@evident-ai/cli 3.0.1-dev.0d0721c → 3.0.1-dev.10c527f

package/dist/index.js

@@ -1078,6 +1078,12 @@ async function getSessionMessages(port, sessionId) {
     return null;
   }
 }
+function isSessionActivelyGenerating(messages) {
+  if (!messages || messages.length === 0) return false;
+  const last = messages[messages.length - 1];
+  if (roleOf(last) !== "assistant") return false;
+  return completedOf(last) == null;
+}
 function sessionLastActivityMs(session) {
   const candidates = [
     session.time?.updated,
@@ -1120,6 +1126,36 @@ async function sessionExists(port, id) {
     return null;
   }
 }
+async function getSessionStatuses(port) {
+  try {
+    const res = await fetch(`${opencodeBase(port)}/session/status`);
+    if (!res.ok) {
+      console.error(
+        `[getSessionStatuses] GET /session/status returned HTTP ${res.status} (port ${port})`
+      );
+      return null;
+    }
+    const body = await res.json();
+    if (body == null || typeof body !== "object" || Array.isArray(body)) {
+      console.error(
+        `[getSessionStatuses] GET /session/status body was not a plain object (port ${port})`
+      );
+      return null;
+    }
+    return body;
+  } catch (err) {
+    console.error(
+      `[getSessionStatuses] GET /session/status failed (port ${port}): ${err instanceof Error ? err.message : String(err)}`
+    );
+    return null;
+  }
+}
+async function isSessionOngoing(port, id) {
+  const map = await getSessionStatuses(port);
+  if (map == null) return null;
+  const entry = map[id];
+  return entry != null && entry.type !== "idle";
+}
 async function createOpenCodeSession(port, directory) {
   const url = new URL(`${opencodeBase(port)}/session`);
   if (directory && directory.trim()) {
@@ -1246,6 +1282,11 @@ function messageRunState(messages, userMessageId) {
   if (isAssistantInFlight(reply)) return "running";
   return errorOf(reply) != null ? "failed" : "done";
 }
+function isPreamblePinnedRunning(messages, userMessageId) {
+  if (messageRunState(messages, userMessageId) !== "running") return false;
+  const reply = findLastAssistantReplyFor(messages, userMessageId);
+  return completedOf(reply) != null && finishOf(reply) === "tool-calls";
+}
 function messageError(messages, userMessageId) {
   const reply = findLastAssistantReplyFor(messages, userMessageId);
   const error2 = errorOf(reply);
@@ -1778,6 +1819,9 @@ var DEFAULT_RETRY_POLICY = {
 var DEFAULT_PAUSED_POLL_INTERVAL_MS = 2e3;
 var DEFAULT_PAUSED_MAX_WAIT_MS = 10 * 60 * 1e3;
 var DEFAULT_STUCK_QUEUED_MS = 6e4;
+var HEARTBEAT_MS = 6e4;
+var ABSOLUTE_MAX_PROCESSING_MS = 6 * 60 * 60 * 1e3;
+var POLL_MISS_GRACE_MS = HEARTBEAT_MS;
 var ChannelAuthError = class extends Error {
   constructor(message) {
     super(message);
@@ -1874,6 +1918,15 @@ var ChannelDriver = class {
    * the row leaves the processing list, exactly like `dontRedispatch`.
    */
   doneUndeliverable = /* @__PURE__ */ new Set();
+  /**
+   * "Already emitted `readopt_poll_unresolved` for this row" (#229). The b1 /
+   * unreadable-status re-evaluate leaf leaves the row UN-tracked so it is re-read
+   * every ~2s drain until the status map becomes readable — but the server-visible
+   * signal is an OUTCOME, so it must fire at most ONCE per row, not once per drain
+   * (Bugbot "Re-adopt signals flood every drain"). Cleared when the row leaves the
+   * processing list, exactly like `dontRedispatch`/`doneUndeliverable`.
+   */
+  readoptPollUnresolvedSignalled = /* @__PURE__ */ new Set();
   /**
    * "A null-id re-adopt re-dispatch is in flight, awaiting its read-back" (WI-5
    * Task 5.4, High-2). Since we no longer send a caller-supplied id, a re-dispatch
@@ -2249,7 +2302,9 @@ var ChannelDriver = class {
         inFlight: /* @__PURE__ */ new Map(),
         loop: null,
         reportedQuestions: /* @__PURE__ */ new Set(),
-        reportedPermissions: /* @__PURE__ */ new Set()
+        reportedPermissions: /* @__PURE__ */ new Set(),
+        lastGoodPollAt: this.now(),
+        hadUsablePoll: false
       };
       this.watchers.set(sessionId, watcher);
     }
@@ -2259,20 +2314,37 @@ var ChannelDriver = class {
       opencodeMessageId,
       message,
       dispatchedAt: now,
+      processingAnchorMs: now,
       deadline: now + this.pausedMaxWaitMs,
       started: false,
       done: false,
-      stuckReported: false
+      stuckReported: false,
+      lastAliveAt: 0,
+      aliveInFlight: false,
+      awaitingHumanLatched: false,
+      pausedOnQuestion: false,
+      pausedOnPermission: false,
+      pausedClearConfirmed: false,
+      pausedInFlight: false,
+      deliveryDeadlineAnchored: false
     });
   }
   /**
    * Register a RE-ADOPTED `processing` message with its session watcher
    * (ADR-0046, WI-4). Mirrors `registerInFlight` but anchors the give-up
    * `deadline` to the row's SERVER-SIDE `processed_at` (Invariant 1), NEVER to
-   * `now`: a row already `processing` for e.g. 5 min must give up ~5 min from now
-   * (10 min after `processed_at`), not 10 min from now — otherwise its deadline
-   * lands ~15 min after `processed_at`, coinciding with the cron reset →
-   * double-drive race. `dispatchedAt` stays `now` (only the appear-guard uses it).
+   * `now`, so the paused/queued/unreachable cases settle on the same wall-clock a
+   * fresh dispatch would (10 min after `processed_at`, not 10 min from now).
+   *
+   * This re-attaches into the SAME watcher, so the ADR-0047 progressing-vs-paused
+   * give-up (`serviceInFlightMessage`) applies unchanged: a re-adopted turn
+   * opencode reports ACTIVELY `running` is watched to completion (its liveness
+   * heartbeat keeps the cron off its row), while a re-adopted turn that is paused
+   * awaiting a human — or queued/unreachable — is still bounded by `deadline` and
+   * handed to the cron. The old "the `deadline` must settle before the ~15-min
+   * cron or they double-drive" reasoning is superseded: liveness now settles the
+   * actively-running case; `deadline` settles the rest. `dispatchedAt` stays `now`
+   * (only the appear-guard uses it).
    *
    * `evidentMessageId` addresses the SERVER row (for markProcessing/markDone);
    * `opencodeMessageId` is the id the watcher polls for a reply — for the orphan
@@ -2290,7 +2362,9 @@ var ChannelDriver = class {
         inFlight: /* @__PURE__ */ new Map(),
         loop: null,
         reportedQuestions: /* @__PURE__ */ new Set(),
-        reportedPermissions: /* @__PURE__ */ new Set()
+        reportedPermissions: /* @__PURE__ */ new Set(),
+        lastGoodPollAt: this.now(),
+        hadUsablePoll: false
       };
       this.watchers.set(sessionId, watcher);
     }
@@ -2299,6 +2373,10 @@ var ChannelDriver = class {
       opencodeMessageId,
       message,
       dispatchedAt: this.now(),
+      // Anchor the absolute-age ceiling to the SERVER-SIDE `processed_at` (the same
+      // value seeding `deadline`), NOT `dispatchedAt` — so a re-adopted zombie's age
+      // reflects the real turn duration and the ceiling fires on the ORIGINAL turn.
+      processingAnchorMs: processedAtMs,
       deadline: processedAtMs + this.pausedMaxWaitMs,
       // The server row is ALREADY `processing`; do not re-fire markProcessing.
       started: true,
@@ -2308,7 +2386,20 @@ var ChannelDriver = class {
       // on `state === 'queued'` (turn produced no reply), not on `started`, so a
       // re-adopted row left wedged in `queued` still emits the signal once
       // (#210/#220 observability).
-      stuckReported: false
+      stuckReported: false,
+      // Task 5.2: a re-adopted actively-running row re-attaches into the SAME
+      // watcher and so hits the SAME actively-running heartbeat branch in
+      // `serviceInFlightMessage` as a fresh dispatch — monitoring observes "runner
+      // re-adopted and is confirming this row alive" via that `alive` heartbeat,
+      // with no extra `re_adopted` signal needed (folds old WI-6).
+      lastAliveAt: 0,
+      aliveInFlight: false,
+      awaitingHumanLatched: false,
+      pausedOnQuestion: false,
+      pausedOnPermission: false,
+      pausedClearConfirmed: false,
+      pausedInFlight: false,
+      deliveryDeadlineAnchored: false
     });
   }
   /**
@@ -2359,12 +2450,30 @@ var ChannelDriver = class {
             messages = Array.isArray(body) ? body : null;
           }
         } catch {
-          continue;
         }
+        if (messages != null && messages.length > 0) {
+          watcher.lastGoodPollAt = this.now();
+          watcher.hadUsablePoll = true;
+        } else {
+          const emptyButReachable = messages != null;
+          const graceApplies = !emptyButReachable || watcher.hadUsablePoll;
+          if (graceApplies && this.now() - watcher.lastGoodPollAt < POLL_MISS_GRACE_MS) {
+            continue;
+          }
+        }
+        const { openQuestions, openPermissions, questionsPolledOk, permissionsPolledOk } = await this.pollInteractions(sessionId, watcher, messages);
         for (const inFlight of [...watcher.inFlight.values()]) {
-          await this.serviceInFlightMessage(sessionId, watcher, inFlight, messages);
+          await this.serviceInFlightMessage(
+            sessionId,
+            watcher,
+            inFlight,
+            messages,
+            openQuestions,
+            openPermissions,
+            questionsPolledOk,
+            permissionsPolledOk
+          );
         }
-        await this.pollInteractions(sessionId, watcher, messages);
       }
     } catch (err) {
       if (err instanceof ChannelAuthError) {
@@ -2386,15 +2495,40 @@ var ChannelDriver = class {
       });
     }
   }
+  /**
+   * On FIRST observing a terminal (done/failed) state, ensure the delivery
+   * (markDone/markFailed) transient-retry path has a real window. A long
+   * ACTIVELY-running turn is kept past its original `deadline`, so by completion
+   * `now >= deadline` already holds and the retry bound below would fire on the
+   * first transient PATCH failure — dropping the message before its reply lands
+   * (Bugbot "Stale deadline aborts long-turn delivery"). Re-anchor once (latched)
+   * to a fresh `pausedMaxWaitMs` window; only extend if the current deadline is at
+   * or past now, so a still-ample window is left untouched.
+   */
+  anchorDeliveryDeadline(inFlight) {
+    if (inFlight.deliveryDeadlineAnchored) return;
+    inFlight.deliveryDeadlineAnchored = true;
+    if (this.now() >= inFlight.deadline) {
+      inFlight.deadline = this.now() + this.pausedMaxWaitMs;
+    }
+  }
   /**
    * Drive ONE in-flight message's lifecycle from the tick's message snapshot.
    * Fires markProcessing on queued→running and markDone on done (each once),
    * applies the idle-path re-dispatch guard, and removes the message from the
    * in-flight set on completion or timeout.
    */
-  async serviceInFlightMessage(sessionId, watcher, inFlight, messages) {
+  async serviceInFlightMessage(sessionId, watcher, inFlight, messages, openQuestions, openPermissions, questionsPolledOk, permissionsPolledOk) {
     const conv = watcher.conv;
     const state = messageRunState(messages, inFlight.opencodeMessageId);
+    const id = inFlight.evidentMessageId;
+    if (openQuestions.has(id)) inFlight.pausedOnQuestion = true;
+    else if (questionsPolledOk) inFlight.pausedOnQuestion = false;
+    if (openPermissions.has(id)) inFlight.pausedOnPermission = true;
+    else if (permissionsPolledOk) inFlight.pausedOnPermission = false;
+    const observedOpen = openQuestions.has(id) || openPermissions.has(id);
+    const latchedPaused = inFlight.pausedOnQuestion || inFlight.pausedOnPermission;
+    const awaitingHuman = observedOpen || latchedPaused;
     if ((state === "running" || state === "done" || state === "failed") && !inFlight.started) {
       let claimed;
       try {
@@ -2425,6 +2559,7 @@ var ChannelDriver = class {
       }
     }
     if (state === "done") {
+      this.anchorDeliveryDeadline(inFlight);
       if (!inFlight.done) {
         this.log({
           level: "info",
@@ -2475,6 +2610,7 @@ var ChannelDriver = class {
       return;
     }
     if (state === "failed") {
+      this.anchorDeliveryDeadline(inFlight);
       if (!inFlight.done) {
         const error2 = messageError(messages, inFlight.opencodeMessageId) ?? void 0;
         this.log({
@@ -2528,7 +2664,51 @@ var ChannelDriver = class {
         stuck_for_ms: this.now() - inFlight.dispatchedAt
       });
     }
-    if (this.now() >= inFlight.deadline) {
+    const activelyRunning = state === "running" && !awaitingHuman;
+    if (activelyRunning && this.now() - inFlight.processingAnchorMs >= ABSOLUTE_MAX_PROCESSING_MS) {
+      this.log({
+        level: "error",
+        message: `Message ${inFlight.evidentMessageId.slice(0, 8)} exceeded the absolute processing ceiling (${Math.round((this.now() - inFlight.processingAnchorMs) / 6e4)}min, session ${sessionId}) while still actively running \u2014 releasing so the cron can reclaim it`,
+        conversation_id: conv.id,
+        message_id: inFlight.evidentMessageId
+      });
+      void this.postSignal(conv.id, inFlight.evidentMessageId, "gave_up", {
+        watched_for_ms: this.now() - inFlight.processingAnchorMs
+      });
+      this.removeInFlight(watcher, inFlight.evidentMessageId);
+      return;
+    }
+    if (activelyRunning && !inFlight.awaitingHumanLatched && !inFlight.aliveInFlight && this.now() - inFlight.lastAliveAt >= HEARTBEAT_MS) {
+      inFlight.aliveInFlight = true;
+      void this.postSignal(conv.id, inFlight.evidentMessageId, "alive").then((ok) => {
+        inFlight.aliveInFlight = false;
+        if (ok) inFlight.lastAliveAt = this.now();
+      });
+    }
+    if (awaitingHuman) {
+      if (!inFlight.awaitingHumanLatched) {
+        inFlight.deadline = this.now() + this.pausedMaxWaitMs;
+        inFlight.awaitingHumanLatched = true;
+      }
+      if (!inFlight.pausedClearConfirmed && !inFlight.pausedInFlight) {
+        inFlight.pausedInFlight = true;
+        void this.postSignal(conv.id, inFlight.evidentMessageId, "paused").then((ok) => {
+          inFlight.pausedInFlight = false;
+          if (ok && inFlight.awaitingHumanLatched) inFlight.pausedClearConfirmed = true;
+        });
+      }
+    } else if (inFlight.awaitingHumanLatched) {
+      inFlight.awaitingHumanLatched = false;
+      inFlight.pausedOnQuestion = false;
+      inFlight.pausedOnPermission = false;
+      inFlight.pausedClearConfirmed = false;
+    }
+    const siblingPaused = (sib) => openQuestions.has(sib.evidentMessageId) || openPermissions.has(sib.evidentMessageId) || sib.awaitingHumanLatched || sib.pausedOnQuestion || sib.pausedOnPermission;
+    const hasActivelyRunningSibling = [...watcher.inFlight.values()].some(
+      (sib) => sib.evidentMessageId !== inFlight.evidentMessageId && messageRunState(messages, sib.opencodeMessageId) === "running" && !siblingPaused(sib)
+    );
+    const queuedBehindRunningSibling = state === "queued" && hasActivelyRunningSibling;
+    if (!activelyRunning && !queuedBehindRunningSibling && this.now() >= inFlight.deadline) {
       this.log({
         level: "info",
         message: `Message ${inFlight.evidentMessageId.slice(0, 8)} did not complete within the watch window \u2014 leaving for the cron safety net`,
@@ -2560,12 +2740,17 @@ var ChannelDriver = class {
    */
   async readoptProcessing() {
     const rows = await this.getProcessingMessages();
-    if (this.dontRedispatch.size > 0 || this.doneUndeliverable.size > 0) {
+    if (this.dontRedispatch.size > 0 || this.doneUndeliverable.size > 0 || this.readoptPollUnresolvedSignalled.size > 0) {
       const stillProcessing = new Set(rows.map((r) => r.id));
-      for (const id of [...this.dontRedispatch, ...this.doneUndeliverable]) {
+      for (const id of [
+        ...this.dontRedispatch,
+        ...this.doneUndeliverable,
+        ...this.readoptPollUnresolvedSignalled
+      ]) {
         if (!stillProcessing.has(id)) {
           const cleared = this.dontRedispatch.delete(id);
           const clearedUndeliverable = this.doneUndeliverable.delete(id);
+          this.readoptPollUnresolvedSignalled.delete(id);
           if (cleared || clearedUndeliverable) {
             this.log({
               level: "info",
@@ -2619,8 +2804,10 @@ var ChannelDriver = class {
         });
         continue;
       }
+      const anyUntracked = sessionRows.some((row) => !this.isTracked(sessionId, row.id));
+      const sessionOngoing = anyUntracked ? await isSessionOngoing(this.port, sessionId) : null;
       for (const row of sessionRows) {
-        await this.readoptOne(sessionId, row, messages);
+        await this.readoptOne(sessionId, row, messages, sessionOngoing);
       }
     }
   }
@@ -2642,7 +2829,7 @@ var ChannelDriver = class {
    *
    * Only `ChannelAuthError` propagates.
    */
-  async readoptOne(sessionId, row, messages) {
+  async readoptOne(sessionId, row, messages, sessionOngoing) {
     if (this.isTracked(sessionId, row.id)) {
       this.log({
         level: "info",
@@ -2682,6 +2869,7 @@ var ChannelDriver = class {
             conversation_id: row.conversation_id,
             message_id: row.id
           });
+          void this.postSignal(row.conversation_id, row.id, "readopt_undeliverable");
           return;
         }
         this.log({
@@ -2693,6 +2881,7 @@ var ChannelDriver = class {
         return;
       }
       this.dontRedispatch.delete(row.id);
+      void this.postSignal(row.conversation_id, row.id, "readopt_done");
       return;
     }
     if (state === "failed") {
@@ -2715,6 +2904,7 @@ var ChannelDriver = class {
             conversation_id: row.conversation_id,
             message_id: row.id
           });
+          void this.postSignal(row.conversation_id, row.id, "readopt_undeliverable");
           return;
         }
         this.log({
@@ -2726,6 +2916,7 @@ var ChannelDriver = class {
         return;
       }
       this.dontRedispatch.delete(row.id);
+      void this.postSignal(row.conversation_id, row.id, "readopt_failed");
       return;
     }
     if (this.dontRedispatch.has(row.id)) {
@@ -2737,6 +2928,71 @@ var ChannelDriver = class {
       });
       return;
     }
+    let statusReadableOngoing = null;
+    if (state === "running" && ocId) {
+      const reply = findLastAssistantReplyFor(messages, ocId);
+      const shape = this.replyCompletionShape(reply);
+      const ongoing = sessionOngoing;
+      statusReadableOngoing = ongoing;
+      if (ongoing === false) {
+        this.log({
+          level: "info",
+          message: `Re-adopt: message ${row.id.slice(0, 8)} running/${shape} but session ${sessionId.slice(0, 8)} is not-ongoing per GET /session/status (absent/idle) \u2014 re-dispatching from scratch (status-gated recovery)`,
+          conversation_id: row.conversation_id,
+          message_id: row.id
+        });
+        await this.forceReadoptRun(sessionId, row);
+        return;
+      }
+      if (ongoing === true) {
+        this.log({
+          level: "info",
+          message: `Re-adopt: message ${row.id.slice(0, 8)} running/${shape} and session ${sessionId.slice(0, 8)} is ongoing per GET /session/status (busy/retry) \u2014 re-attaching watcher (no re-dispatch)`,
+          conversation_id: row.conversation_id,
+          message_id: row.id
+        });
+      } else {
+        if (shape === "b1") {
+          this.log({
+            level: "info",
+            message: `Re-adopt: message ${row.id.slice(0, 8)} running/b1 but GET /session/status was unreadable (null) for session ${sessionId.slice(0, 8)} \u2014 NOT latching a b1 row on a transient status blip; leaving it un-tracked to re-evaluate on the next drain`,
+            conversation_id: row.conversation_id,
+            message_id: row.id
+          });
+          if (!this.readoptPollUnresolvedSignalled.has(row.id)) {
+            this.readoptPollUnresolvedSignalled.add(row.id);
+            void this.postSignal(row.conversation_id, row.id, "readopt_poll_unresolved");
+          }
+          return;
+        }
+        this.log({
+          level: "info",
+          message: `Re-adopt: message ${row.id.slice(0, 8)} running/${shape} but GET /session/status was unreadable (null) for session ${sessionId.slice(0, 8)} \u2014 falling back to the #253 preamble + descendant cross-check`,
+          conversation_id: row.conversation_id,
+          message_id: row.id
+        });
+      }
+    }
+    if (statusReadableOngoing === null && state === "running" && ocId && isPreamblePinnedRunning(messages, ocId)) {
+      const descendantAlive = await this.isAnyDescendantSessionAlive(sessionId);
+      if (descendantAlive === true) {
+        this.log({
+          level: "info",
+          message: `Re-adopt: message ${row.id.slice(0, 8)} preamble-pinned running (root ${sessionId.slice(0, 8)}) but a live descendant sub-agent session was found \u2014 treating as still running, re-attaching watcher (no re-dispatch)`,
+          conversation_id: row.conversation_id,
+          message_id: row.id
+        });
+      } else {
+        this.log({
+          level: "info",
+          message: `Re-adopt: message ${row.id.slice(0, 8)} preamble-pinned on recovery (root ${sessionId.slice(0, 8)}), no live descendant runner \u2014 re-dispatching from scratch${descendantAlive === null ? " (descendant liveness indeterminate; a restart guarantees no live runner, so this does NOT block the re-dispatch)" : ""}`,
+          conversation_id: row.conversation_id,
+          message_id: row.id
+        });
+        await this.forceReadoptRun(sessionId, row);
+        return;
+      }
+    }
     if ((state === "running" || state === "queued") && ocId) {
       const conv = this.convForRow(sessionId, row);
       const message = this.queuedMessageForRow(row);
@@ -2750,6 +3006,7 @@ var ChannelDriver = class {
         conversation_id: row.conversation_id,
         message_id: row.id
       });
+      void this.postSignal(row.conversation_id, row.id, "readopt_reattached");
       return;
     }
     await this.forceReadoptRun(sessionId, row);
@@ -2802,6 +3059,7 @@ var ChannelDriver = class {
         conversation_id: row.conversation_id,
         message_id: row.id
       });
+      void this.postSignal(row.conversation_id, row.id, "readopt_window_elapsed");
       return;
     }
     const options = {
@@ -2830,6 +3088,7 @@ var ChannelDriver = class {
         conversation_id: row.conversation_id,
         message_id: row.id
       });
+      void this.postSignal(row.conversation_id, row.id, "readopt_orphan_unsent");
       return;
     }
     if (ocId === null) {
@@ -2840,6 +3099,7 @@ var ChannelDriver = class {
         conversation_id: row.conversation_id,
         message_id: row.id
       });
+      void this.postSignal(row.conversation_id, row.id, "readopt_orphan_unsent");
       return;
     }
     const conv = this.convForRow(sessionId, row);
@@ -2849,6 +3109,7 @@ var ChannelDriver = class {
     this.readopted.add(row.id);
     this.awaitingReadopt.delete(row.id);
     this.ensureWatcherRunning(sessionId);
+    void this.postSignal(row.conversation_id, row.id, "readopt_redispatched");
   }
   /**
    * True if `evidentMessageId` is already being driven — either in the
@@ -2940,21 +3201,41 @@ var ChannelDriver = class {
    * RUNNING (not done) is the one that paused. With one running message that is
    * unambiguous; with several we prefer an explicit messageID match, else the
    * oldest running message.
+   *
+   * Returns the set of in-flight Evident message ids that are paused awaiting a
+   * human — an outstanding (still-open) question/permission is attributed to them.
+   * `serviceInFlightMessage` uses this to keep an actively-running turn watched
+   * forever (ADR-0047) while still bounding a turn merely blocked on a person who
+   * may never answer. Attribution here covers ALL open interactions, not just
+   * NEW (un-deduped) ones — a question stays "awaiting a human" until answered,
+   * even after it was already surfaced to the channel.
    */
   async pollInteractions(sessionId, watcher, messages) {
+    const openQuestions = /* @__PURE__ */ new Set();
+    const openPermissions = /* @__PURE__ */ new Set();
+    let questionsPolledOk = true;
+    let permissionsPolledOk = true;
     let questions = [];
     try {
       const res = await this.fetchImpl(`${this.opencodeBase}/question`);
       if (res.ok) {
         const body = await res.json();
-        questions = Array.isArray(body) ? body : [];
+        if (Array.isArray(body)) {
+          questions = body;
+        } else {
+          questionsPolledOk = false;
+        }
+      } else {
+        questionsPolledOk = false;
       }
     } catch {
+      questionsPolledOk = false;
     }
     for (const q of questions) {
-      if (watcher.reportedQuestions.has(q.id)) continue;
       if (!await this.sessionBelongsTo(q.sessionID, sessionId)) continue;
       const paused = this.attributeInteraction(watcher, q.tool?.messageID, messages);
+      if (paused) openQuestions.add(paused.evidentMessageId);
+      if (watcher.reportedQuestions.has(q.id)) continue;
       const reported = await this.reportInteraction(
         watcher.conv.id,
         "question",
@@ -2968,14 +3249,22 @@ var ChannelDriver = class {
       const res = await this.fetchImpl(`${this.opencodeBase}/permission`);
       if (res.ok) {
         const body = await res.json();
-        permissions = Array.isArray(body) ? body : [];
+        if (Array.isArray(body)) {
+          permissions = body;
+        } else {
+          permissionsPolledOk = false;
+        }
+      } else {
+        permissionsPolledOk = false;
       }
     } catch {
+      permissionsPolledOk = false;
     }
     for (const p of permissions) {
-      if (watcher.reportedPermissions.has(p.id)) continue;
       if (!await this.sessionBelongsTo(p.sessionID, sessionId)) continue;
       const paused = this.attributeInteraction(watcher, p.messageID, messages);
+      if (paused) openPermissions.add(paused.evidentMessageId);
+      if (watcher.reportedPermissions.has(p.id)) continue;
       const reported = await this.reportInteraction(
         watcher.conv.id,
         "permission",
@@ -2984,6 +3273,7 @@ var ChannelDriver = class {
       );
       if (reported) watcher.reportedPermissions.add(p.id);
     }
+    return { openQuestions, openPermissions, questionsPolledOk, permissionsPolledOk };
   }
   /**
    * True when `sessionId` is the `rootSessionId` itself OR a descendant of it —
@@ -3029,6 +3319,83 @@ var ChannelDriver = class {
     if (parent !== void 0) this.sessionParents.set(sessionId, parent);
     return parent;
   }
+  /**
+   * DEFENSIVE cross-check for the restart-recovery path (WI-2): is any descendant
+   * (`task` sub-agent) session under `rootSessionId` still genuinely doing work?
+   *
+   * The PRIMARY recovery trigger is "preamble-pinned on recovery ⇒ idle" — a
+   * runner restart wipes OpenCode's in-memory `SessionStatus`/`Runner`, so a
+   * completed `finish: "tool-calls"` root reply encountered during re-adoption is
+   * idle by OpenCode's own definition and is re-dispatched. This method exists only
+   * so the WI-3 caller can VETO that re-dispatch in the rare case a descendant is
+   * provably in flight at the exact moment of recovery.
+   *
+   * "Alive" criterion (TIGHTENED): a descendant is alive only when it is PROVABLY,
+   * ACTIVELY generating — its LAST message is an assistant still mid-generation
+   * (`completed == null`, via `isSessionActivelyGenerating`). An
+   * INCOMPLETE-BUT-NOT-GENERATING child — last message a user message, or a
+   * completed `finish: "tool-calls"` step — is NOT alive after a restart (nothing
+   * is generating once the runner is gone), so it does NOT veto. (This is
+   * deliberately NOT `!isTurnComplete`, which also matches those dead-but-non-terminal
+   * shapes and would falsely veto — re-hanging the very turn this path recovers.)
+   *
+   * Return contract (encoded so WI-3 need not re-derive it):
+   *  - `true`  → a descendant is provably, actively generating (veto re-dispatch).
+   *  - `false` → descendants exist but none is actively generating (the restart
+   *              case), OR no descendant is found at all.
+   *  - `null`  → liveness is INDETERMINATE (enumeration via `listSessions` failed).
+   *
+   * ⚠️ `null` (UNKNOWN) MUST NOT be treated as "alive": WI-3 treats `null` the same
+   * as `false` and does NOT veto — a restart guarantees no live runner, so an
+   * indeterminate cross-check almost always means "couldn't reach a child that no
+   * longer exists". The inversion lives in the caller; this method just reports
+   * true/false/null faithfully.
+   *
+   * VERIFY-BEFORE-DEPEND: we depend ONLY on (a) `parentID` from `GET /session/:id`
+   * (already proven by the existing child-session interaction tests, via
+   * `resolveSessionParent`/`sessionBelongsTo`) and (b) the child's own message-list
+   * terminal state. We do NOT depend on any session-level `busy`/`idle` field —
+   * there is none on `GET /session/:id`; OpenCode's busy state is in-memory
+   * `SessionStatus` only.
+   */
+  async isAnyDescendantSessionAlive(rootSessionId) {
+    const sessions = await listSessions(this.port);
+    if (!sessions) {
+      this.log({
+        level: "error",
+        message: `Re-adopt: could not enumerate sessions to cross-check descendant liveness for root ${rootSessionId} (listSessions failed) \u2014 treating child liveness as indeterminate`
+      });
+      return null;
+    }
+    for (const candidate of sessions) {
+      if (!candidate?.id || candidate.id === rootSessionId) continue;
+      if (!await this.sessionBelongsTo(candidate.id, rootSessionId)) continue;
+      const childMsgs = await getSessionMessages(this.port, candidate.id);
+      if (isSessionActivelyGenerating(childMsgs)) {
+        return true;
+      }
+    }
+    return false;
+  }
+  /**
+   * Cheap decision-telemetry label for a running row's LAST correlated reply
+   * (WI-2 Task 2.2): which running SHAPE it is, for the status-gated recovery log.
+   *   - `b1`    — the reply itself is still in flight (`time.completed == null`) —
+   *               the aborted-in-flight production bug after a restart.
+   *   - `b2`    — a COMPLETED reply pinned running only by `finish === "tool-calls"`
+   *               (the sub-agent preamble — #253's shape).
+   *   - `other` — any other shape (defensive; a running row is normally b1 or b2).
+   * Reads `info.time.completed` / `info.finish` (tolerating the legacy top-level
+   * shape) directly rather than re-importing the module-private `completedOf`/
+   * `finishOf` — this is a display label only, not a correctness predicate.
+   */
+  replyCompletionShape(reply) {
+    if (!reply) return "other";
+    const completed = reply.info?.time?.completed ?? reply.time?.completed;
+    if (completed == null) return "b1";
+    const finish = reply.info?.finish ?? reply.finish;
+    return finish === "tool-calls" ? "b2" : "other";
+  }
   /**
    * Attribute a surfaced interaction to the in-flight message it paused on (M-1).
    *
@@ -3260,6 +3627,12 @@ var ChannelDriver = class {
    * MUST NOT use `callWithRetry` (a telemetry ping must not block the sequential
    * watcher tick — one attempt is enough). A failure is SWALLOWED but LOGGED with
    * context (no silent catch, per development-workflow).
+   *
+   * Returns whether the POST SUCCEEDED (2xx). Most callers ignore this (pure
+   * telemetry), but the `paused` liveness-clear uses it to know whether to
+   * RE-ASSERT on a later tick — a single dropped `paused` POST must not leave a
+   * stale `last_seen_alive_at` on a still-paused row (Bugbot "Failed paused signal
+   * leaves liveness").
    */
   async postSignal(conversationId, messageId, signal, extra) {
     try {
@@ -3278,7 +3651,9 @@ var ChannelDriver = class {
           conversation_id: conversationId,
           message_id: messageId
         });
+        return false;
       }
+      return true;
     } catch (err) {
       this.log({
         level: "error",
@@ -3286,6 +3661,7 @@ var ChannelDriver = class {
         conversation_id: conversationId,
         message_id: messageId
       });
+      return false;
     }
   }
   async persistSession(conversationId, sessionId) {