@evident-ai/cli 3.1.1-dev.0d8ac46 → 3.1.1-dev.10bc663

package/dist/index.js

@@ -532,6 +532,353 @@ async function whoami() {
   blank();
 }
 
+// src/lib/auth.ts
+async function getAuthCredentials() {
+  const runnerKey = process.env.EVIDENT_RUNNER_KEY;
+  const agentKey = process.env.EVIDENT_AGENT_KEY;
+  if (runnerKey) {
+    return {
+      token: runnerKey,
+      authType: "agent_key",
+      keySource: "runner_key",
+      notice: agentKey ? "Both EVIDENT_RUNNER_KEY and EVIDENT_AGENT_KEY are set; using EVIDENT_RUNNER_KEY." : void 0
+    };
+  }
+  if (agentKey) {
+    return { token: agentKey, authType: "agent_key", keySource: "agent_key" };
+  }
+  const userToken = process.env.EVIDENT_TOKEN;
+  if (userToken) {
+    return { token: userToken, authType: "bearer" };
+  }
+  const keychainCreds = await getToken();
+  if (keychainCreds) {
+    return {
+      token: keychainCreds.token,
+      authType: "bearer",
+      user: keychainCreds.user
+    };
+  }
+  return null;
+}
+function getAuthHeader(credentials2) {
+  if (credentials2.authType === "agent_key") {
+    return `SandboxKey ${credentials2.token}`;
+  }
+  return `Bearer ${credentials2.token}`;
+}
+function isInteractive(jsonOutput) {
+  if (jsonOutput) return false;
+  if (process.env.CI) return false;
+  if (process.env.GITHUB_ACTIONS) return false;
+  if (!process.stdin.isTTY) return false;
+  return true;
+}
+
+// src/commands/agent-lookup.ts
+async function readErrorMessage(response) {
+  const text = await response.text().catch(() => "");
+  if (!text) return response.statusText || void 0;
+  try {
+    const data = JSON.parse(text);
+    const message = data.message ?? data.error;
+    if (typeof message === "string" && message.trim()) {
+      return message;
+    }
+  } catch {
+  }
+  return text.trim() || response.statusText || void 0;
+}
+function authFailureHint(apiUrl, serverMessage) {
+  const reason = serverMessage ? `: ${serverMessage}` : "";
+  return `Authentication failed${reason}. Your credentials were rejected by ${apiUrl}. This usually means you logged in against a different environment, or your session expired \u2014 log in again pointing at this endpoint and retry.`;
+}
+async function resolveAgentIdFromKey(authHeader) {
+  const apiUrl = getApiUrlConfig();
+  try {
+    const response = await fetch(`${apiUrl}/me`, {
+      headers: { Authorization: authHeader }
+    });
+    if (response.status === 401) {
+      const serverMessage = await readErrorMessage(response);
+      return { error: authFailureHint(apiUrl, serverMessage), authFailed: true };
+    }
+    if (!response.ok) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        error: `Failed to resolve runner from key (HTTP ${response.status})${serverMessage ? `: ${serverMessage}` : ""}`
+      };
+    }
+    const data = await response.json();
+    if (data.auth_type === "agent_key" && data.agent_id) {
+      return { agent_id: data.agent_id };
+    }
+    return {
+      error: "Cannot resolve runner ID: auth type is not agent_key. Please provide --runner explicitly."
+    };
+  } catch (error2) {
+    const message = error2 instanceof Error ? error2.message : "Unknown error";
+    return { error: `Failed to resolve runner from key: ${message}` };
+  }
+}
+var BEST_EFFORT_NOTIFY_TIMEOUT_MS = 2e3;
+async function notifyAgentDisconnected(agentId, authHeader) {
+  const apiUrl = getApiUrlConfig();
+  try {
+    const response = await fetch(`${apiUrl}/runners/${agentId}/disconnect`, {
+      method: "POST",
+      headers: { Authorization: authHeader },
+      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
+    });
+    if (!response.ok) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        ok: false,
+        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
+      };
+    }
+    return { ok: true };
+  } catch (error2) {
+    return { ok: false, error: describeBestEffortError(error2) };
+  }
+}
+function describeBestEffortError(error2) {
+  const name = error2?.name;
+  if (name === "TimeoutError" || name === "AbortError") {
+    return `timed out after ${BEST_EFFORT_NOTIFY_TIMEOUT_MS}ms`;
+  }
+  return error2 instanceof Error ? error2.message : String(error2);
+}
+async function reportMicrovmId(agentId, authHeader, microvmId) {
+  try {
+    const apiUrl = getApiUrlConfig();
+    const response = await fetch(`${apiUrl}/runners/${agentId}/microvm`, {
+      method: "POST",
+      headers: { Authorization: authHeader, "Content-Type": "application/json" },
+      body: JSON.stringify({ microvm_id: microvmId }),
+      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
+    });
+    if (!response.ok) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        ok: false,
+        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
+      };
+    }
+    return { ok: true };
+  } catch (error2) {
+    return { ok: false, error: describeBestEffortError(error2) };
+  }
+}
+function toReportedWindow(window) {
+  if (!window) return null;
+  return { utilization: window.utilization, resets_at: window.resetsAt };
+}
+async function reportClaudeUsage(agentId, authHeader, snapshot) {
+  try {
+    const apiUrl = getApiUrlConfig();
+    const response = await fetch(`${apiUrl}/runners/${agentId}/claude-usage`, {
+      method: "POST",
+      headers: { Authorization: authHeader, "Content-Type": "application/json" },
+      body: JSON.stringify({
+        five_hour: toReportedWindow(snapshot.fiveHour),
+        seven_day: toReportedWindow(snapshot.sevenDay)
+      }),
+      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
+    });
+    if (!response.ok) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        ok: false,
+        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
+      };
+    }
+    return { ok: true };
+  } catch (error2) {
+    return { ok: false, error: describeBestEffortError(error2) };
+  }
+}
+async function getAgentInfo(agentId, authHeader) {
+  const apiUrl = getApiUrlConfig();
+  try {
+    const response = await fetch(`${apiUrl}/runners/${agentId}`, {
+      headers: { Authorization: authHeader }
+    });
+    if (response.status === 401) {
+      const serverMessage = await readErrorMessage(response);
+      return { valid: false, error: authFailureHint(apiUrl, serverMessage), authFailed: true };
+    }
+    if (response.status === 403) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        valid: false,
+        error: serverMessage ?? "You do not have access to this runner (it may belong to a different team or organization)."
+      };
+    }
+    if (response.status === 404) {
+      const serverMessage = await readErrorMessage(response);
+      return { valid: false, error: serverMessage ?? `Runner ${agentId} not found` };
+    }
+    if (!response.ok) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        valid: false,
+        error: `API error (HTTP ${response.status})${serverMessage ? `: ${serverMessage}` : ""}`
+      };
+    }
+    const agent = await response.json();
+    if (agent.agent_type !== "local") {
+      return {
+        valid: false,
+        error: `Runner is type '${agent.agent_type}', must be 'local' for CLI connection`
+      };
+    }
+    return { valid: true, agent };
+  } catch (error2) {
+    const message = error2 instanceof Error ? error2.message : "Unknown error";
+    return { valid: false, error: `Failed to validate runner: ${message}` };
+  }
+}
+
+// src/commands/status.ts
+var STATUS_TIMEOUT_MS = 1e4;
+function authLabelFor(credentials2) {
+  if (credentials2.authType === "agent_key") {
+    return credentials2.keySource === "agent_key" ? "runner key (EVIDENT_AGENT_KEY)" : "runner key (EVIDENT_RUNNER_KEY)";
+  }
+  return "user token";
+}
+function describeFetchError(error2) {
+  const name = error2?.name;
+  if (name === "TimeoutError" || name === "AbortError") {
+    return `timed out after ${STATUS_TIMEOUT_MS}ms waiting for a response`;
+  }
+  return error2 instanceof Error ? error2.message : String(error2);
+}
+async function checkStatus(jsonMode) {
+  const apiUrl = getApiUrlConfig();
+  const credentials2 = await getAuthCredentials();
+  if (!credentials2) {
+    return {
+      ok: false,
+      endpoint: apiUrl,
+      reason: "no_credentials",
+      error: "No credentials configured. Set EVIDENT_RUNNER_KEY (or EVIDENT_AGENT_KEY), or EVIDENT_TOKEN, or run `evident login`.",
+      exitCode: 1
+    };
+  }
+  if (credentials2.notice && !jsonMode) {
+    printWarning(credentials2.notice);
+  }
+  let response;
+  try {
+    response = await fetch(`${apiUrl}/me`, {
+      headers: { Authorization: getAuthHeader(credentials2) },
+      signal: AbortSignal.timeout(STATUS_TIMEOUT_MS)
+    });
+  } catch (error2) {
+    return {
+      ok: false,
+      endpoint: apiUrl,
+      authLabel: authLabelFor(credentials2),
+      reason: "unreachable",
+      error: `Could not reach ${apiUrl}: ${describeFetchError(error2)}. The credentials were NOT validated.`,
+      exitCode: 75
+    };
+  }
+  if (response.status === 401) {
+    const serverMessage = await readErrorMessage(response);
+    return {
+      ok: false,
+      endpoint: apiUrl,
+      authLabel: authLabelFor(credentials2),
+      reason: "unauthorized",
+      error: authFailureHint(apiUrl, serverMessage),
+      exitCode: 1
+    };
+  }
+  if (response.status === 404) {
+    return {
+      ok: false,
+      endpoint: apiUrl,
+      authLabel: authLabelFor(credentials2),
+      reason: "endpoint_not_found",
+      error: `${apiUrl}/me returned HTTP 404 \u2014 that endpoint has no /me route, so it is probably missing the /v1 prefix. The credentials were NOT validated.`,
+      exitCode: 75
+    };
+  }
+  if (response.status >= 500) {
+    const serverMessage = await readErrorMessage(response);
+    return {
+      ok: false,
+      endpoint: apiUrl,
+      authLabel: authLabelFor(credentials2),
+      reason: "unreachable",
+      error: `${apiUrl} returned HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}. The credentials were NOT validated.`,
+      exitCode: 75
+    };
+  }
+  if (!response.ok) {
+    const serverMessage = await readErrorMessage(response);
+    return {
+      ok: false,
+      endpoint: apiUrl,
+      authLabel: authLabelFor(credentials2),
+      reason: "http_error",
+      error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`,
+      exitCode: 1
+    };
+  }
+  const data = await response.json();
+  return {
+    ok: true,
+    endpoint: apiUrl,
+    authType: data.auth_type,
+    authLabel: authLabelFor(credentials2),
+    runnerId: data.auth_type === "agent_key" ? data.agent_id : void 0,
+    reason: "ok",
+    exitCode: 0
+  };
+}
+function printJson(result) {
+  const payload = {
+    ok: result.ok,
+    endpoint: result.endpoint
+  };
+  if (result.authType) payload.auth_type = result.authType;
+  if (result.runnerId) payload.runner_id = result.runnerId;
+  if (result.reason) payload.reason = result.reason;
+  if (result.error) payload.error = result.error;
+  console.log(JSON.stringify(payload));
+}
+function printHuman(result) {
+  blank();
+  console.log(keyValue("Endpoint", result.endpoint));
+  if (result.ok) {
+    console.log(keyValue("Auth", result.authLabel ?? "\u2014"));
+    if (result.runnerId) {
+      console.log(keyValue("Runner", result.runnerId));
+    }
+    console.log(keyValue("Status", "OK \u2014 credentials accepted"));
+    blank();
+    return;
+  }
+  if (result.authLabel) {
+    console.log(keyValue("Auth", result.authLabel));
+  }
+  blank();
+  printError(result.error ?? "Unknown error");
+}
+async function status(options = {}) {
+  const result = await checkStatus(Boolean(options.json));
+  if (options.json) {
+    printJson(result);
+  } else {
+    printHuman(result);
+  }
+  process.exit(result.exitCode);
+}
+
 // src/lib/claude-usage.ts
 import { execFileSync } from "child_process";
 import { readFileSync } from "fs";
@@ -582,6 +929,10 @@ var ClaudeUsageError = class extends Error {
 function isLocalCredentialProblem(err) {
   return err instanceof ClaudeUsageError && (err.reason === "no_credentials" || err.reason === "credentials_expired");
 }
+function normalizeResetsAt(value) {
+  const ms = Date.parse(value);
+  return Number.isNaN(ms) ? null : new Date(ms).toISOString();
+}
 function toWindow(value) {
   if (!value || typeof value !== "object") {
     return null;
@@ -590,7 +941,11 @@ function toWindow(value) {
   if (typeof window.utilization !== "number" || typeof window.resets_at !== "string") {
     return null;
   }
-  return { utilization: window.utilization, resetsAt: window.resets_at };
+  const resetsAt = normalizeResetsAt(window.resets_at);
+  if (resetsAt === null) {
+    return null;
+  }
+  return { utilization: window.utilization, resetsAt };
 }
 async function getClaudeUsage() {
   const credentials2 = readClaudeCliCredentials();
@@ -652,6 +1007,9 @@ import { homedir as homedir3 } from "os";
 import { isAbsolute as isAbsolute2, join as join3, parse, resolve as resolvePath } from "path";
 import chalk6 from "chalk";
 
+// ../../packages/types/src/agents/index.ts
+var MICROVM_MAX_LIFETIME_MS = 8 * 60 * 6e4;
+
 // ../../packages/types/src/telemetry/index.ts
 var TelemetryEventTypes = {
   // Agent activity events (shown in web UI activity log)
@@ -934,49 +1292,6 @@ function forwardRunnerActivity(entry, context) {
   }
 }
 
-// src/lib/auth.ts
-async function getAuthCredentials() {
-  const runnerKey = process.env.EVIDENT_RUNNER_KEY;
-  const agentKey = process.env.EVIDENT_AGENT_KEY;
-  if (runnerKey) {
-    return {
-      token: runnerKey,
-      authType: "agent_key",
-      keySource: "runner_key",
-      notice: agentKey ? "Both EVIDENT_RUNNER_KEY and EVIDENT_AGENT_KEY are set; using EVIDENT_RUNNER_KEY." : void 0
-    };
-  }
-  if (agentKey) {
-    return { token: agentKey, authType: "agent_key", keySource: "agent_key" };
-  }
-  const userToken = process.env.EVIDENT_TOKEN;
-  if (userToken) {
-    return { token: userToken, authType: "bearer" };
-  }
-  const keychainCreds = await getToken();
-  if (keychainCreds) {
-    return {
-      token: keychainCreds.token,
-      authType: "bearer",
-      user: keychainCreds.user
-    };
-  }
-  return null;
-}
-function getAuthHeader(credentials2) {
-  if (credentials2.authType === "agent_key") {
-    return `SandboxKey ${credentials2.token}`;
-  }
-  return `Bearer ${credentials2.token}`;
-}
-function isInteractive(jsonOutput) {
-  if (jsonOutput) return false;
-  if (process.env.CI) return false;
-  if (process.env.GITHUB_ACTIONS) return false;
-  if (!process.stdin.isTTY) return false;
-  return true;
-}
-
 // src/lib/opencode/health.ts
 async function checkOpenCodeHealth(port) {
   try {
@@ -1784,6 +2099,21 @@ function messageError(messages, userMessageId) {
   }
   return "The agent run failed.";
 }
+function isAbortedTerminalReply(messages, userMessageId) {
+  const reply = findLastAssistantReplyFor(messages, userMessageId);
+  const error2 = errorOf(reply);
+  if (error2 == null) return false;
+  if (typeof error2 === "string") return error2.trim() === "Aborted";
+  if (typeof error2 === "object") {
+    const e = error2;
+    if (e.name === "MessageAbortedError") return true;
+    if (e.name === "AbortError") return true;
+    const dataMessage = e.data?.message;
+    const rendered = typeof dataMessage === "string" ? dataMessage : typeof e.message === "string" ? e.message : null;
+    return rendered != null && rendered.trim() === "Aborted";
+  }
+  return false;
+}
 function messageFailure(messages, userMessageId) {
   const reply = findLastAssistantReplyFor(messages, userMessageId);
   const error2 = errorOf(reply);
@@ -2386,6 +2716,10 @@ function nextReportDelayMs(random = Math.random) {
   return BASE_REPORT_DELAY_MS - jitterRangeMs + random() * (2 * jitterRangeMs);
 }
 var FIRST_REPORT_DELAY_MS = 5e3 + Math.random() * 1e4;
+var CLAUDE_USAGE_FAILURE_REESCALATION_TICKS = 6;
+function claudeUsageFailureLogLevel(consecutiveFailures) {
+  return consecutiveFailures === 1 || consecutiveFailures % CLAUDE_USAGE_FAILURE_REESCALATION_TICKS === 0 ? "warn" : "debug";
+}
 
 // src/lib/channels/driver.ts
 import { homedir as homedir2 } from "os";
@@ -2708,8 +3042,8 @@ async function applyOne(options, file) {
   await ack(options, file, "applied");
   return true;
 }
-function durableDownloadCode(status) {
-  return status === 413 ? "file_too_large" : "write_failed";
+function durableDownloadCode(status2) {
+  return status2 === 413 ? "file_too_large" : "write_failed";
 }
 async function downloadContent(options, file, label) {
   try {
@@ -2742,8 +3076,8 @@ async function downloadContent(options, file, label) {
     return { ok: false, terminal: false };
   }
 }
-async function ack(options, file, status, reason) {
-  const outcome = `${status}${reason ? ` (${reason})` : ""}`;
+async function ack(options, file, status2, reason) {
+  const outcome = `${status2}${reason ? ` (${reason})` : ""}`;
   try {
     const res = await options.fetchImpl(
       `${options.apiUrl}/runners/${options.agentId}/files/${file.id}/ack`,
@@ -2753,7 +3087,7 @@ async function ack(options, file, status, reason) {
           Authorization: options.getAuthHeader(),
           "Content-Type": "application/json"
         },
-        body: JSON.stringify(reason ? { status, reason } : { status })
+        body: JSON.stringify(reason ? { status: status2, reason } : { status: status2 })
       }
     );
     if (!res.ok) {
@@ -2817,6 +3151,7 @@ var B2_ABANDONMENT_MIN_PINNED_MS = 3 * 6e4;
 var B2_ABANDONMENT_RECHECK_MS = HEARTBEAT_MS;
 var POLL_MISS_GRACE_MS = HEARTBEAT_MS;
 var MAX_SUPERSEDED_CONVERSATIONS = 256;
+var MAX_IDENTICAL_REDRIVE_POLL_FAILURES = 5;
 var ChannelAuthError = class extends Error {
   constructor(message) {
     super(message);
@@ -2825,10 +3160,10 @@ var ChannelAuthError = class extends Error {
 };
 var ChannelTerminalError = class extends Error {
   status;
-  constructor(message, status) {
+  constructor(message, status2) {
     super(message);
     this.name = "ChannelTerminalError";
-    this.status = status;
+    this.status = status2;
   }
 };
 function backoffDelay(attempt, policy) {
@@ -2836,8 +3171,12 @@ function backoffDelay(attempt, policy) {
   const capped = Math.min(policy.maxDelayMs, exp);
   return Math.floor(Math.random() * capped);
 }
-function isRetryableStatus(status) {
-  return status === 429 || status >= 500 && status <= 599;
+function isRetryableStatus(status2) {
+  return status2 === 429 || status2 >= 500 && status2 <= 599;
+}
+var VOLATILE_BODY_FIELD_PATTERN = /("(?:ref|requestId|request_id|traceId|trace_id)"\s*:\s*)"[^"]*"/gi;
+function normalizeRedrivePollFailureBody(body) {
+  return body.replace(VOLATILE_BODY_FIELD_PATTERN, '$1"<redacted>"').replace(/\s+/g, " ").trim().slice(0, 200);
 }
 var ChannelDriver = class _ChannelDriver {
   agentId;
@@ -2952,6 +3291,84 @@ var ChannelDriver = class _ChannelDriver {
    * processing list, exactly like `dontRedispatch`/`doneUndeliverable`.
    */
   readoptPollUnresolvedSignalled = /* @__PURE__ */ new Set();
+  /**
+   * "Already emitted `redrive_unresolved` for this row" (#965). Mirrors
+   * `readoptPollUnresolvedSignalled`: `resolveRedrive`'s `unresolved` leaf recurs
+   * every ~2s drain until opencode's status becomes readable, but the
+   * server-visible signal is an OUTCOME, so it fires at most once per row. Cleared
+   * on any non-`unresolved` outcome so the set cannot grow beyond the currently
+   * unresolvable rows.
+   */
+  redriveUnresolvedSignalled = /* @__PURE__ */ new Set();
+  /**
+   * First `now()` a `pending` row's re-drive was observed `unresolved` (#965). A
+   * `pending` row is invisible to every cron arm (all require `status =
+   * 'processing'`), so an indefinitely-`unresolved` row would be stranded with
+   * nothing driving it. Once `now - since >= pausedMaxWaitMs`, `resolveRedrive`
+   * takes `dispatch` instead of `unresolved` (reusing the existing knob — see
+   * ADR-0047's own "unreachable ⇒ bounded" rule). Cleared on any other outcome.
+   */
+  redriveUnresolvedSince = /* @__PURE__ */ new Map();
+  /**
+   * Consecutive-identical-poll-failure streak for the re-drive fence (#1348),
+   * keyed by Evident **message id** (not session) so `clearRedriveUnresolved`
+   * can drop it with the other two trackers and it cannot leak. `sessionId` is
+   * carried inside the entry, not the key: a session change is a different
+   * situation and resets the streak, which gives the `(sessionId, message.id)`
+   * pairing #1348 asks for without a composite map key.
+   */
+  redrivePollFailures = /* @__PURE__ */ new Map();
+  /**
+   * "Already emitted `redrive_outcome_unreported` for THIS (message, outcome)
+   * streak" (Class B, #1340: the runner DECIDED reattach/settle/fail_permanent
+   * but its own PATCH to record it failed — distinct from Class A's
+   * `redrive_poll_failed`, where opencode itself can't be observed). Keyed by
+   * message id, valued by the outcome currently failing to report, so a
+   * change of outcome starts a fresh signal. Cleared by
+   * `clearRedriveUnresolved` the instant either PATCH succeeds.
+   */
+  redriveOutcomeUnreportedSignalled = /* @__PURE__ */ new Map();
+  /**
+   * First `now()` a Class B outcome PATCH (reattach/settle/fail_permanent) was
+   * observed to fail for this message (#1366's failure-window trip arm,
+   * `boundRedriveOutcome`). Duration, not a tick count — bounded by the
+   * existing `pausedMaxWaitMs` window (reusing the knob, not a new constant).
+   * Cleared by `clearRedriveUnresolved` the instant the original PATCH
+   * succeeds.
+   */
+  redriveOutcomeFailingSince = /* @__PURE__ */ new Map();
+  /**
+   * "Already posted `redrive_outcome_abandoned` with `reported: false` for this
+   * row" (#1366) — the bound tripped but the terminal `markFailed` fallback ALSO
+   * failed (the route-level fault of G2), so every following tick re-attempts
+   * the same terminal PATCH. Guards that quiet retry from re-signalling on
+   * every tick. Cleared by `clearRedriveUnresolved`.
+   */
+  redriveOutcomeAbandonedSignalled = /* @__PURE__ */ new Set();
+  /**
+   * "Already emitted `dispatch_not_started` for THIS (message, branch) streak"
+   * (#1340). Valued by the branch currently firing, so a row that moves between
+   * exits re-signals — the move IS the finding. Cleared only on a CONFIRMED
+   * dispatch, never on the fence's decision to dispatch: `clearRedriveUnresolved`
+   * runs on that decision (`resolveRedriveUnresolved`), so clearing there would
+   * re-signal on every one of the 15h of re-dispatch attempts #1110 made.
+   */
+  dispatchNotStartedSignalled = /* @__PURE__ */ new Map();
+  /**
+   * Consecutive-UNCONFIRMED-dispatch streak for a `pending` row with NO stored
+   * `opencode_message_id` yet — i.e. one that has never even reached the
+   * re-drive fence above. `sendPromptAsync`'s POST may 2xx, but its own
+   * read-back retries can never confirm the assigned id when the session's
+   * message list is PERMANENTLY unreadable (e.g. a corrupted local opencode
+   * SQLite DB, #1345/#1348's exact fault, just hit BEFORE the row is ever
+   * dispatched instead of after). Unlike an already-dispatched row, THIS row has
+   * no other safety net at all: the lifecycle cron only reclaims `status =
+   * 'processing'` rows, and a row stuck here never reaches `processing`. Keyed
+   * by message id, carrying `sessionId` so a session change (a fresh one bound
+   * after abandonment) starts a new streak rather than inheriting the old
+   * session's count — same shape as `redrivePollFailures` above.
+   */
+  unconfirmedDispatchFailures = /* @__PURE__ */ new Map();
   /**
    * "A null-id re-adopt re-dispatch is in flight, awaiting its read-back" (WI-5
    * Task 5.4, High-2). Since we no longer send a caller-supplied id, a re-dispatch
@@ -3276,7 +3693,7 @@ var ChannelDriver = class _ChannelDriver {
    * @returns the count of messages NEWLY dispatched (not already in-flight).
    */
   async processConversation(conv) {
-    const { sessionId, refusedSessionId } = await this.ensureSession(conv);
+    const { sessionId, refusedSessionId, created: sessionCreated } = await this.ensureSession(conv);
     const messages = await this.getPendingMessages(conv.id);
     let dispatched = 0;
     let skippedAlreadyDispatched = 0;
@@ -3291,6 +3708,15 @@ var ChannelDriver = class _ChannelDriver {
         skippedAlreadyDispatched += 1;
         continue;
       }
+      if (message.opencode_message_id) {
+        const outcome = await this.resolveRedrive(conv, sessionId, message, sessionCreated);
+        if (outcome === "abandoned") {
+          continue;
+        }
+        if (outcome !== "dispatch") {
+          break;
+        }
+      }
       const options = {
         agent: message.opencode_agent ?? void 0,
         model: message.opencode_model ?? void 0
@@ -3320,6 +3746,7 @@ var ChannelDriver = class _ChannelDriver {
             conversation_id: conv.id,
             message_id: message.id
           });
+          this.signalDispatchNotStarted(conv, message, "session_deleted_race");
           break;
         }
         if (exists === null) {
@@ -3329,6 +3756,7 @@ var ChannelDriver = class _ChannelDriver {
             conversation_id: conv.id,
             message_id: message.id
           });
+          this.signalDispatchNotStarted(conv, message, "session_existence_unknown");
           break;
         }
         const errorMessage = err instanceof Error ? err.message : String(err);
@@ -3347,6 +3775,7 @@ var ChannelDriver = class _ChannelDriver {
             conversation_id: conv.id,
             message_id: message.id
           });
+          this.signalDispatchNotStarted(conv, message, "failure_unreported");
         });
         this.log({
           level: "error",
@@ -3357,14 +3786,40 @@ var ChannelDriver = class _ChannelDriver {
         break;
       }
       if (opencodeMessageId === null) {
+        const streak = this.recordUnconfirmedDispatch(message.id, sessionId);
+        if (streak < MAX_IDENTICAL_REDRIVE_POLL_FAILURES) {
+          this.log({
+            level: "warn",
+            message: `Message ${message.id.slice(0, 8)} dispatched but its opencode id could not be read back (${streak}/${MAX_IDENTICAL_REDRIVE_POLL_FAILURES}) \u2014 leaving un-tracked to retry next tick`,
+            conversation_id: conv.id,
+            message_id: message.id
+          });
+          this.signalDispatchNotStarted(conv, message, "readback_unconfirmed");
+          continue;
+        }
+        this.unconfirmedDispatchFailures.delete(message.id);
+        this.sessions.delete(conv.id);
+        this.supersede(conv.id, sessionId);
+        const errorMessage = `OpenCode accepted this message ${streak} times in a row but never confirmed its assigned id (session ${sessionId.slice(0, 8)}'s message list could not be read back) \u2014 the session was abandoned; a fresh one is used for further messages.`;
         this.log({
-          level: "warn",
-          message: `Message ${message.id.slice(0, 8)} dispatched but its opencode id could not be read back \u2014 leaving un-tracked to retry next tick`,
+          level: "error",
+          message: errorMessage,
           conversation_id: conv.id,
           message_id: message.id
         });
-        continue;
+        await this.markFailed(conv.id, message.id, null, errorMessage).catch((markErr) => {
+          this.log({
+            level: "warn",
+            message: `markFailed PATCH for message ${message.id.slice(0, 8)} (conversation ${conv.id.slice(0, 8)}) failed (best-effort, not retried): ${markErr instanceof Error ? markErr.message : String(markErr)}`,
+            conversation_id: conv.id,
+            message_id: message.id
+          });
+          this.signalDispatchNotStarted(conv, message, "abandon_unreported");
+        });
+        break;
       }
+      this.unconfirmedDispatchFailures.delete(message.id);
+      this.dispatchNotStartedSignalled.delete(message.id);
       this.dispatched.add(message.id);
       this.registerInFlight(conv, sessionId, message, opencodeMessageId);
       dispatched += 1;
@@ -3373,12 +3828,458 @@ var ChannelDriver = class _ChannelDriver {
     if (messages.length > 0 && dispatched === 0 && skippedAlreadyDispatched === messages.length) {
       this.log({
         level: "warn",
-        message: `Conversation ${conv.id.slice(0, 8)} has ${messages.length} pending message(s) but ALL are already marked dispatched locally (in-flight set: ${this.dispatched.size}) \u2014 none sent to OpenCode this tick. If this repeats, a message may be stuck acknowledged-but-never-dispatched (its watcher never settled).`,
-        conversation_id: conv.id
+        message: `Conversation ${conv.id.slice(0, 8)} has ${messages.length} pending message(s) but ALL are already marked dispatched locally (in-flight set: ${this.dispatched.size}) \u2014 none sent to OpenCode this tick. If this repeats, a message may be stuck acknowledged-but-never-dispatched (its watcher never settled).`,
+        conversation_id: conv.id
+      });
+    }
+    this.ensureWatcherRunning(sessionId);
+    return dispatched;
+  }
+  /**
+   * Poll a session's message list for the re-drive fence (#965), via the
+   * INJECTED `fetchImpl` — NOT the imported `getSessionMessages` helper, which
+   * hits the global `fetch` and would bypass the same override every other
+   * opencode poll in this file respects. Mirrors `readoptProcessing`'s own
+   * snapshot fetch (`:3081-3111`).
+   *
+   * Returns `{ ok: true, messages }` on a readable snapshot, or
+   * `{ ok: false, signature }` on failure — `signature` is a string that
+   * repeats across attempts for the SAME underlying fault (used by the
+   * consecutive-identical-failure bound, #1348), or `null` for a thrown
+   * exception, which is NOT countable toward that bound (a network blip / an
+   * opencode restart also throws identically every tick, and must keep
+   * retrying unbounded rather than ever being treated as permanent).
+   */
+  async pollSessionMessagesForRedrive(conv, message, sessionId) {
+    try {
+      const res = await this.fetchImpl(`${this.opencodeBase}/session/${sessionId}/message`);
+      if (!res.ok) {
+        const rawBody = await res.text();
+        const normalized = normalizeRedrivePollFailureBody(rawBody);
+        this.log({
+          level: "warn",
+          message: `Re-drive: polling session ${sessionId.slice(0, 8)} for message ${message.id.slice(0, 8)} returned HTTP ${res.status}${normalized ? `: ${normalized}` : ""} \u2014 treating as unreadable this tick`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+        return { ok: false, signature: `HTTP ${res.status}${normalized ? `: ${normalized}` : ""}` };
+      }
+      const body = await res.json();
+      if (!Array.isArray(body)) {
+        this.log({
+          level: "warn",
+          message: `Re-drive: polling session ${sessionId.slice(0, 8)} for message ${message.id.slice(0, 8)} returned a non-array message body \u2014 treating as unreadable this tick`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+        return { ok: false, signature: "non-array message body" };
+      }
+      return { ok: true, messages: body };
+    } catch (err) {
+      this.log({
+        level: "warn",
+        message: `Re-drive: failed to poll session ${sessionId.slice(0, 8)} for message ${message.id.slice(0, 8)} (will retry next drain): ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conv.id,
+        message_id: message.id
+      });
+      return { ok: false, signature: null };
+    }
+  }
+  /**
+   * The re-drive fence for a `pending` row that already carries a stored
+   * `opencode_message_id` (#965) — i.e. it has already been handed to opencode at
+   * least once (see the invariant at `QueuedMessage.opencode_message_id`'s doc).
+   * The lifecycle cron can falsely reclaim a `processing` row back to `pending`
+   * mid-turn (a 5-minute liveness-staleness check racing a still-running turn);
+   * without this fence the drain loop would re-`prompt_async` the SAME turn a
+   * second time against live GitHub state. Mirrors `readoptOne`'s job for the
+   * `processing` re-adopt path, but simpler: no b1/b2 preamble cross-check is
+   * needed here because `sessionCreated` already handles the cases (a #553
+   * abandoned session, a #190 vanished one) that path exists for.
+   *
+   * Only `ChannelAuthError` propagates. A poll that fails identically
+   * `MAX_IDENTICAL_REDRIVE_POLL_FAILURES` times in a row reports the message
+   * failed instead of retrying it (#1348) — SEPARATE from, not a replacement
+   * for, `resolveRedriveUnresolved`'s own `pausedMaxWaitMs` bound below. Every
+   * other failure resolves to `unresolved` and is retried whole on the next
+   * ~2s drain tick.
+   */
+  async resolveRedrive(conv, sessionId, message, sessionCreated) {
+    const ocId = message.opencode_message_id ?? null;
+    if (sessionCreated) {
+      this.clearRedriveUnresolved(message.id);
+      void this.postSignal(conv.id, message.id, "redrive_redispatched");
+      return "dispatch";
+    }
+    const polled = await this.pollSessionMessagesForRedrive(conv, message, sessionId);
+    if (!polled.ok) {
+      const streak = this.recordRedrivePollFailure(message.id, sessionId, polled.signature);
+      if (streak >= MAX_IDENTICAL_REDRIVE_POLL_FAILURES && polled.signature !== null) {
+        return this.failRedrivePollPermanent(conv, sessionId, message, polled.signature, streak);
+      }
+      return this.resolveRedriveUnresolved(conv, message);
+    }
+    this.redrivePollFailures.delete(message.id);
+    const messages = polled.messages;
+    if (messages.length === 0) {
+      return this.resolveRedriveUnresolved(conv, message);
+    }
+    const state = messageRunState(messages, ocId ?? "");
+    if (state === "failed" && isAbortedTerminalReply(messages, ocId ?? "")) {
+      const ongoing = await isSessionOngoing(this.port, sessionId);
+      if (ongoing === false) {
+        this.log({
+          level: "info",
+          message: `Re-drive: message ${message.id.slice(0, 8)} carries an abort-shaped terminal error and session ${sessionId.slice(0, 8)} is not-ongoing per GET /session/status \u2014 restart orphan, re-dispatching instead of marking it permanently failed`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+        this.clearRedriveUnresolved(message.id);
+        void this.postSignal(conv.id, message.id, "redrive_redispatched");
+        return "dispatch";
+      }
+    }
+    if (state === "done" || state === "failed") {
+      return this.settleRedrive(conv, sessionId, message, ocId, messages, state);
+    }
+    if (state === "running" || state === "queued") {
+      const ongoing = await isSessionOngoing(this.port, sessionId);
+      if (ongoing === true) {
+        return this.reattachRedrive(conv, sessionId, message, ocId);
+      }
+      if (ongoing === false) {
+        this.clearRedriveUnresolved(message.id);
+        void this.postSignal(conv.id, message.id, "redrive_redispatched");
+        return "dispatch";
+      }
+      return this.resolveRedriveUnresolved(conv, message);
+    }
+    this.clearRedriveUnresolved(message.id);
+    void this.postSignal(conv.id, message.id, "redrive_redispatched");
+    return "dispatch";
+  }
+  /**
+   * The `reattached` outcome (Task 3.3): the prior turn is STILL ONGOING per
+   * opencode's own status map — undo the false reclaim instead of starting a
+   * second turn.
+   */
+  async reattachRedrive(conv, sessionId, message, ocId) {
+    let anchorMs;
+    const parsed = message.processing_started_at ? Date.parse(message.processing_started_at) : NaN;
+    if (!Number.isNaN(parsed)) {
+      anchorMs = parsed;
+    } else {
+      anchorMs = this.now();
+      this.log({
+        level: "error",
+        message: `Re-drive: message ${message.id.slice(0, 8)} has null/unparseable processing_started_at (${String(message.processing_started_at)}) \u2014 anchoring the watcher's absolute-age ceiling to now (defensive)`,
+        conversation_id: conv.id,
+        message_id: message.id
+      });
+    }
+    const title = await this.resolveSessionTitle(sessionId, conv.id);
+    try {
+      const restored = await this.markProcessing(conv.id, message.id, sessionId, ocId, title);
+      if (!restored) {
+        this.log({
+          level: "error",
+          message: `Re-drive: the server definitively refused to restore message ${message.id.slice(0, 8)} to processing (non-retryable 4xx \u2014 the row is gone or the update was rejected); NOT reporting a re-attach`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+        const bound = await this.boundRedriveOutcome(conv, message, "reattach");
+        return bound === "abandoned" ? "abandoned" : "unresolved";
+      }
+    } catch (err) {
+      if (err instanceof ChannelAuthError) throw err;
+      this.log({
+        level: "warn",
+        message: `Re-drive: failed to restore message ${message.id.slice(0, 8)} to processing (will retry next drain): ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conv.id,
+        message_id: message.id
+      });
+      const bound = await this.boundRedriveOutcome(conv, message, "reattach");
+      return bound === "abandoned" ? "abandoned" : "unresolved";
+    }
+    this.clearRedriveUnresolved(message.id);
+    this.registerReadopted(conv, sessionId, message, ocId ?? "", anchorMs);
+    this.dispatched.add(message.id);
+    this.readopted.add(message.id);
+    this.ensureWatcherRunning(sessionId);
+    const watchedForMs = this.now() - anchorMs;
+    void this.postSignal(conv.id, message.id, "redrive_reattached", {
+      watched_for_ms: watchedForMs
+    });
+    this.log({
+      level: "warn",
+      message: `Re-drive: message ${message.id.slice(0, 8)} (session ${sessionId.slice(0, 8)}) was wrongly reclaimed to pending while its turn was still running (watched ${watchedForMs}ms) \u2014 restored to processing instead of re-dispatching`,
+      conversation_id: conv.id,
+      message_id: message.id
+    });
+    return "reattached";
+  }
+  /**
+   * The `settled` outcome (Task 3.2): the prior turn already finished (or
+   * errored) while nobody was watching — deliver/report it instead of re-running.
+   * Mirrors `readoptOne`'s `done`/`failed` branches' error discipline, simplified
+   * (no `doneUndeliverable` park: a terminal PATCH failure here just retries next
+   * drain, same as any other non-auth failure). The restart-abort carve-out that
+   * keeps the two in step for `failed` lives in the caller (`resolveRedrive`, #1310),
+   * so a row reaching this `failed` branch is a GENUINE failure.
+   */
+  async settleRedrive(conv, sessionId, message, ocId, messages, state) {
+    try {
+      if (state === "done") {
+        const title = await this.resolveSessionTitle(sessionId, conv.id);
+        const usage = messageUsage(messages, ocId ?? "");
+        this.log({
+          level: "info",
+          message: `Re-drive: message ${message.id.slice(0, 8)} completed while its row was wrongly reclaimed to pending \u2014 marking done instead of re-dispatching`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+        await this.markDone(conv.id, message.id, sessionId, ocId, title, usage);
+      } else {
+        const error2 = messageError(messages, ocId ?? "") ?? void 0;
+        const usage = messageUsage(messages, ocId ?? "");
+        const failure = await this.classifyModelAuthFailure(messages, ocId ?? "");
+        this.log({
+          level: "error",
+          message: `Re-drive: message ${message.id.slice(0, 8)} errored while its row was wrongly reclaimed to pending \u2014 marking failed instead of re-dispatching: ${error2 ?? "(no error text)"}`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+        await this.markFailed(conv.id, message.id, sessionId, error2, usage, failure);
+      }
+    } catch (err) {
+      if (err instanceof ChannelAuthError) throw err;
+      this.log({
+        level: "warn",
+        message: `Re-drive: failed to report message ${message.id.slice(0, 8)} ${state} (will retry next drain): ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conv.id,
+        message_id: message.id
+      });
+      const bound = await this.boundRedriveOutcome(conv, message, "settle");
+      return bound === "abandoned" ? "abandoned" : "unresolved";
+    }
+    this.clearRedriveUnresolved(message.id);
+    void this.postSignal(conv.id, message.id, "redrive_settled");
+    return "settled";
+  }
+  /**
+   * The permanent-failure outcome (#1348): the fence's own poll of this session
+   * failed with the SAME opencode-answered signature
+   * `MAX_IDENTICAL_REDRIVE_POLL_FAILURES` times in a row — a transient blip
+   * would have varied or eventually cleared (see `pollSessionMessagesForRedrive`
+   * and `recordRedrivePollFailure`), so this is a durable fault (e.g. #1345's
+   * corrupted opencode session) rather than something worth retrying forever.
+   * Mirrors `settleRedrive`'s error discipline: no `usage`/`failure` args to
+   * `markFailed` (no opencode snapshot to extract them from — this poll never
+   * got a readable one).
+   */
+  async failRedrivePollPermanent(conv, sessionId, message, signature, streak) {
+    this.log({
+      level: "error",
+      message: `Re-drive: message ${message.id.slice(0, 8)} (session ${sessionId.slice(0, 8)}) failed to poll with the identical signature "${signature}" ${streak} times in a row \u2014 reporting the message failed instead of retrying forever`,
+      conversation_id: conv.id,
+      message_id: message.id
+    });
+    try {
+      await this.markFailed(
+        conv.id,
+        message.id,
+        sessionId,
+        `The runner could not read this conversation's state from OpenCode (${signature}). The same failure repeated ${streak} times in a row, so the message was not retried further.`
+      );
+    } catch (err) {
+      if (err instanceof ChannelAuthError) throw err;
+      this.log({
+        level: "warn",
+        message: `Re-drive: failed to report message ${message.id.slice(0, 8)} permanently failed (will retry next drain): ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conv.id,
+        message_id: message.id
+      });
+      const bound = await this.boundRedriveOutcome(conv, message, "fail_permanent");
+      return bound === "abandoned" ? "abandoned" : "unresolved";
+    }
+    this.clearRedriveUnresolved(message.id);
+    void this.postSignal(conv.id, message.id, "redrive_poll_failed");
+    return "settled";
+  }
+  /**
+   * The bounded `unresolved` outcome (Task 3.4): opencode's state could not be
+   * observed (snapshot unreadable/empty, or `isSessionOngoing` returned `null`).
+   * A `pending` row is swept by the server's own `PENDING_MAX_AGE_MS` (24h,
+   * #1368) cron arm, but that is a day-scale backstop — this local bound acts
+   * in minutes so the row (and the conversation it starves, per the ordering
+   * invariant below) isn't left stranded for that long. Bound to the existing
+   * `pausedMaxWaitMs` window (reusing the knob, not a new constant); takes
+   * `dispatch` once elapsed.
+   */
+  resolveRedriveUnresolved(conv, message) {
+    const now = this.now();
+    const since = this.redriveUnresolvedSince.get(message.id);
+    if (since !== void 0 && now - since >= this.pausedMaxWaitMs) {
+      this.clearRedriveUnresolved(message.id);
+      void this.postSignal(conv.id, message.id, "redrive_redispatched");
+      return "dispatch";
+    }
+    if (since === void 0) {
+      this.redriveUnresolvedSince.set(message.id, now);
+    }
+    if (!this.redriveUnresolvedSignalled.has(message.id)) {
+      this.redriveUnresolvedSignalled.add(message.id);
+      void this.postSignal(conv.id, message.id, "redrive_unresolved");
+    }
+    return "unresolved";
+  }
+  /** Clear all `unresolved`/failure-streak trackers for a row (any non-`unresolved` outcome). */
+  clearRedriveUnresolved(messageId) {
+    this.redriveUnresolvedSince.delete(messageId);
+    this.redriveUnresolvedSignalled.delete(messageId);
+    this.redrivePollFailures.delete(messageId);
+    this.redriveOutcomeUnreportedSignalled.delete(messageId);
+    this.redriveOutcomeFailingSince.delete(messageId);
+    this.redriveOutcomeAbandonedSignalled.delete(messageId);
+  }
+  /**
+   * #1340: the dispatch loop reached a message and did NOT start a turn. Fires at
+   * most once per (message, branch) streak — a wedged row is re-tried every tick,
+   * and the per-tick count is already carried by the co-occurring
+   * `redrive_unresolved`/`redrive_redispatched` signals.
+   */
+  signalDispatchNotStarted(conv, message, branch) {
+    if (this.dispatchNotStartedSignalled.get(message.id) === branch) return;
+    this.dispatchNotStartedSignalled.set(message.id, branch);
+    void this.postSignal(conv.id, message.id, "dispatch_not_started", { branch });
+  }
+  /**
+   * Class B (#1340): the runner DECIDED an outcome (reattach/settle/fail_permanent)
+   * but its own PATCH to record it failed. Fires at most once per (message,
+   * outcome) streak, and only while `boundRedriveOutcome` has not yet tripped —
+   * once it trips, `redrive_outcome_abandoned` takes over reporting for the row
+   * (#1366).
+   */
+  signalRedriveOutcomeUnreported(conv, message, outcome) {
+    if (this.redriveOutcomeUnreportedSignalled.get(message.id) === outcome) return;
+    this.redriveOutcomeUnreportedSignalled.set(message.id, outcome);
+    void this.postSignal(conv.id, message.id, "redrive_outcome_unreported", {
+      attempted_outcome: outcome
+    });
+  }
+  /**
+   * The runner-authored, honest error text for the terminal fallback a tripped
+   * `boundRedriveOutcome` sends. Distinguishable per outcome and truthful about
+   * what actually happened — the `settle`/done case must say the turn finished
+   * but its result could not be recorded, never that the runner stopped
+   * responding (that would be a lie for this shape, see #1366's "why this ships").
+   */
+  static REDRIVE_ABANDON_ERROR = {
+    reattach: "your runner could not record that this message had started, so it was given up on",
+    settle: "your runner finished this message but could not record the result, so the reply could not be delivered",
+    fail_permanent: "the runner could not read this conversation's state from OpenCode, and could not record that failure either, so the message was given up on"
+  };
+  /**
+   * Bound for Class B (#1340, #1366): the runner DECIDED an outcome but its own
+   * PATCH to record it failed. Two independent trip arms (either sufficient):
+   * (1) this failure streak has lasted `pausedMaxWaitMs` — DURATION, not a tick
+   * count, reusing the knob `resolveRedriveUnresolved` already established; (2)
+   * the turn's `processing_started_at` age has crossed
+   * `ABSOLUTE_MAX_PROCESSING_MS` — durable and restart-surviving, since arm (1)'s
+   * in-memory streak resets on a scale-to-zero restart.
+   *
+   * INVARIANT — a tripped bound never suppresses the original outcome attempt;
+   * it only adds a fallback after that attempt has failed again. This is only
+   * ever reached from inside the catch of the ORIGINAL outcome PATCH, which is
+   * attempted first on every tick whether or not this bound tripped before —
+   * there is no give-up latch that would short-circuit it. That is what lets a
+   * route-level fault that heals later still deliver the turn's real
+   * `done`/`failed` payload: once the original PATCH succeeds again, this
+   * helper is never entered and the row settles with its real result.
+   */
+  async boundRedriveOutcome(conv, message, outcome) {
+    const now = this.now();
+    const since = this.redriveOutcomeFailingSince.get(message.id);
+    if (since === void 0) this.redriveOutcomeFailingSince.set(message.id, now);
+    const durationTripped = now - (since ?? now) >= this.pausedMaxWaitMs;
+    const parsed = message.processing_started_at ? Date.parse(message.processing_started_at) : NaN;
+    const absoluteAgeTripped = !Number.isNaN(parsed) && now - parsed >= ABSOLUTE_MAX_PROCESSING_MS;
+    if (!durationTripped && !absoluteAgeTripped) {
+      this.signalRedriveOutcomeUnreported(conv, message, outcome);
+      return "retry";
+    }
+    const arm = durationTripped ? "failure_window" : "absolute_age";
+    try {
+      await this.markFailed(
+        conv.id,
+        message.id,
+        void 0,
+        _ChannelDriver.REDRIVE_ABANDON_ERROR[outcome]
+      );
+    } catch (err) {
+      if (err instanceof ChannelAuthError) throw err;
+      this.log({
+        level: "warn",
+        message: `Re-drive bound: fallback markFailed for message ${message.id.slice(0, 8)} also failed (arm ${arm}, will retry next drain): ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conv.id,
+        message_id: message.id
       });
+      if (!this.redriveOutcomeAbandonedSignalled.has(message.id)) {
+        this.redriveOutcomeAbandonedSignalled.add(message.id);
+        void this.postSignal(conv.id, message.id, "redrive_outcome_abandoned", {
+          attempted_outcome: outcome,
+          reported: false,
+          arm
+        });
+      }
+      return "retry";
     }
-    this.ensureWatcherRunning(sessionId);
-    return dispatched;
+    this.clearRedriveUnresolved(message.id);
+    void this.postSignal(conv.id, message.id, "redrive_outcome_abandoned", {
+      attempted_outcome: outcome,
+      reported: true,
+      arm
+    });
+    return "abandoned";
+  }
+  /**
+   * Record one poll outcome toward the re-drive fence's consecutive-identical-
+   * failure streak (#1348) and return the resulting count. `signature === null`
+   * (a thrown exception, H1) always clears the streak and returns `0` — it is
+   * never countable. Otherwise the streak continues only when BOTH the session
+   * and the signature match the previous failure; anything else (a different
+   * session, or the same session failing a DIFFERENT way) starts a fresh streak
+   * at `1`.
+   */
+  recordRedrivePollFailure(messageId, sessionId, signature) {
+    if (signature === null) {
+      this.redrivePollFailures.delete(messageId);
+      return 0;
+    }
+    const existing = this.redrivePollFailures.get(messageId);
+    if (existing && existing.sessionId === sessionId && existing.signature === signature) {
+      existing.count += 1;
+      return existing.count;
+    }
+    this.redrivePollFailures.set(messageId, { sessionId, signature, count: 1 });
+    return 1;
+  }
+  /**
+   * Record one UNCONFIRMED-dispatch outcome (a `pending` row with no stored
+   * `opencode_message_id` whose `sendPromptAsync` returned `null`) toward the
+   * bound in `processConversation`'s dispatch loop, and return the resulting
+   * count. Mirrors `recordRedrivePollFailure`'s session-scoping: a session
+   * change starts a fresh streak at `1` rather than inheriting the old one's
+   * count, since a new session is a genuinely different attempt.
+   */
+  recordUnconfirmedDispatch(messageId, sessionId) {
+    const existing = this.unconfirmedDispatchFailures.get(messageId);
+    if (existing && existing.sessionId === sessionId) {
+      existing.count += 1;
+      return existing.count;
+    }
+    this.unconfirmedDispatchFailures.set(messageId, { sessionId, count: 1 });
+    return 1;
   }
   /**
    * Record that `sessionId` is no longer a valid binding for `conversationId`
@@ -3404,6 +4305,13 @@ var ChannelDriver = class _ChannelDriver {
    * `refusedSessionId` is set when the #553 guard fired — i.e. the persisted
    * binding was an id this runner had abandoned, so a resurrection genuinely
    * happened and a fresh session was bound instead. The caller reports it.
+   *
+   * `created` says the returned session was made JUST NOW, so it provably holds
+   * no prior turn. The re-drive fence needs that as CONTRARY evidence ("nothing
+   * to reconcile against") — distinct from the ambiguous "I polled and saw an
+   * empty transcript", which stays a deferral. Keep it separate from
+   * `refusedSessionId`: only the latter means a #553 resurrection happened, and
+   * only it may drive the `session_superseded` signal.
    */
   async ensureSession(conv) {
     const bound = this.sessions.get(conv.id) ?? conv.opencode_session_id ?? null;
@@ -3414,7 +4322,11 @@ var ChannelDriver = class _ChannelDriver {
         conversation_id: conv.id
       });
       this.sessions.delete(conv.id);
-      return { sessionId: await this.createAndBindSession(conv.id), refusedSessionId: bound };
+      return {
+        sessionId: await this.createAndBindSession(conv.id),
+        refusedSessionId: bound,
+        created: true
+      };
     }
     if (bound) {
       const exists = await sessionExists(this.port, bound);
@@ -3425,12 +4337,12 @@ var ChannelDriver = class _ChannelDriver {
           conversation_id: conv.id
         });
         this.sessions.delete(conv.id);
-        return { sessionId: await this.createAndBindSession(conv.id) };
+        return { sessionId: await this.createAndBindSession(conv.id), created: true };
       }
       this.sessions.set(conv.id, bound);
-      return { sessionId: bound };
+      return { sessionId: bound, created: false };
     }
-    return { sessionId: await this.createAndBindSession(conv.id) };
+    return { sessionId: await this.createAndBindSession(conv.id), created: true };
   }
   /**
    * Create a fresh OpenCode session for a conversation, cache the binding, and
@@ -3663,9 +4575,10 @@ var ChannelDriver = class _ChannelDriver {
    * opencode reports ACTIVELY `running` is watched to completion (its liveness
    * heartbeat keeps the cron off its row), while a re-adopted turn that is paused
    * awaiting a human — or queued/unreachable — is still bounded by `deadline` and
-   * handed to the cron. The old "the `deadline` must settle before the ~15-min
-   * cron or they double-drive" reasoning is superseded: liveness now settles the
-   * actively-running case; `deadline` settles the rest. `dispatchedAt` stays `now`
+   * handed to the cron. Real invariant (#965): the cron MAY reclaim a row this
+   * runner still holds; a reclaimed row that already ran is never re-dispatched
+   * while opencode reports its turn ongoing (readopt's own gate here, and the
+   * `pending`-row re-drive fence, `resolveRedrive`). `dispatchedAt` stays `now`
    * (only the appear-guard uses it).
    *
    * `evidentMessageId` addresses the SERVER row (for markProcessing/markDone);
@@ -4225,7 +5138,10 @@ var ChannelDriver = class _ChannelDriver {
    * re-dispatched (at most once, see `forceReadoptRun`):
    *   - `done`             → `markDone` now (guarded like the watcher's done branch);
    *   - `failed`           → `markFailed` with the surfaced error (issue #182), so an
-   *                          errored turn is reported failed on restart, NOT re-dispatched;
+   *                          errored turn is reported failed on restart, NOT re-dispatched —
+   *                          EXCEPT a restart-ABORTED turn under a not-ongoing session,
+   *                          which is a restart orphan wearing a terminal error and is
+   *                          re-dispatched instead (issue #1310, see the branch below);
    *   - `running`/`queued` → re-attach a watcher via `registerReadopted` (no re-dispatch),
    *                          tracking the stored id so the reply correlates by it;
    *   - `unknown`/null id  → re-dispatch (opencode assigns a fresh id) + attach a watcher.
@@ -4289,7 +5205,16 @@ var ChannelDriver = class _ChannelDriver {
       void this.postSignal(row.conversation_id, row.id, "readopt_done");
       return;
     }
-    if (state === "failed") {
+    const restartAborted = state === "failed" && sessionOngoing === false && isAbortedTerminalReply(messages, ocId ?? "");
+    if (restartAborted) {
+      this.log({
+        level: "info",
+        message: `Re-adopt: message ${row.id.slice(0, 8)} carries an abort-shaped terminal error and session ${sessionId.slice(0, 8)} is not-ongoing per GET /session/status \u2014 restart orphan, re-dispatching instead of marking it permanently failed`,
+        conversation_id: row.conversation_id,
+        message_id: row.id
+      });
+    }
+    if (state === "failed" && !restartAborted) {
       const error2 = messageError(messages, ocId ?? "") ?? void 0;
       const usage = messageUsage(messages, ocId ?? "");
       const failure = await this.classifyModelAuthFailure(messages, ocId ?? "");
@@ -4503,15 +5428,39 @@ var ChannelDriver = class _ChannelDriver {
     }
     if (ocId === null) {
       this.awaitingReadopt.delete(row.id);
+      const streak = this.recordUnconfirmedDispatch(row.id, sessionId);
+      if (streak >= MAX_IDENTICAL_REDRIVE_POLL_FAILURES) {
+        this.unconfirmedDispatchFailures.delete(row.id);
+        this.sessions.delete(readoptConv.id);
+        this.supersede(readoptConv.id, sessionId);
+        const errorMessage = `OpenCode accepted this re-dispatched message ${streak} times in a row but never confirmed its assigned id (session ${sessionId.slice(0, 8)}'s message list could not be read back) \u2014 the session was abandoned; a fresh one is used for further messages.`;
+        this.log({
+          level: "error",
+          message: errorMessage,
+          conversation_id: row.conversation_id,
+          message_id: row.id
+        });
+        await this.markFailed(row.conversation_id, row.id, null, errorMessage).catch((markErr) => {
+          this.log({
+            level: "warn",
+            message: `markFailed PATCH for message ${row.id.slice(0, 8)} (conversation ${row.conversation_id.slice(0, 8)}) failed (best-effort, not retried): ${markErr instanceof Error ? markErr.message : String(markErr)}`,
+            conversation_id: row.conversation_id,
+            message_id: row.id
+          });
+        });
+        void this.postSignal(row.conversation_id, row.id, "readopt_orphan_unsent");
+        return;
+      }
       this.log({
         level: "warn",
-        message: `Re-adopt: message ${row.id.slice(0, 8)} re-dispatched but its opencode id could not be read back \u2014 leaving un-tracked to retry next drain`,
+        message: `Re-adopt: message ${row.id.slice(0, 8)} re-dispatched but its opencode id could not be read back (${streak}/${MAX_IDENTICAL_REDRIVE_POLL_FAILURES}) \u2014 leaving un-tracked to retry next drain`,
         conversation_id: row.conversation_id,
         message_id: row.id
       });
       void this.postSignal(row.conversation_id, row.id, "readopt_orphan_unsent");
       return;
     }
+    this.unconfirmedDispatchFailures.delete(row.id);
     this.registerReadopted(readoptConv, sessionId, readoptMessage, ocId, this.processedAtMs(row));
     this.dispatched.add(row.id);
     this.readopted.add(row.id);
@@ -4567,7 +5516,8 @@ var ChannelDriver = class _ChannelDriver {
       opencode_model: row.opencode_model,
       source_message_id: row.source_message_id,
       slack_user_id: row.slack_user_id,
-      attachments: row.attachments ?? null
+      attachments: row.attachments ?? null,
+      opencode_message_id: row.opencode_message_id
     };
   }
   /**
@@ -5159,11 +6109,11 @@ var ChannelDriver = class _ChannelDriver {
    * `ensureSession` guard, not this suppression, is what makes the self-heal
    * stick.
    */
-  sessionIdBody(sessionId, conversationId, messageId, status) {
+  sessionIdBody(sessionId, conversationId, messageId, status2) {
     if (!this.isSuperseded(conversationId, sessionId)) return { opencode_session_id: sessionId };
     this.log({
       level: "debug",
-      message: `Omitting the abandoned OpenCode session ${sessionId.slice(0, 8)} from the '${status}' update for message ${messageId.slice(0, 8)} so it is not re-bound to conversation ${conversationId.slice(0, 8)}`,
+      message: `Omitting the abandoned OpenCode session ${sessionId.slice(0, 8)} from the '${status2}' update for message ${messageId.slice(0, 8)} so it is not re-bound to conversation ${conversationId.slice(0, 8)}`,
       conversation_id: conversationId,
       message_id: messageId
     });
@@ -5177,11 +6127,12 @@ var ChannelDriver = class _ChannelDriver {
    *
    * Return/throw contract (consumed by the watcher's swap-to-running guard):
    *   - returns `true`  → the server transitioned the row to processing;
-   *   - returns `false` → the server gave a DEFINITIVE "already-processing"
-   *                       answer (a non-retryable, non-auth status — e.g. a
-   *                       conflict because a duplicate already transitioned it),
-   *                       so the caller treats it as already-started and does NOT
-   *                       retry;
+   *   - returns `false` → the server DEFINITIVELY refused to transition the row
+   *                       (a non-retryable, non-auth status: 404 the row or its
+   *                       conversation is gone, 400 the update was rejected).
+   *                       Retrying cannot help. NOTE this is never an
+   *                       "already-processing" answer — that case transitions
+   *                       nothing but still returns 200, hence `true`;
    *   - throws `ChannelAuthError` on 401/403 (terminal auth failure);
    *   - throws on a TRANSIENT failure (retryable 5xx/429 status, or a
    *     network-level error from `fetch`) — i.e. NO definitive server response —
@@ -5609,171 +6560,6 @@ Port ${port} is already in use.`));
   return { port, process: null, version: null, notReadyReason: "you chose to continue without it" };
 }
 
-// src/commands/agent-lookup.ts
-async function readErrorMessage(response) {
-  const text = await response.text().catch(() => "");
-  if (!text) return response.statusText || void 0;
-  try {
-    const data = JSON.parse(text);
-    const message = data.message ?? data.error;
-    if (typeof message === "string" && message.trim()) {
-      return message;
-    }
-  } catch {
-  }
-  return text.trim() || response.statusText || void 0;
-}
-function authFailureHint(apiUrl, serverMessage) {
-  const reason = serverMessage ? `: ${serverMessage}` : "";
-  return `Authentication failed${reason}. Your credentials were rejected by ${apiUrl}. This usually means you logged in against a different environment, or your session expired \u2014 log in again pointing at this endpoint and retry.`;
-}
-async function resolveAgentIdFromKey(authHeader) {
-  const apiUrl = getApiUrlConfig();
-  try {
-    const response = await fetch(`${apiUrl}/me`, {
-      headers: { Authorization: authHeader }
-    });
-    if (response.status === 401) {
-      const serverMessage = await readErrorMessage(response);
-      return { error: authFailureHint(apiUrl, serverMessage), authFailed: true };
-    }
-    if (!response.ok) {
-      const serverMessage = await readErrorMessage(response);
-      return {
-        error: `Failed to resolve runner from key (HTTP ${response.status})${serverMessage ? `: ${serverMessage}` : ""}`
-      };
-    }
-    const data = await response.json();
-    if (data.auth_type === "agent_key" && data.agent_id) {
-      return { agent_id: data.agent_id };
-    }
-    return {
-      error: "Cannot resolve runner ID: auth type is not agent_key. Please provide --runner explicitly."
-    };
-  } catch (error2) {
-    const message = error2 instanceof Error ? error2.message : "Unknown error";
-    return { error: `Failed to resolve runner from key: ${message}` };
-  }
-}
-var BEST_EFFORT_NOTIFY_TIMEOUT_MS = 2e3;
-async function notifyAgentDisconnected(agentId, authHeader) {
-  const apiUrl = getApiUrlConfig();
-  try {
-    const response = await fetch(`${apiUrl}/runners/${agentId}/disconnect`, {
-      method: "POST",
-      headers: { Authorization: authHeader },
-      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
-    });
-    if (!response.ok) {
-      const serverMessage = await readErrorMessage(response);
-      return {
-        ok: false,
-        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
-      };
-    }
-    return { ok: true };
-  } catch (error2) {
-    return { ok: false, error: describeBestEffortError(error2) };
-  }
-}
-function describeBestEffortError(error2) {
-  const name = error2?.name;
-  if (name === "TimeoutError" || name === "AbortError") {
-    return `timed out after ${BEST_EFFORT_NOTIFY_TIMEOUT_MS}ms`;
-  }
-  return error2 instanceof Error ? error2.message : String(error2);
-}
-async function reportMicrovmId(agentId, authHeader, microvmId) {
-  try {
-    const apiUrl = getApiUrlConfig();
-    const response = await fetch(`${apiUrl}/runners/${agentId}/microvm`, {
-      method: "POST",
-      headers: { Authorization: authHeader, "Content-Type": "application/json" },
-      body: JSON.stringify({ microvm_id: microvmId }),
-      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
-    });
-    if (!response.ok) {
-      const serverMessage = await readErrorMessage(response);
-      return {
-        ok: false,
-        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
-      };
-    }
-    return { ok: true };
-  } catch (error2) {
-    return { ok: false, error: describeBestEffortError(error2) };
-  }
-}
-function toReportedWindow(window) {
-  if (!window) return null;
-  return { utilization: window.utilization, resets_at: window.resetsAt };
-}
-async function reportClaudeUsage(agentId, authHeader, snapshot) {
-  try {
-    const apiUrl = getApiUrlConfig();
-    const response = await fetch(`${apiUrl}/runners/${agentId}/claude-usage`, {
-      method: "POST",
-      headers: { Authorization: authHeader, "Content-Type": "application/json" },
-      body: JSON.stringify({
-        five_hour: toReportedWindow(snapshot.fiveHour),
-        seven_day: toReportedWindow(snapshot.sevenDay)
-      }),
-      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
-    });
-    if (!response.ok) {
-      const serverMessage = await readErrorMessage(response);
-      return {
-        ok: false,
-        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
-      };
-    }
-    return { ok: true };
-  } catch (error2) {
-    return { ok: false, error: describeBestEffortError(error2) };
-  }
-}
-async function getAgentInfo(agentId, authHeader) {
-  const apiUrl = getApiUrlConfig();
-  try {
-    const response = await fetch(`${apiUrl}/runners/${agentId}`, {
-      headers: { Authorization: authHeader }
-    });
-    if (response.status === 401) {
-      const serverMessage = await readErrorMessage(response);
-      return { valid: false, error: authFailureHint(apiUrl, serverMessage), authFailed: true };
-    }
-    if (response.status === 403) {
-      const serverMessage = await readErrorMessage(response);
-      return {
-        valid: false,
-        error: serverMessage ?? "You do not have access to this runner (it may belong to a different team or organization)."
-      };
-    }
-    if (response.status === 404) {
-      const serverMessage = await readErrorMessage(response);
-      return { valid: false, error: serverMessage ?? `Runner ${agentId} not found` };
-    }
-    if (!response.ok) {
-      const serverMessage = await readErrorMessage(response);
-      return {
-        valid: false,
-        error: `API error (HTTP ${response.status})${serverMessage ? `: ${serverMessage}` : ""}`
-      };
-    }
-    const agent = await response.json();
-    if (agent.agent_type !== "local") {
-      return {
-        valid: false,
-        error: `Runner is type '${agent.agent_type}', must be 'local' for CLI connection`
-      };
-    }
-    return { valid: true, agent };
-  } catch (error2) {
-    const message = error2 instanceof Error ? error2.message : "Unknown error";
-    return { valid: false, error: `Failed to validate runner: ${message}` };
-  }
-}
-
 // src/commands/run.ts
 var MAX_ACTIVITY_LOG_ENTRIES = 10;
 var CHANNEL_POLL_INTERVAL_MS = Number(process.env.EVIDENT_CHANNEL_POLL_INTERVAL_MS) || 2e3;
@@ -5984,9 +6770,15 @@ async function handleAuthError(state, error2) {
 }
 async function driveChannels(state, driver) {
   let idlePolls = 0;
+  let idleMs = 0;
+  let consecutiveDrainFailures = 0;
+  let unreachableMs = 0;
   let lastSeenProxiedActivityAt = state.lastProxiedActivityAt;
   let lastSeenAppliedFiles = driver.fileSyncActivity().appliedFiles;
   while (state.running) {
+    const cycleStartedAtMs = performance.now();
+    let idleThisCycle = false;
+    let unreachableThisCycle = false;
     if (state.connection?.reconnecting && state.connection.reconnectPromise) {
       logActivity(state, { type: "info", message: "Waiting for tunnel reconnection..." });
       if (state.interactive) displayStatus(state);
@@ -6001,17 +6793,23 @@ async function driveChannels(state, driver) {
     );
     try {
       const processed = await driver.drainPending();
+      consecutiveDrainFailures = 0;
+      unreachableMs = 0;
       state.messageCount += processed;
       const proxiedActivity = state.lastProxiedActivityAt !== lastSeenProxiedActivityAt;
       lastSeenProxiedActivityAt = state.lastProxiedActivityAt;
       const appliedFiles = driver.fileSyncActivity().appliedFiles;
-      const fileActivity = carriedOverFileSync || appliedFiles !== lastSeenAppliedFiles;
+      const filesApplied = appliedFiles !== lastSeenAppliedFiles;
+      const fileActivity = carriedOverFileSync || filesApplied;
       lastSeenAppliedFiles = appliedFiles;
+      if (filesApplied) state.claudeUsageRearm?.();
       if (processed > 0 || driver.hasInFlightWatchers() || proxiedActivity || fileActivity) {
         idlePolls = 0;
+        idleMs = 0;
         if (processed > 0 && state.interactive) displayStatus(state);
       } else if (state.idleTimeout !== null) {
         idlePolls++;
+        idleThisCycle = true;
         if (idlePolls === 1) {
           logActivity(state, {
             type: "info",
@@ -6035,15 +6833,38 @@ async function driveChannels(state, driver) {
       const errorMessage = error2 instanceof Error ? error2.message : String(error2);
       logActivity(state, { type: "error", error: `Channel processing error: ${errorMessage}` });
       if (state.interactive) displayStatus(state);
+      if (driver.hasInFlightWatchers()) {
+        consecutiveDrainFailures = 0;
+        unreachableMs = 0;
+      } else if (state.idleTimeout !== null) {
+        consecutiveDrainFailures++;
+        unreachableThisCycle = true;
+        if (consecutiveDrainFailures === 1) {
+          logActivity(state, {
+            type: "info",
+            message: `Cannot reach Evident, will exit if this persists past the idle timeout (timeout: ${state.idleTimeout}s)...`
+          });
+          if (state.interactive) displayStatus(state);
+        }
+      }
     }
     await new Promise((resolve3) => setTimeout(resolve3, CHANNEL_POLL_INTERVAL_MS));
-    if (state.idleTimeout !== null && idlePolls >= 2) {
-      const idleMs = idlePolls * CHANNEL_POLL_INTERVAL_MS;
-      if (idleMs > state.idleTimeout * 1e3) {
-        logActivity(state, { type: "info", message: "Idle timeout reached" });
-        if (state.interactive) displayStatus(state);
-        break;
-      }
+    const cycleMs = performance.now() - cycleStartedAtMs;
+    if (idleThisCycle) idleMs += cycleMs;
+    if (unreachableThisCycle) unreachableMs += cycleMs;
+    if (state.idleTimeout !== null && consecutiveDrainFailures >= 2 && unreachableMs > state.idleTimeout * 1e3) {
+      logActivity(state, {
+        type: "info",
+        level: "warn",
+        message: `Exiting: could not reach Evident for ${consecutiveDrainFailures} consecutive polls (${Math.round(unreachableMs / 1e3)}s)`
+      });
+      if (state.interactive) displayStatus(state);
+      break;
+    }
+    if (state.idleTimeout !== null && idlePolls >= 2 && idleMs > state.idleTimeout * 1e3) {
+      logActivity(state, { type: "info", message: "Idle timeout reached" });
+      if (state.interactive) displayStatus(state);
+      break;
     }
   }
 }
@@ -6122,6 +6943,9 @@ function scheduleSessionCleanup(state, driver, options) {
   );
   state.sessionCleanupTimers.push(interval, firstSweep);
 }
+function claudeUsageFailureStreakSuffix(consecutiveFailures) {
+  return consecutiveFailures > 1 ? ` (${consecutiveFailures} consecutive failures)` : "";
+}
 function scheduleClaudeUsageReporting(state, options) {
   const { mode, warnings } = resolveClaudeUsageReportingMode(
     options.claudeUsageReporting,
@@ -6140,13 +6964,26 @@ function scheduleClaudeUsageReporting(state, options) {
       level: "debug",
       message: "Claude usage reporting is off (--claude-usage-reporting off)"
     });
-    return;
+    return null;
   }
   let consecutiveFailures = 0;
+  let armed = false;
+  let rearmRequested = false;
   const scheduleNextTick = () => {
+    armed = true;
+    rearmRequested = false;
     state.claudeUsageTimer = setTimeout(() => void tick(false), nextReportDelayMs());
   };
-  const tick = async (isFirst) => {
+  const rearm = () => {
+    if (armed) {
+      rearmRequested = true;
+      return;
+    }
+    rearmRequested = false;
+    armed = true;
+    state.claudeUsageTimer = setTimeout(() => void tick(true), FIRST_REPORT_DELAY_MS);
+  };
+  const tick = async (isProbe) => {
     try {
       const usage = await getClaudeUsage();
       const result = await reportClaudeUsage(state.agentId, state.authHeader, usage);
@@ -6168,8 +7005,8 @@ function scheduleClaudeUsageReporting(state, options) {
         consecutiveFailures++;
         logActivity(state, {
           type: "info",
-          level: consecutiveFailures === 1 ? "warn" : "debug",
-          message: `Failed to report Claude usage: ${result.error}`
+          level: claudeUsageFailureLogLevel(consecutiveFailures),
+          message: `Failed to report Claude usage: ${result.error}${claudeUsageFailureStreakSuffix(consecutiveFailures)}`
         });
       }
       scheduleNextTick();
@@ -6182,12 +7019,14 @@ function scheduleClaudeUsageReporting(state, options) {
             message: "Claude usage reporting is forced on but no usable Claude Code login was found \u2014 run `claude` to sign in; reporting will keep retrying"
           });
           scheduleNextTick();
-        } else if (isFirst) {
+        } else if (isProbe) {
           logActivity(state, {
             type: "info",
             level: "debug",
             message: `Claude usage reporting: ${error2.message}`
           });
+          armed = false;
+          if (rearmRequested) rearm();
         } else {
           logActivity(state, {
             type: "info",
@@ -6201,14 +7040,16 @@ function scheduleClaudeUsageReporting(state, options) {
         const message = error2 instanceof Error ? error2.message : String(error2);
         logActivity(state, {
           type: "info",
-          level: consecutiveFailures === 1 ? "warn" : "debug",
-          message: `Claude usage reporting failed: ${message}`
+          level: claudeUsageFailureLogLevel(consecutiveFailures),
+          message: `Claude usage reporting failed: ${message}${claudeUsageFailureStreakSuffix(consecutiveFailures)}`
         });
         scheduleNextTick();
       }
     }
   };
+  armed = true;
   state.claudeUsageTimer = setTimeout(() => void tick(true), FIRST_REPORT_DELAY_MS);
+  return rearm;
 }
 async function notifyOffline(state) {
   if (!state.agentId || !state.authHeader) return;
@@ -6249,6 +7090,7 @@ async function cleanup(state, opts = {}) {
     clearTimeout(state.claudeUsageTimer);
     state.claudeUsageTimer = null;
   }
+  state.claudeUsageRearm = null;
   if (opts.graceful && state.channelDriver) {
     state.channelDriver.stop();
     log2(state, "Draining in-flight channel work before shutdown...");
@@ -6330,6 +7172,7 @@ async function run(options) {
     lastProxiedActivityAt: null,
     sessionCleanupTimers: [],
     claudeUsageTimer: null,
+    claudeUsageRearm: null,
     authHeader: ""
   };
   setTelemetryAuthProvider(() => ({ authHeader: state.authHeader, agentId: state.agentId }));
@@ -6409,6 +7252,7 @@ async function run(options) {
         console.log(chalk6.dim("Or run `evident login` for interactive authentication"));
         blank();
         process.exit(1);
+        return;
       }
       blank();
       console.log(chalk6.yellow("You are not logged in to Evident."));
@@ -6453,6 +7297,7 @@ async function run(options) {
         } else {
           printError(resolved.error || "Failed to resolve runner ID from key");
           process.exit(1);
+          return;
         }
       } else {
         printError(
@@ -6466,6 +7311,7 @@ async function run(options) {
         );
         blank();
         process.exit(1);
+        return;
       }
     }
     telemetry.info(
@@ -6713,7 +7559,7 @@ async function run(options) {
       throw error2;
     }
     scheduleSessionCleanup(state, channelDriver, options);
-    scheduleClaudeUsageReporting(state, options);
+    state.claudeUsageRearm = scheduleClaudeUsageReporting(state, options);
     if (!interactive || state.json) {
       log2(state, "Driving channel messages...");
     }
@@ -6768,6 +7614,7 @@ program.name("evident").description("Run OpenCode locally and connect it to Evid
 program.command("login").description("Authenticate with Evident").option("--token", "Use token-based authentication (for CI/CD)").option("--no-browser", "Do not open the browser automatically").action(login);
 program.command("logout").description("Remove stored credentials for the current endpoint").option("--all", "Remove stored credentials for all endpoints").action((options) => logout({ all: options.all }));
 program.command("whoami").description("Show the currently logged in user").action(whoami);
+program.command("status").description("Check whether the configured credentials can reach Evident").option("--json", "Output in JSON format").action((options) => status({ json: options.json }));
 program.command("claude-usage").description("[spike] Show Claude subscription usage (requires a local `claude login`)").action(claudeUsage);
 program.command("run").description("Connect to Evident and process messages").option("--runner [id]", "Runner ID to connect to (optional when EVIDENT_RUNNER_KEY is set)").option(
   "-a, --agent [id]",
@@ -6797,7 +7644,7 @@ program.command("run").description("Connect to Evident and process messages").op
   []
 ).option(
   "--tunnel-ready-file <path>",
-  "Path to write once the tunnel is connected (set by the MicroVM hooks; unused on a developer machine)"
+  "Path to write once the tunnel is connected (opt-in; unused unless an operator/image sets it)"
 ).action(
   (options) => {
     run({