@ctrl-spc/cs 0.7.14 → 0.7.16

package/dist/panel3/run.js

@@ -1,3 +1,4 @@
+import { failureMessage } from '../failure-reason.js';
 /**
  * ═══ AGENT PANEL v3: the poll loop that answers a card. ═══
  *
@@ -137,7 +138,7 @@ import { answerPrompt, escalationPrompt, levelOnePrompt, ownerActivationPrompt,
 import { ASK_CONTENT_COLUMNS, attachmentLine, gitRulesFor, loadAttachments, loadOutputNames, outputOf, recordBaseProtection, standingRulesFor, withAskContent, } from './show.js';
 import { forgetSecrets, redactSecrets } from './secrets.js';
 import { sayListening, sayPollingProblem, stopListening } from './presence.js';
-import { selectedHarness } from './coordinator.js';
+import { selectedHarness, recoveryHarnesses } from './coordinator.js';
 import { baseBranchState, checkoutForCodebase, commitCardWork, detectBaseProtection, folderIsBranch, hasCheckoutForCodebase, mergeIntoBase, releaseBaseBranch, settleCardWorktree, worktreeForCard, ownsReconciliation, prepareCardReconciliation, finishCardReconciliation, worktreesOnThisMachine, } from './checkout.js';
 import { harness, startAgent } from './spawn.js';
 import { establishOwnerSession, listOwnerSessionIds, OWNER_SESSION_GRACE_MS, readOwnerSession, removeOwnerSession, validSessionUuid, writeOwnerSession, } from './session.js';
@@ -146,11 +147,187 @@ import { listPanel3CodexOwnerHomeIds, removePanel3CodexOwnerHome, } from '../cod
 import { getMachineIdentity, scratchDir } from '../config.js';
 import { listCodebases } from '../codebases.js';
 import { killTree, processIsAlive } from '../win-shell.js';
+import { randomUUID } from 'node:crypto';
 import { hostname, uptime } from 'node:os';
 import { execFileSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { mkdir, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
+function recoveryAttempt(run) {
+    return { runId: run.id, processToken: run.process_token, startedAt: run.started_at, resumedAt: run.resumed_at };
+}
+async function startTrackedAgent(client, runId, preparation, work, captured, ...args) {
+    if (!preparation)
+        return { ...startAgent(...args), attempt: captured };
+    const claimed = captured ?? work?.claimAttempt(runId);
+    if (!claimed)
+        throw new Error('This run no longer belongs to the claimed attempt.');
+    preparation.setAttempt(claimed);
+    let preparationFailed = false;
+    let failureReason = '';
+    const execution = {
+        ...preparation.execution,
+        register: async (child, agent) => {
+            await preparation.execution.register(child, agent);
+            // An ordinary stop can reopen admission after a refusal. Every such
+            // wait needs a fresh cloud check before the prompt is authorized.
+            try {
+                let waited;
+                do {
+                    const { data, error } = await client.from('panel3_runs')
+                        .select('process_token,started_at,resumed_at,state,ended_at').eq('id', runId).single();
+                    if (error)
+                        throw error;
+                    if (!data || data.state !== 'running' || data.ended_at !== null
+                        || claimed.processToken !== (data.process_token ?? null) || claimed.startedAt !== data.started_at
+                        || claimed.resumedAt !== (data.resumed_at ?? null)) {
+                        throw new Error('This run no longer belongs to the claimed attempt.');
+                    }
+                    waited = await preparation.execution.waitForPromptAdmission();
+                } while (waited);
+            }
+            catch (error) {
+                if (!preparation.execution.interrupted()) {
+                    const reason = error instanceof Error ? error.message : String(error);
+                    preparation.deferFailure(reason, args[1]);
+                    preparationFailed = true;
+                    failureReason = reason;
+                }
+                throw error;
+            }
+        },
+    };
+    const started = startAgent(args[0], args[1], args[2], args[3], args[4], args[5], execution);
+    // Do not hold the claim barrier while registration waits for an ordinary
+    // stop to be refused. The original answer promises proven process closure.
+    const answered = started.answered.then(async (answer) => {
+        if (preparationFailed && !preparation.execution.interrupted()) {
+            await endRun(client, args[1], runId, claimed.cardId, failureReason, claimed);
+            preparation.execution.complete();
+        }
+        return answer;
+    });
+    void answered.catch(() => { }); // The caller records the PID before awaiting settlement.
+    return { ...started, answered, attempt: claimed, deferOutcome: preparation.deferOutcome, acknowledgeOutcome: preparation.acknowledgeOutcome, preparationFailed: () => preparationFailed };
+}
+function panelClaimAttempts(result) {
+    if (!Array.isArray(result))
+        throw new Error('The claim journal returned no complete result.');
+    const unique = new Map();
+    for (const row of result) {
+        const attempt = row?._attempt;
+        if (!attempt || typeof attempt.run_id !== 'string' || typeof attempt.card_id !== 'string' || typeof attempt.started_at !== 'string') {
+            throw new Error('The claim journal returned an incomplete run identity.');
+        }
+        unique.set(attempt.run_id, { runId: attempt.run_id, cardId: attempt.card_id, processToken: attempt.process_token ?? null,
+            pid: attempt.pid ?? null, startedAt: attempt.started_at, resumedAt: attempt.resumed_at ?? null,
+            observedPendingTurnIds: attempt.observed_pending_turn_ids ?? null, authRecoveryRunId: attempt.auth_recovery_run_id ?? null, harness: attempt.harness ?? null });
+    }
+    return [...unique.values()];
+}
+function capturedPanelAttempt(rows, runId, work) {
+    return work?.claimAttempt(runId) ?? panelClaimAttempts(rows).find(attempt => attempt.runId === runId);
+}
+async function panelClaim(client, work, action, args, nativeContext) {
+    const operationId = work?.beginRpc(action, { ...args, ...(nativeContext ? { nativeContext } : {}) }) ?? randomUUID();
+    try {
+        const response = await client.rpc(action, { ...args, p_operation_id: operationId });
+        if (!response.error) {
+            const journal = await client.rpc('panel3_reconcile_claim', { p_machine_id: args.p_machine_id, p_operation_id: operationId });
+            if (journal.error)
+                throw journal.error;
+            const row = journal.data?.[0];
+            if (row?.outcome !== 'completed' || row.action !== action)
+                throw new Error('The claim was cancelled before it could start.');
+            const attempts = panelClaimAttempts(row.result);
+            work?.recordRpc(operationId, attempts, false, row.result);
+            return { ...response, data: row.result, operationId };
+        }
+        if (response.error)
+            work?.deferRpc(operationId);
+        return { ...response, operationId };
+    }
+    catch (error) {
+        work?.deferRpc(operationId);
+        throw error;
+    }
+}
+async function reconcilePanelInterruptions(client, machineId, work) {
+    const capability = await client.rpc('panel3_interrupt_machine_runs', { p_machine_id: machineId,
+        p_operation_id: randomUUID(), p_interrupted_at: new Date().toISOString(), p_attempts: [] });
+    if (capability.error)
+        throw new Error(`could not verify interruption recovery: ${capability.error.message}`);
+    for (const pending of work.pendingOutcomes()) {
+        const { attempt, outcome } = pending;
+        const { data, error } = await client.from('panel3_runs').select('started_at,resumed_at,process_token,state,ended_at,level,card:panel3_cards!panel3_runs_card_id_fkey(conversation_run_id)').eq('id', attempt.runId).maybeSingle();
+        if (error)
+            throw new Error(`could not read the completed attempt: ${error.message}`);
+        if (data && data.started_at === attempt.startedAt && (data.resumed_at ?? null) === attempt.resumedAt
+            && (data.process_token ?? null) === attempt.processToken && data.ended_at === null) {
+            const card = (Array.isArray(data.card) ? data.card[0] : data.card);
+            const successfulToolEnding = !outcome.ok && outcome.failureKind !== 'authentication' && (data.state === 'asked' || (data.level === 1 && !!card?.conversation_run_id));
+            if (outcome.ok || successfulToolEnding)
+                await writeAnswer(client, attempt.runId, attempt.cardId, successfulToolEnding ? null : outcome.text, attempt.processToken ?? undefined, attempt);
+            else
+                await endRun(client, outcome.level ?? 1, attempt.runId, attempt.cardId, outcome.reason, attempt, outcome.failureKind);
+        }
+        work.acknowledgeOutcome(pending.id);
+    }
+    for (const failure of work.failedPreparations()) {
+        await endRun(client, failure.level, failure.attempt.runId, failure.attempt.cardId, failure.reason, failure.attempt);
+        work.acknowledgePreparationFailure(failure.id);
+    }
+    for (const claim of work.pendingRpcs()) {
+        const journal = await client.rpc('panel3_reconcile_claim', { p_machine_id: machineId, p_operation_id: claim.id });
+        if (journal.error)
+            throw new Error(`could not read the claim receipt: ${journal.error.message}`);
+        const row = journal.data?.[0];
+        if (row?.outcome === 'cancelled')
+            work.recordRpc(claim.id, [], true);
+        else if (row?.outcome === 'completed' && row.action === claim.action)
+            work.recordRpc(claim.id, panelClaimAttempts(row.result), false, row.result);
+        else
+            throw new Error('The pending claim could not be reconciled.');
+    }
+    if (work.legacyRequired()) {
+        const attempts = [];
+        for (let offset = 0;; offset += 500) {
+            const { data, error } = await client.from('panel3_runs')
+                .select('id,card_id,process_token,pid,started_at,resumed_at')
+                .eq('machine_id', machineId).is('ended_at', null).order('id').range(offset, offset + 499);
+            if (error)
+                throw error;
+            if (!Array.isArray(data))
+                throw new Error('The old run snapshot did not return a complete page.');
+            for (const row of data) {
+                if (typeof row.started_at !== 'string')
+                    throw new Error('An old run has no exact attempt identity.');
+                attempts.push({ runId: row.id, cardId: row.card_id, processToken: row.process_token ?? null,
+                    pid: row.pid ?? null, startedAt: row.started_at, resumedAt: row.resumed_at ?? null, observedPendingTurnIds: null });
+            }
+            if (data.length < 500)
+                break;
+        }
+        for (const attempt of attempts)
+            work.recordLegacy(attempt);
+        work.legacyComplete();
+    }
+    for (const receipt of work.receipts()) {
+        const attempt = receipt.attempt;
+        const { data, error } = await client.rpc('panel3_interrupt_machine_runs', {
+            p_machine_id: machineId, p_operation_id: receipt.operationId, p_interrupted_at: receipt.interruptedAt,
+            p_attempts: [{ run_id: attempt.runId, process_token: attempt.processToken, pid: receipt.pid ?? attempt.pid ?? null,
+                    started_at: attempt.startedAt, resumed_at: attempt.resumedAt, observed_pending_turn_ids: attempt.observedPendingTurnIds }],
+        });
+        if (error)
+            throw error;
+        const result = data?.[0];
+        if (!result || result.run_id !== attempt.runId || !['interrupted', 'already_interrupted', 'continued', 'stale'].includes(result.outcome)) {
+            throw new Error('The interrupted run was not acknowledged. Work remains protected.');
+        }
+        work.acknowledge(receipt.id);
+    }
+}
 const USAGE = 'usage: run [--once]';
 /** How long between takes. Short, because it is the whole delay between a user
  *  sending and a card showing an agent on it, and the take is one small indexed
@@ -550,18 +727,24 @@ pictures = []) => {
  * a dispatch knows the brief before the row exists and writes it there. Passing
  * it again would be rewriting a brief that ux.md fixes at dispatch.
  *
- * A failure here is NOT fatal. The agent is already running and killing it over
- * a bookkeeping write would cost the user the work. What is lost is precision:
- * the run has no pid, so once this daemon is gone recovery treats it as dead —
- * which errs towards answering again rather than stranding.
+ * A bookkeeping failure does not discard the locally tracked execution. Exact
+ * activation predicates prevent a delayed write from reviving an ended run or
+ * attaching this process to a later continuation.
  */
-async function recordProcess(client, runId, pid, brief, processToken) {
+async function recordProcess(client, runId, pid, brief, processToken, attempt) {
     let query = client
         .from('panel3_runs')
         .update({ pid, ...(brief === undefined ? {} : { brief }) })
-        .eq('id', runId);
+        .eq('id', runId)
+        .eq('state', 'running')
+        .is('ended_at', null);
     if (processToken !== undefined)
         query = query.eq('process_token', processToken);
+    if (attempt) {
+        query = query.eq('started_at', attempt.startedAt);
+        query = attempt.resumedAt === null ? query.is('resumed_at', null) : query.eq('resumed_at', attempt.resumedAt);
+        query = attempt.processToken === null ? query.is('process_token', null) : query.eq('process_token', attempt.processToken);
+    }
     const written = await returned(query.select('id'), 'record what is running', `run ${runId}`);
     if (written.length === 0)
         throw new Error(`could not record what is running for run ${runId}: its activation has ended`);
@@ -579,15 +762,24 @@ async function recordProcess(client, runId, pid, brief, processToken) {
  * there first. It is a fact about the record rather than a failure, so it does
  * not go through `returned()`, exactly as the answer's own null does not.
  */
-async function giveUp(client, runId, reason, processToken) {
+async function giveUp(client, runId, reason, processToken, attempt, failureKind) {
     const { data, error } = await client
         .rpc('panel3_give_up', {
         p_run_id: runId,
         p_reason: reason,
+        p_failure_kind: failureKind ?? null,
+        p_process_token: processToken ?? null,
+        p_expected_attempt: null,
         ...(processToken === undefined ? {} : { p_process_token: processToken }),
+        ...(attempt ? { p_process_token: attempt.processToken, p_expected_attempt: {
+                started_at: attempt.startedAt, resumed_at: attempt.resumedAt,
+            } } : {}),
     });
     if (error)
         throw new Error(`could not give up run ${runId}: ${error.message}`);
+    if (attempt && data !== null && (!Number.isInteger(data) || data < 0)) {
+        throw new Error(`could not give up run ${runId}: no ending was acknowledged`);
+    }
     /* THE RUN IS OVER, so whatever it read is dropped. Every ending does this —
        here, `failRun` and `writeAnswer` — because a daemon stays up for days and
        has no business holding Tuesday's secret. */
@@ -630,7 +822,7 @@ async function giveUp(client, runId, reason, processToken) {
  * a run can be the last thing live on it — but no turn is written, exactly as
  * none is written for a run that stopped to ask.
  */
-async function writeAnswer(client, runId, cardId, text, processToken) {
+async function writeAnswer(client, runId, cardId, text, processToken, attempt) {
     /* ═══ THE SECOND OF THE TWO CHOKEPOINTS THE CREDENTIAL RULE RESTS ON. ═══
        This is the ONE path an agent's own words take to a hosted row — a turn on
        the card at levels 1 and 2, and a level 3's `panel3_runs.report`, which
@@ -640,6 +832,9 @@ async function writeAnswer(client, runId, cardId, text, processToken) {
     const { data: turnId, error } = await client
         .rpc('panel3_answer', {
         p_run_id: runId,
+        p_process_token: processToken ?? attempt?.processToken ?? null,
+        p_expected_attempt: attempt ? { started_at: attempt.startedAt, resumed_at: attempt.resumedAt } : null,
+        p_auth_recovery_run_id: attempt?.authRecoveryRunId ?? null,
         p_body: text === null ? null : redactSecrets(processToken === undefined ? runId : `${runId}:${processToken}`, text),
         ...(processToken === undefined ? {} : { p_process_token: processToken }),
     });
@@ -707,14 +902,15 @@ async function writeAnswer(client, runId, cardId, text, processToken) {
                away. */
             said(`run ${runId} had already ended, so its answer was not written to card ${cardId}`);
         }
-        return ownerSettlementAccepted(run, processToken);
+        return ownerSettlementAccepted(run, processToken, attempt);
     }
     out(`answered card ${cardId}  run ${runId}  ${text?.length ?? 0} characters`);
     return true;
 }
-export function ownerSettlementAccepted(run, processToken) {
+export function ownerSettlementAccepted(run, processToken, attempt) {
     return (run.state === 'asked' || run.state === 'finished')
-        && (processToken === undefined || run.processToken === processToken);
+        && (processToken === undefined || run.processToken === processToken)
+        && (!attempt || run.processToken === attempt.processToken && run.startedAt === attempt.startedAt && (run.resumedAt ?? null) === attempt.resumedAt);
 }
 /** What the record says a run is now, and at what level. Read only to say the
  *  right sentence about something that has already happened; nothing branches on
@@ -722,7 +918,7 @@ export function ownerSettlementAccepted(run, processToken) {
 async function runNow(client, runId) {
     const runs = await returned(client
         .from('panel3_runs')
-        .select('state, level, process_token, card:panel3_cards!panel3_runs_card_id_fkey(conversation_run_id)')
+        .select('state, level, process_token, started_at, resumed_at, card:panel3_cards!panel3_runs_card_id_fkey(conversation_run_id)')
         .eq('id', runId), 'read', `the state of run ${runId}`);
     const run = runs[0];
     return run
@@ -730,9 +926,9 @@ async function runNow(client, runId) {
             state: run.state,
             level: run.level,
             conversationOwnerId: run.card?.conversation_run_id ?? null,
-            processToken: run.process_token,
+            processToken: run.process_token, startedAt: run.started_at, resumedAt: run.resumed_at,
         }
-        : { state: 'no longer on the record', level: null, conversationOwnerId: null, processToken: null };
+        : { state: 'no longer on the record', level: null, conversationOwnerId: null, processToken: null, startedAt: null, resumedAt: null };
 }
 /**
  * A run whose process failed, ended with the reason ON ITS OWN COLUMN, and its
@@ -828,76 +1024,83 @@ export async function settingsForRun(client, runId) {
  * the level is what tells it how a run of this shape ends.
  */
 async function answerCard(client, tools, machineId, cardId, turns) {
-    const runId = turns[0].run_id;
-    /* BEFORE THE SPAWN, AND ITS FAILURE IS THE SPAWN'S FAILURE. The receipts are
-       part of what the agent is sent, so a read that fails must not be papered
-       over with an empty list: that reads as a card that has made nothing, which
-       is how an agent creates a second epic beside the one it cannot see. The
-       attachments read carries the same rule: a failed read here must not read
-       as "nothing is attached", which is a different card than the one that was
-       actually sent. */
-    /* ═══ AND A FAILURE HERE ENDS THE RUN, RATHER THAN LEAVING IT RUNNING WITH NO
-       PROCESS. ═══ The take already wrote the run row in the statement that leased
-       the turns, so a throw between here and `startAgent` leaves a run reading
-       `running` with a null pid and nothing on stderr the person can see.
-       `recoverStranded` then reads that as a machine that went away, hands the
-       message back, and `panel3_take_turns` leases it to A BRAND NEW RUN whose
-       attempts start again at one — so a permanent failure, such as a read this
-       build cannot make against the current schema, repeats forever while the card
-       says Working and never says why. This is the sixth of `endRun`'s endings and
-       the last one that was missing: `resumeRun` and `startRearmed` already end
-       their two post-claim failures this way for exactly this reason.
-       THE REASON IS SHAREABLE. All three reads are `returned()` calls against the
-       database, whose messages name tables and columns and never a local path, so
-       constraint 6 is satisfied without a level fork here. */
-    let brief;
-    /* WHERE IT RUNS AND WHAT IT IS TOLD ABOUT THE CODEBASES, THROUGH THE SAME
-       SEAM AS EVERY OTHER SPAWN. A level 1 run works in an empty directory of the
-       user's own, and it is the fifth start site rather than a special case: the
-       generated git block reaches every level, and one place resolving it is what
-       makes that true without four copies of the read. */
-    let where;
-    /* THE MANDATE IS READ IN THE SAME WINDOW AND UNDER THE SAME RULE. A launcher
-       is an agent like any other and gets the project's standing rules before it
-       decides anything, and a read that fails must not read as "this project has
-       no rules" — that is a different project than the one the person is on. So it
-       joins the three reads above inside this ending rather than beside it. */
-    let rules;
-    let settings;
-    try {
-        brief = briefFor(turns[0].card_title, turns, await receiptsFor(client, cardId), await attachmentsFor(client, cardId), await codebasesForRun(client, runId));
-        rules = await standingRulesFor(client, runId);
-        settings = await settingsForRun(client, runId);
-        where = await workingDirectory(client, runId, LEVEL, false);
-    }
-    catch (error) {
-        const why = error instanceof Error ? error.message : String(error);
-        await endRun(client, LEVEL, runId, cardId, why);
-        throw new Error(`NO AGENT IS RUNNING: ${why}`);
-    }
-    /* ═══ THE RUN ID IS ON THE URL, AND THAT IS THE WHOLE OF WHAT THE AGENT IS
-       TOLD ABOUT ITS OWN STANDING. ═══ The tools server reads the level off the
-       run row this id names, so the daemon does not tell the child what it may do
-       and the child has nothing to claim. `LEVEL` below decides argv only — which
-       of the harness's own tools the process gets — and the two can never disagree
-       about the record, because only one of them consults it. */
-    /* AN EMPTY DIRECTORY OF THE USER'S OWN, because level 1 has no code tool to
-       use a real one with, and the daemon's inherited cwd under a launchd login
-       item is the filesystem root. */
-    const started = startAgent(withStandingRules(rules, brief, where.block), LEVEL, tools.urlFor(runId), where.cwd, undefined, settings);
-    out(`run      ${runId}  level ${LEVEL}  ${started.pid ? `pid ${started.pid}` : 'no process'}`);
+    const preparation = tools.work?.prepare(turns[0].run_id);
     try {
-        /* THE BRIEF, NOT WHAT THE PROCESS WAS HANDED. The rules are current at the
-           activation and the brief is immutable, so storing the composed string
-           would freeze one inside the other and every respawn would replay it. */
-        await recordProcess(client, runId, started.pid, brief);
+        const runId = turns[0].run_id;
+        const attempt = capturedPanelAttempt(turns, runId, tools.work);
+        /* BEFORE THE SPAWN, AND ITS FAILURE IS THE SPAWN'S FAILURE. The receipts are
+           part of what the agent is sent, so a read that fails must not be papered
+           over with an empty list: that reads as a card that has made nothing, which
+           is how an agent creates a second epic beside the one it cannot see. The
+           attachments read carries the same rule: a failed read here must not read
+           as "nothing is attached", which is a different card than the one that was
+           actually sent. */
+        /* ═══ AND A FAILURE HERE ENDS THE RUN, RATHER THAN LEAVING IT RUNNING WITH NO
+           PROCESS. ═══ The take already wrote the run row in the statement that leased
+           the turns, so a throw between here and `startAgent` leaves a run reading
+           `running` with a null pid and nothing on stderr the person can see.
+           `recoverStranded` then reads that as a machine that went away, hands the
+           message back, and `panel3_take_turns` leases it to A BRAND NEW RUN whose
+           attempts start again at one — so a permanent failure, such as a read this
+           build cannot make against the current schema, repeats forever while the card
+           says Working and never says why. This is the sixth of `endRun`'s endings and
+           the last one that was missing: `resumeRun` and `startRearmed` already end
+           their two post-claim failures this way for exactly this reason.
+           THE REASON IS SHAREABLE. All three reads are `returned()` calls against the
+           database, whose messages name tables and columns and never a local path, so
+           constraint 6 is satisfied without a level fork here. */
+        let brief;
+        /* WHERE IT RUNS AND WHAT IT IS TOLD ABOUT THE CODEBASES, THROUGH THE SAME
+           SEAM AS EVERY OTHER SPAWN. A level 1 run works in an empty directory of the
+           user's own, and it is the fifth start site rather than a special case: the
+           generated git block reaches every level, and one place resolving it is what
+           makes that true without four copies of the read. */
+        let where;
+        /* THE MANDATE IS READ IN THE SAME WINDOW AND UNDER THE SAME RULE. A launcher
+           is an agent like any other and gets the project's standing rules before it
+           decides anything, and a read that fails must not read as "this project has
+           no rules" — that is a different project than the one the person is on. So it
+           joins the three reads above inside this ending rather than beside it. */
+        let rules;
+        let settings;
+        try {
+            brief = briefFor(turns[0].card_title, turns, await receiptsFor(client, cardId), await attachmentsFor(client, cardId), await codebasesForRun(client, runId));
+            rules = await standingRulesFor(client, runId);
+            settings = await settingsForRun(client, runId);
+            where = await workingDirectory(client, runId, LEVEL, false);
+        }
+        catch (error) {
+            const why = error instanceof Error ? error.message : String(error);
+            await endRun(client, LEVEL, runId, cardId, why, attempt);
+            throw new Error(`NO AGENT IS RUNNING: ${why}`);
+        }
+        /* ═══ THE RUN ID IS ON THE URL, AND THAT IS THE WHOLE OF WHAT THE AGENT IS
+           TOLD ABOUT ITS OWN STANDING. ═══ The tools server reads the level off the
+           run row this id names, so the daemon does not tell the child what it may do
+           and the child has nothing to claim. `LEVEL` below decides argv only — which
+           of the harness's own tools the process gets — and the two can never disagree
+           about the record, because only one of them consults it. */
+        /* AN EMPTY DIRECTORY OF THE USER'S OWN, because level 1 has no code tool to
+           use a real one with, and the daemon's inherited cwd under a launchd login
+           item is the filesystem root. */
+        const started = await startTrackedAgent(client, runId, preparation, tools.work, attempt, withStandingRules(rules, brief, where.block), LEVEL, tools.urlFor(runId), where.cwd, undefined, settings);
+        out(`run      ${runId}  level ${LEVEL}  ${started.pid ? `pid ${started.pid}` : 'no process'}`);
+        try {
+            /* THE BRIEF, NOT WHAT THE PROCESS WAS HANDED. The rules are current at the
+               activation and the brief is immutable, so storing the composed string
+               would freeze one inside the other and every respawn would replay it. */
+            await recordProcess(client, runId, started.pid, brief, undefined, started.attempt);
+        }
+        catch (error) {
+            // Said, not fatal. See `recordProcess` for what this costs and why the
+            // agent is not killed over it.
+            said(`${error instanceof Error ? error.message : String(error)} (the run is still going)`);
+        }
+        return settle(client, tools, machineId, LEVEL, runId, cardId, started, false);
     }
-    catch (error) {
-        // Said, not fatal. See `recordProcess` for what this costs and why the
-        // agent is not killed over it.
-        said(`${error instanceof Error ? error.message : String(error)} (the run is still going)`);
+    finally {
+        preparation?.finish();
     }
-    return settle(client, tools, machineId, LEVEL, runId, cardId, started, false);
 }
 /**
  * WHICH PROJECT A RUN'S CARD IS FILED UNDER, or null when the card has none.
@@ -1224,92 +1427,106 @@ async function workingDirectory(client, runId, level, isOwner, knownCodebase) {
  * Then the row, then the process, then the pid — constraint 8, in the only order
  * that satisfies it.
  */
-async function startChild(client, tools, machineId, parentRunId, brief, codebase, parentProcessToken, choice = {}) {
-    const { data, error } = await client.rpc('panel3_dispatch', {
-        p_parent_run_id: parentRunId,
-        p_brief: brief,
-        p_machine_id: machineId,
-        p_codebase_id: codebase?.id ?? null,
-        p_codebase_label: codebase?.name ?? null,
-        p_process_token: parentProcessToken ?? null,
-        p_model: choice.model ?? null,
-        p_effort: choice.effort ?? null,
-    });
-    if (error)
-        throw new Error(`could not start an agent under run ${parentRunId}: ${readableWriteError(error.message)}`);
-    const row = data?.[0];
-    if (!row) {
-        /* NOTHING WAS WRITTEN AND NOTHING IS RUNNING, and the two reasons are said
-           together because the caller cannot tell them apart from here and both mean
-           the same thing to it. */
-        throw new Error(`NO AGENT WAS STARTED and nothing was written: run ${parentRunId} has ended, is already as `
-            + 'deep as anything may be sent from, or this conversation already has its owner. Exit now.');
-    }
-    if (row.run_level !== 2 && row.run_level !== 3) {
-        /* UNREACHABLE, AND STILL SETTLED. `panel3_dispatch` writes `parent.level + 1`
-           from a parent it has just checked is below 3, so there is no level here
-           this cannot spawn. If that ever stops being true, the row exists and
-           nothing will ever start for it, and leaving it `running` would make a
-           recovery sweep wait out the pid grace window to conclude what is already
-           known. */
-        const why = `run ${row.run_id} was written at level ${row.run_level}, which cannot be spawned`;
-        await giveUp(client, row.run_id, why, row.process_token ?? undefined);
-        throw new Error(why);
-    }
-    const level = row.run_level;
-    let where;
-    let prompt;
-    let pictures;
-    /* READ AGAINST THE CHILD'S OWN RUN ROW, NOT THE PARENT'S. The row already
-       exists (`panel3_dispatch` wrote it above) and it carries this child's
-       codebase, which is what decides which codebase-scoped rules it is under. */
-    let rules;
-    let settings;
-    try {
-        where = await workingDirectory(client, row.run_id, level, level === 2, codebase);
-        prompt = level === 2
-            ? await initialOwnerPrompt(client, row.run_card_id, parentRunId, brief)
-            : brief;
-        rules = await standingRulesFor(client, row.run_id);
-        settings = await settingsForRun(client, row.run_id);
-        /* Inside this site's own try, for `standingRulesFor`'s reason: a failure to
-           assemble what the agent needs ends the run the way this path already ends
-           runs, rather than starting a process that is missing it. */
-        pictures = await picturesOnDisk(client, row.run_card_id, where, level);
-    }
-    catch (error) {
-        const why = error instanceof Error ? error.message : String(error);
-        await giveUp(client, row.run_id, why, row.process_token ?? undefined);
-        throw new Error(`NO AGENT IS RUNNING: ${why}`);
-    }
-    const processToken = row.process_token ?? undefined;
-    const isOwner = level === 2;
-    const started = startAgent(withStandingRules(rules, prompt, where.block, [], pictures), level, tools.urlFor(row.run_id, processToken), where.cwd, isOwner ? { ownerId: row.run_id } : undefined, settings);
-    if (started.pid === null) {
-        /* THERE IS A ROW AND THERE IS NO PROCESS, which is the one shape the record
-           must never be left in quietly. The answer is already settled — nothing ran
-           — so the reason is read off it, the run is ended with that reason on it,
-           and the tool call fails saying no agent was started. */
-        const answer = await started.answered;
-        const reason = answer.ok ? 'the process ended before it could be identified' : answer.reason;
-        await giveUp(client, row.run_id, reason, processToken);
-        throw new Error(`NO AGENT IS RUNNING: ${reason}`);
-    }
-    out(`dispatch run ${row.run_id}  level ${level}  under ${parentRunId}  pid ${started.pid}`);
+async function startChild(client, tools, machineId, parentRunId, brief, codebase, parentProcessToken, choice = {}, recovered) {
+    let claimOperationId;
+    const preparation = tools.work?.prepare();
     try {
-        await recordProcess(client, row.run_id, started.pid, undefined, processToken);
+        const response = recovered ?? await panelClaim(client, tools.work, 'panel3_dispatch', {
+            p_parent_run_id: parentRunId,
+            p_brief: brief,
+            p_machine_id: machineId,
+            p_codebase_id: codebase?.id ?? null,
+            p_codebase_label: codebase?.name ?? null,
+            p_process_token: parentProcessToken ?? null,
+            p_model: choice.model ?? null,
+            p_effort: choice.effort ?? null,
+        });
+        const { data, error, operationId } = response;
+        claimOperationId = operationId;
+        if (error)
+            throw new Error(`could not start an agent under run ${parentRunId}: ${readableWriteError(error.message)}`);
+        const row = data?.[0];
+        if (!row) {
+            /* NOTHING WAS WRITTEN AND NOTHING IS RUNNING, and the two reasons are said
+               together because the caller cannot tell them apart from here and both mean
+               the same thing to it. */
+            throw new Error(`NO AGENT WAS STARTED and nothing was written: run ${parentRunId} has ended, is already as `
+                + 'deep as anything may be sent from, or this conversation already has its owner. Exit now.');
+        }
+        const attempt = capturedPanelAttempt(data ?? [], row.run_id, tools.work);
+        if (row.run_level !== 2 && row.run_level !== 3) {
+            /* UNREACHABLE, AND STILL SETTLED. `panel3_dispatch` writes `parent.level + 1`
+               from a parent it has just checked is below 3, so there is no level here
+               this cannot spawn. If that ever stops being true, the row exists and
+               nothing will ever start for it, and leaving it `running` would make a
+               recovery sweep wait out the pid grace window to conclude what is already
+               known. */
+            const why = `run ${row.run_id} was written at level ${row.run_level}, which cannot be spawned`;
+            await giveUp(client, row.run_id, why, row.process_token ?? undefined, attempt);
+            throw new Error(why);
+        }
+        const level = row.run_level;
+        let where;
+        let prompt;
+        let pictures;
+        /* READ AGAINST THE CHILD'S OWN RUN ROW, NOT THE PARENT'S. The row already
+           exists (`panel3_dispatch` wrote it above) and it carries this child's
+           codebase, which is what decides which codebase-scoped rules it is under. */
+        let rules;
+        let settings;
+        try {
+            where = await workingDirectory(client, row.run_id, level, level === 2, codebase);
+            prompt = level === 2
+                ? await initialOwnerPrompt(client, row.run_card_id, parentRunId, brief)
+                : brief;
+            rules = await standingRulesFor(client, row.run_id);
+            settings = await settingsForRun(client, row.run_id);
+            /* Inside this site's own try, for `standingRulesFor`'s reason: a failure to
+               assemble what the agent needs ends the run the way this path already ends
+               runs, rather than starting a process that is missing it. */
+            pictures = await picturesOnDisk(client, row.run_card_id, where, level);
+        }
+        catch (error) {
+            const why = error instanceof Error ? error.message : String(error);
+            await giveUp(client, row.run_id, why, row.process_token ?? undefined, attempt);
+            throw new Error(`NO AGENT IS RUNNING: ${why}`);
+        }
+        const processToken = row.process_token ?? undefined;
+        const isOwner = level === 2;
+        const started = await startTrackedAgent(client, row.run_id, preparation, tools.work, attempt, withStandingRules(rules, prompt, where.block, [], pictures), level, tools.urlFor(row.run_id, processToken), where.cwd, isOwner ? { ownerId: row.run_id } : undefined, settings);
+        if (started.pid === null) {
+            if (started.interrupted?.())
+                throw new Error('Work was interrupted by the service command.');
+            /* THERE IS A ROW AND THERE IS NO PROCESS, which is the one shape the record
+               must never be left in quietly. The answer is already settled — nothing ran
+               — so the reason is read off it, the run is ended with that reason on it,
+               and the tool call fails saying no agent was started. */
+            const answer = await started.answered;
+            const reason = answer.ok ? 'the process ended before it could be identified' : answer.reason;
+            await giveUp(client, row.run_id, reason, processToken, attempt);
+            throw new Error(`NO AGENT IS RUNNING: ${reason}`);
+        }
+        out(`dispatch run ${row.run_id}  level ${level}  under ${parentRunId}  pid ${started.pid}`);
+        try {
+            await recordProcess(client, row.run_id, started.pid, undefined, processToken, started.attempt);
+        }
+        catch (error) {
+            // Said, not fatal, exactly as at level 1: the agent is running and killing
+            // it over a bookkeeping write would cost the user the work.
+            said(`${error instanceof Error ? error.message : String(error)} (the run is still going)`);
+        }
+        return {
+            runId: row.run_id,
+            settled: settle(client, tools, machineId, level, row.run_id, row.run_card_id, started, true, processToken, isOwner && processToken
+                ? ownerSessionLifecycle(started, row.run_id, settings.harness ?? harness(), processToken)
+                : undefined),
+        };
     }
-    catch (error) {
-        // Said, not fatal, exactly as at level 1: the agent is running and killing
-        // it over a bookkeeping write would cost the user the work.
-        said(`${error instanceof Error ? error.message : String(error)} (the run is still going)`);
+    finally {
+        preparation?.finish();
+        if (claimOperationId)
+            tools.work?.finishRpcs([claimOperationId]);
     }
-    return {
-        runId: row.run_id,
-        settled: settle(client, tools, machineId, level, row.run_id, row.run_card_id, started, true, processToken, isOwner && processToken
-            ? ownerSessionLifecycle(started, row.run_id, settings.harness ?? harness(), processToken)
-            : undefined),
-    };
 }
 /**
  * HOW MANY PROCESSES HAVE BEEN STARTED FOR THIS RUN, counting the first.
@@ -1377,9 +1594,22 @@ async function attemptsSoFar(client, runId) {
  * Returns whether THIS call is what ended it. False is a fact about the record,
  * not a failure: the run had already ended, and the caller says so.
  */
-async function endRun(client, level, runId, cardId, why) {
+async function endRun(client, level, runId, cardId, why, attempt, failureKind) {
     if (level !== 1)
-        return (await giveUp(client, runId, why)) !== null;
+        return (await giveUp(client, runId, why, undefined, attempt, failureKind)) !== null;
+    if (attempt) {
+        const { data, error } = await client.rpc('panel3_end_run', {
+            p_run_id: runId, p_reason: why, p_process_token: attempt.processToken,
+            p_failure_kind: failureKind ?? null,
+            p_expected_attempt: { started_at: attempt.startedAt, resumed_at: attempt.resumedAt },
+        });
+        if (error)
+            throw new Error(`could not end run ${runId}: ${error.message}`);
+        if (typeof data !== 'boolean')
+            throw new Error(`could not end run ${runId}: no ending was acknowledged`);
+        forgetSecrets(runId);
+        return data;
+    }
     /* ═══ THE RUN FIRST, AND THE CARD ONLY IF THIS RUN WAS STILL THE CARD'S TO
        FAIL. ═══
        The card used to be written first, and the argument for that was a daemon
@@ -1464,6 +1694,13 @@ function ownerSessionLifecycle(started, ownerId, ownerHarness, processToken, exp
 }
 function settle(client, tools, machineId, level, runId, cardId, started, speaksToTheCard = true, processToken, ownerSession) {
     return started.answered.then(async (answer) => {
+        if (started.interrupted?.() || started.preparationFailed?.())
+            return;
+        if (!answer.ok)
+            answer = { ...answer, reason: failureMessage(started.attempt?.harness ?? harness(), answer.failureKind ?? 'unknown') };
+        started.deferOutcome?.({ surface: 'panel', ok: answer.ok,
+            text: answer.ok && speaksToTheCard ? redactSecrets(processToken === undefined ? runId : `${runId}:${processToken}`, answer.text) : null,
+            reason: answer.ok ? '' : answer.reason, failureKind: answer.ok ? undefined : answer.failureKind, level });
         /* ═══ A RUN THAT STOPPED TO ASK DID NOT DIE, WHATEVER THE HARNESS PRINTED
            ON ITS WAY OUT. ═══
     
@@ -1488,12 +1725,20 @@ function settle(client, tools, machineId, level, runId, cardId, started, speaksT
            into an ordinary ending, and then handed to `writeAnswer` — which already
            owns this case and already prints its sentence — rather than to a second
            ending written here beside it. */
-        if (!answer.ok) {
+        const observe = (authenticated) => {
+            const selected = started.attempt?.harness;
+            if (selected)
+                tools.work?.observeHarness(selected, authenticated ? 'authenticated' : 'sign-in-required', authenticated ? 'dispatch-success' : 'provider-rejected');
+        };
+        if (!answer.ok && answer.failureKind !== 'authentication') {
             const run = await runNow(client, runId);
             if (run.state === 'asked') {
-                const accepted = await writeAnswer(client, runId, cardId, null, processToken);
-                if (accepted)
+                started.deferOutcome?.({ surface: 'panel', ok: true, text: null, reason: '', level });
+                const accepted = await writeAnswer(client, runId, cardId, null, processToken, started.attempt);
+                if (accepted) {
+                    observe(true);
                     await ownerSession?.established();
+                }
                 else
                     await ownerSession?.failed();
                 return;
@@ -1503,7 +1748,9 @@ function settle(client, tools, machineId, level, runId, cardId, started, speaksT
                exit cleanly without an agent message after the tool succeeds. The
                record, not prose the launcher was told not to write, decides success. */
             if (level === 1 && run.conversationOwnerId !== null) {
-                await writeAnswer(client, runId, cardId, null, processToken);
+                started.deferOutcome?.({ surface: 'panel', ok: true, text: null, reason: '', level });
+                if (await writeAnswer(client, runId, cardId, null, processToken, started.attempt))
+                    observe(true);
                 return;
             }
         }
@@ -1514,7 +1761,7 @@ function settle(client, tools, machineId, level, runId, cardId, started, speaksT
                Repeating an invalid model/effort request cannot repair it. Unknown
                process deaths retain the existing recovery policy. */
             const attempts = await attemptsSoFar(client, runId);
-            if (answer.retryable !== false && started.pid !== null && attempts < MAX_ATTEMPTS) {
+            if (answer.retryable === true && started.pid !== null && attempts < MAX_ATTEMPTS) {
                 out(`retry    run ${runId}  attempt ${attempts} of ${MAX_ATTEMPTS} died: ${answer.reason}`);
                 const again = processToken === undefined
                     ? await resumeRun(client, tools, machineId, runId, started.pid)
@@ -1552,8 +1799,10 @@ function settle(client, tools, machineId, level, runId, cardId, started, speaksT
                than two. */
             const why = attempts > 1 ? `${answer.reason} (after ${attempts} attempts)` : answer.reason;
             const ended = processToken === undefined
-                ? await endRun(client, level, runId, cardId, why)
-                : (await giveUp(client, runId, why, processToken)) !== null;
+                ? await endRun(client, level, runId, cardId, why, started.attempt, answer.failureKind)
+                : (await giveUp(client, runId, why, processToken, started.attempt, answer.failureKind)) !== null;
+            if (ended && answer.failureKind === 'authentication')
+                observe(false);
             if (!ended) {
                 /* IT WAS ALREADY SETTLED, by recovery, which decided this process was
                    gone before it said so itself, or by the person's Stop. Nothing was
@@ -1570,12 +1819,14 @@ function settle(client, tools, machineId, level, runId, cardId, started, speaksT
         /* ═══ ITS OWN WORDS, ONTO THE CARD, THROUGH THE SAME STATEMENT EVERY LEVEL
            USES. ═══ Nothing reads them, nothing shortens them and nothing waits to
            approve them: ux.md's "whoever did the work writes the answer". */
-        const accepted = await writeAnswer(client, runId, cardId, speaksToTheCard ? answer.text : null, processToken);
-        if (accepted)
+        const accepted = await writeAnswer(client, runId, cardId, speaksToTheCard ? answer.text : null, processToken, started.attempt);
+        if (accepted) {
+            observe(true);
             await ownerSession?.established();
+        }
         else
             await ownerSession?.failed();
-    });
+    }).then(() => { started.acknowledgeOutcome?.(); started.completed?.(); });
 }
 /**
  * ═══ ONE RUN, STARTED AGAIN AS ITSELF, WITH WHAT IT WAS SENT AND WHAT IT HAD
@@ -1633,13 +1884,13 @@ function settle(client, tools, machineId, level, runId, cardId, started, speaksT
  * the record refuses a fourth, and the caller is the one that knows what to say
  * about the failure it was holding.
  */
-async function resumeRun(client, tools, machineId, runId, afterPid) {
+async function resumeRun(client, tools, machineId, runId, afterPid, recovered) {
     /* ═══ THE SWEEP CHECKS BEFORE THE CLAIM AND THE RETRY CANNOT, AND `afterPid`
        IS THE WHOLE OF WHAT DECIDES IT. ═══ Said once, here. See the header for
        both halves of the argument: a machine with no checkout must not take a run
        it cannot start, and the level a retry needs the answer for is not known
        until the claim returns.
-  
+       *
        ═══ IT IS THE EXISTENCE CHECK AND NOTHING MORE, WHICH IS WHAT CHANGED IN
        worktrees-8. ═══ Resolving the working copy now CREATES a branch, a folder
        and a row write, and every poll tick that loses the claim race would leave
@@ -1648,126 +1899,139 @@ async function resumeRun(client, tools, machineId, runId, afterPid) {
        this position was ever asking, and the copy is made after the claim. */
     if (afterPid === null)
         checkoutForCodebase(await codebaseOfRun(client, runId), hostname());
-    const { data, error } = await client.rpc('panel3_resume', {
-        p_run_id: runId,
-        p_machine_id: machineId,
-        p_after_pid: afterPid,
-    });
-    if (error)
-        throw new Error(`could not start run ${runId} again: ${error.message}`);
-    const claimed = data?.[0];
-    if (!claimed)
-        return null;
-    const level = claimed.run_level === 1 ? 1 : claimed.run_level === 2 ? 2 : 3;
-    if (claimed.run_level !== level) {
-        /* UNREACHABLE, AND STILL SETTLED, exactly as in `startChild`: the level
-           column is checked at three, so there is no level here this cannot spawn.
-           The claim has already happened, so leaving it would strand the run for a
-           whole grace window before anything looked at it again. */
-        const why = `run ${runId} is at level ${claimed.run_level}, which cannot be spawned`;
-        await giveUp(client, runId, why);
-        throw new Error(why);
-    }
-    /* ONE RESOLUTION FOR BOTH PATHS, AFTER THE CLAIM. It used to fork on whether
-       the sweep had already resolved a folder before the claim; since the copy is
-       the card's own and making it writes, both paths make it here, in the branch
-       that can end the run when it cannot be made. */
-    let where;
-    try {
-        where = await workingDirectory(client, runId, level, false);
-    }
-    catch (error) {
-        /* ═══ THE REASON IS WRITTEN TO THE DATABASE, SO IT MAY NOT CARRY A PATH.
-           ═══ Constraint 6, and `startRearmed`'s own handling of the same two
-           calls: `worktreeForCard()` is already careful about this and says so;
-           `scratchDir()` is not, because it is `mkdirSync`, whose EACCES and
-           ENOTDIR messages name the directory they failed on. So the machine's own
-           error is kept for stderr and the record is told only what is true and
-           shareable. */
-        const stderrOnly = error instanceof Error ? error.message : String(error);
-        const why = level === 1
-            ? 'this machine could not make the empty directory this runs in'
-            : stderrOnly;
-        /* ═══ AND IT ENDS THE WAY A RUN OF THIS LEVEL ENDS. ═══ It was
-           `panel3_give_up` outright, which was right while only a dispatched run
-           could reach this function and is a leak now that the retry brings level
-           1 here: handing the person's message back mints a new run with its
-           attempts at one, which is the bound the retry is under, undone by the
-           one path that could not start. See `endRun`. */
-        await endRun(client, level, runId, claimed.run_card_id, why);
-        throw new Error(`NO AGENT IS RUNNING: ${level === 1 ? stderrOnly : why}`);
-    }
-    /* WHAT IT SENT OTHERS TO DO, FROM THE RECORD. Level 3 has no `dispatch`, so it
-       has no children to have: null says that, where an empty list would say it
-       chose to send nobody.
-  
-       ═══ AND LEVEL 1 HAS THEM TOO, WHICH ONLY THE RETRY CAN REACH. ═══ This read
-       used to be `level === 2`, which was correct only because nothing at level 1
-       ever got here. Left alone it would hand a coordinator a null child list, and
-       a coordinator that came back to no children dispatches its workers a second
-       time: ux.md's single most expensive failure. `startRearmed` reads it the
-       same way, for the same reason. */
-    const children = level === 3 ? null : await childrenOf(client, runId);
-    /* ═══ READ AGAIN ON EVERY START, WHICH IS THE WHOLE OF CONTRACT POINT 2. ═══
-       A resumed or retried run is handed the rules AS THEY STAND NOW, not as they
-       stood when it first began: a rule edited while the conversation was running
-       governs the rest of it, and a rule deleted while it was running stops
-       applying to it. That is only true because this read happens here rather than
-       once, at the top of the run's life.
-  
-       ═══ AND IT ENDS THE WAY THIS PATH ALREADY ENDS. ═══ The claim has already
-       happened, so a throw here would leave a run reading `running` with no
-       process. `endRun` with the level fork is this path's own ending (see the cwd
-       branch above for why level 1 may not simply be given up on), and the reason
-       is a `returned()` message naming tables and columns, which carries no local
-       path and is therefore shareable. */
-    let rules;
-    let settings;
-    let pictures;
+    let claimOperationId;
+    const preparation = tools.work?.prepare();
     try {
-        rules = await standingRulesFor(client, runId);
-        settings = await settingsForRun(client, runId);
-        /* ═══ WRITTEN AGAIN ON EVERY START, LIKE THE RULES. ═══ A resumed process is
-           a NEW process with a new copy of the working directory, so the files a
-           previous one was handed are not there any more, and the stored brief this
-           path replays cannot carry a path that was not known when it was written. */
-        pictures = await picturesOnDisk(client, claimed.run_card_id, where, level);
-    }
-    catch (error) {
-        const why = error instanceof Error ? error.message : String(error);
-        await endRun(client, level, runId, claimed.run_card_id, why);
-        throw new Error(`NO AGENT IS RUNNING: ${why}`);
-    }
-    const started = startAgent(
-    /* ═══ WHY IT DIED IS WHAT DIFFERS, AND IT IS TOLD THE TRUTH ABOUT IT. ═══
-       `resumePrompt` opens by saying the machine went down, which is true of the
-       sweep and false of a retry: the daemon that watched this harness exit is
-       still running. See `retryPrompt`. */
-    withStandingRules(rules, afterPid === null
-        ? resumePrompt(claimed.run_brief, claimed.run_report, children)
-        : retryPrompt(claimed.run_brief, claimed.run_report, children), where.block, [], pictures), level, tools.urlFor(runId), where.cwd, undefined, settings);
-    if (started.pid === null) {
-        /* THE CLAIM HAPPENED AND NO PROCESS DID, which is the one shape the record
-           must never be left in quietly. Same handling as a dispatch that could not
-           start: the reason is read off the settled answer and the run is ended with
-           it. */
-        const answer = await started.answered;
-        const reason = answer.ok ? 'the process ended before it could be identified' : answer.reason;
-        // The same level fork, for the same reason. See `endRun`.
-        await endRun(client, level, runId, claimed.run_card_id, reason);
-        throw new Error(`NO AGENT IS RUNNING: ${reason}`);
-    }
-    out(`resume   run ${runId}  level ${level}  pid ${started.pid}  `
-        + `${claimed.run_report === null ? 'no report to carry' : 'carrying its report'}`);
-    try {
-        await recordProcess(client, runId, started.pid);
+        const response = recovered ?? await panelClaim(client, tools.work, 'panel3_resume', {
+            p_run_id: runId,
+            p_machine_id: machineId,
+            p_after_pid: afterPid,
+        });
+        const { data, error, operationId } = response;
+        claimOperationId = operationId;
+        if (error)
+            throw new Error(`could not start run ${runId} again: ${error.message}`);
+        const claimed = data?.[0];
+        if (!claimed)
+            return null;
+        const attempt = capturedPanelAttempt(data ?? [], runId, tools.work);
+        const level = claimed.run_level === 1 ? 1 : claimed.run_level === 2 ? 2 : 3;
+        if (claimed.run_level !== level) {
+            /* UNREACHABLE, AND STILL SETTLED, exactly as in `startChild`: the level
+               column is checked at three, so there is no level here this cannot spawn.
+               The claim has already happened, so leaving it would strand the run for a
+               whole grace window before anything looked at it again. */
+            const why = `run ${runId} is at level ${claimed.run_level}, which cannot be spawned`;
+            await giveUp(client, runId, why, undefined, attempt);
+            throw new Error(why);
+        }
+        /* ONE RESOLUTION FOR BOTH PATHS, AFTER THE CLAIM. It used to fork on whether
+           the sweep had already resolved a folder before the claim; since the copy is
+           the card's own and making it writes, both paths make it here, in the branch
+           that can end the run when it cannot be made. */
+        let where;
+        try {
+            where = await workingDirectory(client, runId, level, false);
+        }
+        catch (error) {
+            /* ═══ THE REASON IS WRITTEN TO THE DATABASE, SO IT MAY NOT CARRY A PATH.
+               ═══ Constraint 6, and `startRearmed`'s own handling of the same two
+               calls: `worktreeForCard()` is already careful about this and says so;
+               `scratchDir()` is not, because it is `mkdirSync`, whose EACCES and
+               ENOTDIR messages name the directory they failed on. So the machine's own
+               error is kept for stderr and the record is told only what is true and
+               shareable. */
+            const stderrOnly = error instanceof Error ? error.message : String(error);
+            const why = level === 1
+                ? 'this machine could not make the empty directory this runs in'
+                : stderrOnly;
+            /* ═══ AND IT ENDS THE WAY A RUN OF THIS LEVEL ENDS. ═══ It was
+               `panel3_give_up` outright, which was right while only a dispatched run
+               could reach this function and is a leak now that the retry brings level
+               1 here: handing the person's message back mints a new run with its
+               attempts at one, which is the bound the retry is under, undone by the
+               one path that could not start. See `endRun`. */
+            await endRun(client, level, runId, claimed.run_card_id, why, attempt);
+            throw new Error(`NO AGENT IS RUNNING: ${level === 1 ? stderrOnly : why}`);
+        }
+        /* WHAT IT SENT OTHERS TO DO, FROM THE RECORD. Level 3 has no `dispatch`, so it
+           has no children to have: null says that, where an empty list would say it
+           chose to send nobody.
+           *
+           ═══ AND LEVEL 1 HAS THEM TOO, WHICH ONLY THE RETRY CAN REACH. ═══ This read
+           used to be `level === 2`, which was correct only because nothing at level 1
+           ever got here. Left alone it would hand a coordinator a null child list, and
+           a coordinator that came back to no children dispatches its workers a second
+           time: ux.md's single most expensive failure. `startRearmed` reads it the
+           same way, for the same reason. */
+        const children = level === 3 ? null : await childrenOf(client, runId);
+        /* ═══ READ AGAIN ON EVERY START, WHICH IS THE WHOLE OF CONTRACT POINT 2. ═══
+           A resumed or retried run is handed the rules AS THEY STAND NOW, not as they
+           stood when it first began: a rule edited while the conversation was running
+           governs the rest of it, and a rule deleted while it was running stops
+           applying to it. That is only true because this read happens here rather than
+           once, at the top of the run's life.
+           *
+           ═══ AND IT ENDS THE WAY THIS PATH ALREADY ENDS. ═══ The claim has already
+           happened, so a throw here would leave a run reading `running` with no
+           process. `endRun` with the level fork is this path's own ending (see the cwd
+           branch above for why level 1 may not simply be given up on), and the reason
+           is a `returned()` message naming tables and columns, which carries no local
+           path and is therefore shareable. */
+        let rules;
+        let settings;
+        let pictures;
+        try {
+            rules = await standingRulesFor(client, runId);
+            settings = await settingsForRun(client, runId);
+            /* ═══ WRITTEN AGAIN ON EVERY START, LIKE THE RULES. ═══ A resumed process is
+               a NEW process with a new copy of the working directory, so the files a
+               previous one was handed are not there any more, and the stored brief this
+               path replays cannot carry a path that was not known when it was written. */
+            pictures = await picturesOnDisk(client, claimed.run_card_id, where, level);
+        }
+        catch (error) {
+            const why = error instanceof Error ? error.message : String(error);
+            await endRun(client, level, runId, claimed.run_card_id, why, attempt);
+            throw new Error(`NO AGENT IS RUNNING: ${why}`);
+        }
+        /* ═══ WHY IT DIED IS WHAT DIFFERS, AND IT IS TOLD THE TRUTH ABOUT IT. ═══
+             `resumePrompt` opens by saying the machine went down, which is true of the
+             sweep and false of a retry: the daemon that watched this harness exit is
+             still running. See `retryPrompt`. */
+        const started = await startTrackedAgent(client, runId, preparation, tools.work, attempt, withStandingRules(rules, afterPid === null
+            ? resumePrompt(claimed.run_brief, claimed.run_report, children)
+            : retryPrompt(claimed.run_brief, claimed.run_report, children), where.block, [], pictures), level, tools.urlFor(runId), where.cwd, undefined, settings);
+        if (started.pid === null) {
+            if (started.interrupted?.())
+                throw new Error('Work was interrupted by the service command.');
+            /* THE CLAIM HAPPENED AND NO PROCESS DID, which is the one shape the record
+               must never be left in quietly. Same handling as a dispatch that could not
+               start: the reason is read off the settled answer and the run is ended with
+               it. */
+            const answer = await started.answered;
+            const reason = answer.ok ? 'the process ended before it could be identified' : answer.reason;
+            // The same level fork, for the same reason. See `endRun`.
+            await endRun(client, level, runId, claimed.run_card_id, reason, attempt);
+            throw new Error(`NO AGENT IS RUNNING: ${reason}`);
+        }
+        out(`resume   run ${runId}  level ${level}  pid ${started.pid}  `
+            + `${claimed.run_report === null ? 'no report to carry' : 'carrying its report'}`);
+        try {
+            await recordProcess(client, runId, started.pid, undefined, undefined, started.attempt);
+        }
+        catch (error) {
+            // Said, not fatal, as everywhere else: the agent is running and killing it
+            // over a bookkeeping write would cost the user the work a second time.
+            said(`${error instanceof Error ? error.message : String(error)} (the run is still going)`);
+        }
+        return { settled: settle(client, tools, machineId, level, runId, claimed.run_card_id, started) };
     }
-    catch (error) {
-        // Said, not fatal, as everywhere else: the agent is running and killing it
-        // over a bookkeeping write would cost the user the work a second time.
-        said(`${error instanceof Error ? error.message : String(error)} (the run is still going)`);
+    finally {
+        preparation?.finish();
+        if (claimOperationId)
+            tools.work?.finishRpcs([claimOperationId]);
     }
-    return { settled: settle(client, tools, machineId, level, runId, claimed.run_card_id, started) };
 }
 /**
  * ═══ ONE RUN, STARTED AGAIN BECAUSE SOMETHING IT WAS WAITING ON EXISTS NOW. ═══
@@ -1796,105 +2060,114 @@ async function resumeRun(client, tools, machineId, runId, afterPid) {
  * and in `cs show`, rather than quietly hoping the next poll finds it.
  */
 async function startRearmed(client, tools, machineId, row) {
-    const level = row.run_level === 1 ? 1 : row.run_level === 2 ? 2 : 3;
-    if (row.run_level !== level) {
-        const why = `run ${row.run_id} is at level ${row.run_level}, which cannot be spawned`;
-        await giveUp(client, row.run_id, why);
-        throw new Error(why);
-    }
-    let where;
+    const preparation = tools.work?.prepare(row.run_id);
     try {
-        where = await workingDirectory(client, row.run_id, level, false);
-    }
-    catch (error) {
-        /* ═══ THE REASON IS WRITTEN TO THE DATABASE, SO IT MAY NOT CARRY A PATH.
-           ═══ Constraint 6. `workingCopy()` is already careful about this and says
-           so; `scratchDir()` is not — it is `mkdirSync`, whose EACCES and ENOTDIR
-           messages name the directory they failed on — and `failed_because` is a
-           column `cs show` prints. So the machine's own error is kept for stderr
-           and the record is told only what is true and shareable. */
-        const said = error instanceof Error ? error.message : String(error);
-        const why = level === 1
-            ? 'this machine could not make the empty directory this runs in'
-            : said;
-        // The level fork, which this path needs for the same reason `resumeRun`'s
-        // two do: a re-arm serves level 1, and a level 1 run holds the person's
-        // message. See `endRun`.
-        await endRun(client, level, row.run_id, row.run_card_id, why);
-        throw new Error(`NO AGENT IS RUNNING: ${level === 1 ? said : why}`);
-    }
-    /* WHAT IT SENT OTHERS TO DO AND WHAT THEY WROTE, FROM THE RECORD, AS LATE AS
-       POSSIBLE. Level 3 has no `dispatch`, so it has no children to have: null
-       says that, where an empty list would say it chose to send nobody. */
-    const children = level === 3 ? null : await childrenOf(client, row.run_id);
-    const deliveredArtifact = row.ask_id !== null && row.mine
-        ? await rearmedArtifactAnswer(client, row.ask_id)
-        : null;
-    /* ═══ THE MERGE HAPPENS HERE, OFF THE MARK ON THE ASK, BEFORE THE AGENT THAT
-       WILL SPEAK ABOUT IT IS STARTED. ═══ The re-arm is the last thing that runs
-       before the spawn, which is why it is the only place the outcome can reach
-       the prompt. See `landCardWork`. */
-    const offered = row.ask_id !== null && row.mine
-        ? await landingOffer(client, row.ask_id)
-        : null;
-    const landing = offered === null ? null : landCardWork(where, offered);
-    /* ═══ THREE REASONS, AND THE ROW SAYS WHICH. ═══ No question is ux.md's third
-       re-arm: everybody it sent has finished, and it is started to read them back.
-       `children` cannot be null on that path — only a run with children is ever
-       claimed for it — and the prompt takes the list rather than the maybe-list so
-       that is a fact of the signature rather than of a comment. */
-    const prompt = row.ask_id === null
-        ? readBackPrompt(row.run_brief, row.run_report, children ?? [])
-        : row.mine
-            ? answerPrompt(row.run_brief, row.run_report, children, row.question ?? '', row.answer ?? '', deliveredArtifact, landing)
-            : escalationPrompt(row.run_brief, row.run_report, children, row.ask_id, row.question ?? '');
-    /* CURRENT AT THIS ACTIVATION, exactly as on the resume path, and ended the
-       same way: the re-arm's claim has already happened, so a failure here ends
-       the run with its reason rather than leaving it claimed with no process. */
-    let rules;
-    let settings;
-    let pictures;
-    try {
-        rules = await standingRulesFor(client, row.run_id);
-        settings = await settingsForRun(client, row.run_id);
-        pictures = await picturesOnDisk(client, row.run_card_id, where, level);
-    }
-    catch (error) {
-        const why = error instanceof Error ? error.message : String(error);
-        await endRun(client, level, row.run_id, row.run_card_id, why);
-        throw new Error(`NO AGENT IS RUNNING: ${why}`);
-    }
-    const started = startAgent(withStandingRules(rules, prompt, where.block, [], pictures), level, tools.urlFor(row.run_id), where.cwd, undefined, settings);
-    if (started.pid === null) {
-        const answer = await started.answered;
-        const reason = answer.ok ? 'the process ended before it could be identified' : answer.reason;
-        // The same level fork, for the same reason. See `endRun`.
-        await endRun(client, level, row.run_id, row.run_card_id, reason);
-        throw new Error(`NO AGENT IS RUNNING: ${reason}`);
-    }
-    out(`rearm    run ${row.run_id}  level ${level}  pid ${started.pid}  `
-        + `${row.ask_id === null
-            ? 'to read back everybody it sent'
+        const attempt = capturedPanelAttempt([row], row.run_id, tools.work);
+        const level = row.run_level === 1 ? 1 : row.run_level === 2 ? 2 : 3;
+        if (row.run_level !== level) {
+            const why = `run ${row.run_id} is at level ${row.run_level}, which cannot be spawned`;
+            await giveUp(client, row.run_id, why, undefined, attempt);
+            throw new Error(why);
+        }
+        let where;
+        try {
+            where = await workingDirectory(client, row.run_id, level, false);
+        }
+        catch (error) {
+            /* ═══ THE REASON IS WRITTEN TO THE DATABASE, SO IT MAY NOT CARRY A PATH.
+               ═══ Constraint 6. `workingCopy()` is already careful about this and says
+               so; `scratchDir()` is not — it is `mkdirSync`, whose EACCES and ENOTDIR
+               messages name the directory they failed on — and `failed_because` is a
+               column `cs show` prints. So the machine's own error is kept for stderr
+               and the record is told only what is true and shareable. */
+            const said = error instanceof Error ? error.message : String(error);
+            const why = level === 1
+                ? 'this machine could not make the empty directory this runs in'
+                : said;
+            // The level fork, which this path needs for the same reason `resumeRun`'s
+            // two do: a re-arm serves level 1, and a level 1 run holds the person's
+            // message. See `endRun`.
+            await endRun(client, level, row.run_id, row.run_card_id, why, attempt);
+            throw new Error(`NO AGENT IS RUNNING: ${level === 1 ? said : why}`);
+        }
+        /* WHAT IT SENT OTHERS TO DO AND WHAT THEY WROTE, FROM THE RECORD, AS LATE AS
+           POSSIBLE. Level 3 has no `dispatch`, so it has no children to have: null
+           says that, where an empty list would say it chose to send nobody. */
+        const children = level === 3 ? null : await childrenOf(client, row.run_id);
+        const deliveredArtifact = row.ask_id !== null && row.mine
+            ? await rearmedArtifactAnswer(client, row.ask_id)
+            : null;
+        /* ═══ THE MERGE HAPPENS HERE, OFF THE MARK ON THE ASK, BEFORE THE AGENT THAT
+           WILL SPEAK ABOUT IT IS STARTED. ═══ The re-arm is the last thing that runs
+           before the spawn, which is why it is the only place the outcome can reach
+           the prompt. See `landCardWork`. */
+        const offered = row.ask_id !== null && row.mine
+            ? await landingOffer(client, row.ask_id)
+            : null;
+        const landing = offered === null ? null : landCardWork(where, offered);
+        /* ═══ THREE REASONS, AND THE ROW SAYS WHICH. ═══ No question is ux.md's third
+           re-arm: everybody it sent has finished, and it is started to read them back.
+           `children` cannot be null on that path — only a run with children is ever
+           claimed for it — and the prompt takes the list rather than the maybe-list so
+           that is a fact of the signature rather than of a comment. */
+        const prompt = row.ask_id === null
+            ? readBackPrompt(row.run_brief, row.run_report, children ?? [])
             : row.mine
-                ? 'with the answer to its own question'
-                : 'with a question it has to settle'}`);
-    try {
-        await recordProcess(client, row.run_id, started.pid);
+                ? answerPrompt(row.run_brief, row.run_report, children, row.question ?? '', row.answer ?? '', deliveredArtifact, landing)
+                : escalationPrompt(row.run_brief, row.run_report, children, row.ask_id, row.question ?? '');
+        /* CURRENT AT THIS ACTIVATION, exactly as on the resume path, and ended the
+           same way: the re-arm's claim has already happened, so a failure here ends
+           the run with its reason rather than leaving it claimed with no process. */
+        let rules;
+        let settings;
+        let pictures;
+        try {
+            rules = await standingRulesFor(client, row.run_id);
+            settings = await settingsForRun(client, row.run_id);
+            pictures = await picturesOnDisk(client, row.run_card_id, where, level);
+        }
+        catch (error) {
+            const why = error instanceof Error ? error.message : String(error);
+            await endRun(client, level, row.run_id, row.run_card_id, why, attempt);
+            throw new Error(`NO AGENT IS RUNNING: ${why}`);
+        }
+        const started = await startTrackedAgent(client, row.run_id, preparation, tools.work, attempt, withStandingRules(rules, prompt, where.block, [], pictures), level, tools.urlFor(row.run_id), where.cwd, undefined, settings);
+        if (started.pid === null) {
+            if (started.interrupted?.())
+                throw new Error('Work was interrupted by the service command.');
+            const answer = await started.answered;
+            const reason = answer.ok ? 'the process ended before it could be identified' : answer.reason;
+            // The same level fork, for the same reason. See `endRun`.
+            await endRun(client, level, row.run_id, row.run_card_id, reason, attempt);
+            throw new Error(`NO AGENT IS RUNNING: ${reason}`);
+        }
+        out(`rearm    run ${row.run_id}  level ${level}  pid ${started.pid}  `
+            + `${row.ask_id === null
+                ? 'to read back everybody it sent'
+                : row.mine
+                    ? 'with the answer to its own question'
+                    : 'with a question it has to settle'}`);
+        try {
+            await recordProcess(client, row.run_id, started.pid, undefined, undefined, started.attempt);
+        }
+        catch (error) {
+            // Said, not fatal, as everywhere else: the agent is running and killing it
+            // over a bookkeeping write would cost the user the work.
+            said(`${error instanceof Error ? error.message : String(error)} (the run is still going)`);
+        }
+        /* ═══ AND IT SPEAKS TO THE CARD ONLY IF IT IS DOING THE PERSON'S WORK. ═══
+           Exactly the distinction ux.md draws: a run carrying on with its own work has
+           something to say when it finishes, and a run started only to settle somebody
+           else's question does not. A run started to read back everybody it sent is
+           the first kind and the clearest case of it — that reply IS the answer to the
+           request. See `settle`. */
+        return {
+            settled: settle(client, tools, machineId, level, row.run_id, row.run_card_id, started, row.ask_id === null || !!row.mine),
+        };
+    }
+    finally {
+        preparation?.finish();
     }
-    catch (error) {
-        // Said, not fatal, as everywhere else: the agent is running and killing it
-        // over a bookkeeping write would cost the user the work.
-        said(`${error instanceof Error ? error.message : String(error)} (the run is still going)`);
-    }
-    /* ═══ AND IT SPEAKS TO THE CARD ONLY IF IT IS DOING THE PERSON'S WORK. ═══
-       Exactly the distinction ux.md draws: a run carrying on with its own work has
-       something to say when it finishes, and a run started only to settle somebody
-       else's question does not. A run started to read back everybody it sent is
-       the first kind and the clearest case of it — that reply IS the answer to the
-       request. See `settle`. */
-    return {
-        settled: settle(client, tools, machineId, level, row.run_id, row.run_card_id, started, row.ask_id === null || !!row.mine),
-    };
 }
 /**
  * The runs one run dispatched, AND WHAT EACH OF THEM WROTE, in the words the
@@ -2047,140 +2320,159 @@ export function resumableOwnerSessionId(candidate, machineId, machineHarness) {
         ? local.nativeSessionId
         : undefined;
 }
-async function activateOwner(client, tools, machineId, runId, afterProcessToken = null, afterPid = null) {
-    const candidate = await ownerCandidate(client, runId);
-    if (!candidate)
-        return null;
-    // Existing conversations retain their agent; an explicit hand-back follows
-    // the new selection. Never reuse a native session across different agents.
-    if (candidate.handed_back_at === null && candidate.machine_id !== machineId)
-        return null;
-    const machineHarness = candidate.handed_back_at === null && candidate.harness !== null
-        ? harness({ CTRL_SPC_V3_AGENT: candidate.harness })
-        : await selectedHarness(client, machineId);
-    const resumeSessionId = resumableOwnerSessionId(candidate, machineId, machineHarness);
-    /* ═══ THE EXISTENCE CHECK BEFORE THE CLAIM, AND THE COPY AFTER IT. ═══ This
-       was the whole resolution, which was right while resolving meant reading a
-       folder out of a file. Since worktrees-8 it also CREATES one, and a daemon
-       that lost the activation race would leave a branch and a folder behind for
-       an owner it never activated. The refusal this position exists for — a
-       machine that does not have this codebase must not take the activation —
-       is unchanged, because it is the located checkout that answers it. */
-    if (candidate.codebase_id !== null) {
-        checkoutForCodebase(await codebaseOfRun(client, candidate.id), hostname());
-    }
-    const { data, error } = await client.rpc('panel3_take_owner_activation', {
-        p_run_id: runId,
-        p_machine_id: machineId,
-        p_agent: machineHarness,
-        p_after_process_token: afterProcessToken,
-        p_after_pid: afterPid,
-    });
-    if (error)
-        throw new Error(`could not activate conversation owner ${runId}: ${error.message}`);
-    const claimed = data?.[0];
-    if (!claimed)
-        return null;
-    const [events, children] = await Promise.all([
-        ownerConversation(client, claimed.run_card_id, new Set(claimed.turn_ids ?? [])),
-        ownerChildren(client, runId),
-    ]);
-    const currentArtifactAnswer = deliveredArtifactAnswer(events, claimed);
-    const delivered = claimed.ask_id === null ? null : {
-        id: claimed.ask_id,
-        question: claimed.question ?? '(question unavailable)',
-        answer: claimed.answer,
-        mine: claimed.mine === true,
-        artifactAnswer: currentArtifactAnswer,
-    };
-    /* ═══ AFTER THE CLAIM, SO THE ENDING IS THE ONE THIS PATH HAS. ═══ Every
-       failure below the claim ends the activation with `giveUp` and its process
-       token; a throw above it would merely be an activation that did not happen.
-  
-       ═══ AND IT MATTERS MOST HERE. ═══ This is the owner, which lives for the
-       whole card and whose native session is RESUMED, so it is the one agent that
-       can be running while a person edits or deletes a rule. Reading at every
-       activation is what makes an edit govern the rest of the conversation, and
-       the block's own supersession sentence is what makes a DELETION take effect
-       in a session that still holds the older copy.
-  
-       ═══ AND IT IS BEFORE THE PROMPT SINCE worktrees-8 C1, because the prompt now
-       says what the product DID with the person's answer, and the landing needs
-       the card's copy. Nothing in the prompt depended on it before. */
-    let rules;
-    let settings;
-    /* THE CARD'S COPY IS MADE IN THE SAME WINDOW AND UNDER THE SAME ENDING, for
-       the reason the check above gives: it writes, so it happens after the claim,
-       and a failure to make it is an activation that ends rather than one that
-       sits `running` with no process. */
-    let where;
-    /* ═══ AND WHAT IS ATTACHED, READ IN THE SAME WINDOW AND UNDER THE SAME
-       ENDING. ═══ attaching-after-the-fact-10: a person may attach to a card that
-       is already running, and the owner's brief is immutable, so the only account
-       of attachments it would otherwise get is the one frozen at dispatch. Read
-       at every activation, exactly as the rules are, and for the same reason a
-       failed read ends the activation rather than continuing: "nothing is
-       attached" is a different card from the one the person sent.
-  
-       THE CODEBASE LINES ARE DROPPED. `whatWasAttached` partitions those into a
-       section whose own text says "its one codebase is named separately below",
-       a forward reference to something `workBrief` supplies and an owner
-       activation does not. This block carries the PERSON's attachments; where the
-       owner is working is `where.block`'s answer. */
-    let attached;
-    let pictures;
+async function activateOwner(client, tools, machineId, runId, afterProcessToken = null, afterPid = null, recovered) {
+    let claimOperationId;
+    const preparation = tools.work?.prepare();
     try {
-        where = await ownerDirectory(client, candidate);
-        rules = await standingRulesFor(client, runId);
-        settings = await settingsForRun(client, runId);
-        attached = whatWasAttached((await attachmentsFor(client, claimed.run_card_id))
-            .filter((line) => !line.startsWith('codebase  ')));
-        /* ═══ THE OWNER'S OWN ACTIVATION, WHICH IS WHERE MOST PICTURES ARRIVE. ═══
-           The person sends one and this is the run that reads it. Written on every
-           activation rather than once, so an owner resumed into an existing native
-           conversation is told again about a directory a previous process wrote. */
-        pictures = await picturesOnDisk(client, claimed.run_card_id, where, 2);
-    }
-    catch (error) {
-        const why = error instanceof Error ? error.message : String(error);
-        await giveUp(client, runId, why, claimed.process_token);
-        throw new Error(`NO AGENT IS RUNNING: ${why}`);
-    }
-    /* THE MERGE, OFF THE MARK ON THE ASK, BEFORE THE AGENT THAT WILL SPEAK ABOUT
-       IT IS STARTED. The owner reaches an answer by this route as often as by the
-       re-arm, which is why the artifact answer is read on both and this is too. */
-    const offered = claimed.ask_id !== null && claimed.mine === true
-        ? await landingOffer(client, claimed.ask_id)
-        : null;
-    const landing = offered === null ? null : landCardWork(where, offered);
-    const prompt = resumeSessionId
-        ? ownerContinuationPrompt(claimed.run_brief, claimed.run_report, events, children, delivered, landing)
-        : ownerActivationPrompt(claimed.run_brief, claimed.run_report, events, children, delivered !== null && !delivered.mine
-            ? { id: delivered.id, question: delivered.question }
-            : null, currentArtifactAnswer, 
+        const candidate = await ownerCandidate(client, runId);
+        if (!candidate)
+            return null;
+        // Existing conversations retain their agent; an explicit hand-back follows
+        // the new selection. Never reuse a native session across different agents.
+        if (candidate.handed_back_at === null && candidate.machine_id !== machineId)
+            return null;
+        const machineHarness = candidate.handed_back_at === null && candidate.harness !== null
+            ? harness({ CTRL_SPC_V3_AGENT: candidate.harness })
+            : await selectedHarness(client, machineId);
+        if (recovered?.nativeContext && (recovered.nativeContext.harness !== machineHarness || recovered.nativeContext.processToken !== null && typeof recovered.nativeContext.processToken !== 'string' || recovered.nativeContext.nativeSessionId !== undefined && typeof recovered.nativeContext.nativeSessionId !== 'string'))
+            throw new Error('The saved native conversation context is invalid.');
+        const resumeSessionId = recovered?.nativeContext
+            ? resumableOwnerSessionId({ ...candidate, process_token: recovered.nativeContext.processToken }, machineId, recovered.nativeContext.harness)
+            : resumableOwnerSessionId(candidate, machineId, machineHarness);
+        if (recovered?.nativeContext?.nativeSessionId && resumeSessionId !== recovered.nativeContext.nativeSessionId)
+            throw new Error('The saved native conversation is no longer available for this attempt.');
+        /* ═══ THE EXISTENCE CHECK BEFORE THE CLAIM, AND THE COPY AFTER IT. ═══ This
+           was the whole resolution, which was right while resolving meant reading a
+           folder out of a file. Since worktrees-8 it also CREATES one, and a daemon
+           that lost the activation race would leave a branch and a folder behind for
+           an owner it never activated. The refusal this position exists for — a
+           machine that does not have this codebase must not take the activation —
+           is unchanged, because it is the located checkout that answers it. */
+        if (candidate.codebase_id !== null) {
+            checkoutForCodebase(await codebaseOfRun(client, candidate.id), hostname());
+        }
+        const response = recovered ?? await panelClaim(client, tools.work, 'panel3_take_owner_activation', {
+            p_run_id: runId,
+            p_machine_id: machineId,
+            p_agent: machineHarness,
+            p_after_process_token: afterProcessToken,
+            p_after_pid: afterPid,
+        }, { nativeSessionId: resumeSessionId, processToken: candidate.process_token, harness: machineHarness });
+        const { data, error, operationId } = response;
+        claimOperationId = operationId;
+        if (error)
+            throw new Error(`could not activate conversation owner ${runId}: ${error.message}`);
+        const claimed = data?.[0];
+        if (!claimed)
+            return null;
+        const attempt = capturedPanelAttempt(data ?? [], runId, tools.work);
+        const [events, children] = await Promise.all([
+            ownerConversation(client, claimed.run_card_id, new Set(claimed.turn_ids ?? [])),
+            ownerChildren(client, runId),
+        ]);
+        const currentArtifactAnswer = deliveredArtifactAnswer(events, claimed);
+        const delivered = claimed.ask_id === null ? null : {
+            id: claimed.ask_id,
+            question: claimed.question ?? '(question unavailable)',
+            answer: claimed.answer,
+            mine: claimed.mine === true,
+            artifactAnswer: currentArtifactAnswer,
+        };
+        /* ═══ AFTER THE CLAIM, SO THE ENDING IS THE ONE THIS PATH HAS. ═══ Every
+           failure below the claim ends the activation with `giveUp` and its process
+           token; a throw above it would merely be an activation that did not happen.
+           *
+           ═══ AND IT MATTERS MOST HERE. ═══ This is the owner, which lives for the
+           whole card and whose native session is RESUMED, so it is the one agent that
+           can be running while a person edits or deletes a rule. Reading at every
+           activation is what makes an edit govern the rest of the conversation, and
+           the block's own supersession sentence is what makes a DELETION take effect
+           in a session that still holds the older copy.
+           *
+           ═══ AND IT IS BEFORE THE PROMPT SINCE worktrees-8 C1, because the prompt now
+           says what the product DID with the person's answer, and the landing needs
+           the card's copy. Nothing in the prompt depended on it before. */
+        let rules;
+        let settings;
+        /* THE CARD'S COPY IS MADE IN THE SAME WINDOW AND UNDER THE SAME ENDING, for
+           the reason the check above gives: it writes, so it happens after the claim,
+           and a failure to make it is an activation that ends rather than one that
+           sits `running` with no process. */
+        let where;
+        /* ═══ AND WHAT IS ATTACHED, READ IN THE SAME WINDOW AND UNDER THE SAME
+           ENDING. ═══ attaching-after-the-fact-10: a person may attach to a card that
+           is already running, and the owner's brief is immutable, so the only account
+           of attachments it would otherwise get is the one frozen at dispatch. Read
+           at every activation, exactly as the rules are, and for the same reason a
+           failed read ends the activation rather than continuing: "nothing is
+           attached" is a different card from the one the person sent.
+           *
+           THE CODEBASE LINES ARE DROPPED. `whatWasAttached` partitions those into a
+           section whose own text says "its one codebase is named separately below",
+           a forward reference to something `workBrief` supplies and an owner
+           activation does not. This block carries the PERSON's attachments; where the
+           owner is working is `where.block`'s answer. */
+        let attached;
+        let pictures;
+        try {
+            where = await ownerDirectory(client, candidate);
+            rules = await standingRulesFor(client, runId);
+            settings = await settingsForRun(client, runId);
+            attached = whatWasAttached((await attachmentsFor(client, claimed.run_card_id))
+                .filter((line) => !line.startsWith('codebase  ')));
+            /* ═══ THE OWNER'S OWN ACTIVATION, WHICH IS WHERE MOST PICTURES ARRIVE. ═══
+               The person sends one and this is the run that reads it. Written on every
+               activation rather than once, so an owner resumed into an existing native
+               conversation is told again about a directory a previous process wrote. */
+            pictures = await picturesOnDisk(client, claimed.run_card_id, where, 2);
+        }
+        catch (error) {
+            const why = error instanceof Error ? error.message : String(error);
+            await giveUp(client, runId, why, claimed.process_token, attempt);
+            throw new Error(`NO AGENT IS RUNNING: ${why}`);
+        }
+        /* THE MERGE, OFF THE MARK ON THE ASK, BEFORE THE AGENT THAT WILL SPEAK ABOUT
+           IT IS STARTED. The owner reaches an answer by this route as often as by the
+           re-arm, which is why the artifact answer is read on both and this is too. */
+        const offered = claimed.ask_id !== null && claimed.mine === true
+            ? await landingOffer(client, claimed.ask_id)
+            : null;
+        const landing = offered === null ? null : landCardWork(where, offered);
         /* ═══ A PROCESS OF ITS OWN ENDED BEFORE IT FINISHED. ═══ `afterPid` is the
            fact, and it is non-null on all three paths that follow one: a harness
            that crashed, a machine that went down, and now a person's correction.
            The sentences it adds say what to do and never why, because those three
            are not the same event and `prompt.ts` exists to stop an agent being
            told an untrue reason for its own restart. */
-        afterPid !== null, landing);
-    const started = startAgent(withStandingRules(rules, prompt, where.block, attached, pictures), 2, tools.urlFor(runId, claimed.process_token), where.cwd, { ownerId: runId, ...(resumeSessionId ? { resumeSessionId } : {}) }, settings);
-    if (started.pid === null) {
-        const answer = await started.answered;
-        const reason = answer.ok ? 'the process ended before it could be identified' : answer.reason;
-        await giveUp(client, runId, reason, claimed.process_token);
-        throw new Error(`NO AGENT IS RUNNING: ${reason}`);
-    }
-    try {
-        await recordProcess(client, runId, started.pid, undefined, claimed.process_token);
+        const prompt = resumeSessionId
+            ? ownerContinuationPrompt(claimed.run_brief, claimed.run_report, events, children, delivered, landing)
+            : ownerActivationPrompt(claimed.run_brief, claimed.run_report, events, children, delivered !== null && !delivered.mine
+                ? { id: delivered.id, question: delivered.question }
+                : null, currentArtifactAnswer, afterPid !== null, landing);
+        const started = await startTrackedAgent(client, runId, preparation, tools.work, attempt, withStandingRules(rules, prompt, where.block, attached, pictures), 2, tools.urlFor(runId, claimed.process_token), where.cwd, { ownerId: runId, ...(resumeSessionId ? { resumeSessionId } : {}) }, settings);
+        if (started.pid === null) {
+            if (started.interrupted?.())
+                throw new Error('Work was interrupted by the service command.');
+            const answer = await started.answered;
+            const reason = answer.ok ? 'the process ended before it could be identified' : answer.reason;
+            await giveUp(client, runId, reason, claimed.process_token, attempt);
+            throw new Error(`NO AGENT IS RUNNING: ${reason}`);
+        }
+        try {
+            await recordProcess(client, runId, started.pid, undefined, claimed.process_token, started.attempt);
+        }
+        catch (error) {
+            said(`${error instanceof Error ? error.message : String(error)} (the run is still going)`);
+        }
+        return {
+            settled: settle(client, tools, machineId, 2, runId, claimed.run_card_id, started, true, claimed.process_token, ownerSessionLifecycle(started, runId, machineHarness, claimed.process_token, resumeSessionId)),
+        };
     }
-    catch (error) {
-        said(`${error instanceof Error ? error.message : String(error)} (the run is still going)`);
+    finally {
+        preparation?.finish();
+        if (claimOperationId)
+            tools.work?.finishRpcs([claimOperationId]);
     }
-    return {
-        settled: settle(client, tools, machineId, 2, runId, claimed.run_card_id, started, true, claimed.process_token, ownerSessionLifecycle(started, runId, machineHarness, claimed.process_token, resumeSessionId)),
-    };
 }
 /** The only owner rows the normal poll may try, including an explicit hand-back move.
  *
@@ -2256,7 +2548,8 @@ export function redirectedProcess(candidate, machineId,
 /** The newest unaddressed person turn per card. MAX, never first-seen: a turn
  *  left unaddressed while a question was open would otherwise pin its card
  *  below `resumed_at` for good and nothing on it could ever redirect. */
-waiting, cardId, booted) {
+waiting, cardId, booted, executionHeld = false) {
+    // A dead transport can still own live tools in the durable execution boundary.
     // The claim's own five, mirrored.
     if (candidate.state !== 'running' || candidate.ended_at !== null)
         return null;
@@ -2288,7 +2581,7 @@ waiting, cardId, booted) {
     if (new Date(said).getTime() <= new Date(candidate.resumed_at ?? candidate.started_at).getTime()) {
         return null;
     }
-    return runProcessIsAlive(candidate, booted) ? candidate.pid : null;
+    return executionHeld || runProcessIsAlive(candidate, booted) ? candidate.pid : null;
 }
 export function pendingOwnerSessionWithinGrace(candidate, now = Date.now()) {
     const local = readOwnerSession(candidate.id);
@@ -2331,9 +2624,17 @@ async function takeOwnerActivations(client, tools, machineId, mine, hold) {
            else and there is a dead process, a row still reading `running` and a card
            still saying `working`, with nothing local to retry it. */
         if (mine.has(candidate.id)) {
-            const pid = redirectedProcess({ ...candidate, card_state: candidate.card?.state ?? null }, machineId, waiting, candidate.card_id, bootedAt());
+            const attempt = recoveryAttempt(candidate);
+            const executionHeld = tools.work?.heldAttempt(attempt) ?? false;
+            // A run ID alone cannot authorize stopping a newer activation.
+            if (tools.work && !executionHeld)
+                continue;
+            const pid = redirectedProcess({ ...candidate, card_state: candidate.card?.state ?? null }, machineId, waiting, candidate.card_id, bootedAt(), executionHeld);
             if (pid !== null) {
-                killTree({ pid, kill: (signal) => process.kill(pid, signal) });
+                if (executionHeld)
+                    await tools.work.stopHeldAttempt(attempt);
+                else
+                    killTree({ pid, kill: (signal) => process.kill(pid, signal) });
                 /* ═══ SIGNALLED, NOT KILLED, AND THE WORD IS THE POINT. ═══ `killTree`
                    swallows a refused signal on both platforms, so saying "killed" would
                    claim a death this daemon never observed. A process that survives is
@@ -2344,6 +2645,8 @@ async function takeOwnerActivations(client, tools, machineId, mine, hold) {
             }
             continue;
         }
+        if (tools.work?.heldAttempt(recoveryAttempt(candidate)))
+            continue;
         if (pendingOwnerSessionWithinGrace(candidate))
             continue;
         if (candidate.handed_back_at !== null
@@ -2407,7 +2710,7 @@ function runProcessIsAlive(run, booted) {
  * touched here. A current owner row, live PID, in-flight process, or fresh
  * pid-null claim always defers cleanup. Stable state is removed only after the
  * owner row disappears, becomes terminal, or no longer owns its card. */
-export async function reconcileOwnerSessions(client, machineId, _machineHarness, inFlightOwnerIds = new Set()) {
+export async function reconcileOwnerSessions(client, machineId, _machineHarness, inFlightOwnerIds = new Set(), work) {
     const mappingIds = listOwnerSessionIds();
     const homeIds = listPanel3CodexOwnerHomeIds();
     const all = [...new Set([...mappingIds, ...homeIds])];
@@ -2424,7 +2727,11 @@ export async function reconcileOwnerSessions(client, machineId, _machineHarness,
     for (const id of ids) {
         if (inFlightOwnerIds.has(id))
             continue;
+        if (work?.heldLocalOwner(id))
+            continue;
         const row = byId.get(id);
+        if (row && work?.heldAttempt(recoveryAttempt(row)))
+            continue;
         const localProcessInUse = !!row
             && row.machine_id === machineId
             && ((row.pid !== null && processIsAlive(row.pid))
@@ -2477,10 +2784,10 @@ export async function reconcileOwnerSessions(client, machineId, _machineHarness,
  * the next poll tries again: clearing it after an EPERM would say this machine
  * has no process for a run whose agent is still working.
  */
-async function killStopped(client, machineId) {
+async function killStopped(client, machineId, work) {
     const stopped = await returned(client
         .from('panel3_runs')
-        .select('id, card_id, pid, state, started_at, resumed_at')
+        .select('id, card_id, pid, state, started_at, resumed_at, process_token')
         .eq('machine_id', machineId)
         .in('state', [...ENDED_BY_THE_PERSON, 'finished', 'failed'])
         .not('pid', 'is', null), 'read', 'the runs on this machine that are not coming back');
@@ -2488,7 +2795,16 @@ async function killStopped(client, machineId) {
         return;
     const booted = bootedAt();
     for (const run of stopped) {
-        if (runProcessIsAlive(run, booted)) {
+        let stoppedByOwner = false;
+        if (work?.heldAttempt(recoveryAttempt(run))) {
+            if (!ENDED_BY_THE_PERSON.includes(run.state))
+                continue;
+            // The recorded bridge can be gone while its owned tools still run.
+            // Only the durable owner can confirm that the complete execution ended.
+            await work.stopHeldAttempt(recoveryAttempt(run));
+            stoppedByOwner = true;
+        }
+        if (!stoppedByOwner && runProcessIsAlive(run, booted)) {
             if (!ENDED_BY_THE_PERSON.includes(run.state))
                 continue;
             try {
@@ -2509,15 +2825,18 @@ async function killStopped(client, machineId) {
             continue;
         }
         try {
-            await returned(client
+            let cleared = client
                 .from('panel3_runs')
                 .update({ pid: null })
-                // A finished owner may activate again between this read and write.
-                // Only acknowledge the exact process whose exit was observed.
                 .eq('id', run.id)
                 .eq('pid', run.pid)
-                .in('state', [...ENDED_BY_THE_PERSON, 'finished', 'failed'])
-                .select('id'), 'clear the process id of', `run ${run.id}`);
+                .eq('started_at', run.started_at)
+                .in('state', [...ENDED_BY_THE_PERSON, 'finished', 'failed']);
+            cleared = run.process_token === null ? cleared.is('process_token', null) : cleared.eq('process_token', run.process_token);
+            cleared = run.resumed_at === null ? cleared.is('resumed_at', null) : cleared.eq('resumed_at', run.resumed_at);
+            await returned(
+            // A finished owner may activate again while its old execution closes.
+            cleared.select('id'), 'clear the process id of', `run ${run.id}`);
         }
         catch (error) {
             // Said, not fatal. The kill has already happened; this is bookkeeping, and
@@ -2602,6 +2921,8 @@ async function recoverStranded(client, tools, machineId, mine, hold) {
     for (const run of live) {
         if (mine.has(run.id))
             continue;
+        if (tools.work?.heldAttempt(recoveryAttempt(run)))
+            continue;
         // WHEN THE ATTEMPT NOW RUNNING BEGAN, which is the first one until a resume
         // says otherwise. See the header.
         const startedAt = new Date(run.resumed_at ?? run.started_at).getTime();
@@ -2838,6 +3159,8 @@ export async function takeHandedBack(client, tools, machineId, mine, hold) {
     // ONCE, OUTSIDE THE LOOP. It is a property of this machine, not of a row.
     const booted = bootedAt();
     for (const run of offered) {
+        if (tools.work?.heldAttempt(recoveryAttempt(run)))
+            continue;
         if (mine.has(run.id)) {
             /* THIS DAEMON'S OWN LIVE WORK, OFFERED WHILE IT WAS BUSY BEING QUIET. See
                the header. Said rather than passed over in silence, because a machine
@@ -3028,7 +3351,7 @@ export async function sweepFinishedWorktrees(client) {
 export function clientReader(injected) {
     return typeof injected === 'function' ? injected : () => injected;
 }
-export async function run(args, injected, signal, lifecycle) {
+export async function run(args, injected, signal, lifecycle, work) {
     let once = false;
     for (const arg of args) {
         if (arg === '--once')
@@ -3059,6 +3382,7 @@ export async function run(args, injected, signal, lifecycle) {
     const machineId = getMachineIdentity().id;
     const machineName = hostname();
     let listeningHarness = null;
+    const listeningRoutes = new Set();
     /* THE RUNS THIS PROCESS IS HOLDING RIGHT NOW, so recovery cannot declare its
        own live work dead in the moment before a pid is recorded. It covers THIS
        daemon only, which is why `PID_GRACE_MS` exists for the other ones. Keyed by
@@ -3084,11 +3408,22 @@ export async function run(args, injected, signal, lifecycle) {
        `tools` is referenced inside the callback it is being given, which is safe
        for the plain reason that the callback can only run once a request has
        arrived at a server that by then exists. */
+    if (work && !work.cloudAllowed())
+        throw new Error('Cloud operations are suspended for this sign-in.');
+    if (work)
+        await reconcilePanelInterruptions(current(), machineId, work);
     const tools = await startToolsServer(current(), async (parentRunId, brief, codebase, processToken, choice) => {
-        const child = await startChild(current(), tools, machineId, parentRunId, brief, codebase, processToken, choice);
-        hold(child.runId, child.settled);
-        return { runId: child.runId };
+        const endClaim = work?.beginClaim();
+        try {
+            const child = await startChild(current(), tools, machineId, parentRunId, brief, codebase, processToken, choice);
+            hold(child.runId, child.settled);
+            return { runId: child.runId };
+        }
+        finally {
+            endClaim?.();
+        }
     }, (runId, processToken, action) => recoverLanding(current(), machineId, runId, processToken, action));
+    tools.work = work;
     out(`daemon   machine ${machineId}`);
     out(`tools    ${tools.urlFor('<run-id>')}`);
     out(once ? 'mode     one poll' : `mode     polling every ${POLL_INTERVAL_MS / 1000}s, Ctrl-C to stop`);
@@ -3129,6 +3464,8 @@ export async function run(args, injected, signal, lifecycle) {
             // Restart only at a poll boundary, before any claims, with no live work.
             if (lifecycle && !lifecycle.beforePoll(inFlight.size))
                 break;
+            let endClaim;
+            const claimOperations = [];
             /* ═══ ONE POLL FAILING IS NOT THE DAEMON FAILING. ═══ Every read and write
                here throws on a network or database error, by design (constraint 7), and
                until Slice 4 that threw straight out of `panel3/cli.js run` and exited the process.
@@ -3141,37 +3478,119 @@ export async function run(args, injected, signal, lifecycle) {
                `--once` still fails loudly, because the acceptance harness reads the exit
                code and a swallowed failure there would make a broken suite look green. */
             try {
+                if (work && !work.cloudAllowed()) {
+                    await sleep(POLL_INTERVAL_MS);
+                    continue;
+                }
+                if (work)
+                    await reconcilePanelInterruptions(current(), machineId, work);
+                if (work && !work.allowed()) {
+                    // A successful read proves polling before recovery opens admission.
+                    const { error } = await current().from('panel3_cards').select('id').limit(1);
+                    if (error)
+                        throw error;
+                    lifecycle?.ready();
+                    await sleep(POLL_INTERVAL_MS);
+                    continue;
+                }
+                endClaim = work?.beginClaim();
                 /* ═══ THE USER'S STOP IS HONOURED BEFORE ANYTHING ELSE ON THE POLL. ═══ It
                    is the only thing here that a person is waiting on, and the two takes
                    below can spend the rest of the poll starting agents. Nothing else needs
                    to run first: `panel3_stop_card` has already ended the runs, so recovery
                    cannot see them and neither take can start them. */
-                await killStopped(current(), machineId);
+                await killStopped(current(), machineId, work);
+                for (const claim of work?.recoveredClaims() ?? []) {
+                    const attempts = panelClaimAttempts(claim.result);
+                    const eligible = new Set();
+                    for (const attempt of attempts) {
+                        if (inFlight.has(attempt.runId))
+                            continue;
+                        const pending = work?.claimAttempt(attempt.runId);
+                        if (!pending)
+                            continue; // Preparation or an actual stop already owns it.
+                        const { data, error } = await current().from('panel3_runs')
+                            .select('started_at,resumed_at,process_token,state,ended_at').eq('id', attempt.runId).maybeSingle();
+                        if (error)
+                            throw error;
+                        if (data?.state === 'running' && data.ended_at === null && data.started_at === attempt.startedAt
+                            && (data.resumed_at ?? null) === attempt.resumedAt && (data.process_token ?? null) === attempt.processToken)
+                            eligible.add(attempt.runId);
+                    }
+                    const rows = (claim.result ?? []).filter((row) => eligible.has(row._attempt?.run_id ?? row.run_id));
+                    const response = { data: rows, error: null, operationId: claim.id, nativeContext: claim.args?.nativeContext };
+                    const args = claim.args ?? {};
+                    if (rows.length) {
+                        if (claim.action === 'panel3_take_turns') {
+                            for (const [cardId, turns] of byCard(rows))
+                                hold(turns[0].run_id, answerCard(current(), tools, machineId, cardId, turns));
+                        }
+                        else if (claim.action === 'panel3_take_rearms') {
+                            for (const row of rows) {
+                                const started = await startRearmed(current(), tools, machineId, row);
+                                hold(row.run_id, started.settled);
+                            }
+                        }
+                        else if (claim.action === 'panel3_dispatch') {
+                            const row = rows[0];
+                            const codebase = args.p_codebase_id ? await codebaseOfRun(current(), row.run_id) : null;
+                            const started = await startChild(current(), tools, machineId, String(args.p_parent_run_id), String(args.p_brief), codebase, typeof args.p_process_token === 'string' ? args.p_process_token : undefined, {}, response);
+                            hold(started.runId, started.settled);
+                        }
+                        else if (claim.action === 'panel3_resume') {
+                            const runId = String(args.p_run_id);
+                            const started = await resumeRun(current(), tools, machineId, runId, typeof args.p_after_pid === 'number' ? args.p_after_pid : null, response);
+                            if (started)
+                                hold(runId, started.settled);
+                        }
+                        else if (claim.action === 'panel3_take_owner_activation') {
+                            const runId = String(args.p_run_id);
+                            const started = await activateOwner(current(), tools, machineId, runId, typeof args.p_after_process_token === 'string' ? args.p_after_process_token : null, typeof args.p_after_pid === 'number' ? args.p_after_pid : null, response);
+                            if (started)
+                                hold(runId, started.settled);
+                        }
+                        else
+                            throw new Error('The saved panel claim has an unsupported action.');
+                    }
+                    work?.finishRpcs([claim.id]);
+                }
                 /* Publish readiness before claiming work. A card with an untaken turn reads the same whether a daemon
                    is two seconds away or nobody has one running; this row is the only place
                    the difference exists. It is written before the takes rather than after
                    so that a machine which is up but busy still reads as up. */
-                // Resolve before claiming work. A failed read or missing binary must not
-                // leave the previous agent advertised as ready for new assignments.
-                let machineHarness;
-                try {
-                    machineHarness = await selectedHarness(current(), machineId);
+                const installed = recoveryHarnesses();
+                for (const route of [...listeningRoutes]) {
+                    if (!installed.includes(route)) {
+                        await stopListening(current(), machineId, route);
+                        listeningRoutes.delete(route);
+                    }
                 }
-                catch (error) {
-                    if (listeningHarness !== null) {
-                        await stopListening(current(), machineId, listeningHarness);
-                        listeningHarness = null;
+                // A primary selection failure cannot skip an installed recovery route.
+                for (const route of installed) {
+                    try {
+                        const response = await panelClaim(current(), work, 'panel3_take_turns', { p_machine_id: machineId, p_agent: route, p_recovery_only: true });
+                        if (response.operationId)
+                            claimOperations.push(response.operationId);
+                        const taken = await returned(Promise.resolve(response), 'take', 'explicit authentication recovery');
+                        await sayListening(current(), machineId, machineName, route);
+                        await sayPollingProblem(current(), machineId, route, null);
+                        listeningRoutes.add(route);
+                        for (const [cardId, turns] of byCard(taken))
+                            hold(turns[0].run_id, answerCard(current(), tools, machineId, cardId, turns));
+                    }
+                    catch (error) {
+                        try {
+                            await sayPollingProblem(current(), machineId, route, 'poll_failed');
+                        }
+                        catch { /* The last successful observation expires. */ }
+                        said(`Authentication recovery polling failed for ${route}: ${error instanceof Error ? error.message : String(error)}`);
                     }
-                    throw error;
                 }
+                const machineHarness = await selectedHarness(current(), machineId);
+                listeningHarness = machineHarness;
                 if (signal?.aborted)
                     break;
-                if (listeningHarness !== null && listeningHarness !== machineHarness) {
-                    await stopListening(current(), machineId, listeningHarness);
-                }
-                listeningHarness = machineHarness;
-                await sayListening(current(), machineId, machineName, machineHarness);
-                await reconcileOwnerSessions(current(), machineId, machineHarness, new Set(inFlight.keys()));
+                await reconcileOwnerSessions(current(), machineId, machineHarness, new Set(inFlight.keys()), work);
                 await recoverStranded(current(), tools, machineId, new Set(inFlight.keys()), hold);
                 /* ═══ AND THE COPIES OF CARDS THAT ARE OVER. ═══ After recovery,
                    deliberately: a run this machine is about to resume is one whose card is
@@ -3197,7 +3616,10 @@ export async function run(args, injected, signal, lifecycle) {
                 /* THE MACHINE ID GOES IN because the take writes the run row, and a run has
                    to say where it is running: the exclusion is cross-machine and recovery is
                    per-machine, so a row with nobody's machine on it could be neither. */
-                const taken = await returned(current().rpc('panel3_take_turns', { p_machine_id: machineId, p_agent: machineHarness }), 'take', 'turns');
+                const takenResponse = await panelClaim(current(), work, 'panel3_take_turns', { p_machine_id: machineId, p_agent: machineHarness, p_recovery_only: false });
+                if (takenResponse.operationId)
+                    claimOperations.push(takenResponse.operationId);
+                const taken = await returned(Promise.resolve(takenResponse), 'take', 'turns');
                 /* ═══ THE OTHER KIND OF TAKEABLE WORK. ═══ ux.md's re-arm: an answered
                    question makes the branch that asked it takeable again, and a question
                    still walking up makes the run it reached takeable so that level gets its
@@ -3211,7 +3633,10 @@ export async function run(args, injected, signal, lifecycle) {
                    to it on a later poll rather than putting two of them on one card. The
                    other order would decide the same question from a snapshot taken before
                    the run existed. */
-                const rearmed = await returned(current().rpc('panel3_take_rearms', { p_machine_id: machineId, p_agent: machineHarness }), 'take', 'runs that can carry on');
+                const rearmedResponse = await panelClaim(current(), work, 'panel3_take_rearms', { p_machine_id: machineId, p_agent: machineHarness });
+                if (rearmedResponse.operationId)
+                    claimOperations.push(rearmedResponse.operationId);
+                const rearmed = await returned(Promise.resolve(rearmedResponse), 'take', 'runs that can carry on');
                 for (const row of rearmed) {
                     /* NOT AWAITED PAST THE SPAWN, exactly as a taken card is not: the work is a
                        real agent and holding the poll open for it would put every other card
@@ -3239,6 +3664,8 @@ export async function run(args, injected, signal, lifecycle) {
                     // rather than becoming an unhandled rejection.
                     hold(runId, answerCard(current(), tools, machineId, cardId, turns));
                 }
+                await sayListening(current(), machineId, machineName, machineHarness);
+                listeningRoutes.add(machineHarness);
                 await sayPollingProblem(current(), machineId, machineHarness, null);
                 lifecycle?.ready();
                 if (once) {
@@ -3265,14 +3692,18 @@ export async function run(args, injected, signal, lifecycle) {
                     }
                 }
             }
+            finally {
+                work?.finishRpcs(claimOperations);
+                endClaim?.();
+            }
             if (!signal?.aborted)
                 await sleep(POLL_INTERVAL_MS);
         }
     }
     finally {
         try {
-            if (listeningHarness !== null)
-                await stopListening(current(), machineId, listeningHarness);
+            for (const route of listeningRoutes)
+                await stopListening(current(), machineId, route);
         }
         finally {
             await tools.close();
@@ -3284,8 +3715,12 @@ export async function run(args, injected, signal, lifecycle) {
  * client. A stopped worker is restarted automatically. Explicit restarts happen
  * at an idle poll boundary and confirm only after a new worker completes a poll.
  * Sign-out stops the supervisor, so it cannot restart behind the user's back. */
-export function startPanel(injected) {
+export function startPanel(injected, work) {
     const controller = new AbortController();
+    let resolveReady;
+    let rejectReady;
+    const ready = new Promise((resolve, reject) => { resolveReady = resolve; rejectReady = reject; });
+    void ready.catch(() => { });
     let requested = false;
     let restarting = null;
     let resolveRestart = null;
@@ -3304,11 +3739,12 @@ export function startPanel(injected) {
                         }
                         return false;
                     },
-                    ready: () => { if (!requested)
+                    ready: () => { resolveReady(); if (!requested)
                         resolveRestart?.(); },
-                });
+                }, work);
             }
             catch (error) {
+                rejectReady(error instanceof Error ? error : new Error(String(error)));
                 said(`the agent panel stopped polling: ${error instanceof Error ? error.message : String(error)}`);
                 // Startup failures must not leave an online machine with a dead worker.
                 if (!controller.signal.aborted)
@@ -3317,6 +3753,7 @@ export function startPanel(injected) {
         }
     })();
     return {
+        ready,
         restart: () => {
             if (controller.signal.aborted)
                 return Promise.reject(new Error('This machine is signing out. Open Companion and sign in again.'));
@@ -3339,6 +3776,7 @@ export function startPanel(injected) {
         },
         stop: async () => {
             controller.abort();
+            rejectReady(new Error('Cloud startup was cancelled by the service command.'));
             rejectRestart?.(new Error('The machine disconnected before the worker restarted.'));
             await running;
         },