules = await standingRulesFor(client, runId);
+            settings = await settingsForRun(client, runId);
+            attached = whatWasAttached((await attachmentsFor(client, claimed.run_card_id))
+                .filter((line) => !line.startsWith('codebase  ')));
+            /* ═══ THE OWNER'S OWN ACTIVATION, WHICH IS WHERE MOST PICTURES ARRIVE. ═══
+               The person sends one and this is the run that reads it. Written on every
+               activation rather than once, so an owner resumed into an existing native
+               conversation is told again about a directory a previous process wrote. */
+            pictures = await picturesOnDisk(client, claimed.run_card_id, where, 2);
+        }
+        catch (error) {
+            const why = error instanceof Error ? error.message : String(error);
+            await giveUp(client, runId, why, claimed.process_token);
+            throw new Error(`NO AGENT IS RUNNING: ${why}`);
+        }
+        /* THE MERGE, OFF THE MARK ON THE ASK, BEFORE THE AGENT THAT WILL SPEAK ABOUT
+           IT IS STARTED. The owner reaches an answer by this route as often as by the
+           re-arm, which is why the artifact answer is read on both and this is too. */
+        const offered = claimed.ask_id !== null && claimed.mine === true
+            ? await landingOffer(client, claimed.ask_id)
+            : null;
+        const landing = offered === null ? null : landCardWork(where, offered);
         /* ═══ A PROCESS OF ITS OWN ENDED BEFORE IT FINISHED. ═══ `afterPid` is the
            fact, and it is non-null on all three paths that follow one: a harness
            that crashed, a machine that went down, and now a person's correction.
            The sentences it adds say what to do and never why, because those three
            are not the same event and `prompt.ts` exists to stop an agent being
            told an untrue reason for its own restart. */
-        afterPid !== null, landing);
-    const started = startAgent(withStandingRules(rules, prompt, where.block, attached, pictures), 2, tools.urlFor(runId, claimed.process_token), where.cwd, { ownerId: runId, ...(resumeSessionId ? { resumeSessionId } : {}) }, settings);
-    if (started.pid === null) {
-        const answer = await started.answered;
-        const reason = answer.ok ? 'the process ended before it could be identified' : answer.reason;
-        await giveUp(client, runId, reason, claimed.process_token);
-        throw new Error(`NO AGENT IS RUNNING: ${reason}`);
-    }
-    try {
-        await recordProcess(client, runId, started.pid, undefined, claimed.process_token);
+        const prompt = resumeSessionId
+            ? ownerContinuationPrompt(claimed.run_brief, claimed.run_report, events, children, delivered, landing)
+            : ownerActivationPrompt(claimed.run_brief, claimed.run_report, events, children, delivered !== null && !delivered.mine
+                ? { id: delivered.id, question: delivered.question }
+                : null, currentArtifactAnswer, afterPid !== null, landing);
+        const started = await startTrackedAgent(client, runId, preparation, tools.work, withStandingRules(rules, prompt, where.block, attached, pictures), 2, tools.urlFor(runId, claimed.process_token), where.cwd, { ownerId: runId, ...(resumeSessionId ? { resumeSessionId } : {}) }, settings);
+        if (started.pid === null) {
+            if (started.interrupted?.())
+                throw new Error('Work was interrupted by the service command.');
+            const answer = await started.answered;
+            const reason = answer.ok ? 'the process ended before it could be identified' : answer.reason;
+            await giveUp(client, runId, reason, claimed.process_token);
+            throw new Error(`NO AGENT IS RUNNING: ${reason}`);
+        }
+        try {
+            await recordProcess(client, runId, started.pid, undefined, claimed.process_token, started.attempt);
+        }
+        catch (error) {
+            said(`${error instanceof Error ? error.message : String(error)} (the run is still going)`);
+        }
+        return {
+            settled: settle(client, tools, machineId, 2, runId, claimed.run_card_id, started, true, claimed.process_token, ownerSessionLifecycle(started, runId, machineHarness, claimed.process_token, resumeSessionId)),
+        };
     }
-    catch (error) {
-        said(`${error instanceof Error ? error.message : String(error)} (the run is still going)`);
+    finally {
+        preparation?.finish();
+        if (claimOperationId)
+            tools.work?.finishRpcs([claimOperationId]);
     }
-    return {
-        settled: settle(client, tools, machineId, 2, runId, claimed.run_card_id, started, true, claimed.process_token, ownerSessionLifecycle(started, runId, machineHarness, claimed.process_token, resumeSessionId)),
-    };
 }
 /** The only owner rows the normal poll may try, including an explicit hand-back move.
  *
@@ -2256,7 +2490,8 @@ export function redirectedProcess(candidate, machineId,
 /** The newest unaddressed person turn per card. MAX, never first-seen: a turn
  *  left unaddressed while a question was open would otherwise pin its card
  *  below `resumed_at` for good and nothing on it could ever redirect. */
-waiting, cardId, booted) {
+waiting, cardId, booted, executionHeld = false) {
+    // A dead transport can still own live tools in the durable execution boundary.
     // The claim's own five, mirrored.
     if (candidate.state !== 'running' || candidate.ended_at !== null)
         return null;
@@ -2288,7 +2523,7 @@ waiting, cardId, booted) {
     if (new Date(said).getTime() <= new Date(candidate.resumed_at ?? candidate.started_at).getTime()) {
         return null;
     }
-    return runProcessIsAlive(candidate, booted) ? candidate.pid : null;
+    return executionHeld || runProcessIsAlive(candidate, booted) ? candidate.pid : null;
 }
 export function pendingOwnerSessionWithinGrace(candidate, now = Date.now()) {
     const local = readOwnerSession(candidate.id);
@@ -2331,9 +2566,17 @@ async function takeOwnerActivations(client, tools, machineId, mine, hold) {
            else and there is a dead process, a row still reading `running` and a card
            still saying `working`, with nothing local to retry it. */
         if (mine.has(candidate.id)) {
-            const pid = redirectedProcess({ ...candidate, card_state: candidate.card?.state ?? null }, machineId, waiting, candidate.card_id, bootedAt());
+            const attempt = recoveryAttempt(candidate);
+            const executionHeld = tools.work?.heldAttempt(attempt) ?? false;
+            // A run ID alone cannot authorize stopping a newer activation.
+            if (tools.work && !executionHeld)
+                continue;
+            const pid = redirectedProcess({ ...candidate, card_state: candidate.card?.state ?? null }, machineId, waiting, candidate.card_id, bootedAt(), executionHeld);
             if (pid !== null) {
-                killTree({ pid, kill: (signal) => process.kill(pid, signal) });
+                if (executionHeld)
+                    await tools.work.stopHeldAttempt(attempt);
+                else
+                    killTree({ pid, kill: (signal) => process.kill(pid, signal) });
                 /* ═══ SIGNALLED, NOT KILLED, AND THE WORD IS THE POINT. ═══ `killTree`
                    swallows a refused signal on both platforms, so saying "killed" would
                    claim a death this daemon never observed. A process that survives is
@@ -2344,6 +2587,8 @@ async function takeOwnerActivations(client, tools, machineId, mine, hold) {
             }
             continue;
         }
+        if (tools.work?.heldAttempt(recoveryAttempt(candidate)))
+            continue;
         if (pendingOwnerSessionWithinGrace(candidate))
             continue;
         if (candidate.handed_back_at !== null
@@ -2407,7 +2652,7 @@ function runProcessIsAlive(run, booted) {
  * touched here. A current owner row, live PID, in-flight process, or fresh
  * pid-null claim always defers cleanup. Stable state is removed only after the
  * owner row disappears, becomes terminal, or no longer owns its card. */
-export async function reconcileOwnerSessions(client, machineId, _machineHarness, inFlightOwnerIds = new Set()) {
+export async function reconcileOwnerSessions(client, machineId, _machineHarness, inFlightOwnerIds = new Set(), work) {
     const mappingIds = listOwnerSessionIds();
     const homeIds = listPanel3CodexOwnerHomeIds();
     const all = [...new Set([...mappingIds, ...homeIds])];
@@ -2424,7 +2669,11 @@ export async function reconcileOwnerSessions(client, machineId, _machineHarness,
     for (const id of ids) {
         if (inFlightOwnerIds.has(id))
             continue;
+        if (work?.heldLocalOwner(id))
+            continue;
         const row = byId.get(id);
+        if (row && work?.heldAttempt(recoveryAttempt(row)))
+            continue;
         const localProcessInUse = !!row
             && row.machine_id === machineId
             && ((row.pid !== null && processIsAlive(row.pid))
@@ -2477,10 +2726,10 @@ export async function reconcileOwnerSessions(client, machineId, _machineHarness,
  * the next poll tries again: clearing it after an EPERM would say this machine
  * has no process for a run whose agent is still working.
  */
-async function killStopped(client, machineId) {
+async function killStopped(client, machineId, work) {
     const stopped = await returned(client
         .from('panel3_runs')
-        .select('id, card_id, pid, state, started_at, resumed_at')
+        .select('id, card_id, pid, state, started_at, resumed_at, process_token')
         .eq('machine_id', machineId)
         .in('state', [...ENDED_BY_THE_PERSON, 'finished', 'failed'])
         .not('pid', 'is', null), 'read', 'the runs on this machine that are not coming back');
@@ -2488,7 +2737,16 @@ async function killStopped(client, machineId) {
         return;
     const booted = bootedAt();
     for (const run of stopped) {
-        if (runProcessIsAlive(run, booted)) {
+        let stoppedByOwner = false;
+        if (work?.heldAttempt(recoveryAttempt(run))) {
+            if (!ENDED_BY_THE_PERSON.includes(run.state))
+                continue;
+            // The recorded bridge can be gone while its owned tools still run.
+            // Only the durable owner can confirm that the complete execution ended.
+            await work.stopHeldAttempt(recoveryAttempt(run));
+            stoppedByOwner = true;
+        }
+        if (!stoppedByOwner && runProcessIsAlive(run, booted)) {
             if (!ENDED_BY_THE_PERSON.includes(run.state))
                 continue;
             try {
@@ -2509,15 +2767,18 @@ async function killStopped(client, machineId) {
             continue;
         }
         try {
-            await returned(client
+            let cleared = client
                 .from('panel3_runs')
                 .update({ pid: null })
-                // A finished owner may activate again between this read and write.
-                // Only acknowledge the exact process whose exit was observed.
                 .eq('id', run.id)
                 .eq('pid', run.pid)
-                .in('state', [...ENDED_BY_THE_PERSON, 'finished', 'failed'])
-                .select('id'), 'clear the process id of', `run ${run.id}`);
+                .eq('started_at', run.started_at)
+                .in('state', [...ENDED_BY_THE_PERSON, 'finished', 'failed']);
+            cleared = run.process_token === null ? cleared.is('process_token', null) : cleared.eq('process_token', run.process_token);
+            cleared = run.resumed_at === null ? cleared.is('resumed_at', null) : cleared.eq('resumed_at', run.resumed_at);
+            await returned(
+            // A finished owner may activate again while its old execution closes.
+            cleared.select('id'), 'clear the process id of', `run ${run.id}`);
         }
         catch (error) {
             // Said, not fatal. The kill has already happened; this is bookkeeping, and
@@ -2602,6 +2863,8 @@ async function recoverStranded(client, tools, machineId, mine, hold) {
     for (const run of live) {
         if (mine.has(run.id))
             continue;
+        if (tools.work?.heldAttempt(recoveryAttempt(run)))
+            continue;
         // WHEN THE ATTEMPT NOW RUNNING BEGAN, which is the first one until a resume
         // says otherwise. See the header.
         const startedAt = new Date(run.resumed_at ?? run.started_at).getTime();
@@ -2838,6 +3101,8 @@ export async function takeHandedBack(client, tools, machineId, mine, hold) {
     // ONCE, OUTSIDE THE LOOP. It is a property of this machine, not of a row.
     const booted = bootedAt();
     for (const run of offered) {
+        if (tools.work?.heldAttempt(recoveryAttempt(run)))
+            continue;
         if (mine.has(run.id)) {
             /* THIS DAEMON'S OWN LIVE WORK, OFFERED WHILE IT WAS BUSY BEING QUIET. See
                the header. Said rather than passed over in silence, because a machine
@@ -3028,7 +3293,7 @@ export async function sweepFinishedWorktrees(client) {
 export function clientReader(injected) {
     return typeof injected === 'function' ? injected : () => injected;
 }
-export async function run(args, injected, signal, lifecycle) {
+export async function run(args, injected, signal, lifecycle, work) {
     let once = false;
     for (const arg of args) {
         if (arg === '--once')
@@ -3084,11 +3349,21 @@ export async function run(args, injected, signal, lifecycle) {
        `tools` is referenced inside the callback it is being given, which is safe
        for the plain reason that the callback can only run once a request has
        arrived at a server that by then exists. */
+    if (work)
+        await reconcilePanelInterruptions(current(), machineId, work);
+    lifecycle?.reconciled?.();
     const tools = await startToolsServer(current(), async (parentRunId, brief, codebase, processToken, choice) => {
-        const child = await startChild(current(), tools, machineId, parentRunId, brief, codebase, processToken, choice);
-        hold(child.runId, child.settled);
-        return { runId: child.runId };
+        const endClaim = work?.beginClaim();
+        try {
+            const child = await startChild(current(), tools, machineId, parentRunId, brief, codebase, processToken, choice);
+            hold(child.runId, child.settled);
+            return { runId: child.runId };
+        }
+        finally {
+            endClaim?.();
+        }
     }, (runId, processToken, action) => recoverLanding(current(), machineId, runId, processToken, action));
+    tools.work = work;
     out(`daemon   machine ${machineId}`);
     out(`tools    ${tools.urlFor('<run-id>')}`);
     out(once ? 'mode     one poll' : `mode     polling every ${POLL_INTERVAL_MS / 1000}s, Ctrl-C to stop`);
@@ -3129,6 +3404,8 @@ export async function run(args, injected, signal, lifecycle) {
             // Restart only at a poll boundary, before any claims, with no live work.
             if (lifecycle && !lifecycle.beforePoll(inFlight.size))
                 break;
+            let endClaim;
+            const claimOperations = [];
             /* ═══ ONE POLL FAILING IS NOT THE DAEMON FAILING. ═══ Every read and write
                here throws on a network or database error, by design (constraint 7), and
                until Slice 4 that threw straight out of `panel3/cli.js run` and exited the process.
@@ -3141,12 +3418,19 @@ export async function run(args, injected, signal, lifecycle) {
                `--once` still fails loudly, because the acceptance harness reads the exit
                code and a swallowed failure there would make a broken suite look green. */
             try {
+                if (work)
+                    await reconcilePanelInterruptions(current(), machineId, work);
+                if (work && !work.allowed()) {
+                    await sleep(POLL_INTERVAL_MS);
+                    continue;
+                }
+                endClaim = work?.beginClaim();
                 /* ═══ THE USER'S STOP IS HONOURED BEFORE ANYTHING ELSE ON THE POLL. ═══ It
                    is the only thing here that a person is waiting on, and the two takes
                    below can spend the rest of the poll starting agents. Nothing else needs
                    to run first: `panel3_stop_card` has already ended the runs, so recovery
                    cannot see them and neither take can start them. */
-                await killStopped(current(), machineId);
+                await killStopped(current(), machineId, work);
                 /* Publish readiness before claiming work. A card with an untaken turn reads the same whether a daemon
                    is two seconds away or nobody has one running; this row is the only place
                    the difference exists. It is written before the takes rather than after
@@ -3171,7 +3455,7 @@ export async function run(args, injected, signal, lifecycle) {
                 }
                 listeningHarness = machineHarness;
                 await sayListening(current(), machineId, machineName, machineHarness);
-                await reconcileOwnerSessions(current(), machineId, machineHarness, new Set(inFlight.keys()));
+                await reconcileOwnerSessions(current(), machineId, machineHarness, new Set(inFlight.keys()), work);
                 await recoverStranded(current(), tools, machineId, new Set(inFlight.keys()), hold);
                 /* ═══ AND THE COPIES OF CARDS THAT ARE OVER. ═══ After recovery,
                    deliberately: a run this machine is about to resume is one whose card is
@@ -3197,7 +3481,10 @@ export async function run(args, injected, signal, lifecycle) {
                 /* THE MACHINE ID GOES IN because the take writes the run row, and a run has
                    to say where it is running: the exclusion is cross-machine and recovery is
                    per-machine, so a row with nobody's machine on it could be neither. */
-                const taken = await returned(current().rpc('panel3_take_turns', { p_machine_id: machineId, p_agent: machineHarness }), 'take', 'turns');
+                const takenResponse = await panelClaim(current(), work, 'panel3_take_turns', { p_machine_id: machineId, p_agent: machineHarness });
+                if (takenResponse.operationId)
+                    claimOperations.push(takenResponse.operationId);
+                const taken = await returned(Promise.resolve(takenResponse), 'take', 'turns');
                 /* ═══ THE OTHER KIND OF TAKEABLE WORK. ═══ ux.md's re-arm: an answered
                    question makes the branch that asked it takeable again, and a question
                    still walking up makes the run it reached takeable so that level gets its
@@ -3211,7 +3498,10 @@ export async function run(args, injected, signal, lifecycle) {
                    to it on a later poll rather than putting two of them on one card. The
                    other order would decide the same question from a snapshot taken before
                    the run existed. */
-                const rearmed = await returned(current().rpc('panel3_take_rearms', { p_machine_id: machineId, p_agent: machineHarness }), 'take', 'runs that can carry on');
+                const rearmedResponse = await panelClaim(current(), work, 'panel3_take_rearms', { p_machine_id: machineId, p_agent: machineHarness });
+                if (rearmedResponse.operationId)
+                    claimOperations.push(rearmedResponse.operationId);
+                const rearmed = await returned(Promise.resolve(rearmedResponse), 'take', 'runs that can carry on');
                 for (const row of rearmed) {
                     /* NOT AWAITED PAST THE SPAWN, exactly as a taken card is not: the work is a
                        real agent and holding the poll open for it would put every other card
@@ -3265,6 +3555,10 @@ export async function run(args, injected, signal, lifecycle) {
                     }
                 }
             }
+            finally {
+                work?.finishRpcs(claimOperations);
+                endClaim?.();
+            }
             if (!signal?.aborted)
                 await sleep(POLL_INTERVAL_MS);
         }
@@ -3284,8 +3578,12 @@ export async function run(args, injected, signal, lifecycle) {
  * client. A stopped worker is restarted automatically. Explicit restarts happen
  * at an idle poll boundary and confirm only after a new worker completes a poll.
  * Sign-out stops the supervisor, so it cannot restart behind the user's back. */
-export function startPanel(injected) {
+export function startPanel(injected, work) {
     const controller = new AbortController();
+    let resolveReady;
+    let rejectReady;
+    const ready = new Promise((resolve, reject) => { resolveReady = resolve; rejectReady = reject; });
+    void ready.catch(() => { });
     let requested = false;
     let restarting = null;
     let resolveRestart = null;
@@ -3304,11 +3602,13 @@ export function startPanel(injected) {
                         }
                         return false;
                     },
+                    reconciled: () => resolveReady(),
                     ready: () => { if (!requested)
                         resolveRestart?.(); },
-                });
+                }, work);
             }
             catch (error) {
+                rejectReady(error instanceof Error ? error : new Error(String(error)));
                 said(`the agent panel stopped polling: ${error instanceof Error ? error.message : String(error)}`);
                 // Startup failures must not leave an online machine with a dead worker.
                 if (!controller.signal.aborted)
@@ -3317,6 +3617,7 @@ export function startPanel(injected) {
         }
     })();
     return {
+        ready,
         restart: () => {
             if (controller.signal.aborted)
                 return Promise.reject(new Error('This machine is signing out. Open Companion and sign in again.'));
@@ -3339,6 +3640,7 @@ export function startPanel(injected) {
         },
         stop: async () => {
             controller.abort();
+            rejectReady(new Error('Cloud startup was cancelled by the service command.'));
             rejectRestart?.(new Error('The machine disconnected before the worker restarted.'));
             await running;
         },