@ctrl-spc/cs 0.7.14 → 0.7.16

package/dist/orchestrator.js

@@ -1,14 +1,17 @@
+import { executionIdentity } from './agents.js';
+import { CodexHomeFailure } from './codex-home.js';
 import { execFile, spawn as spawnChild } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
+import { beginOwnedClaim, ownedWorkAllowed, hasOwnedWorkContext, pendingTerminalOutcomes, acknowledgeTerminalOutcome, updateTerminalOutcome, ownedWorkerClaimedAt, ownedWorkerExecutionHeld, reserveOwnedWork, legacyHeldTodoIds, interruptionReceipts, acknowledgeInterruption, legacySnapshotNeeded, saveLegacySnapshot, legacyTodoHolds, releaseLegacyTodoHold, recordExitedInterruption, beginRpcClaim, deferRpcClaim, pendingRpcClaims, recordRpcClaims, finishRpcClaims, recoveredRpcClaims, pendingRpcReference, retireRpcReference } from './daemon-processes.js';
 import { promisify } from 'node:util';
 import { agentPath, detectAgents } from './agents.js';
 /* 18a Slice 7: the two Windows spawn rules, in one module so a caller cannot
    take the shell and forget the quoting. `quoteForCmd` is re-exported because
    this module's own tests reach for it here. */
-import { killTree, needsShell, processIsAlive, quoteForCmd } from './win-shell.js';
+import { killTree, needsShell, processIsAlive, quoteForCmd, spawnOwnedProcess, releaseOwnedProcess } from './win-shell.js';
 export { quoteForCmd } from './win-shell.js';
 import { ORCHESTRATOR_MAX_CONCURRENT, ORCHESTRATOR_SPAWN_TIMEOUT_MS } from './env.js';
-import { agentDisplayName, plainFailureReason } from './failure-reason.js';
+import { agentDisplayName, nativeFailureKind, failureMessage } from './failure-reason.js';
 /* 18c SLICE 9 (GAP 15): the two request-scoped releases. They live in mcp.ts
    beside the session-end routes and the reservations table's other writers, so
    there is ONE place that knows how a lease is let go, rather than two that can
@@ -199,7 +202,7 @@ export async function claimNextTodo(client, machineId, agent,
    because the claim must stay ONE statement (see below), and because a
    blocked unit is the OLDEST claimable row: released and re-claimed it would
    be picked first every tick, starving everything behind it. */
-skipIds = []) {
+skipIds = [], recoveryOnly = false) {
     /* THROUGH AN RPC, NOT PostgREST — and this is not a style preference, it is
        the fix for a bug that made the whole slice inert.
   
@@ -224,11 +227,11 @@ skipIds = []) {
        row rather than blocking or double-claiming. `userId` is no longer passed:
        the function scopes itself with `auth.uid()`, which is the same identity
        RLS uses and cannot be spoofed by a caller. */
-    const { data, error } = await client.rpc('cliv2_claim_next_loose_todo', {
+    const { data, error, operationId } = await cliClaim(client, 'cliv2_claim_next_loose_todo', {
         p_machine_id: machineId,
         p_agent: agent,
         p_skip_ids: skipIds,
-    });
+    }, recoveryOnly);
     if (error)
         throw error;
     /* 18b Slice 2: the claim also carries the request's OWN project (id and name),
@@ -240,40 +243,12 @@ skipIds = []) {
     const row = (data ?? [])[0];
     if (!row)
         return null;
-    /* ═══ 18d SLICE 4 — THE FENCE TOKEN FOR THIS DISPATCH. ═══
-  
-       `claimed_at` is what this run OWNS. It is read here, immediately after the
-       claim, rather than added to the RPC's return table, because that keeps the
-       shipped function's contract alone and needs no migration.
-  
-       WHY IT IS NEEDED. hand_off_stage clears the claim so the next stage is
-       dispatched to a fresh worker, and the handing-off worker then keeps talking
-       for as long as it takes to write its closing answer. Its exit path wrote
-       `state='done'` unconditionally, over a row a SECOND worker was already
-       working: the card read Done carrying stage 1's answer, and because the claim
-       RPC skips `done` rows the request could never be claimed again, so the
-       remaining stages were never run. Found by the gate's audit, and it matches
-       what the walk saw.
-  
-       Every terminal write is now fenced on this value, so a run that no longer
-       holds the claim writes NOTHING. Null is possible only if the row vanished
-       between claiming and reading it, and an unfenceable dispatch is treated as
-       already superseded rather than allowed to clobber. */
-    let claimedAt = null;
-    try {
-        const { data: claimRow } = await client
-            .from('cliv2_loose_todos')
-            .select('claimed_at')
-            .eq('id', row.id)
-            .maybeSingle();
-        claimedAt = claimRow?.claimed_at ?? null;
-    }
-    catch {
-        /* Unreadable is treated as unfenceable, which only loses the protection —
-           it never blocks the dispatch that was already claimed successfully. */
-    }
+    const claimedAt = row.claimed_at ?? null;
+    if (hasOwnedWorkContext() && !claimedAt)
+        throw new Error('The claim did not return an exact attempt identity. Update the database before starting work.');
     return {
         id: row.id,
+        ...(operationId ? { claimOperationId: operationId } : {}),
         instruction: row.instruction,
         /* `?? null` rather than trusting the shape: a daemon running against a
            database that has not taken this slice's migration yet gets neither
@@ -514,10 +489,13 @@ claimedAt) {
     const write = client
         .from('cliv2_loose_todos')
         .update({ answer, state: 'done' })
-        .eq('id', todoId);
-    const { error } = await (claimedAt ? write.eq('claimed_at', claimedAt) : write);
+        .eq('id', todoId)
+        .in('state', ['working', 'needs-input']);
+    const { data: written, error } = await (claimedAt ? write.eq('claimed_at', claimedAt) : write).select('id');
     if (error)
         throw error;
+    if (!written?.length)
+        return false;
     /* 18c SLICE 1 — CLOSE OUT THE LAST ACTIVITY LINE.
      *
      * report_activity only ever flips the PREVIOUS 'doing' row to 'done' when a
@@ -541,6 +519,7 @@ claimedAt) {
     catch (err) {
         console.warn(`answerTodo: closing out the last activity line failed: ${err.message}`);
     }
+    return true;
 }
 /**
  * !Cleanup PHASE 6 (I15) — DID THIS WORKER ASK SOMETHING AND EXIT?
@@ -566,7 +545,7 @@ claimedAt) {
  * a card asking the user for something that does not exist, unclearable except
  * by Stop. A wrong `done` is recoverable by Retry; a phantom question is not.
  */
-export async function todoHasOpenAsk(client, todoId, warn) {
+export async function todoHasOpenAsk(client, todoId, warn, strict = false) {
     try {
         const { data, error } = await client
             .from('cliv2_todo_asks')
@@ -578,11 +557,13 @@ export async function todoHasOpenAsk(client, todoId, warn) {
             throw new Error(error.message);
         if ((data ?? []).length > 0)
             return true;
-        if (await todoHasOpenDecision(client, todoId, warn))
+        if (await todoHasOpenDecision(client, todoId, warn, strict))
             return true;
-        return await todoHasOpenBlockedNotice(client, todoId, warn);
+        return await todoHasOpenBlockedNotice(client, todoId, warn, strict);
     }
     catch (err) {
+        if (strict)
+            throw err;
         warn(`[orchestrator] could not check for open questions: ${err.message}`);
         return false;
     }
@@ -606,7 +587,7 @@ export async function todoHasOpenAsk(client, todoId, warn) {
  * Best-effort and false on error, like its two siblings, and for the same
  * reason: a wrong `done` is recoverable by Retry, a phantom park is not.
  */
-export async function todoHasOpenBlockedNotice(client, todoId, warn) {
+export async function todoHasOpenBlockedNotice(client, todoId, warn, strict = false) {
     try {
         const { data, error } = await client
             .from('cliv2_blocked_notices')
@@ -619,6 +600,8 @@ export async function todoHasOpenBlockedNotice(client, todoId, warn) {
         return (data ?? []).length > 0;
     }
     catch (err) {
+        if (strict)
+            throw err;
         warn(`[orchestrator] could not check for an open stop: ${err.message}`);
         return false;
     }
@@ -659,7 +642,7 @@ const PERMISSION_CATEGORY = 'cliv2_permission';
  * BEST-EFFORT, like every read in the tick. A failure returns false, which costs
  * a wrongly-finished card rather than a lost run.
  */
-export async function todoHasOpenDecision(client, todoId, warn) {
+export async function todoHasOpenDecision(client, todoId, warn, strict = false) {
     try {
         const { data: links, error: linkError } = await client
             .from('cliv2_loose_todo_links')
@@ -691,6 +674,8 @@ export async function todoHasOpenDecision(client, todoId, warn) {
         return (data ?? []).length > 0;
     }
     catch (err) {
+        if (strict)
+            throw err;
         warn(`[orchestrator] could not check the work item's questions: ${err.message}`);
         return false;
     }
@@ -803,7 +788,7 @@ export async function todoRunLeftATrace(client, todoId, warn,
  *  same answer for the scope gate and resolving it twice would let the two
  *  disagree about which item this run is for. Null for a panel request with
  *  no work item, which is the greenfield case. */
-workItemId = null) {
+workItemId = null, strict = false) {
     try {
         /* ANY ONE IS ENOUGH, so the cheapest and most likely is asked first and the
            rest are skipped once one answers yes. A session is what the guidance
@@ -852,6 +837,8 @@ workItemId = null) {
         return (dropped.data?.dropped_activity ?? 0) > 0;
     }
     catch (err) {
+        if (strict)
+            throw err;
         /* See the block comment: towards `done`, so a transient read failure never
            discards a run that really did the work. */
         warn(`[orchestrator] could not check whether the run recorded anything: ${err.message}`);
@@ -888,10 +875,12 @@ claimedAt) {
         // `answer` is constrained nonblank-when-present, so '' must go in as null
         // rather than as an empty string the check would refuse.
         .update({ answer: trimmed || null, state: 'needs-input' })
-        .eq('id', todoId);
-    const { error } = await (claimedAt ? write.eq('claimed_at', claimedAt) : write);
+        .eq('id', todoId)
+        .in('state', ['working', 'needs-input']);
+    const { data, error } = await (claimedAt ? write.eq('claimed_at', claimedAt) : write).select('id');
     if (error)
         throw error;
+    return !!data?.length;
 }
 /**
  * !Cleanup PHASE 6 (I17) — HAS THE USER STOPPED THIS?
@@ -934,12 +923,13 @@ export async function todoWasStopped(client, todoId) {
  * already hit Retry, the unit is `working` again and this matches nothing. That
  * is the Gherkin line "the daemon does not later overwrite that".
  */
-export async function releaseStoppedTodo(client, todoId) {
-    const { error } = await client
+export async function releaseStoppedTodo(client, todoId, claimedAt) {
+    const write = client
         .from('cliv2_loose_todos')
         .update({ claimed_machine_id: null, claimed_agent: null, claimed_at: null })
         .eq('id', todoId)
         .eq('state', 'stopped');
+    const { error } = await (claimedAt ? write.eq('claimed_at', claimedAt) : write);
     if (error)
         throw error;
 }
@@ -972,6 +962,41 @@ export const MAX_ATTEMPTS = 3;
  *  so there is one count: a second read could land after another process had
  *  touched the row, and a wait computed from a stale count is a wait the card's
  *  own countdown would disagree with. */
+/** The existing terminal write, also used for a nonretryable native refusal. */
+async function failClaimedTodo(client, todoId, reason, expectedClaim, count) {
+    let attempts = count ?? 0;
+    if (count === undefined) {
+        const { data, error } = await client.from('cliv2_loose_todos').select('attempts,claimed_at').eq('id', todoId).maybeSingle();
+        if (error)
+            throw error;
+        if (!data || data.claimed_at !== expectedClaim)
+            return { fate: 'stale', attempts: data?.attempts ?? 0 };
+        attempts = Number(data.attempts ?? 0) + 1;
+    }
+    let failure = client
+        .from('cliv2_loose_todos')
+        .update({
+        state: 'failed',
+        attempts,
+        stopped_reason: reason.trim() || 'the work failed repeatedly',
+        claimed_machine_id: null,
+        claimed_agent: null,
+        claimed_at: null,
+        /* 18a SLICE 6: cleared at the bound. A wait on a terminal row would be
+           read by nothing and would outlive the row's own meaning; the only
+           route back is Retry, which means now. */
+        retry_after: null,
+    })
+        .eq('id', todoId)
+        .in('state', ['working', 'needs-input']);
+    failure = expectedClaim ? failure.eq('claimed_at', expectedClaim) : failure.is('claimed_at', null);
+    const { data: failed, error: failError } = await failure.select('id');
+    if (failError)
+        throw failError;
+    if (!failed?.length)
+        return { fate: 'stale', attempts: attempts - 1 };
+    return { fate: 'failed', attempts };
+}
 export async function releaseOrFail(client, todoId, reason, 
 /** 18a Slice 6: injectable so a test can place the wait exactly. */
 nowMs = Date.now(), 
@@ -992,34 +1017,17 @@ claimedAt) {
        already claimed by the run that replaced this one. */
     const current = data;
     if (claimedAt && current && current.claimed_at !== claimedAt) {
-        return { fate: 'released', attempts: current.attempts ?? 0 };
+        return { fate: 'stale', attempts: current.attempts ?? 0 };
     }
     const attempts = (current?.attempts ?? 0) + 1;
-    if (attempts >= MAX_ATTEMPTS) {
-        const { error: failError } = await client
-            .from('cliv2_loose_todos')
-            .update({
-            state: 'failed',
-            attempts,
-            stopped_reason: reason.trim() || 'the work failed repeatedly',
-            claimed_machine_id: null,
-            claimed_agent: null,
-            claimed_at: null,
-            /* 18a SLICE 6: cleared at the bound. A wait on a terminal row would be
-               read by nothing and would outlive the row's own meaning; the only
-               route back is Retry, which means now. */
-            retry_after: null,
-        })
-            .eq('id', todoId);
-        if (failError)
-            throw failError;
-        return { fate: 'failed', attempts };
-    }
+    const expectedClaim = claimedAt ?? current?.claimed_at ?? null;
+    if (attempts >= MAX_ATTEMPTS)
+        return failClaimedTodo(client, todoId, reason, expectedClaim, attempts);
     /* 18a SLICE 6: THE WAIT IS WRITTEN ON THE SAME STATEMENT AS THE COUNT, for
        the reason the count is on the same statement as the release: a wait that
        can fail on its own is a wait the daemon might not honour, and the failure
        mode is the fork bomb this bound exists to prevent. */
-    const { error: releaseError } = await client
+    let release = client
         .from('cliv2_loose_todos')
         .update({
         attempts,
@@ -1028,9 +1036,14 @@ claimedAt) {
         claimed_at: null,
         retry_after: new Date(nowMs + retryDelayMs(attempts)).toISOString(),
     })
-        .eq('id', todoId);
+        .eq('id', todoId)
+        .in('state', ['working', 'needs-input']);
+    release = expectedClaim ? release.eq('claimed_at', expectedClaim) : release.is('claimed_at', null);
+    const { data: released, error: releaseError } = await release.select('id');
     if (releaseError)
         throw releaseError;
+    if (!released?.length)
+        return { fate: 'stale', attempts: current?.attempts ?? 0 };
     return { fate: 'released', attempts };
 }
 /**
@@ -1172,11 +1185,13 @@ export async function scopeIsApproved(client, workItemId) {
  * See the call site for why the claim stays: an unclaimed todo is immediately
  * re-claimable, so releasing would spin the tick loop.
  */
-export async function parkTodoForScope(client, todoId) {
-    const { error } = await client
+export async function parkTodoForScope(client, todoId, claimedAt) {
+    const write = client
         .from('cliv2_loose_todos')
         .update({ state: 'needs-input' })
-        .eq('id', todoId);
+        .eq('id', todoId)
+        .in('state', ['working', 'needs-input']);
+    const { error } = await (claimedAt ? write.eq('claimed_at', claimedAt) : write);
     if (error)
         throw error;
 }
@@ -1279,7 +1294,7 @@ injectedSpawn,
  *  worker's, and injected by the same convention (`deps.resolveContext`) so a
  *  test can point it somewhere without `resolveClaimContext` growing
  *  parameters for the suite's sake. */
-resolveContext = (claim) => resolveClaimContext(client, claim, warn)) {
+resolveContext = (claim) => resolveClaimContext(client, claim, warn), observeHarness) {
     /* ═══ 18k SLICE 10b — NO TOOLS MEANS NO ANSWER, the tick's own rule. ═══
        An answerer now holds the worker's toolset, so one started while the tools
        server is down would have NONE of it: it could not read the work item, could
@@ -1319,17 +1334,19 @@ resolveContext = (claim) => resolveClaimContext(client, claim, warn)) {
        returns; what bounds a long answer is `state.answering`, keyed per run, and
        `state.maxAnswering`. This guard is back to meaning what it says: one take
        at a time, which is a few queries. */
-    if (state.takeInFlight)
+    if (state.takeInFlight || !ownedWorkAllowed())
         return;
+    const endClaim = beginOwnedClaim();
     state.takeInFlight = true;
     try {
-        await takeRunMessagesInner(client, userId, machineId, agents, state, log, warn, spawn, resolveContext);
+        await takeRunMessagesInner(client, userId, machineId, agents, state, log, warn, spawn, resolveContext, observeHarness);
     }
     finally {
         state.takeInFlight = false;
+        endClaim();
     }
 }
-async function takeRunMessagesInner(client, userId, machineId, agents, state, log, warn, spawn, resolveContext) {
+async function takeRunMessagesInner(client, userId, machineId, agents, state, log, warn, spawn, resolveContext, observeHarness) {
     /* ═══ 18k SLICE 10 — A MACHINE ANSWERS ITS OWN RUNS, DESIGNATED OR NOT. ═══
        Slice 7 gated this whole function on being the designated orchestrator, and
        that is wrong for work already claimed: the user may switch the toolbar to
@@ -1342,6 +1359,7 @@ async function takeRunMessagesInner(client, userId, machineId, agents, state, lo
        old check survives on its own. */
     if (agents.length === 0)
         return;
+    const claimOperations = [];
     /* THE RUNS THIS MACHINE CLAIMS, which is what it may answer for. `claimed_at`
        is the real predicate rather than the state alone: `releaseStoppedTodo` and
        `releaseOrFail` null the claim on `stopped` and `failed`, while `answerTodo`
@@ -1400,6 +1418,13 @@ async function takeRunMessagesInner(client, userId, machineId, agents, state, lo
        scoped take with an empty id list, which correctly returns nothing — so this
        is a saved round trip every ten seconds on every machine in the fleet that is
        not participating, not a safety property. The safety is the scope itself. */
+    if (hasOwnedWorkContext()) {
+        for (const claim of recoveredRpcClaims('cli').filter(row => row.action !== 'cliv2_claim_next_loose_todo')) {
+            for (const ref of cliClaimReferences(claim.action, claim.result))
+                if (ref.surface === 'reply' && pendingRpcReference(ref) && !state.answering.has(ref.todoId) && !ownTodoIds.includes(ref.todoId))
+                    ownTodoIds.push(ref.todoId);
+        }
+    }
     if (ownTodoIds.length === 0 && !designated)
         return;
     try {
@@ -1412,13 +1437,17 @@ async function takeRunMessagesInner(client, userId, machineId, agents, state, lo
            which is the whole of the starvation this scoping removes. */
         const taken = [];
         if (ownTodoIds.length > 0) {
-            const own = await client.rpc('cliv2_take_run_messages', { p_todo_ids: ownTodoIds, p_machine_id: machineId });
+            const own = await cliClaim(client, 'cliv2_take_run_messages', { p_todo_ids: ownTodoIds, p_machine_id: machineId, p_skip_todo_ids: [...legacyHeldTodoIds(), ...state.answering] });
+            if (own.operationId)
+                claimOperations.push(own.operationId);
             if (own.error)
                 throw new Error(own.error.message);
             taken.push(...(own.data ?? []));
         }
         if (designated) {
-            const rest = await client.rpc('cliv2_take_run_messages', { p_todo_ids: null, p_machine_id: machineId });
+            const rest = await cliClaim(client, 'cliv2_take_run_messages', { p_todo_ids: null, p_machine_id: machineId, p_skip_todo_ids: [...legacyHeldTodoIds(), ...state.answering] });
+            if (rest.operationId)
+                claimOperations.push(rest.operationId);
             if (rest.error)
                 throw new Error(rest.error.message);
             /* DEDUPED BY ID rather than trusted to be disjoint. The database will not
@@ -1450,7 +1479,13 @@ async function takeRunMessagesInner(client, userId, machineId, agents, state, lo
            cover: the answer is not to a message, it is to an approval. Everything
            downstream already handles an empty id list — the covering RPC is skipped
            and the lease is not involved, because no message was leased. */
-        const granted = await readGrantedRuns(client, userId, warn);
+        const grants = await cliClaim(client, 'cliv2_take_granted_resumes', { p_todo_ids: designated ? null : ownTodoIds,
+            p_machine_id: machineId, p_skip_todo_ids: [...legacyHeldTodoIds(), ...state.answering] });
+        if (grants.operationId)
+            claimOperations.push(grants.operationId);
+        if (grants.error)
+            throw grants.error;
+        const granted = (grants.data ?? []);
         /* AN EMPTY PASS SAYS NOTHING. This runs every 10 seconds and the common case
            is nothing to take and nothing approved; a line each time would bury every
            useful one, the same rule `reportRole` and `reportNoTools` follow.
@@ -1495,7 +1530,8 @@ async function takeRunMessagesInner(client, userId, machineId, agents, state, lo
         }
         /* AND THE APPROVED RUNS JOIN THEM, with no message ids: there is nothing to
            cover, because the answer is to an approval rather than to a message. */
-        for (const todoId of granted) {
+        for (const grant of granted) {
+            const todoId = grant.todo_id;
             if (!byRun.has(todoId))
                 byRun.set(todoId, { messageIds: [], wasExpired: false });
         }
@@ -1553,7 +1589,10 @@ async function takeRunMessagesInner(client, userId, machineId, agents, state, lo
                `answerRunMessages` warns and returns false rather than throwing, and
                the pass's job is to have STARTED every answer. The `catch` is the
                daemon's never-throw contract, not a second failure path. */
-            void answerRunMessages(client, todoId, group.messageIds, { agent: plan.agent, cwd: context.checkout, workingCopyElsewhere: plan.workingCopyElsewhere }, state, spawn, warn).catch(err => {
+            void answerRunMessages(client, todoId, group.messageIds, { agent: plan.agent, cwd: context.checkout, workingCopyElsewhere: plan.workingCopyElsewhere }, state, spawn, warn, { surface: 'reply', todoId,
+                messageLeases: taken.filter((row) => row.todo_id === todoId).map((row) => ({ id: row.id, taken_at: row.taken_at })),
+                grantLeases: granted.filter((row) => row.todo_id === todoId).map((row) => ({ id: row.id, resume_taken_at: row.resume_taken_at })),
+                observedPendingMessageIds: null }, machineId, undefined, observeHarness).catch(err => {
                 warn(`[orchestrator] could not answer ${shortId(todoId)}: ${err.message}`);
             });
         }
@@ -1561,6 +1600,10 @@ async function takeRunMessagesInner(client, userId, machineId, agents, state, lo
     catch (err) {
         reportTakeFailed(state, err.message, warn);
     }
+    finally {
+        if (hasOwnedWorkContext())
+            finishRpcClaims(claimOperations, true);
+    }
 }
 /**
  * 18k Slice 10 — THE CODEBASE THIS RUN IS FOR, recovered the way the tick
@@ -2195,7 +2238,7 @@ plan, state,
 /** 18k Slice 10b — THE WORKER'S OWN SPAWN SHAPE, not a responder's. There is no
  *  second adapter any more: this is what `defaultSpawn(mcpServer)` returns, and
  *  the answerer differs from a dispatch only in passing no `alsoRunningIn`. */
-spawn, warn) {
+spawn, warn, attempt, machineId, owned, observeHarness) {
     /* ═══ 18k SLICE 10b — ONE ANSWER PER RUN AT A TIME. ═══
        DEPTH, NOT THE PRIMARY DEFENCE. `takeRunMessagesInner` subtracts
        `state.answering` from the scoped take's id list, so a run this machine is
@@ -2220,26 +2263,64 @@ spawn, warn) {
        into an inner function so the clear is in ONE place rather than repeated at
        every `return` below, which is the same shape `orchestratorTick` uses to
        release its own slot. */
+    if (hasOwnedWorkContext() && (!attempt || !machineId))
+        throw new Error('The reply has no exact source lease identity.');
+    owned = hasOwnedWorkContext() ? reserveOwnedWork(attempt, plan.agent) : undefined;
     state.answering.add(todoId);
     try {
-        return await answerRunMessagesInner(client, todoId, messageIds, plan, state, spawn, warn);
+        const answered = await answerRunMessagesInner(client, todoId, messageIds, plan, state, spawn, warn, attempt, machineId, owned, observeHarness);
+        if (answered)
+            owned?.complete();
+        return answered;
     }
     finally {
         state.answering.delete(todoId);
+        owned?.finishPreparation();
+    }
+}
+async function settleReplyOutcome(client, machineId, attempt, outcome, onAccepted) {
+    const todoId = attempt.todoId;
+    const finished = await client.rpc('cliv2_finish_reply_attempt', {
+        p_todo_id: todoId, p_machine_id: machineId, p_message_leases: attempt.messageLeases,
+        p_grant_leases: attempt.grantLeases, p_body: outcome.text,
+        ...(!outcome.ok && !outcome.stopped ? { p_failure_kind: outcome.failureKind ?? 'unknown' } : {}),
+    });
+    if (finished.error)
+        throw finished.error;
+    const receipt = finished.data?.[0]?.outcome;
+    if (receipt === 'stale')
+        return false;
+    if (receipt === 'failed' || receipt === 'already_failed') {
+        onAccepted?.();
+        return false;
     }
+    if (receipt !== 'accepted' && receipt !== 'already_settled')
+        throw new Error('The reply acknowledgement was incomplete.');
+    onAccepted?.();
+    if (outcome.stopped && outcome.replyingToClaim)
+        await releaseStoppedTodo(client, todoId, outcome.replyingToClaim);
+    else if (outcome.workerIsLive && outcome.replyingToClaim) {
+        const scheduled = await client.from('cliv2_loose_todos')
+            .update({ claimed_machine_id: null, claimed_agent: null, claimed_at: null })
+            .eq('id', todoId).eq('claimed_at', outcome.replyingToClaim).in('state', ['working', 'needs-input']);
+        if (scheduled.error)
+            throw scheduled.error;
+    }
+    return !outcome.stopped;
 }
-async function answerRunMessagesInner(client, todoId, messageIds, plan, state, spawn, warn) {
+async function answerRunMessagesInner(client, todoId, messageIds, plan, state, spawn, warn, attempt, machineId, owned, observeHarness) {
     /* ALREADY GIVEN UP ON. Said ONCE, at the bound, and then silently skipped —
        the `reportTakeFailed` rule: a line every two minutes forever would bury
        every useful one. */
-    const attempts = Math.max(...messageIds.map(id => state.replyAttempts.get(id) ?? 0));
+    const sourceIds = [...messageIds, ...(attempt?.grantLeases ?? []).map(grant => `grant:${grant.id}`)];
+    const attempts = Math.max(0, ...sourceIds.map(id => state.replyAttempts.get(id) ?? 0));
     if (attempts >= MAX_REPLY_ATTEMPTS)
         return false;
     const fail = (reason) => {
-        for (const id of messageIds) {
+        for (const id of sourceIds) {
             state.replyAttempts.set(id, (state.replyAttempts.get(id) ?? 0) + 1);
         }
-        const spent = Math.max(...messageIds.map(id => state.replyAttempts.get(id) ?? 0));
+        const spent = Math.max(0, ...sourceIds.map(id => state.replyAttempts.get(id) ?? 0));
         if (spent >= MAX_REPLY_ATTEMPTS) {
             warn(`[orchestrator] gave up answering ${shortId(todoId)} after ${MAX_REPLY_ATTEMPTS} attempts: ${reason}`);
         }
@@ -2287,6 +2368,12 @@ async function answerRunMessagesInner(client, todoId, messageIds, plan, state, s
        would either promise a boundary that never comes, or re-dispatch a worker
        for a change the agent already made itself. */
     const workerIsLive = await liveWorkerForTodo(client, todoId, warn);
+    // A stopped request may retain a claim even though its worker has ended.
+    // Capture it before answering so a late stopped reply cannot clear a newer one.
+    const current = await client.from('cliv2_loose_todos').select('claimed_at').eq('id', todoId).maybeSingle();
+    if (current.error)
+        throw current.error;
+    const replyingToClaim = current.data?.claimed_at ?? null;
     /* ═══ 18k SLICE 10b — SPAWNED AS A WORKER, WITH NO CLOCK ON IT. ═══
        The worker's own adapter, so the answerer holds the worker's toolset (ruling
        1) and no timeout at all (ruling 5) — an agent asked for a real change may
@@ -2304,166 +2391,53 @@ async function answerRunMessagesInner(client, todoId, messageIds, plan, state, s
        NO `alsoRunningIn`: the answerer works one run, in that run's own checkout.
        `runTodoId` IS the run, so a tool call it makes is attributed without
        depending on the agent repeating an id back to us. */
+    if (attempt) {
+        const pending = await client.from('cliv2_run_messages').select('id').eq('todo_id', todoId).is('answered_by', null);
+        if (pending.error)
+            throw pending.error;
+        attempt.observedPendingMessageIds = (pending.data ?? []).map((row) => row.id);
+        owned?.setReference(attempt);
+    }
+    const harnessIdentity = executionIdentity(plan.agent);
     let spawnedPid = null;
     const result = await spawn(plan.agent, buildReplyPrompt(record, bodies, { hasCheckout: plan.cwd !== null, workingCopyElsewhere: plan.workingCopyElsewhere }, workerIsLive), undefined, plan.cwd, () => todoWasStopped(client, todoId), (pid) => {
         state.livePids.add(pid);
         spawnedPid = pid;
-    }, undefined, todoId);
+    }, undefined, todoId, owned);
     /* HOWEVER THE ANSWER ENDED. The pid must leave `livePids` on every path, or a
        dead child looks alive to the liveness watch forever. */
     if (spawnedPid !== null)
         state.livePids.delete(spawnedPid);
-    /* ═══ 18k SLICE 10b — THE USER STOPPED IT, AND THAT IS NOT A FAILURE. ═══
-       CHECKED BEFORE `!result.ok`, because a killed child also reports not-ok, and
-       falling through would count the user's own decision as an attempt and
-       re-spawn the very thing they cancelled — `dispatchClaimInner` makes the same
-       check for the same reason.
-  
-       BUT STOPPING ALONE WOULD BE AN INFINITE SPAWN LOOP. A stopped run stays
-       stopped, so the message stays uncovered, the lease lapses, the next take
-       spawns another answerer, and that one is stopped too — forever, burning no
-       budget because no attempt is counted. So the messages are COVERED, and
-       `cliv2_mark_messages_answered` needs a reply id, so one short reply is what
-       covers them. That is also the honest thread: it says the message was not
-       answered because the work was stopped, rather than showing "Queued" forever.
-       ux.md's north star forbids "this will never be answered", and an uncovered
-       stopped message is exactly that state.
-  
-       AND THE CLAIM. This function set no claim, but the run may carry one from an
-       earlier dispatch, and `releaseStoppedTodo` is the only thing that clears it —
-       without this call Retry cannot pick the run up. Its own `.eq('state','stopped')`
-       guard makes it a no-op when Retry has already re-armed the run. */
-    if (result.stopped) {
-        try {
-            const replyId = await writeRunReply(client, todoId, 'Stopped.');
-            const { error } = await client.rpc('cliv2_mark_messages_answered', {
-                p_reply_id: replyId,
-                p_message_ids: messageIds,
-            });
-            if (error)
-                throw new Error(error.message);
-            for (const id of messageIds)
-                state.replyAttempts.delete(id);
-        }
-        catch (err) {
-            warn(`[orchestrator] ${shortId(todoId)} was stopped and the conversation could not be closed off: ${err.message}`);
-        }
-        try {
-            await releaseStoppedTodo(client, todoId);
-        }
-        catch (err) {
-            warn(`[orchestrator] ${shortId(todoId)} was stopped and its claim could not be released: ${err.message}`);
-        }
+    if (result.interrupted)
         return false;
-    }
-    if (!result.ok) {
-        fail(result.error);
-        return false;
-    }
-    const body = result.output.trim();
-    if (body === '') {
-        fail('it said nothing');
+    const failureKind = result.failureKind ?? nativeFailureKind(result.saidTail ?? '');
+    if (!result.ok && !result.stopped && failureKind === 'transient' && attempts + 1 < MAX_REPLY_ATTEMPTS) {
+        fail(failureMessage(plan.agent, failureKind));
+        owned?.complete();
         return false;
     }
-    let replyId;
-    try {
-        replyId = await writeRunReply(client, todoId, body);
-    }
-    catch (err) {
-        fail(`the reply could not be saved: ${err.message}`);
-        return false;
-    }
-    /* ANSWERED. The count is cleared so a LATER message on this run that fails
-       starts from zero rather than inheriting a spent budget.
-  
-       ═══ 18k SLICE 9: AND IT IS CLEARED HERE, BEFORE THE COVERING WRITE. ═══
-       The reply EXISTS from this line on, so the attempt is spent whatever happens
-       next, and the covering below must NOT go through `fail()`. `fail()`'s
-       contract is "nothing was written, so retry the whole thing", and that
-       contract does not hold once a reply is in the thread. Had the covering's
-       failure counted an attempt, three consecutive attribution failures — a reply
-       written EACH time — would exhaust `MAX_REPLY_ATTEMPTS` while `answered_by`
-       stayed null, so the take would keep re-offering the row forever and nothing
-       would ever spawn again: three replies, then permanent silence with "Queued"
-       showing. Strictly worse than the predicate this slice replaces, which at
-       least excluded such a message after the first reply. */
-    for (const id of messageIds)
+    if (!result.ok && !result.stopped && failureKind === 'transient')
+        fail(failureMessage(plan.agent, failureKind));
+    const succeeded = result.ok && !!result.output.trim();
+    const body = result.stopped ? 'Stopped.' : succeeded ? result.output.trim() : null;
+    if (!attempt || !machineId)
+        throw new Error('The reply has no exact source lease identity.');
+    const terminal = { surface: 'reply', completedAt: Date.now(), harnessIdentity, ok: succeeded, text: body, reason: succeeded ? '' : failureMessage(plan.agent, failureKind), failureKind: succeeded ? undefined : failureKind, stopped: !!result.stopped, replyingToClaim, workerIsLive: result.ok && workerIsLive };
+    owned?.deferOutcome(terminal);
+    // A durable terminal result is awaiting acknowledgement, never another native attempt.
+    for (const id of sourceIds)
         state.replyAttempts.delete(id);
-    /* ═══ 18k SLICE 9: RECORD WHAT THE REPLY ANSWERED. ═══
-       "Was this message in front of the responder that wrote that reply" is known
-       only here, to the code that handed it over — no timestamp anywhere records
-       it, which is why 20260814190000's inference was wrong by the width of the
-       responder's runtime.
-  
-       REPLY FIRST, COVERING SECOND, DELIBERATELY. If the covering fails the reply
-       exists and the messages stay uncovered, so the next take re-takes them and
-       they get a second reply: visible duplication the user can see and react to.
-       The reverse order risks a covering for a reply that was never written — a
-       message marked answered by nothing, invisible forever. A visible duplicate
-       beats a silent drop, which is the north star's own ranking (ux.md:739).
-  
-       AND THE BOUND IS NOT LOST, IT MOVES: the RPC's own `answered_by is null`
-       term is what bounds a repeated failure here. Each retry round writes at most
-       one extra reply and rounds are one pass apart, so the user-visible bound is
-       duplicate replies at one per pass, never an unbounded spawn loop and never
-       permanent silence. A database that will not accept the mark is an outage,
-       and the honest behaviour under an outage is a visible duplicate rather than
-       a message that disappears. */
-    /* 18k Slice 10b — NOTHING TO ATTRIBUTE WHEN AN APPROVAL WOKE THIS. The reply
-       answers a grant, not a message, so there is no row to mark and the RPC is
-       skipped rather than called with an empty list. The grant's own `consumed_at`
-       is what stops it being offered again, stamped by the tool when the approved
-       call finally goes through. */
-    if (messageIds.length > 0) {
-        try {
-            const { error } = await client.rpc('cliv2_mark_messages_answered', {
-                p_reply_id: replyId,
-                p_message_ids: messageIds,
-            });
-            if (error)
-                throw new Error(error.message);
-        }
-        catch (err) {
-            warn(`[orchestrator] the reply to ${shortId(todoId)} could not be attributed, it will be answered again: ${err.message}`);
-            return false;
-        }
-    }
-    /* ═══ 18k SLICE 10b — CASE B: THE BOUNDARY. ═══
-       An agent was already working this checkout, so the reply said what would
-       happen rather than doing it. Clearing the claim is what makes that true: the
-       next tick dispatches a fresh worker, and `readRunDirection` hands it the
-       message. Nothing interrupts the live worker — it finishes what it is on, and
-       the change rides the NEXT dispatch, exactly as `hand_off_stage` already does
-       mid-run.
-  
-       AFTER THE REPLY AND ITS COVERING, NEVER BEFORE. Clearing first and then
-       failing to write the reply would re-dispatch a worker for a change nobody
-       was ever told about.
-  
-       GUARDED ON `working`/`needs-input`, for `releaseTodoForRedispatch`'s own
-       reason: a run that has since finished, failed or been stopped must not be
-       resurrected into `working` by a claim clear. And all three columns move
-       together — `cliv2_loose_todos_claim_complete_check` makes a half-release a
-       database error.
-  
-       BEST-EFFORT: the reply is in the thread whatever happens here, so a failed
-       clear costs the user a change that does not get dispatched — which the next
-       message re-raises — where throwing would lose the reply's own success. */
-    if (workerIsLive) {
-        try {
-            const { error } = await client
-                .from('cliv2_loose_todos')
-                .update({ claimed_machine_id: null, claimed_agent: null, claimed_at: null })
-                .eq('id', todoId)
-                .in('state', ['working', 'needs-input']);
-            if (error)
-                throw new Error(error.message);
-        }
-        catch (err) {
-            warn(`[orchestrator] ${shortId(todoId)} was answered but the change could not be scheduled: ${err.message}`);
-        }
-    }
-    return true;
+    const answered = await settleReplyOutcome(client, machineId, attempt, terminal, () => {
+        if (succeeded && !result.stopped)
+            observeHarness?.(plan.agent, 'authenticated', 'dispatch-success', terminal.completedAt, terminal.harnessIdentity);
+        else if (failureKind === 'authentication')
+            observeHarness?.(plan.agent, 'sign-in-required', 'provider-rejected', terminal.completedAt, terminal.harnessIdentity);
+    });
+    owned?.acknowledgeOutcome();
+    owned?.complete();
+    for (const id of sourceIds)
+        state.replyAttempts.delete(id);
+    return answered;
 }
 /** 18k Slice 7 — say ONCE that the take is failing, not every 10 seconds.
  *
@@ -2504,7 +2478,7 @@ export function reportTakeFailed(state, reason, warn) {
  * is the brake, exactly as it is for the scope park, and answering is what lets
  * it off.
  */
-export async function askWhichCodebase(client, todoId, projectName, remotes, warn) {
+export async function askWhichCodebase(client, todoId, projectName, remotes, warn, claimedAt) {
     try {
         const { error } = await client.rpc('cliv2_ask_about_request', {
             p_todo: todoId,
@@ -2517,7 +2491,7 @@ export async function askWhichCodebase(client, todoId, projectName, remotes, war
         });
         if (error)
             throw new Error(error.message);
-        await parkTodoForScope(client, todoId);
+        await parkTodoForScope(client, todoId, claimedAt);
         return true;
     }
     catch (err) {
@@ -2797,11 +2771,13 @@ export async function collisionForTodo(client, todoId, gitRemoteUrl, warn) {
         return null;
     }
 }
-export async function releaseTodo(client, todoId) {
-    const { error } = await client
+export async function releaseTodo(client, todoId, claimedAt) {
+    const write = client
         .from('cliv2_loose_todos')
         .update({ claimed_machine_id: null, claimed_agent: null, claimed_at: null })
-        .eq('id', todoId);
+        .eq('id', todoId)
+        .in('state', ['working', 'needs-input']);
+    const { error } = await (claimedAt ? write.eq('claimed_at', claimedAt) : write);
     if (error)
         throw error;
 }
@@ -3707,12 +3683,13 @@ run = spawnAgent) {
     alsoRunningIn, 
     /** 18c Slice 1 — the request this spawn is working, so
      *  `report_activity` lines can be attributed without the prompt. */
-    runTodoId) => 
-    /* !Cleanup Phase 6b (I42): NO TIMEOUT. `NO_SPAWN_TIMEOUT` disables the kill
-       entirely — a working agent is never killed for elapsed time (user ruling
-       2026-08-06). Liveness is watched from outside the run instead, by
-       `reapDeadWorkers` on the heartbeat. */
-    run(agent, prompt, NO_SPAWN_TIMEOUT, { onStep, mcpServer, cwd, stopRequested, onPid, alsoRunningIn, runTodoId });
+    runTodoId, owned) => {
+        /* !Cleanup Phase 6b (I42): NO TIMEOUT. `NO_SPAWN_TIMEOUT` disables the kill
+           entirely — a working agent is never killed for elapsed time (user ruling
+           2026-08-06). Liveness is watched from outside the run instead, by
+           `reapDeadWorkers` on the heartbeat. */
+        return run(agent, prompt, NO_SPAWN_TIMEOUT, { onStep, mcpServer, cwd, stopRequested, onPid, alsoRunningIn, runTodoId, owned });
+    };
 }
 /** 18k Slice 8 — how many times one message may be attempted before the daemon
  *  stops spawning for it.
@@ -3727,7 +3704,9 @@ export const MAX_REPLY_ATTEMPTS = 3;
 /** Bound on retained stdout. Generous — a real run's JSONL is a few hundred KB —
  *  but finite, so a runaway agent cannot exhaust memory. */
 const MAX_OUTPUT_BYTES = 32 * 1024 * 1024;
-export async function spawnAgent(agent, prompt, timeoutMs = ORCHESTRATOR_SPAWN_TIMEOUT_MS, { resolveBin = agentPath, exec, onStep, spawnProcess = spawnChild, maxOutputBytes = MAX_OUTPUT_BYTES, mcpServer = null, cwd = null, stopRequested, stopPollMs = STOP_POLL_MS, onPid, alsoRunningIn = [], runTodoId = null } = {}) {
+export async function spawnAgent(agent, prompt, timeoutMs = ORCHESTRATOR_SPAWN_TIMEOUT_MS, { resolveBin = agentPath, exec, onStep, spawnProcess = spawnChild, maxOutputBytes = MAX_OUTPUT_BYTES, mcpServer = null, cwd = null, stopRequested, stopPollMs = STOP_POLL_MS, onPid, alsoRunningIn = [], runTodoId = null, owned } = {}) {
+    if (owned?.interrupted())
+        return { ok: false, output: '', error: 'Work was interrupted by the service command.', interrupted: true };
     const bin = resolveBin(agent);
     if (!bin)
         return { ok: false, output: '', error: `${agent} is not installed on this machine` };
@@ -3741,7 +3720,7 @@ export async function spawnAgent(agent, prompt, timeoutMs = ORCHESTRATOR_SPAWN_T
        Windows path holds spaces (`C:\\Program Files\\…`) and the MCP config is
        JSON, so both would still be split by cmd.exe. */
     const viaShell = needsShell(bin);
-    const rawArgs = headlessAgentArgs(agent, prompt, mcpServer, alsoRunningIn, viaShell, runTodoId);
+    const rawArgs = headlessAgentArgs(agent, prompt, mcpServer, alsoRunningIn, true, runTodoId);
     const args = viaShell ? rawArgs.map(quoteForCmd) : rawArgs;
     /* !Cleanup Phase 2 (I5), CORRECTED BY 18b SLICE 2.
        It used to be `cwd ?? undefined`, and `undefined` means "inherit the
@@ -3787,10 +3766,8 @@ export async function spawnAgent(agent, prompt, timeoutMs = ORCHESTRATOR_SPAWN_T
     const codexHome = agent === 'claude'
         ? null
         : ensureCodexRunHome(mcpServer, runTodoId, runTodoId ? `${runTodoId}-${randomUUID().slice(0, 8)}` : null);
-    if (agent !== 'claude' && !codexHome) {
-        console.warn('[orchestrator] codex is running WITHOUT an isolated configuration: no signed-in codex ' +
-            'credential to seed a per-run home. This worker inherits the MCP servers, instruction ' +
-            'files and permission posture on this machine.');
+    if (codexHome instanceof CodexHomeFailure) {
+        return { ok: false, output: '', error: codexHome.message, failureKind: codexHome.kind };
     }
     /* Spread the parent's env rather than replacing it: codex needs PATH, HOME,
        the proxy variables and the user's shell environment to run at all. Only the
@@ -3829,13 +3806,18 @@ export async function spawnAgent(agent, prompt, timeoutMs = ORCHESTRATOR_SPAWN_T
     return new Promise((resolve) => {
         let child;
         try {
-            child = spawnProcess(bin, args, {
+            owned?.beforeSpawn();
+            const spawnExecution = owned && spawnProcess === spawnChild
+                ? (file, argv, options) => spawnOwnedProcess(file, argv, options, owned.id)
+                : spawnProcess;
+            child = spawnExecution(bin, args, {
                 // The repo-wide invariant for ANY child process (MEMORY: "Windows
                 // silence decision"). A user must never see a console flash.
                 windowsHide: true,
                 shell: viaShell,
                 // 18a Slice 7: stdin is a pipe only where the prompt travels down it.
-                stdio: [viaShell ? 'pipe' : 'ignore', 'pipe', 'pipe'],
+                stdio: ['pipe', 'pipe', 'pipe'],
+                detached: process.platform !== 'win32',
                 // !Cleanup Phase 2 (I5) — the worker starts inside the work item's own
                 // checkout instead of at the daemon's cwd (`/` under launchd).
                 cwd: childCwd,
@@ -3849,17 +3831,15 @@ export async function spawnAgent(agent, prompt, timeoutMs = ORCHESTRATOR_SPAWN_T
             /* Nothing was spawned, so nothing can still be holding the directory. */
             if (codexHome)
                 removeCodexRunHome(codexHome);
-            return resolve(spawnFailure(agent, err));
+            return resolve({ ...spawnFailure(agent, err), ...(owned?.interrupted() ? { interrupted: true } : {}) });
         }
         /* 18a SLICE 7 — AND THE PROMPT GOES DOWN IT, then the pipe is CLOSED.
            Both agents wait for end-of-input before they start, so leaving it open
            hangs the run forever. The write is best-effort in the same sense every
            other pipe operation here is: a child that died before reading raises
            EPIPE, and that is the child's exit to report, not this write's. */
-        if (viaShell && child.stdin) {
-            child.stdin.on('error', () => { });
-            child.stdin.end(prompt);
-        }
+        let registration = Promise.resolve();
+        child.stdin?.on('error', () => { });
         /* !Cleanup Phase 6b (I43) — hand the pid up the moment it exists, so the
            liveness watch can tell a dead agent from a quiet one. Guarded on
            `typeof`: a child that failed to spawn has no pid, and reporting
@@ -4020,9 +4000,24 @@ export async function spawnAgent(agent, prompt, timeoutMs = ORCHESTRATOR_SPAWN_T
                it stripped to '', the column would take null and the card would lose
                the context its question needs. `redactSecrets` is identity when the run
                read no credential, which is almost every run. */
-            resolve(result.output
-                ? { ...result, output: redactSecrets(runTodoId, result.output) }
-                : result);
+            void (async () => {
+                await registration.catch(() => { });
+                if (owned && typeof child.pid === 'number') {
+                    for (;;) {
+                        try {
+                            await owned.exited();
+                            break;
+                        }
+                        catch {
+                            await new Promise((done) => setTimeout(done, 250));
+                        }
+                    }
+                }
+                if (codexHome && owned)
+                    removeCodexRunHome(codexHome);
+                resolve({ ...(result.output ? { ...result, output: redactSecrets(runTodoId, result.output) } : result),
+                    ...(owned?.interrupted() ? { interrupted: true } : {}) });
+            })();
         };
         /* ═══ 18c SLICE 8 — THE HOME IS SWEPT WHEN THE CHILD IS GONE, NOT WHEN THE
                PROMISE SETTLES. ═══
@@ -4058,7 +4053,8 @@ export async function spawnAgent(agent, prompt, timeoutMs = ORCHESTRATOR_SPAWN_T
             sweptHome = true;
             removeCodexRunHome(codexHome);
         };
-        child.on('close', sweepHomeWhenChildIsGone);
+        if (!owned)
+            child.on('close', sweepHomeWhenChildIsGone);
         /* !Cleanup PHASE 6b (I42) — THE ELAPSED-TIME KILL IS OFF BY DEFAULT NOW.
            User ruling 2026-08-06: "No agent that is actively working should ever be
            killed automatically, regardless of how much time has elapsed."
@@ -4186,7 +4182,7 @@ export async function spawnAgent(agent, prompt, timeoutMs = ORCHESTRATOR_SPAWN_T
                    401 that means signed out. Each tailed separately so a chatty stdout
                    cannot push stderr out of the window. */
                 const saidTail = `${stdout.slice(-STDERR_TAIL_BYTES)}\n${stderrTail}`;
-                return settle({ ok: false, output: '', error: `${agent} ${how}`, saidTail });
+                return settle({ ok: false, output: '', error: `${agent} ${how}`, saidTail, failureKind: nativeFailureKind(stdout, stderrTail) });
             }
             /* 18c SLICE 8 — CODEX CAN EXIT 0 ON A TURN THAT FAILED, so the exit code
                above is not the last word. Checked AFTER the code, because a non-zero
@@ -4196,7 +4192,7 @@ export async function spawnAgent(agent, prompt, timeoutMs = ORCHESTRATOR_SPAWN_T
                release path, like every other failure, so the unit is retried. */
             if (codexTurnFailed !== null) {
                 const saidTail = `${stdout.slice(-STDERR_TAIL_BYTES)}\n${stderrTail}`;
-                return settle({ ok: false, output: '', error: `${agent} ${codexTurnFailed}`, saidTail });
+                return settle({ ok: false, output: '', error: `${agent} ${codexTurnFailed}`, saidTail, failureKind: nativeFailureKind(stdout, stderrTail) });
             }
             /* PREFER WHAT WAS CAPTURED LIVE, FOR BOTH HARNESSES (18c Slice 8 — it used
                to be claude only). `stdout` is now the fallback only for a run that
@@ -4214,6 +4210,18 @@ export async function spawnAgent(agent, prompt, timeoutMs = ORCHESTRATOR_SPAWN_T
                way: anything parseable was already captured live above. */
             settle(finishSpawn(agent, stdout));
         });
+        registration = owned ? owned.register(child) : Promise.resolve();
+        void registration.then(() => {
+            if (!owned?.interrupted()) {
+                if (owned)
+                    releaseOwnedProcess(child);
+                child.stdin?.end(prompt);
+            }
+        }).catch((error) => {
+            child.stdin?.destroy();
+            killTree(child);
+            settle(spawnFailure(agent, error));
+        });
     });
 }
 /**
@@ -4401,7 +4409,7 @@ export async function startWorker(client, todoId, machineId, agent, warn = conso
 /** Move a worker through its lifecycle. `died` REQUIRES a reason — the table's
  *  check constraint refuses the row otherwise, deliberately: a failure the panel
  *  cannot explain gives the user nothing to act on. */
-export async function updateWorker(client, workerId, state, error = null, warn = console.warn) {
+export async function updateWorker(client, workerId, state, error = null, warn = console.warn, strict = false) {
     if (!workerId)
         return;
     try {
@@ -4412,11 +4420,14 @@ export async function updateWorker(client, workerId, state, error = null, warn =
         const { error: writeError } = await client
             .from('cliv2_workers')
             .update(patch)
-            .eq('id', workerId);
+            .eq('id', workerId)
+            .in('state', ['working', 'dispatching']);
         if (writeError)
             throw writeError;
     }
     catch (err) {
+        if (strict)
+            throw err;
         warn(`[orchestrator] could not update the worker: ${err.message}`);
     }
 }
@@ -4596,6 +4607,11 @@ export async function reapDeadWorkers(client, machineId, livePids, now = () => n
         const cutoff = now().getTime() - STALE_WORKER_MS;
         let reaped = 0;
         for (const row of rows) {
+            if (hasOwnedWorkContext() && ownedWorkerExecutionHeld(row.id))
+                continue;
+            const claimedAt = hasOwnedWorkContext() ? ownedWorkerClaimedAt(row.id) : undefined;
+            if (claimedAt === null)
+                continue;
             /* CONDITION 1 — quiet. A worker that has written a step recently is
                working, and nothing else is even considered. */
             const seen = Date.parse(row.updated_at);
@@ -4641,7 +4657,9 @@ export async function reapDeadWorkers(client, machineId, livePids, now = () => n
                    card everything Slices 5 and 6 already draw (the attempt, the
                    reason, the countdown) for free, and at the bound it gives up and
                    says why instead of being fed back into the same machine. */
-                const { fate, attempts } = await releaseOrFail(client, row.todo_id, plain, now().getTime());
+                const { fate, attempts } = await releaseOrFail(client, row.todo_id, plain, now().getTime(), claimedAt);
+                if (fate === 'stale')
+                    continue;
                 /* 18c SLICE 9 (GAP 15): AND IT HOLDS NOTHING ANY MORE.
                    THIS PATH NEEDS ITS OWN CALL and is not covered by `dispatchClaim`'s
                    `finally`: the reaper exists precisely for a worker that died while
@@ -4705,6 +4723,7 @@ export async function reapDeadWorkers(client, machineId, livePids, now = () => n
  */
 export async function recoverStrandedWorkers(client, machineId, log = console.log, warn = console.warn) {
     try {
+        const lifecycleOwned = hasOwnedWorkContext();
         const { data, error } = await client
             .from('cliv2_workers')
             .update({
@@ -4732,7 +4751,11 @@ export async function recoverStrandedWorkers(client, machineId, log = console.lo
         /* The todo goes back in the queue. Order matters: the worker is closed
            FIRST, so there is no instant at which a claimable todo still has a live
            worker that would refuse the dispatch. */
-        for (const row of stranded) {
+        // Lifecycle startup has already reconciled exact attempt receipts. A stale
+        // worker row can outlive a newer claim, including one on another machine;
+        // closing that obsolete worker must never release the newer assignment.
+        // Keep the pre-lifecycle compatibility path only for its existing callers.
+        for (const row of lifecycleOwned ? [] : stranded) {
             try {
                 await releaseTodo(client, row.todo_id);
             }
@@ -5287,7 +5310,7 @@ export async function orchestratorTick(deps) {
        query, so a tick that cannot start anything costs nothing at all — no read,
        no claim, no log. Was `if (state.busy)`, which is why a second request typed
        three seconds after the first sat untouched until the first finished.
-  
+       *
        THE SLOT IS TAKEN HERE, NOT AFTER THE CLAIM, and that is not tidiness — it
        is the difference between a cap and a suggestion. `pollOrchestrator` is an
        interval that does NOT await, so ticks genuinely overlap, and there are
@@ -5297,7 +5320,7 @@ export async function orchestratorTick(deps) {
        the cap would bound nothing. Taking the slot before the first await makes
        the check-and-take atomic with respect to the event loop, because there is
        no suspension point between them.
-  
+       *
        EVERY early return below MUST give it back, which is why the whole body from
        here down is wrapped so the release is in one place rather than repeated at
        each `return`. */
@@ -5305,8 +5328,14 @@ export async function orchestratorTick(deps) {
         return 'busy';
     state.inFlight += 1;
     try {
+        await reconcileInterruptedWork(deps.client, deps.machineId, deps.observeHarness);
         return await runTick(deps, state, now, log, warn);
     }
+    catch (error) {
+        // This supervising tick must survive an outage and retry its saved recovery.
+        warn(`orchestrator poll failed, will retry: ${error instanceof Error ? error.message : JSON.stringify(error)}`);
+        return 'failed';
+    }
     finally {
         state.inFlight -= 1;
     }
@@ -5314,208 +5343,230 @@ export async function orchestratorTick(deps) {
 /** The tick body, with its concurrency slot already taken. Split out so the slot
  *  is released in exactly one place — see the caller. */
 async function runTick(deps, state, now, log, warn) {
-    /* Only what CHOOSING a unit needs. The spawn's own inputs (`spawn`,
-       `mcpServer`) are destructured in `dispatchClaim`, where they are used.
-       `resolveContext` is needed in BOTH: here it answers "which repo would this
-       touch" for the collision read, and there it answers "where does the worker
-       start" — deliberately the same resolver, so the two cannot disagree. */
-    const { client, userId, machineId, machineName, agents, resolveContext = (claim) => resolveClaimContext(client, claim, warn), } = deps;
-    /* 18a SLICE 6: THE BACKOFF USED TO BE CHECKED HERE, and returning from this
-       line is precisely what was wrong with it: a failing agent stopped the whole
-       daemon rather than stopping itself. The wait is now per request, on the row,
-       and the claim itself skips a request whose moment has not come. */
-    let role;
+    if (!ownedWorkAllowed())
+        return 'nothing-to-do';
+    const endClaim = beginOwnedClaim();
+    const claimOperations = [];
     try {
-        const { data, error } = await client
-            .from('cliv2_orchestrator_preference')
-            .select('machine_id, agent')
-            .eq('user_id', userId)
-            .maybeSingle();
-        if (error)
-            throw error;
-        role = resolveOrchestratorRole(data ?? null, machineId, agents);
-    }
-    catch (err) {
-        // Do NOT fall through to a claim on a failed read: an unreadable designation
-        // is not a designation, and guessing would be exactly the fleet-wide race
-        // the machine check exists to prevent.
-        warn(`orchestrator designation read failed, will retry: ${err.message}`);
-        return 'failed';
-    }
-    reportRole(state, role, machineName, log);
-    if (role.kind !== 'this-machine')
-        return 'not-designated';
-    /* ═══ 18d — NO TOOLS MEANS NO DISPATCH. ═══
-  
-       FOUND BY WALKING IT, 2026-08-12. A daemon restart raced its own port: the
-       replacement process came up while the old one still held 4579, so
-       `toolsServerStatus().running` was false, `presence.ts` passed
-       `mcpServer: null`, and the very next tick claimed a request and spawned a
-       worker WITH NO CTRL+SPC TOOLS AT ALL. That worker could not read the work
-       item, could not read its own stage document, could not call `ask_question`
-       and could not `hand_off_stage`. It did the only thing left: it wrote an
-       essay into its final answer explaining that the tools were missing, and the
-       request was burned — `attempts` spent, the user's card finished, and
-       nothing to show for it.
-  
-       Null is the RIGHT value there: the alternative that comment rejects is
-       letting the worker inherit the user's own agent config, where a second
-       CTRL+SPC server pointed at a DIFFERENT ACCOUNT was once found registered and
-       listening. That is worse. But there was a third option nobody took, which is
-       to not dispatch at all.
-  
-       WAITING IS FREE AND CORRECT. The request keeps its place, unclaimed and
-       unspent, and the tools server comes up moments later — the port race
-       resolves as soon as the old process lets go. A dispatch made in this window
-       cannot be retried usefully, because it is not the request that is broken.
-  
-       BEFORE THE CLAIM, deliberately: claiming and then refusing to spawn would
-       spend `attempts` on a condition that has nothing to do with the request.
-  
-       THE CONDITION IS "A REAL SPAWN WITH NO SERVER", not "no server". An injected
-       `spawn` is a caller who has taken over the launching entirely — every test in
-       the suite, and any future embedder — and for them `mcpServer` describes
-       nothing, because `defaultSpawn` is what turns it into an argv. Gating on the
-       null alone would refuse to dispatch in exactly the cases where the tools are
-       not in question, which is not a stricter check but a wrong one. */
-    if (!deps.mcpServer && !deps.spawn) {
-        reportNoTools(state, warn);
-        return 'no-tools';
-    }
-    state.warnedNoTools = false;
-    /* ═══ !Cleanup PHASE 7 SLICE 2: CLAIM PAST THE BLOCKED ONES. ═══
-  
-       A dependent unit must WAIT, and everything behind it must NOT. Those two
-       requirements together are why this is a loop rather than a single claim.
-  
-       The claim is this design's only queue position, and it takes the OLDEST
-       claimable row. So a blocked unit that is merely released is re-claimed FIRST
-       on the very next tick, forever — it stops being a waiting unit and becomes a
-       queue stopper. Releasing it AND telling the next claim to skip it is what
-       makes the rest of the queue reachable.
-  
-       BOUNDED BY THE NUMBER OF UNITS SKIPPED, not by a fixed count: each iteration
-       either dispatches (returns), finds nothing (returns), or adds exactly one id
-       to `skip`, and a skipped id can never be claimed again this tick. So the
-       loop runs at most once per blocked unit and then ends. No timeout needed,
-       because it cannot revisit a row.
-  
-       THE UNIT STAYS `working` AND UNCLAIMED, deliberately — it is NOT parked to
-       `needs-input` the way the scope gate parks. `needs-input` means "this needs
-       YOU", and a dependency needs nothing from the user: it resolves when the
-       blocker finishes. Parking it would put a card under "Needs you" offering no
-       action, which is precisely the defect Phase 1 existed to remove. The panel
-       reads the same `blocked_tasks` view and renders "Waiting on <name>" from it,
-       so the card explains itself without a state that lies. */
-    const skip = [];
-    let blockedCount = 0;
-    for (;;) {
-        let claim;
+        /* Only what CHOOSING a unit needs. The spawn's own inputs (`spawn`,
+           `mcpServer`) are destructured in `dispatchClaim`, where they are used.
+           `resolveContext` is needed in BOTH: here it answers "which repo would this
+           touch" for the collision read, and there it answers "where does the worker
+           start" — deliberately the same resolver, so the two cannot disagree. */
+        const { client, userId, machineId, machineName, agents, resolveContext = (claim) => resolveClaimContext(client, claim, warn), } = deps;
+        /* 18a SLICE 6: THE BACKOFF USED TO BE CHECKED HERE, and returning from this
+           line is precisely what was wrong with it: a failing agent stopped the whole
+           daemon rather than stopping itself. The wait is now per request, on the row,
+           and the claim itself skips a request whose moment has not come. */
+        const recovered = hasOwnedWorkContext() ? recoveredRpcClaims('cli').find(row => row.action === 'cliv2_claim_next_loose_todo' && agents.includes(row.args?.p_agent)) : undefined;
+        let role;
         try {
-            claim = await claimNextTodo(client, machineId, role.agent, skip);
+            const { data, error } = await client
+                .from('cliv2_orchestrator_preference')
+                .select('machine_id, agent')
+                .eq('user_id', userId)
+                .maybeSingle();
+            if (error)
+                throw error;
+            role = resolveOrchestratorRole(data ?? null, machineId, agents);
         }
         catch (err) {
-            warn(`orchestrator poll failed, will retry: ${err.message}`);
-            return 'failed';
+            // Do NOT fall through to a claim on a failed read: an unreadable designation
+            // is not a designation, and guessing would be exactly the fleet-wide race
+            // the machine check exists to prevent.
+            warn(`orchestrator designation read failed, will retry: ${err.message}`);
+            if (!recovered)
+                return 'failed';
+            role = { kind: 'none' };
         }
-        if (!claim) {
-            /* Nothing claimable. If we skipped something, the queue is not empty —
-               it is WAITING, which is a different fact and must not be logged as
-               idleness. */
-            return blockedCount > 0 ? 'blocked' : 'nothing-to-do';
+        if (recovered)
+            role = { kind: 'this-machine', agent: recovered.args.p_agent };
+        reportRole(state, role, machineName, log);
+        if (role.kind !== 'this-machine')
+            return 'not-designated';
+        /* ═══ 18d — NO TOOLS MEANS NO DISPATCH. ═══
+           *
+           FOUND BY WALKING IT, 2026-08-12. A daemon restart raced its own port: the
+           replacement process came up while the old one still held 4579, so
+           `toolsServerStatus().running` was false, `presence.ts` passed
+           `mcpServer: null`, and the very next tick claimed a request and spawned a
+           worker WITH NO CTRL+SPC TOOLS AT ALL. That worker could not read the work
+           item, could not read its own stage document, could not call `ask_question`
+           and could not `hand_off_stage`. It did the only thing left: it wrote an
+           essay into its final answer explaining that the tools were missing, and the
+           request was burned — `attempts` spent, the user's card finished, and
+           nothing to show for it.
+           *
+           Null is the RIGHT value there: the alternative that comment rejects is
+           letting the worker inherit the user's own agent config, where a second
+           CTRL+SPC server pointed at a DIFFERENT ACCOUNT was once found registered and
+           listening. That is worse. But there was a third option nobody took, which is
+           to not dispatch at all.
+           *
+           WAITING IS FREE AND CORRECT. The request keeps its place, unclaimed and
+           unspent, and the tools server comes up moments later — the port race
+           resolves as soon as the old process lets go. A dispatch made in this window
+           cannot be retried usefully, because it is not the request that is broken.
+           *
+           BEFORE THE CLAIM, deliberately: claiming and then refusing to spawn would
+           spend `attempts` on a condition that has nothing to do with the request.
+           *
+           THE CONDITION IS "A REAL SPAWN WITH NO SERVER", not "no server". An injected
+           `spawn` is a caller who has taken over the launching entirely — every test in
+           the suite, and any future embedder — and for them `mcpServer` describes
+           nothing, because `defaultSpawn` is what turns it into an argv. Gating on the
+           null alone would refuse to dispatch in exactly the cases where the tools are
+           not in question, which is not a stricter check but a wrong one. */
+        if (!deps.mcpServer && !deps.spawn) {
+            reportNoTools(state, warn);
+            return 'no-tools';
         }
-        /* ═══ THE TWO REASONS WORK WAITS, ASKED IN ORDER. ═══
-    
-           A DEPENDENCY IS ASKED FIRST, and the order is meaningful rather than
-           incidental: a dependency is a FACT about what must happen before what,
-           while a collision is a CHOICE to serialise safely. When both are true the
-           user is better told the one that will not change on its own — a collision
-           clears the moment the other agent releases, a dependency does not clear
-           until the blocker is finished.
-    
-           Slice 3 adds the second. Both hold the SAME WAY (release, skip, report
-           once), so the shared tail below is written once rather than twice. */
-        const blocker = await blockerForTodo(client, claim.id, warn);
-        /* THE CODEBASE COMES FROM `resolveContext`, the SAME resolver the dispatch
-           uses to choose the worker's working directory — not a second lookup that
-           could disagree with it. A reservation is scoped by `git_remote_url`, so
-           "which repo would this run touch" and "which repo will it start in" have
-           to be one answer. Only reached when there is no dependency, so an ordinary
-           dispatchable request costs one extra read, not two. */
-        /* ═══ 18b SLICE 4 — THE CODEBASE THE USER CHOSE, AND THE FAN-OUT. ═══
-    
-           Read BEFORE the context is resolved, because it is an input to it: given a
-           choice, the resolver treats the project as if that one codebase were its
-           only one, and the ambiguity never arises.
-    
-           MORE THAN ONE CHOSEN MEANS MORE THAN ONE RUN (user ruling, 2026-08-07).
-           This tick dispatches the FIRST; `spawnSiblingRuns` below creates a sibling
-           request for each of the rest, which the daemon then claims on its own
-           ticks exactly like any other request. Each run carries ONE codebase and
-           starts in that codebase's own checkout, wherever it is on disk — nothing
-           here reads folder layout, which is the whole of the location ruling.
-    
-           Nothing changes for a request that was never asked: `chosen` is empty, the
-           claim carries null, and every path below behaves as it did in Slice 2. */
-        /* A SIBLING ALREADY KNOWS ITS OWN, and asks nothing. `chosen_codebase` comes
-           down on the claim itself (this slice's migration), so a fanned-out run
-           needs no ask to read and cannot fan out again — which is what stops the
-           fan-out being infinite. Only a request that was ASKED reads the answer. */
-        const chosen = blocker
-            ? []
-            : claim.chosenCodebase
-                ? [claim.chosenCodebase]
-                : await readChosenCodebases(client, claim.id, warn);
-        const runClaim = chosen.length > 0
-            ? { ...claim, chosenCodebase: chosen[0] }
-            : claim;
-        const context = blocker ? null : await resolveContext(runClaim);
-        const collision = context
-            ? await collisionForTodo(client, claim.id, context.gitRemoteUrl, warn)
-            : null;
-        if (!blocker && !collision) {
-            /* NO LONGER WAITING, so the next time it does wait it is reported again.
-               Without this, a unit that blocked, ran, and blocked again on something
-               else would stay silent forever. */
-            state.reportedWaiting.delete(claim.id);
-            /* THE RESOLVED CONTEXT IS HANDED ON rather than resolved again. It reads
-               several tables and touches the filesystem, and the dispatch needs the
-               very same answer — resolving twice would both cost a second pass and
-               allow the collision check and the working directory to disagree. */
-            /* THE SIBLINGS ARE CREATED BEFORE THIS RUN DISPATCHES, so a user who chose
-               three codebases sees three cards immediately rather than one that
-               mysteriously multiplies later. Best-effort: a failed sibling costs that
-               codebase its run, and is logged; it must not cost the user the run that
-               is about to start. */
-            if (chosen.length > 1) {
-                await spawnSiblingRuns(client, claim, chosen.slice(1), log, warn);
+        state.warnedNoTools = false;
+        /* ═══ !Cleanup PHASE 7 SLICE 2: CLAIM PAST THE BLOCKED ONES. ═══
+           *
+           A dependent unit must WAIT, and everything behind it must NOT. Those two
+           requirements together are why this is a loop rather than a single claim.
+           *
+           The claim is this design's only queue position, and it takes the OLDEST
+           claimable row. So a blocked unit that is merely released is re-claimed FIRST
+           on the very next tick, forever — it stops being a waiting unit and becomes a
+           queue stopper. Releasing it AND telling the next claim to skip it is what
+           makes the rest of the queue reachable.
+           *
+           BOUNDED BY THE NUMBER OF UNITS SKIPPED, not by a fixed count: each iteration
+           either dispatches (returns), finds nothing (returns), or adds exactly one id
+           to `skip`, and a skipped id can never be claimed again this tick. So the
+           loop runs at most once per blocked unit and then ends. No timeout needed,
+           because it cannot revisit a row.
+           *
+           THE UNIT STAYS `working` AND UNCLAIMED, deliberately — it is NOT parked to
+           `needs-input` the way the scope gate parks. `needs-input` means "this needs
+           YOU", and a dependency needs nothing from the user: it resolves when the
+           blocker finishes. Parking it would put a card under "Needs you" offering no
+           action, which is precisely the defect Phase 1 existed to remove. The panel
+           reads the same `blocked_tasks` view and renders "Waiting on <name>" from it,
+           so the card explains itself without a state that lies. */
+        const skip = [];
+        let blockedCount = 0;
+        for (;;) {
+            let claim;
+            try {
+                claim = await claimNextTodo(client, machineId, role.agent, [...skip, ...legacyHeldTodoIds()], !!recovered);
+                if (claim?.claimOperationId)
+                    claimOperations.push(claim.claimOperationId);
             }
-            return await dispatchClaim(deps, state, now, log, warn, role, runClaim, context, chosen);
-        }
-        /* SAID ONCE PER (unit, REASON) — see `reportedWaiting`. The tick runs every
-           3s and this branch is reached on every one of them for as long as the wait
-           holds. The key carries the reason, not just the unit, so a request that
-           stops waiting on a dependency and starts waiting on a FILE says so. */
-        const waitKey = blocker
-            ? `dep:${blocker.dependsOnId}`
-            : `path:${collision.heldBySessionId}:${collision.path}`;
-        const waitLine = blocker
-            ? `is waiting on "${blocker.dependsOnName}"`
-            : `is waiting on the same files as "${collision.heldByInstruction ?? 'another run'}"`
-                + ` (${collision.path}${collision.pathCount > 1 ? ` and ${collision.pathCount - 1} more` : ''})`;
-        if (state.reportedWaiting.get(claim.id) !== waitKey) {
-            state.reportedWaiting.set(claim.id, waitKey);
-            log(`[orchestrator] "${claim.instruction}" (${shortId(claim.id)}) ${waitLine} — not dispatching`);
+            catch (err) {
+                warn(`orchestrator poll failed, will retry: ${err.message}`);
+                return 'failed';
+            }
+            if (!claim) {
+                /* Nothing claimable. If we skipped something, the queue is not empty —
+                   it is WAITING, which is a different fact and must not be logged as
+                   idleness. */
+                return blockedCount > 0 ? 'blocked' : 'nothing-to-do';
+            }
+            /* ═══ THE TWO REASONS WORK WAITS, ASKED IN ORDER. ═══
+             *
+               A DEPENDENCY IS ASKED FIRST, and the order is meaningful rather than
+               incidental: a dependency is a FACT about what must happen before what,
+               while a collision is a CHOICE to serialise safely. When both are true the
+               user is better told the one that will not change on its own — a collision
+               clears the moment the other agent releases, a dependency does not clear
+               until the blocker is finished.
+             *
+               Slice 3 adds the second. Both hold the SAME WAY (release, skip, report
+               once), so the shared tail below is written once rather than twice. */
+            const blocker = await blockerForTodo(client, claim.id, warn);
+            /* THE CODEBASE COMES FROM `resolveContext`, the SAME resolver the dispatch
+               uses to choose the worker's working directory — not a second lookup that
+               could disagree with it. A reservation is scoped by `git_remote_url`, so
+               "which repo would this run touch" and "which repo will it start in" have
+               to be one answer. Only reached when there is no dependency, so an ordinary
+               dispatchable request costs one extra read, not two. */
+            /* ═══ 18b SLICE 4 — THE CODEBASE THE USER CHOSE, AND THE FAN-OUT. ═══
+             *
+               Read BEFORE the context is resolved, because it is an input to it: given a
+               choice, the resolver treats the project as if that one codebase were its
+               only one, and the ambiguity never arises.
+             *
+               MORE THAN ONE CHOSEN MEANS MORE THAN ONE RUN (user ruling, 2026-08-07).
+               This tick dispatches the FIRST; `spawnSiblingRuns` below creates a sibling
+               request for each of the rest, which the daemon then claims on its own
+               ticks exactly like any other request. Each run carries ONE codebase and
+               starts in that codebase's own checkout, wherever it is on disk — nothing
+               here reads folder layout, which is the whole of the location ruling.
+             *
+               Nothing changes for a request that was never asked: `chosen` is empty, the
+               claim carries null, and every path below behaves as it did in Slice 2. */
+            /* A SIBLING ALREADY KNOWS ITS OWN, and asks nothing. `chosen_codebase` comes
+               down on the claim itself (this slice's migration), so a fanned-out run
+               needs no ask to read and cannot fan out again — which is what stops the
+               fan-out being infinite. Only a request that was ASKED reads the answer. */
+            const chosen = blocker
+                ? []
+                : claim.chosenCodebase
+                    ? [claim.chosenCodebase]
+                    : await readChosenCodebases(client, claim.id, warn);
+            const runClaim = chosen.length > 0
+                ? { ...claim, chosenCodebase: chosen[0] }
+                : claim;
+            const context = blocker ? null : await resolveContext(runClaim);
+            const collision = context
+                ? await collisionForTodo(client, claim.id, context.gitRemoteUrl, warn)
+                : null;
+            if (!blocker && !collision) {
+                /* NO LONGER WAITING, so the next time it does wait it is reported again.
+                   Without this, a unit that blocked, ran, and blocked again on something
+                   else would stay silent forever. */
+                state.reportedWaiting.delete(claim.id);
+                /* THE RESOLVED CONTEXT IS HANDED ON rather than resolved again. It reads
+                   several tables and touches the filesystem, and the dispatch needs the
+                   very same answer — resolving twice would both cost a second pass and
+                   allow the collision check and the working directory to disagree. */
+                /* THE SIBLINGS ARE CREATED BEFORE THIS RUN DISPATCHES, so a user who chose
+                   three codebases sees three cards immediately rather than one that
+                   mysteriously multiplies later. Best-effort: a failed sibling costs that
+                   codebase its run, and is logged; it must not cost the user the run that
+                   is about to start. */
+                if (chosen.length > 1) {
+                    await spawnSiblingRuns(client, claim, chosen.slice(1), log, warn);
+                }
+                const dispatched = dispatchClaim(deps, state, now, log, warn, role, runClaim, context, chosen);
+                if (hasOwnedWorkContext())
+                    finishRpcClaims(claimOperations, true);
+                endClaim();
+                return await dispatched;
+            }
+            /* SAID ONCE PER (unit, REASON) — see `reportedWaiting`. The tick runs every
+               3s and this branch is reached on every one of them for as long as the wait
+               holds. The key carries the reason, not just the unit, so a request that
+               stops waiting on a dependency and starts waiting on a FILE says so. */
+            const waitKey = blocker
+                ? `dep:${blocker.dependsOnId}`
+                : `path:${collision.heldBySessionId}:${collision.path}`;
+            const waitLine = blocker
+                ? `is waiting on "${blocker.dependsOnName}"`
+                : `is waiting on the same files as "${collision.heldByInstruction ?? 'another run'}"`
+                    + ` (${collision.path}${collision.pathCount > 1 ? ` and ${collision.pathCount - 1} more` : ''})`;
+            if (state.reportedWaiting.get(claim.id) !== waitKey) {
+                state.reportedWaiting.set(claim.id, waitKey);
+                log(`[orchestrator] "${claim.instruction}" (${shortId(claim.id)}) ${waitLine} — not dispatching`);
+            }
+            /* RELEASED, so that the moment the blocker is done the ordinary claim picks
+               it up with no user action and no special path. That is the Gherkin line
+               "123.1 starts without my intervention", and it is why this must not keep
+               the claim the way `parkTodoForScope` does. */
+            await releaseTodo(client, claim.id, claim.claimedAt).catch((err) => {
+                warn(`could not release a blocked todo: ${err.message}`);
+            });
+            skip.push(claim.id);
+            blockedCount += 1;
         }
-        /* RELEASED, so that the moment the blocker is done the ordinary claim picks
-           it up with no user action and no special path. That is the Gherkin line
-           "123.1 starts without my intervention", and it is why this must not keep
-           the claim the way `parkTodoForScope` does. */
-        await releaseTodo(client, claim.id).catch((err) => {
-            warn(`could not release a blocked todo: ${err.message}`);
-        });
-        skip.push(claim.id);
-        blockedCount += 1;
+    }
+    finally {
+        if (hasOwnedWorkContext())
+            finishRpcClaims(claimOperations, true);
+        endClaim();
     }
 }
 /**
@@ -5549,10 +5600,14 @@ async function runTick(deps, state, now, log, warn) {
  * returns is not a funnel.
  */
 async function dispatchClaim(deps, state, now, log, warn, role, claim, context, chosenCodebases = []) {
+    const owned = hasOwnedWorkContext() ? reserveOwnedWork({ surface: 'worker', todoId: claim.id, workerId: null, claimedAt: claim.claimedAt, observedPendingMessageIds: null }, role.agent) : undefined;
     try {
-        return await dispatchClaimInner(deps, state, now, log, warn, role, claim, context, chosenCodebases);
+        const outcome = await dispatchClaimInner(deps, state, now, log, warn, role, claim, context, chosenCodebases, owned);
+        owned?.complete();
+        return outcome;
     }
     finally {
+        owned?.finishPreparation();
         /* THE RUN IS OVER, SO IT HOLDS NOTHING, however it ended and wherever it
            returned from. Best-effort by contract: `releaseTodoReservations` never
            throws, so this cannot change what the body returned, and a `finally`
@@ -5567,6 +5622,57 @@ async function dispatchClaim(deps, state, now, log, warn, role, claim, context,
         forgetSecrets(claim.id);
     }
 }
+async function settleWorkerOutcome(client, workerId, claim, role, result, targeted, now, startedAt, log, warn, saved, persist, onAccepted) {
+    let disposition = saved?.disposition;
+    if (!disposition) {
+        if (!result.ok) {
+            const kind = result.failureKind ?? nativeFailureKind(result.saidTail ?? '');
+            const reason = failureMessage(role.agent, kind);
+            disposition = { worker: 'died', reason, todo: kind === 'transient' ? 'retry' : 'failed' };
+        }
+        else if (await todoHasOpenAsk(client, claim.id, warn, true)) {
+            disposition = { worker: 'done', reason: '', todo: 'needs-input' };
+        }
+        else if (!await todoRunLeftATrace(client, claim.id, warn, targeted, true)) {
+            disposition = { worker: 'died', reason: NOTHING_RECORDED_REASON, todo: 'retry' };
+        }
+        else
+            disposition = { worker: 'done', reason: '', todo: 'done' };
+        if (saved) {
+            saved.disposition = disposition;
+            persist?.(saved);
+        }
+    }
+    if (disposition.todo === 'needs-input') {
+        const accepted = await suspendTodoForAsk(client, claim.id, result.output, claim.claimedAt);
+        if (accepted)
+            onAccepted?.();
+        await updateWorker(client, workerId, 'done', null, warn, true);
+        log(`[orchestrator] ${shortId(claim.id)} is waiting on the user`);
+        return 'answered';
+    }
+    if (disposition.todo === 'done') {
+        const accepted = await answerTodo(client, claim.id, result.output, claim.claimedAt);
+        if (accepted)
+            onAccepted?.();
+        await updateWorker(client, workerId, 'done', null, warn, true);
+        log(`[orchestrator] answered ${shortId(claim.id)} in ${((now().getTime() - startedAt) / 1000).toFixed(1)}s`);
+        return 'answered';
+    }
+    await updateWorker(client, workerId, 'died', disposition.reason, warn, true);
+    const { fate, attempts } = disposition.todo === 'retry'
+        ? await releaseOrFail(client, claim.id, disposition.reason, now().getTime(), claim.claimedAt)
+        : await failClaimedTodo(client, claim.id, disposition.reason, claim.claimedAt ?? null);
+    if (fate === 'stale')
+        return 'nothing-to-do';
+    onAccepted?.();
+    if (fate === 'failed') {
+        warn(`[orchestrator] ${shortId(claim.id)} failed: ${disposition.reason}`);
+        return 'failed';
+    }
+    warn(`[orchestrator] retrying ${shortId(claim.id)} in ${Math.round(retryDelayMs(attempts) / 1000)}s`);
+    return 'released';
+}
 async function dispatchClaimInner(deps, state, now, log, warn, role, claim, 
 /* !Cleanup Phase 7 Slice 3 — RESOLVED BY THE CALLER, and passed in rather than
    resolved again here. `runTick` needs the same answer first, to know which
@@ -5577,7 +5683,7 @@ context,
 /** 18b Slice 4 — every codebase the user chose, including this run's own. The
  *  siblings are derived from it below; empty on every request that was never
  *  asked, which is the ordinary case. */
-chosenCodebases = []) {
+chosenCodebases = [], owned) {
     const { client, machineId, mcpServer = null, spawn = defaultSpawn(mcpServer), } = deps;
     /* ═══ 16g SLICE 1 — THE SECOND ENFORCEMENT POINT. ═══
        `No approved scope-version pointer → no execution write and no coding lane.`
@@ -5638,7 +5744,7 @@ chosenCodebases = []) {
            uses the mirror of this: answering an ask CLEARS the claim to make the
            work dispatchable again — so approving scope re-dispatches through the
            path that already exists, with no new mechanism. */
-        await parkTodoForScope(client, claim.id).catch((err) => {
+        await parkTodoForScope(client, claim.id, claim.claimedAt).catch((err) => {
             warn(`could not park an unapproved todo: ${err.message}`);
         });
         return 'nothing-to-do';
@@ -5665,7 +5771,7 @@ chosenCodebases = []) {
        hold a dead end too. Building stays held exactly as shipped. */
     if (targeted && building && await todoIsHeldForScope(client, claim.id)) {
         log(`[orchestrator] "${claim.instruction}" has an unresolved scope change — not dispatching`);
-        await parkTodoForScope(client, claim.id).catch((err) => {
+        await parkTodoForScope(client, claim.id, claim.claimedAt).catch((err) => {
             warn(`could not park a held todo: ${err.message}`);
         });
         return 'nothing-to-do';
@@ -5682,6 +5788,7 @@ chosenCodebases = []) {
     let workerId = null;
     /* !Cleanup Phase 6b (I43) — outside the try for the same reason: the `finally`
        has to remove it from `livePids` however this run ended. */
+    let terminalDeferred = false;
     let spawnedPid = null;
     try {
         log(`[orchestrator] picked up "${claim.instruction}" (${shortId(claim.id)})`);
@@ -5801,7 +5908,7 @@ chosenCodebases = []) {
            with the words it had in Slice 2: never parked with no question on it,
            which the user could only clear with Stop. */
         if (context.miss?.kind === 'ambiguous-codebase' && instructionNeedsCheckout(claim.instruction)) {
-            const asked = await askWhichCodebase(client, claim.id, context.miss.projectName, context.miss.gitRemoteUrls, warn);
+            const asked = await askWhichCodebase(client, claim.id, context.miss.projectName, context.miss.gitRemoteUrls, warn, claim.claimedAt);
             if (asked) {
                 log(`[orchestrator] asking which codebase "${claim.instruction}" should run in`);
                 await updateWorker(client, workerId, 'died', 'waiting for the user to choose a codebase', warn);
@@ -5811,7 +5918,7 @@ chosenCodebases = []) {
         if (context.miss && instructionNeedsCheckout(claim.instruction)) {
             log(`[orchestrator] "${claim.instruction}" needs the code, which is not on this machine`);
             await updateWorker(client, workerId, 'died', 'the codebase is not available on this machine', warn);
-            await answerTodo(client, claim.id, checkoutMissAnswer(context.miss));
+            await answerTodo(client, claim.id, checkoutMissAnswer(context.miss), claim.claimedAt);
             return 'answered';
         }
         /* ═══ 18d SLICE 4 — ONE STAGE PER DISPATCH (user ruling, 2026-08-12). ═══
@@ -5823,6 +5930,15 @@ chosenCodebases = []) {
         if (stage) {
             log(`[orchestrator] ${shortId(claim.id)} is working stage ${stage.position}/${stage.total}: ${stage.title}`);
         }
+        if (owned) {
+            if (!claim.claimedAt || !workerId)
+                throw new Error('The worker has no exact attempt identity.');
+            const pending = await client.from('cliv2_run_messages').select('id').eq('todo_id', claim.id).is('answered_by', null);
+            if (pending.error)
+                throw pending.error;
+            owned.setReference({ surface: 'worker', todoId: claim.id, workerId, claimedAt: claim.claimedAt,
+                observedPendingMessageIds: (pending.data ?? []).map((row) => row.id) });
+        }
         const result = await spawn(role.agent, buildPrompt(claim.instruction, claim.id, answered, targeted && scopeVersion ? { workItemId: targeted, version: scopeVersion } : null, replies, context, planningOnly, interrupted, selectedTools, stage, directed), (step) => steps.offer(step), context.checkout, 
         // !Cleanup Phase 6 (I17) — polled by the child; true kills it.
         () => todoWasStopped(client, claim.id), 
@@ -5850,118 +5966,44 @@ chosenCodebases = []) {
            not the prompt, so report_activity attributes without depending on
            agent cooperation (ux.md § Corrections: codex dropped a prompt-carried
            id twice). */
-        claim.id);
+        claim.id, owned);
         /* !Cleanup PHASE 6 (I17) — THE USER STOPPED IT, and that is not a failure.
            Checked BEFORE `!result.ok`, because a killed child also reports not-ok:
            falling through would count the user's own decision as an attempt and
            retry the very thing they cancelled. Nothing is written but the claim
            release — the browser already set `stopped`. */
+        if (result.interrupted)
+            return 'nothing-to-do';
         if (result.stopped) {
-            await updateWorker(client, workerId, 'died', 'stopped by the user', warn);
-            await releaseStoppedTodo(client, claim.id);
+            terminalDeferred = !!owned;
+            owned?.deferOutcome({ surface: 'worker', ok: false, text: null, reason: 'stopped by the user', stopped: true });
+            await updateWorker(client, workerId, 'died', 'stopped by the user', warn, true);
+            await releaseStoppedTodo(client, claim.id, claim.claimedAt);
+            owned?.acknowledgeOutcome();
+            terminalDeferred = false;
             log(`[orchestrator] ${shortId(claim.id)} was stopped by the user`);
             return 'released';
         }
-        if (!result.ok) {
-            /* THE WORKER DIED. Its row says so, WITH the reason, before the unit is
-               released — so a panel watching this moment sees "worker stopped" rather
-               than a unit that silently went back to unclaimed. Order matters: the
-               release is what makes the todo claimable again, so anything that must
-               be true about the dead worker has to be written first. */
-            /* 18a SLICE 5: THE WORKER ROW CARRIES THE PLAIN REASON, because that row
-               is what the card reads BETWEEN attempts. `result.error` stays the log's
-               string; the stored one is the sentence. */
-            const plain = plainFailureReason(role.agent, result.error, result.saidTail ?? '');
-            await updateWorker(client, workerId, 'died', plain, warn);
-            /* ux.md state D — released, not left claimed and silent. !Cleanup Phase 6
-               (I18): released ONLY while attempts remain. At the bound this writes
-               `failed` with the reason instead, which is what stops the unit being
-               re-claimed forever while reading as Working. */
-            const { fate, attempts } = await releaseOrFail(client, claim.id, plain, now().getTime(), claim.claimedAt);
-            if (fate === 'failed') {
-                warn(`[orchestrator] ${result.error} — ${shortId(claim.id)} failed after ${MAX_ATTEMPTS} attempts`);
-                return 'failed';
-            }
-            /* 18a SLICE 6: THIS REQUEST WAITS, AND NOTHING ELSE DOES. The wait went
-               onto the row with the attempt count; what is left here is saying so, in
-               the line that used to say only "releasing". */
-            const seconds = Math.round(retryDelayMs(attempts) / 1000);
-            warn(`[orchestrator] ${result.error}: retrying ${shortId(claim.id)} in ${seconds}s`);
-            return 'released';
-        }
-        /* !Cleanup PHASE 6 (I15) — A QUESTION IS NOT A FINISHED JOB.
-           The child exited cleanly, which until now meant `done` unconditionally.
-           But a one-shot headless run ASKS AND EXITS — that is the only way it can
-           handle a question — so the clean exit says nothing about whether the work
-           is over. If an ask is open on this unit, the truthful state is that it
-           needs the user, and the Inbox already has the question. */
-        if (await todoHasOpenAsk(client, claim.id, warn)) {
-            await suspendTodoForAsk(client, claim.id, result.output, claim.claimedAt);
-            await updateWorker(client, workerId, 'done', null, warn);
-            log(`[orchestrator] ${shortId(claim.id)} is waiting on the user`);
-            return 'answered';
-        }
-        /* A CONFIDENT ANSWER WITH NOTHING BEHIND IT IS NOT A FINISHED JOB.
-           See `todoRunLeftATrace` for the measurement: a codex worker that was
-           correctly configured, connected, and fetched the tool list still reported
-           that it had no tools, twice in three identical runs, and one reported
-           ATTACHING a screenshot it never attached. Every one of them exited 0 with
-           prose on stdout, which is all the two checks above look at, so every one
-           of them landed here and was written `done`.
-    
-           PLACED AFTER THE ASK CHECK, and that order is load-bearing. A run that
-           asked a question and exited has legitimately recorded something and is
-           already handled as `needs-input`; reaching this check first would relabel
-           the product's most important state as a failure.
-    
-           RELEASED FOR RETRY RATHER THAN FAILED OUTRIGHT, through the SAME
-           `releaseOrFail` the dead-worker path uses. This is intermittent by nature
-           (the third run of the identical prompt worked perfectly), so a retry is
-           very likely to succeed, and the attempt bound is what stops it looping
-           forever. At the bound the card says why, in words about what is KNOWN
-           (nothing was recorded) rather than repeating the agent's own account of a
-           run that has just been shown to be an unreliable narrator.
-    
-           `targeted` IS PASSED, and without it this check is blind to the primary
-           flow. A session opened on a work item has `todo_id` NULL by the table's
-           own one-anchor constraint, and the prompt tells the agent to open it that
-           way whenever there is an item, so a `todo_id`-only lookup could never
-           match a targeted run. See `todoRunLeftATrace`. It is the same value the
-           scope gate above already resolved, so the two cannot disagree about which
-           item this request is for. */
-        if (!await todoRunLeftATrace(client, claim.id, warn, targeted)) {
-            /* THE WORKER DIED WITH NO STEP, and that blank is load-bearing rather
-               than incidental. `interruptedRunStep` looks up the most recent `died`
-               worker on this request and `describeInterruptedRun` then tells the
-               REPLACEMENT agent that a previous attempt "stopped partway" and that
-               anything it did "IS STILL THERE". For a genuinely toolless run that is
-               true and useful. Clearing the step keeps the claim honest about the one
-               thing that is known: this run recorded nothing, so there is no last
-               action to hand on and nothing for the next agent to resume from. */
-            await updateWorker(client, workerId, 'died', NOTHING_RECORDED_REASON, warn);
-            const { fate, attempts } = await releaseOrFail(client, claim.id, NOTHING_RECORDED_REASON, now().getTime(), claim.claimedAt);
-            if (fate === 'failed') {
-                warn(`[orchestrator] ${shortId(claim.id)} recorded nothing and failed after ${MAX_ATTEMPTS} attempts`);
-                return 'failed';
-            }
-            const seconds = Math.round(retryDelayMs(attempts) / 1000);
-            warn(`[orchestrator] ${shortId(claim.id)} recorded nothing: retrying in ${seconds}s`);
-            return 'released';
-        }
-        /* FENCED ON THE CLAIM THIS DISPATCH TOOK (18d Slice 4). If this run handed
-           its stage on, the claim is already cleared and a fresh worker is on the
-           row, so this write must do nothing rather than mark the request finished
-           over work that is still running. See answerTodo's own comment. */
-        await answerTodo(client, claim.id, result.output, claim.claimedAt);
-        // The worker finished and its answer is committed. Marked done AFTER the
-        // answer write, so a worker is never reported finished for a unit that has
-        // no answer on it.
-        await updateWorker(client, workerId, 'done', null, warn);
-        const seconds = ((now().getTime() - startedAt) / 1000).toFixed(1);
-        log(`[orchestrator] answered ${shortId(claim.id)} in ${seconds}s`);
-        return 'answered';
+        terminalDeferred = !!owned;
+        const terminal = { surface: 'worker', ok: result.ok, text: result.ok ? result.output : null,
+            reason: result.ok ? '' : failureMessage(role.agent, result.failureKind ?? nativeFailureKind(result.saidTail ?? '')),
+            failureKind: result.failureKind ?? nativeFailureKind(result.saidTail ?? ''), workItemId: targeted };
+        owned?.deferOutcome(terminal);
+        const settled = await settleWorkerOutcome(client, workerId, claim, role, result, targeted, now, startedAt, log, warn, terminal, owned?.deferOutcome, () => {
+            if (result.ok)
+                deps.observeHarness?.(role.agent, 'authenticated', 'dispatch-success');
+            else if (result.failureKind === 'authentication')
+                deps.observeHarness?.(role.agent, 'sign-in-required', 'provider-rejected');
+        });
+        owned?.acknowledgeOutcome();
+        terminalDeferred = false;
+        return settled;
     }
     catch (err) {
+        if (terminalDeferred) {
+            warn('The completed execution is waiting for its original account to acknowledge the result.');
+            return 'failed';
+        }
         // The answer write itself failed (network, RLS, a reverted migration). The
         // todo is CLAIMED and has no answer — the worst state — so release it here
         // too. A release that also fails is warned and the row is left claimed;
@@ -5979,6 +6021,8 @@ chosenCodebases = []) {
                repeatedly by a durable cause — a reverted migration, an RLS change —
                and before the bound it was the same forever-loop as a failed spawn. */
             const { fate, attempts } = await releaseOrFail(client, claim.id, err.message, now().getTime(), claim.claimedAt);
+            if (fate === 'stale')
+                return 'nothing-to-do';
             warn(fate === 'failed'
                 ? `[orchestrator] ${shortId(claim.id)} failed after ${MAX_ATTEMPTS} attempts`
                 : `[orchestrator] retrying ${shortId(claim.id)} in ${Math.round(retryDelayMs(attempts) / 1000)}s`);
@@ -6009,3 +6053,276 @@ chosenCodebases = []) {
 export function liveAgents() {
     return detectAgents();
 }
+function cliClaimReferences(action, result) {
+    if (!Array.isArray(result))
+        throw new Error('The claim journal returned no complete result.');
+    return result.map((row) => {
+        if (action === 'cliv2_claim_next_loose_todo') {
+            const attempt = row?._attempt;
+            if (!attempt || typeof attempt.todo_id !== 'string' || typeof attempt.claimed_at !== 'string')
+                throw new Error('The claim journal returned an incomplete request identity.');
+            return { surface: 'worker', todoId: attempt.todo_id, workerId: null, claimedAt: attempt.claimed_at, observedPendingMessageIds: null };
+        }
+        if (typeof row?.id !== 'string' || typeof row?.todo_id !== 'string')
+            throw new Error('The claim journal returned an incomplete reply source.');
+        if (action === 'cliv2_take_run_messages' && typeof row.taken_at === 'string')
+            return {
+                surface: 'reply', todoId: row.todo_id, messageLeases: [{ id: row.id, taken_at: row.taken_at }], grantLeases: [], observedPendingMessageIds: null,
+            };
+        if (action === 'cliv2_take_granted_resumes' && typeof row.resume_taken_at === 'string')
+            return {
+                surface: 'reply', todoId: row.todo_id, messageLeases: [], grantLeases: [{ id: row.id, resume_taken_at: row.resume_taken_at }], observedPendingMessageIds: null,
+            };
+        throw new Error('The claim journal returned an unrecognized lease identity.');
+    });
+}
+async function recoveredCliClaim(client, action, args) {
+    const skip = (args.p_skip_ids ?? args.p_skip_todo_ids ?? []);
+    for (const claim of recoveredRpcClaims('cli').filter(row => row.action === action)) {
+        if (action === 'cliv2_claim_next_loose_todo' && claim.args?.p_agent !== args.p_agent)
+            continue;
+        const rows = [];
+        for (const row of claim.result ?? []) {
+            const ref = cliClaimReferences(action, [row])[0];
+            if (ref.surface === 'panel' || !pendingRpcReference(ref))
+                continue;
+            if (skip.includes(ref.todoId) || Array.isArray(args.p_todo_ids) && !args.p_todo_ids.includes(ref.todoId))
+                continue;
+            let current = false;
+            if (ref.surface === 'worker') {
+                const read = await client.from('cliv2_loose_todos').select('state,claimed_at,claimed_machine_id').eq('id', ref.todoId).maybeSingle();
+                if (read.error)
+                    throw read.error;
+                current = !!read.data && read.data.claimed_at === ref.claimedAt && read.data.claimed_machine_id === args.p_machine_id && ['working', 'needs-input'].includes(read.data.state);
+            }
+            else if (action === 'cliv2_take_run_messages') {
+                const source = ref.messageLeases[0];
+                const read = await client.from('cliv2_run_messages').select('taken_at,taken_machine_id,answered_by,interrupted_at').eq('id', source.id).maybeSingle();
+                if (read.error)
+                    throw read.error;
+                current = !!read.data && read.data.taken_at === source.taken_at && read.data.taken_machine_id === args.p_machine_id && !read.data.answered_by && !read.data.interrupted_at;
+            }
+            else {
+                const source = ref.grantLeases[0];
+                const read = await client.from('cliv2_permission_requests').select('resume_taken_at,resume_machine_id,resume_answered_by,resume_interrupted_at,state').eq('id', source.id).maybeSingle();
+                if (read.error)
+                    throw read.error;
+                current = !!read.data && read.data.resume_taken_at === source.resume_taken_at && read.data.resume_machine_id === args.p_machine_id && !read.data.resume_answered_by && !read.data.resume_interrupted_at && read.data.state === 'granted';
+            }
+            if (current)
+                rows.push(row);
+            else
+                retireRpcReference(ref);
+        }
+        if (rows.length)
+            return { data: rows, error: null, operationId: claim.id };
+        finishRpcClaims([claim.id], true);
+    }
+    return null;
+}
+async function cliClaim(client, action, args, recoveryOnly = false) {
+    if (!hasOwnedWorkContext())
+        return { ...await client.rpc(action, args), operationId: undefined };
+    const recovered = await recoveredCliClaim(client, action, args);
+    if (recovered)
+        return recovered;
+    if (recoveryOnly)
+        return { data: [], error: null, operationId: undefined };
+    const operationId = beginRpcClaim('cli', action, args);
+    try {
+        const response = await client.rpc(action, { ...args, p_operation_id: operationId });
+        if (!response.error) {
+            const journal = await client.rpc('cliv2_reconcile_claim', { p_machine_id: args.p_machine_id, p_operation_id: operationId });
+            if (journal.error)
+                throw journal.error;
+            const row = journal.data?.[0];
+            if (row?.outcome !== 'completed' || row.action !== action)
+                throw new Error('The claim was cancelled before it could start.');
+            recordRpcClaims(operationId, cliClaimReferences(action, row.result), false, row.result);
+            if (row.result.length === 0)
+                finishRpcClaims([operationId]);
+            return { ...response, data: row.result, operationId: row.result.length ? operationId : undefined };
+        }
+        if (response.error)
+            deferRpcClaim(operationId);
+        return { ...response, operationId };
+    }
+    catch (error) {
+        deferRpcClaim(operationId);
+        throw error;
+    }
+}
+/** Read every legacy source before committing a baseline; a failed page keeps admission closed. */
+async function legacyRows(client, table, columns, todoId) {
+    const rows = [];
+    let after = null;
+    for (;;) {
+        let query = client.from(table).select(columns).order('id').limit(500);
+        if (todoId)
+            query = query.eq('todo_id', todoId);
+        if (after)
+            query = query.gt('id', after);
+        const { data, error } = await query;
+        if (error)
+            throw error;
+        if (!Array.isArray(data))
+            throw new Error('The old work snapshot did not return a complete page.');
+        rows.push(...data);
+        if (data.length < 500)
+            return rows;
+        after = data[data.length - 1].id;
+        if (typeof after !== 'string')
+            throw new Error('The old work snapshot has no continuation identity.');
+    }
+}
+export async function reconcileInterruptedWork(client, machineId, observeHarness) {
+    if (!hasOwnedWorkContext())
+        return;
+    const capability = await client.rpc('cliv2_interrupt_machine_work', { p_machine_id: machineId,
+        p_operation_id: randomUUID(), p_interrupted_at: new Date().toISOString(), p_workers: [], p_replies: [] });
+    if (capability.error)
+        throw capability.error;
+    for (const pending of pendingTerminalOutcomes()) {
+        if (pending.reference.surface === 'reply') {
+            await settleReplyOutcome(client, machineId, pending.reference, pending.outcome, () => {
+                const outcome = pending.outcome;
+                if (!outcome.completedAt || !outcome.harnessIdentity || !['claude', 'codex'].includes(pending.harness ?? '') || outcome.stopped)
+                    return;
+                if (outcome.ok || outcome.failureKind === 'authentication')
+                    observeHarness?.(pending.harness, outcome.ok ? 'authenticated' : 'sign-in-required', outcome.ok ? 'dispatch-success' : 'provider-rejected', outcome.completedAt, outcome.harnessIdentity);
+            });
+            acknowledgeTerminalOutcome(pending.id);
+            continue;
+        }
+        if (pending.reference.surface !== 'worker')
+            continue;
+        const ref = pending.reference;
+        if (pending.outcome.stopped) {
+            await updateWorker(client, ref.workerId, 'died', 'stopped by the user', message => console.warn(message), true);
+            await releaseStoppedTodo(client, ref.todoId, ref.claimedAt);
+            acknowledgeTerminalOutcome(pending.id);
+            continue;
+        }
+        const { data, error } = await client.from('cliv2_loose_todos').select('claimed_at,state').eq('id', ref.todoId).maybeSingle();
+        if (error)
+            throw error;
+        if (data?.claimed_at === ref.claimedAt && ['working', 'needs-input'].includes(data.state)) {
+            await settleWorkerOutcome(client, ref.workerId, { id: ref.todoId, claimedAt: ref.claimedAt }, { agent: pending.harness ?? 'Agent' }, { ok: pending.outcome.ok, output: pending.outcome.text ?? '', error: pending.outcome.reason, failureKind: pending.outcome.failureKind }, pending.outcome.workItemId ?? null, () => new Date(), Date.now(), () => { }, message => console.warn(message), pending.outcome, value => updateTerminalOutcome(pending.id, value));
+        }
+        else {
+            const disposition = pending.outcome.disposition;
+            await updateWorker(client, ref.workerId, disposition?.worker ?? (pending.outcome.ok ? 'done' : 'died'), disposition?.reason || pending.outcome.reason || null, message => console.warn(message), true);
+        }
+        acknowledgeTerminalOutcome(pending.id);
+    }
+    for (const claim of pendingRpcClaims('cli')) {
+        const journal = await client.rpc('cliv2_reconcile_claim', { p_machine_id: machineId, p_operation_id: claim.id });
+        if (journal.error)
+            throw journal.error;
+        const row = journal.data?.[0];
+        if (row?.outcome === 'cancelled')
+            recordRpcClaims(claim.id, [], true);
+        else if (row?.outcome === 'completed' && row.action === claim.action)
+            recordRpcClaims(claim.id, cliClaimReferences(claim.action, row.result), false, row.result);
+        else
+            throw new Error('The pending claim could not be reconciled.');
+    }
+    if (legacySnapshotNeeded()) {
+        const todos = await legacyRows(client, 'cliv2_loose_todos', 'id,claimed_at,claimed_machine_id');
+        const workers = await legacyRows(client, 'cliv2_workers', 'id,todo_id,machine_id,state');
+        const messages = await legacyRows(client, 'cliv2_run_messages', 'id,todo_id,taken_at,taken_machine_id,answered_by');
+        const permissions = await legacyRows(client, 'cliv2_permission_requests', 'id,todo_id,state,consumed_at,resume_taken_at,resume_machine_id,resume_answered_by');
+        const holds = new Map();
+        const hold = (todoId) => {
+            let value = holds.get(todoId);
+            if (!value) {
+                value = { todoId, messageIds: [], messageSources: [], permissionSources: [] };
+                holds.set(todoId, value);
+            }
+            return value;
+        };
+        for (const message of messages) {
+            if (message.answered_by != null || message.taken_machine_id && message.taken_machine_id !== machineId)
+                continue;
+            const pending = hold(message.todo_id);
+            pending.messageIds.push(message.id);
+            if (message.taken_at)
+                pending.messageSources.push({ id: message.id, taken_at: message.taken_at });
+            if (message.taken_machine_id === machineId && message.taken_at)
+                recordExitedInterruption({
+                    surface: 'reply', todoId: message.todo_id, messageLeases: [{ id: message.id, taken_at: message.taken_at }],
+                    grantLeases: [], observedPendingMessageIds: null,
+                });
+        }
+        for (const permission of permissions) {
+            if (!permission.todo_id || permission.state !== 'granted' || permission.resume_answered_by != null
+                || permission.resume_machine_id && permission.resume_machine_id !== machineId)
+                continue;
+            hold(permission.todo_id).permissionSources.push({ id: permission.id, state: permission.state, consumed_at: permission.consumed_at });
+            if (permission.resume_machine_id === machineId && permission.resume_taken_at)
+                recordExitedInterruption({
+                    surface: 'reply', todoId: permission.todo_id, messageLeases: [],
+                    grantLeases: [{ id: permission.id, resume_taken_at: permission.resume_taken_at }], observedPendingMessageIds: null,
+                });
+        }
+        for (const worker of workers) {
+            if (worker.machine_id !== machineId || !['working', 'dispatching'].includes(worker.state))
+                continue;
+            const todo = todos.find((row) => row.id === worker.todo_id);
+            if (!todo || todo.claimed_machine_id !== machineId || !todo.claimed_at)
+                continue;
+            recordExitedInterruption({ surface: 'worker', todoId: todo.id, workerId: worker.id,
+                claimedAt: todo.claimed_at, observedPendingMessageIds: null });
+        }
+        for (const baseline of holds.values())
+            baseline.messageIds = messages.filter((row) => row.todo_id === baseline.todoId).map((row) => row.id);
+        saveLegacySnapshot([...holds.values()]);
+    }
+    for (const surface of ['worker', 'reply']) {
+        for (const receipt of interruptionReceipts(surface)) {
+            const ref = receipt.reference;
+            const workers = ref.surface === 'worker' ? [{ worker_id: ref.workerId, todo_id: ref.todoId,
+                    claimed_at: ref.claimedAt, observed_pending_message_ids: ref.observedPendingMessageIds }] : [];
+            const replies = ref.surface === 'reply' ? [{ todo_id: ref.todoId, message_leases: ref.messageLeases,
+                    grant_leases: ref.grantLeases, observed_pending_message_ids: ref.observedPendingMessageIds }] : [];
+            const { data, error } = await client.rpc('cliv2_interrupt_machine_work', {
+                p_machine_id: machineId, p_operation_id: receipt.operationId, p_interrupted_at: receipt.interruptedAt,
+                p_workers: workers, p_replies: replies,
+            });
+            if (error)
+                throw error;
+            const expected = ref.surface === 'worker' ? [{ kind: ref.workerId ? 'worker' : 'claim', id: ref.workerId ?? ref.todoId }] : ref.surface === 'reply'
+                ? [...ref.messageLeases.map((source) => ({ kind: 'message', id: source.id })), ...ref.grantLeases.map((source) => ({ kind: 'grant', id: source.id }))] : [];
+            const results = data;
+            if (!Array.isArray(results) || expected.some((expectedRow) => !results.some((row) => row.id === expectedRow.id && row.kind === expectedRow.kind
+                && ['interrupted', 'already_interrupted', 'already_settled', 'continued', 'stale'].includes(row.outcome)))) {
+                throw new Error('Interrupted work was not fully acknowledged. Work remains protected.');
+            }
+            acknowledgeInterruption(receipt.id);
+        }
+    }
+    await refreshLegacyTodoHolds(client, machineId);
+}
+export async function refreshLegacyTodoHolds(client, machineId) {
+    for (const hold of legacyTodoHolds()) {
+        const todo = await client.from('cliv2_loose_todos').select('id,claimed_machine_id').eq('id', hold.todoId).maybeSingle();
+        if (todo.error)
+            throw todo.error;
+        if (!todo.data) {
+            releaseLegacyTodoHold(hold.todoId);
+            continue;
+        }
+        const messages = { data: await legacyRows(client, 'cliv2_run_messages', 'id,answered_by,taken_at,taken_machine_id', hold.todoId) };
+        if (messages.data.some((row) => !hold.messageIds.includes(row.id))) {
+            releaseLegacyTodoHold(hold.todoId);
+            continue;
+        }
+        const permissions = { data: await legacyRows(client, 'cliv2_permission_requests', 'id,state,consumed_at,resume_answered_by,resume_machine_id', hold.todoId) };
+        const messagesRemain = messages.data.some((row) => hold.messageIds.includes(row.id) && row.answered_by === null
+            && (!row.taken_machine_id || row.taken_machine_id === machineId));
+        const grantsRemain = permissions.data.some((row) => hold.permissionSources.some((source) => source.id === row.id)
+            && row.state === 'granted' && row.resume_answered_by === null && (!row.resume_machine_id || row.resume_machine_id === machineId));
+        if (!messagesRemain && !grantsRemain)
+            releaseLegacyTodoHold(hold.todoId);
+    }
+}