@evident-ai/cli 3.1.1-dev.97fd633 → 3.1.1-dev.9deb35f

package/dist/index.js

@@ -38,11 +38,6 @@ function getApiUrl() {
 function getTunnelUrl() {
   return tunnelOverride ?? process.env.EVIDENT_TUNNEL_URL ?? defaults.tunnelUrl;
 }
-var config = new Conf({
-  projectName: "evident",
-  projectSuffix: "",
-  defaults
-});
 var credentials = new Conf({
   projectName: "evident",
   projectSuffix: "",
@@ -267,16 +262,28 @@ async function getToken() {
   }
   return null;
 }
+function toError(err) {
+  return err instanceof Error ? err : new Error(String(err));
+}
 async function deleteToken(options = {}) {
   const keytar = await getKeytar();
+  const failures = [];
   if (keytar) {
     if (options.all) {
-      const all = await keytar.findCredentials(SERVICE_NAME).catch(() => []);
+      let accounts = [];
+      try {
+        accounts = await keytar.findCredentials(SERVICE_NAME);
+      } catch (err) {
+        failures.push({ type: "enumerate", error: toError(err) });
+      }
       await Promise.all(
-        all.map(
-          (entry) => keytar.deletePassword(SERVICE_NAME, entry.account).catch(() => {
-          })
-        )
+        accounts.map(async (entry) => {
+          try {
+            await keytar.deletePassword(SERVICE_NAME, entry.account);
+          } catch (err) {
+            failures.push({ type: "delete", account: entry.account, error: toError(err) });
+          }
+        })
       );
     } else {
       await keytar.deletePassword(SERVICE_NAME, keychainAccount());
@@ -287,6 +294,7 @@ async function deleteToken(options = {}) {
   } else {
     clearCredentials();
   }
+  return { failures };
 }
 
 // src/utils/ui.ts
@@ -404,8 +412,10 @@ async function deviceFlowLogin(options) {
 }
 async function tokenLogin() {
   console.log("Token login mode.");
-  console.log("Run `evident login` on a machine with a browser to get a token.");
-  console.log("Manage or revoke existing tokens under Settings \u2192 CLI tokens.");
+  console.log("Create a token under Settings \u2192 CLI tokens in the dashboard, then paste it below.");
+  console.log(
+    "(Alternatively, run `evident login` on a machine with a browser, or set EVIDENT_TOKEN for CI.)"
+  );
   blank();
   process.stdout.write("Paste token: ");
   const token = await new Promise((resolve3) => {
@@ -429,13 +439,22 @@ async function tokenLogin() {
     printError("No token provided.");
     process.exit(1);
   }
+  await validateAndStoreToken(token);
+}
+async function validateAndStoreToken(token) {
   const spinner = ora("Validating token...").start();
   try {
-    const result = await api.post("/auth/token/validate", { token });
+    const result = await api.get("/me", {
+      headers: { Authorization: `Bearer ${token}` }
+    });
+    if (!result.user) {
+      throw new Error(
+        "This token is not a user login (e.g. a runner key). Paste a CLI token instead."
+      );
+    }
     await storeToken({
       token,
-      user: result.user,
-      expiresAt: result.expires_at
+      user: { email: result.user.email }
     });
     spinner.stop();
     printSuccess(`Logged in as ${chalk2.bold(result.user.email)}`);
@@ -455,9 +474,22 @@ async function login(options) {
 }
 
 // src/commands/logout.ts
+function describeFailure(failure) {
+  if (failure.type === "enumerate") {
+    return `could not list stored keychain entries (${failure.error.message})`;
+  }
+  return `${failure.account} (${failure.error.message})`;
+}
 async function logout(options = {}) {
   if (options.all) {
-    await deleteToken({ all: true });
+    const result = await deleteToken({ all: true });
+    if (result.failures.length > 0) {
+      printError(
+        `Failed to fully clear your keychain: ${result.failures.map(describeFailure).join("; ")}. Your local credentials file was cleared, but stale keychain entries may remain \u2014 run \`evident logout --all\` again, or remove them manually from your OS keychain / credential manager.`
+      );
+      process.exitCode = 1;
+      return;
+    }
     printSuccess("Logged out of all endpoints.");
     return;
   }
@@ -466,43 +498,508 @@ async function logout(options = {}) {
     printWarning(`You are not logged in to ${getApiUrlConfig()}.`);
     return;
   }
-  await deleteToken();
-  printSuccess(`Logged out of ${getApiUrlConfig()}.`);
+  await deleteToken();
+  printSuccess(`Logged out of ${getApiUrlConfig()}.`);
+}
+
+// src/commands/whoami.ts
+import chalk3 from "chalk";
+async function whoami() {
+  const apiUrl = getApiUrlConfig();
+  const credentials2 = await getToken();
+  if (!credentials2) {
+    printError(`Not logged in to ${apiUrl}. Run the \`login\` command to authenticate.`);
+    process.exit(1);
+  }
+  blank();
+  console.log(keyValue("Endpoint", apiUrl));
+  console.log(keyValue("User", chalk3.bold(credentials2.user.email)));
+  if (credentials2.user.id) {
+    console.log(keyValue("User ID", credentials2.user.id));
+  }
+  if (credentials2.expiresAt) {
+    const expiresAt = new Date(credentials2.expiresAt);
+    const now = /* @__PURE__ */ new Date();
+    if (expiresAt < now) {
+      console.log(keyValue("Status", chalk3.red("Token expired")));
+    } else {
+      const daysRemaining = Math.ceil(
+        (expiresAt.getTime() - now.getTime()) / (1e3 * 60 * 60 * 24)
+      );
+      console.log(keyValue("Expires", `${daysRemaining} days`));
+    }
+  }
+  blank();
+}
+
+// src/lib/auth.ts
+async function getAuthCredentials() {
+  const runnerKey = process.env.EVIDENT_RUNNER_KEY;
+  const agentKey = process.env.EVIDENT_AGENT_KEY;
+  if (runnerKey) {
+    return {
+      token: runnerKey,
+      authType: "agent_key",
+      keySource: "runner_key",
+      notice: agentKey ? "Both EVIDENT_RUNNER_KEY and EVIDENT_AGENT_KEY are set; using EVIDENT_RUNNER_KEY." : void 0
+    };
+  }
+  if (agentKey) {
+    return { token: agentKey, authType: "agent_key", keySource: "agent_key" };
+  }
+  const userToken = process.env.EVIDENT_TOKEN;
+  if (userToken) {
+    return { token: userToken, authType: "bearer" };
+  }
+  const keychainCreds = await getToken();
+  if (keychainCreds) {
+    return {
+      token: keychainCreds.token,
+      authType: "bearer",
+      user: keychainCreds.user
+    };
+  }
+  return null;
+}
+function getAuthHeader(credentials2) {
+  if (credentials2.authType === "agent_key") {
+    return `SandboxKey ${credentials2.token}`;
+  }
+  return `Bearer ${credentials2.token}`;
+}
+function isInteractive(jsonOutput) {
+  if (jsonOutput) return false;
+  if (process.env.CI) return false;
+  if (process.env.GITHUB_ACTIONS) return false;
+  if (!process.stdin.isTTY) return false;
+  return true;
+}
+
+// src/commands/agent-lookup.ts
+async function readErrorMessage(response) {
+  const text = await response.text().catch(() => "");
+  if (!text) return response.statusText || void 0;
+  try {
+    const data = JSON.parse(text);
+    const message = data.message ?? data.error;
+    if (typeof message === "string" && message.trim()) {
+      return message;
+    }
+  } catch {
+  }
+  return text.trim() || response.statusText || void 0;
+}
+function authFailureHint(apiUrl, serverMessage) {
+  const reason = serverMessage ? `: ${serverMessage}` : "";
+  return `Authentication failed${reason}. Your credentials were rejected by ${apiUrl}. This usually means you logged in against a different environment, or your session expired \u2014 log in again pointing at this endpoint and retry.`;
+}
+async function resolveAgentIdFromKey(authHeader) {
+  const apiUrl = getApiUrlConfig();
+  try {
+    const response = await fetch(`${apiUrl}/me`, {
+      headers: { Authorization: authHeader }
+    });
+    if (response.status === 401) {
+      const serverMessage = await readErrorMessage(response);
+      return { error: authFailureHint(apiUrl, serverMessage), authFailed: true };
+    }
+    if (!response.ok) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        error: `Failed to resolve runner from key (HTTP ${response.status})${serverMessage ? `: ${serverMessage}` : ""}`
+      };
+    }
+    const data = await response.json();
+    if (data.auth_type === "agent_key" && data.agent_id) {
+      return { agent_id: data.agent_id };
+    }
+    return {
+      error: "Cannot resolve runner ID: auth type is not agent_key. Please provide --runner explicitly."
+    };
+  } catch (error2) {
+    const message = error2 instanceof Error ? error2.message : "Unknown error";
+    return { error: `Failed to resolve runner from key: ${message}` };
+  }
+}
+var BEST_EFFORT_NOTIFY_TIMEOUT_MS = 2e3;
+async function notifyAgentDisconnected(agentId, authHeader) {
+  const apiUrl = getApiUrlConfig();
+  try {
+    const response = await fetch(`${apiUrl}/runners/${agentId}/disconnect`, {
+      method: "POST",
+      headers: { Authorization: authHeader },
+      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
+    });
+    if (!response.ok) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        ok: false,
+        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
+      };
+    }
+    return { ok: true };
+  } catch (error2) {
+    return { ok: false, error: describeBestEffortError(error2) };
+  }
+}
+function describeBestEffortError(error2) {
+  const name = error2?.name;
+  if (name === "TimeoutError" || name === "AbortError") {
+    return `timed out after ${BEST_EFFORT_NOTIFY_TIMEOUT_MS}ms`;
+  }
+  return error2 instanceof Error ? error2.message : String(error2);
+}
+async function reportMicrovmId(agentId, authHeader, microvmId) {
+  try {
+    const apiUrl = getApiUrlConfig();
+    const response = await fetch(`${apiUrl}/runners/${agentId}/microvm`, {
+      method: "POST",
+      headers: { Authorization: authHeader, "Content-Type": "application/json" },
+      body: JSON.stringify({ microvm_id: microvmId }),
+      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
+    });
+    if (!response.ok) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        ok: false,
+        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
+      };
+    }
+    return { ok: true };
+  } catch (error2) {
+    return { ok: false, error: describeBestEffortError(error2) };
+  }
+}
+function toReportedWindow(window) {
+  if (!window) return null;
+  return { utilization: window.utilization, resets_at: window.resetsAt };
+}
+async function reportClaudeUsage(agentId, authHeader, snapshot) {
+  try {
+    const apiUrl = getApiUrlConfig();
+    const response = await fetch(`${apiUrl}/runners/${agentId}/claude-usage`, {
+      method: "POST",
+      headers: { Authorization: authHeader, "Content-Type": "application/json" },
+      body: JSON.stringify({
+        five_hour: toReportedWindow(snapshot.fiveHour),
+        seven_day: toReportedWindow(snapshot.sevenDay)
+      }),
+      signal: AbortSignal.timeout(BEST_EFFORT_NOTIFY_TIMEOUT_MS)
+    });
+    if (!response.ok) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        ok: false,
+        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
+      };
+    }
+    return { ok: true };
+  } catch (error2) {
+    return { ok: false, error: describeBestEffortError(error2) };
+  }
+}
+async function getAgentInfo(agentId, authHeader) {
+  const apiUrl = getApiUrlConfig();
+  try {
+    const response = await fetch(`${apiUrl}/runners/${agentId}`, {
+      headers: { Authorization: authHeader }
+    });
+    if (response.status === 401) {
+      const serverMessage = await readErrorMessage(response);
+      return { valid: false, error: authFailureHint(apiUrl, serverMessage), authFailed: true };
+    }
+    if (response.status === 403) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        valid: false,
+        error: serverMessage ?? "You do not have access to this runner (it may belong to a different team or organization)."
+      };
+    }
+    if (response.status === 404) {
+      const serverMessage = await readErrorMessage(response);
+      return { valid: false, error: serverMessage ?? `Runner ${agentId} not found` };
+    }
+    if (!response.ok) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        valid: false,
+        error: `API error (HTTP ${response.status})${serverMessage ? `: ${serverMessage}` : ""}`
+      };
+    }
+    const agent = await response.json();
+    if (agent.agent_type !== "local") {
+      return {
+        valid: false,
+        error: `Runner is type '${agent.agent_type}', must be 'local' for CLI connection`
+      };
+    }
+    return { valid: true, agent };
+  } catch (error2) {
+    const message = error2 instanceof Error ? error2.message : "Unknown error";
+    return { valid: false, error: `Failed to validate runner: ${message}` };
+  }
+}
+
+// src/commands/status.ts
+var STATUS_TIMEOUT_MS = 1e4;
+function authLabelFor(credentials2) {
+  if (credentials2.authType === "agent_key") {
+    return credentials2.keySource === "agent_key" ? "runner key (EVIDENT_AGENT_KEY)" : "runner key (EVIDENT_RUNNER_KEY)";
+  }
+  return "user token";
+}
+function describeFetchError(error2) {
+  const name = error2?.name;
+  if (name === "TimeoutError" || name === "AbortError") {
+    return `timed out after ${STATUS_TIMEOUT_MS}ms waiting for a response`;
+  }
+  return error2 instanceof Error ? error2.message : String(error2);
+}
+async function checkStatus(jsonMode) {
+  const apiUrl = getApiUrlConfig();
+  const credentials2 = await getAuthCredentials();
+  if (!credentials2) {
+    return {
+      ok: false,
+      endpoint: apiUrl,
+      reason: "no_credentials",
+      error: "No credentials configured. Set EVIDENT_RUNNER_KEY (or EVIDENT_AGENT_KEY), or EVIDENT_TOKEN, or run `evident login`.",
+      exitCode: 1
+    };
+  }
+  if (credentials2.notice && !jsonMode) {
+    printWarning(credentials2.notice);
+  }
+  let response;
+  try {
+    response = await fetch(`${apiUrl}/me`, {
+      headers: { Authorization: getAuthHeader(credentials2) },
+      signal: AbortSignal.timeout(STATUS_TIMEOUT_MS)
+    });
+  } catch (error2) {
+    return {
+      ok: false,
+      endpoint: apiUrl,
+      authLabel: authLabelFor(credentials2),
+      reason: "unreachable",
+      error: `Could not reach ${apiUrl}: ${describeFetchError(error2)}. The credentials were NOT validated.`,
+      exitCode: 75
+    };
+  }
+  if (response.status === 401) {
+    const serverMessage = await readErrorMessage(response);
+    return {
+      ok: false,
+      endpoint: apiUrl,
+      authLabel: authLabelFor(credentials2),
+      reason: "unauthorized",
+      error: authFailureHint(apiUrl, serverMessage),
+      exitCode: 1
+    };
+  }
+  if (response.status >= 500) {
+    const serverMessage = await readErrorMessage(response);
+    return {
+      ok: false,
+      endpoint: apiUrl,
+      authLabel: authLabelFor(credentials2),
+      reason: "unreachable",
+      error: `${apiUrl} returned HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}. The credentials were NOT validated.`,
+      exitCode: 75
+    };
+  }
+  if (!response.ok) {
+    const serverMessage = await readErrorMessage(response);
+    return {
+      ok: false,
+      endpoint: apiUrl,
+      authLabel: authLabelFor(credentials2),
+      reason: "http_error",
+      error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`,
+      exitCode: 1
+    };
+  }
+  const data = await response.json();
+  return {
+    ok: true,
+    endpoint: apiUrl,
+    authType: data.auth_type,
+    authLabel: authLabelFor(credentials2),
+    runnerId: data.auth_type === "agent_key" ? data.agent_id : void 0,
+    reason: "ok",
+    exitCode: 0
+  };
+}
+function printJson(result) {
+  const payload = {
+    ok: result.ok,
+    endpoint: result.endpoint
+  };
+  if (result.authType) payload.auth_type = result.authType;
+  if (result.runnerId) payload.runner_id = result.runnerId;
+  if (result.reason) payload.reason = result.reason;
+  if (result.error) payload.error = result.error;
+  console.log(JSON.stringify(payload));
+}
+function printHuman(result) {
+  blank();
+  console.log(keyValue("Endpoint", result.endpoint));
+  if (result.ok) {
+    console.log(keyValue("Auth", result.authLabel ?? "\u2014"));
+    if (result.runnerId) {
+      console.log(keyValue("Runner", result.runnerId));
+    }
+    console.log(keyValue("Status", "OK \u2014 credentials accepted"));
+    blank();
+    return;
+  }
+  if (result.authLabel) {
+    console.log(keyValue("Auth", result.authLabel));
+  }
+  blank();
+  printError(result.error ?? "Unknown error");
+}
+async function status(options = {}) {
+  const result = await checkStatus(Boolean(options.json));
+  if (options.json) {
+    printJson(result);
+  } else {
+    printHuman(result);
+  }
+  process.exit(result.exitCode);
+}
+
+// src/lib/claude-usage.ts
+import { execFileSync } from "child_process";
+import { readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var CLAUDE_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
+var KEYCHAIN_SERVICE = "Claude Code-credentials";
+function parseClaudeCliCredentials(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const data = parsed.claudeAiOauth ?? parsed;
+  const creds = data;
+  if (typeof creds.accessToken !== "string" || typeof creds.expiresAt !== "number") {
+    return null;
+  }
+  return { accessToken: creds.accessToken, expiresAt: creds.expiresAt };
+}
+function readClaudeCliCredentials() {
+  if (process.platform === "darwin") {
+    try {
+      const raw = execFileSync(
+        "/usr/bin/security",
+        ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-w"],
+        { encoding: "utf-8", timeout: 2e3, stdio: ["pipe", "pipe", "ignore"] }
+      );
+      return parseClaudeCliCredentials(raw);
+    } catch {
+      return null;
+    }
+  }
+  try {
+    const raw = readFileSync(join(homedir(), ".claude", ".credentials.json"), "utf-8");
+    return parseClaudeCliCredentials(raw);
+  } catch {
+    return null;
+  }
+}
+var ClaudeUsageError = class extends Error {
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+  }
+};
+function isLocalCredentialProblem(err) {
+  return err instanceof ClaudeUsageError && (err.reason === "no_credentials" || err.reason === "credentials_expired");
+}
+function normalizeResetsAt(value) {
+  const ms = Date.parse(value);
+  return Number.isNaN(ms) ? null : new Date(ms).toISOString();
+}
+function toWindow(value) {
+  if (!value || typeof value !== "object") {
+    return null;
+  }
+  const window = value;
+  if (typeof window.utilization !== "number" || typeof window.resets_at !== "string") {
+    return null;
+  }
+  const resetsAt = normalizeResetsAt(window.resets_at);
+  if (resetsAt === null) {
+    return null;
+  }
+  return { utilization: window.utilization, resetsAt };
+}
+async function getClaudeUsage() {
+  const credentials2 = readClaudeCliCredentials();
+  if (!credentials2) {
+    throw new ClaudeUsageError(
+      "No local Claude Code login found. Run `claude` once to sign in with your Claude subscription.",
+      "no_credentials"
+    );
+  }
+  if (credentials2.expiresAt < Date.now()) {
+    throw new ClaudeUsageError(
+      "Claude Code credentials have expired. Run `claude` to refresh them.",
+      "credentials_expired"
+    );
+  }
+  const res = await fetch(CLAUDE_USAGE_URL, {
+    headers: {
+      Authorization: `Bearer ${credentials2.accessToken}`,
+      "Content-Type": "application/json",
+      "anthropic-version": "2023-06-01"
+    }
+  });
+  if (!res.ok) {
+    throw new ClaudeUsageError(`Claude usage request failed: HTTP ${res.status}`, "request_failed");
+  }
+  const body = await res.json();
+  return {
+    fiveHour: toWindow(body.five_hour),
+    sevenDay: toWindow(body.seven_day)
+  };
 }
 
-// src/commands/whoami.ts
-import chalk3 from "chalk";
-async function whoami() {
-  const apiUrl = getApiUrlConfig();
-  const credentials2 = await getToken();
-  if (!credentials2) {
-    printError(`Not logged in to ${apiUrl}. Run the \`login\` command to authenticate.`);
-    process.exit(1);
+// src/commands/claude-usage.ts
+function formatWindow(label, window) {
+  if (!window) {
+    return keyValue(label, "not available for this plan");
   }
-  blank();
-  console.log(keyValue("Endpoint", apiUrl));
-  console.log(keyValue("User", chalk3.bold(credentials2.user.email)));
-  console.log(keyValue("User ID", credentials2.user.id));
-  if (credentials2.expiresAt) {
-    const expiresAt = new Date(credentials2.expiresAt);
-    const now = /* @__PURE__ */ new Date();
-    if (expiresAt < now) {
-      console.log(keyValue("Status", chalk3.red("Token expired")));
-    } else {
-      const daysRemaining = Math.ceil(
-        (expiresAt.getTime() - now.getTime()) / (1e3 * 60 * 60 * 24)
-      );
-      console.log(keyValue("Expires", `${daysRemaining} days`));
+  const resetsAt = new Date(window.resetsAt);
+  return keyValue(label, `${window.utilization}% used, resets ${resetsAt.toLocaleString()}`);
+}
+async function claudeUsage() {
+  try {
+    const usage = await getClaudeUsage();
+    blank();
+    console.log(formatWindow("5-hour session", usage.fiveHour));
+    console.log(formatWindow("7-day", usage.sevenDay));
+    blank();
+  } catch (err) {
+    if (err instanceof ClaudeUsageError) {
+      printError(err.message);
+      process.exit(1);
     }
+    throw err;
   }
-  blank();
 }
 
 // src/commands/run.ts
-import { homedir as homedir2 } from "os";
-import { isAbsolute as isAbsolute2, join as join2, parse, resolve as resolvePath } from "path";
+import { homedir as homedir3 } from "os";
+import { isAbsolute as isAbsolute2, join as join3, parse, resolve as resolvePath } from "path";
 import chalk6 from "chalk";
 
+// ../../packages/types/src/agents/index.ts
+var MICROVM_MAX_LIFETIME_MS = 8 * 60 * 6e4;
+
 // ../../packages/types/src/telemetry/index.ts
 var TelemetryEventTypes = {
   // Agent activity events (shown in web UI activity log)
@@ -510,7 +1007,10 @@ var TelemetryEventTypes = {
   AGENT_DISCONNECTED: "agent.disconnected",
   AGENT_MESSAGE_PROCESSING: "agent.message_processing",
   AGENT_MESSAGE_DONE: "agent.message_done",
-  AGENT_MESSAGE_FAILED: "agent.message_failed"
+  AGENT_MESSAGE_FAILED: "agent.message_failed",
+  // A `warn`/`error` runner-side log line forwarded server-side for
+  // observability (issue #916) — see `apps/cli/src/lib/runner-activity-telemetry.ts`.
+  RUNNER_ACTIVITY: "runner.activity"
 };
 
 // ../../packages/types/src/tunnel/index.ts
@@ -565,6 +1065,13 @@ var isShuttingDown = false;
 var FLUSH_INTERVAL_MS = 5e3;
 var MAX_BUFFER_SIZE = 50;
 var FLUSH_TIMEOUT_MS = 3e3;
+var authProvider = null;
+function setTelemetryAuthProvider(provider) {
+  authProvider = provider;
+}
+var FLUSH_FAILURE_LOG_INTERVAL_MS = 6e4;
+var lastFlushFailureLoggedAt = 0;
+var suppressedFlushFailureCount = 0;
 function logEvent(eventType, options = {}) {
   const event = {
     event_type: eventType,
@@ -599,9 +1106,16 @@ async function flushEvents() {
     flushTimeout = null;
   }
   try {
-    const credentials2 = await getToken();
-    if (!credentials2) {
-      return;
+    const providerContext = authProvider?.();
+    let authHeader;
+    if (providerContext?.authHeader) {
+      authHeader = providerContext.authHeader;
+    } else {
+      const credentials2 = await getToken();
+      if (!credentials2) {
+        return;
+      }
+      authHeader = `Bearer ${credentials2.token}`;
     }
     const apiUrl = getApiUrlConfig();
     const controller = new AbortController();
@@ -616,7 +1130,7 @@ async function flushEvents() {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
-          Authorization: `Bearer ${credentials2.token}`
+          Authorization: authHeader
         },
         body: JSON.stringify(request),
         signal: controller.signal
@@ -628,8 +1142,15 @@ async function flushEvents() {
       clearTimeout(timeout);
     }
   } catch (error2) {
-    if (process.env.DEBUG) {
-      console.error("Telemetry error:", error2);
+    const now = Date.now();
+    if (now - lastFlushFailureLoggedAt >= FLUSH_FAILURE_LOG_INTERVAL_MS) {
+      const message = error2 instanceof Error ? error2.message : String(error2);
+      const suffix = suppressedFlushFailureCount > 0 ? ` (${suppressedFlushFailureCount} more suppressed in the last ${FLUSH_FAILURE_LOG_INTERVAL_MS / 1e3}s)` : "";
+      console.error(`Telemetry flush error: ${message}${suffix}`);
+      lastFlushFailureLoggedAt = now;
+      suppressedFlushFailureCount = 0;
+    } else {
+      suppressedFlushFailureCount++;
     }
   }
 }
@@ -698,47 +1219,67 @@ var EventTypes = {
   DEPRECATED_AGENT_KEY_ENV_USED: "cli.deprecated_agent_key_env_used"
 };
 
-// src/lib/auth.ts
-async function getAuthCredentials() {
-  const runnerKey = process.env.EVIDENT_RUNNER_KEY;
-  const agentKey = process.env.EVIDENT_AGENT_KEY;
-  if (runnerKey) {
-    return {
-      token: runnerKey,
-      authType: "agent_key",
-      keySource: "runner_key",
-      notice: agentKey ? "Both EVIDENT_RUNNER_KEY and EVIDENT_AGENT_KEY are set; using EVIDENT_RUNNER_KEY." : void 0
-    };
-  }
-  if (agentKey) {
-    return { token: agentKey, authType: "agent_key", keySource: "agent_key" };
-  }
-  const userToken = process.env.EVIDENT_TOKEN;
-  if (userToken) {
-    return { token: userToken, authType: "bearer" };
+// src/lib/runner-activity-telemetry.ts
+var FORWARDED_LEVELS = /* @__PURE__ */ new Set(["warn", "error"]);
+var SEVERITY_BY_LEVEL = {
+  warn: "warning",
+  error: "error"
+};
+var MAX_MESSAGE_LENGTH = 500;
+var TRUNCATION_MARKER = "\u2026";
+function redact(message) {
+  return message.replace(/esk_[A-Za-z0-9_-]+/g, "esk_***").replace(/ct_[A-Za-z0-9_-]+/g, "ct_***").replace(/https?:\/\/\S+/g, "<url>");
+}
+function truncate(message) {
+  if (message.length <= MAX_MESSAGE_LENGTH) return message;
+  return message.slice(0, MAX_MESSAGE_LENGTH - TRUNCATION_MARKER.length) + TRUNCATION_MARKER;
+}
+var RATE_LIMIT_WINDOW_MS = 6e4;
+var RATE_LIMIT_MAX_EVENTS = 30;
+var windowStartedAt = 0;
+var windowCount = 0;
+var windowDroppedCount = 0;
+function admitUnderRateLimit(now) {
+  if (now - windowStartedAt >= RATE_LIMIT_WINDOW_MS) {
+    if (windowDroppedCount > 0) {
+      console.error(
+        `[runner-activity-telemetry] rate cap reached: dropped ${windowDroppedCount} ${windowDroppedCount === 1 ? "entry" : "entries"} in the last ${RATE_LIMIT_WINDOW_MS / 1e3}s (cap ${RATE_LIMIT_MAX_EVENTS}/min)`
+      );
+    }
+    windowStartedAt = now;
+    windowCount = 0;
+    windowDroppedCount = 0;
   }
-  const keychainCreds = await getToken();
-  if (keychainCreds) {
-    return {
-      token: keychainCreds.token,
-      authType: "bearer",
-      user: keychainCreds.user
-    };
+  if (windowCount >= RATE_LIMIT_MAX_EVENTS) {
+    windowDroppedCount++;
+    if (windowDroppedCount === 1) {
+      console.error(
+        `[runner-activity-telemetry] rate cap reached (${RATE_LIMIT_MAX_EVENTS} per ${RATE_LIMIT_WINDOW_MS / 1e3}s) \u2014 dropping further entries this window`
+      );
+    }
+    return false;
   }
-  return null;
+  windowCount++;
+  return true;
 }
-function getAuthHeader(credentials2) {
-  if (credentials2.authType === "agent_key") {
-    return `SandboxKey ${credentials2.token}`;
+function forwardRunnerActivity(entry, context) {
+  try {
+    if (!FORWARDED_LEVELS.has(entry.level)) return;
+    if (!context.agentId || !context.authHeader) return;
+    if (!admitUnderRateLimit(Date.now())) return;
+    const rawMessage = entry.error ?? entry.message ?? "";
+    const message = truncate(redact(rawMessage));
+    logEvent(TelemetryEventTypes.RUNNER_ACTIVITY, {
+      severity: SEVERITY_BY_LEVEL[entry.level],
+      message,
+      metadata: { source: "cli.run" },
+      agentId: context.agentId
+    });
+  } catch (err) {
+    console.error(
+      `[runner-activity-telemetry] failed to forward runner activity: ${err instanceof Error ? err.message : String(err)}`
+    );
   }
-  return `Bearer ${credentials2.token}`;
-}
-function isInteractive(jsonOutput) {
-  if (jsonOutput) return false;
-  if (process.env.CI) return false;
-  if (process.env.GITHUB_ACTIONS) return false;
-  if (!process.stdin.isTTY) return false;
-  return true;
 }
 
 // src/lib/opencode/health.ts
@@ -1532,6 +2073,9 @@ function isPreamblePinnedRunning(messages, userMessageId) {
   const reply = findLastAssistantReplyFor(messages, userMessageId);
   return completedOf(reply) != null && finishOf(reply) === "tool-calls";
 }
+function isB2AbandonmentConfirmed(params) {
+  return params.pinnedForMs >= params.minPinnedMs && params.descendantOngoing === false;
+}
 function messageError(messages, userMessageId) {
   const reply = findLastAssistantReplyFor(messages, userMessageId);
   const error2 = errorOf(reply);
@@ -1545,6 +2089,57 @@ function messageError(messages, userMessageId) {
   }
   return "The agent run failed.";
 }
+function isAbortedTerminalReply(messages, userMessageId) {
+  const reply = findLastAssistantReplyFor(messages, userMessageId);
+  const error2 = errorOf(reply);
+  if (error2 == null) return false;
+  if (typeof error2 === "string") return error2.trim() === "Aborted";
+  if (typeof error2 === "object") {
+    const e = error2;
+    if (e.name === "MessageAbortedError") return true;
+    if (e.name === "AbortError") return true;
+    const dataMessage = e.data?.message;
+    const rendered = typeof dataMessage === "string" ? dataMessage : typeof e.message === "string" ? e.message : null;
+    return rendered != null && rendered.trim() === "Aborted";
+  }
+  return false;
+}
+function messageFailure(messages, userMessageId) {
+  const reply = findLastAssistantReplyFor(messages, userMessageId);
+  const error2 = errorOf(reply);
+  if (error2 == null || typeof error2 !== "object") return null;
+  const e = error2;
+  const replyProviderId = reply?.info?.providerID ?? null;
+  const replyModelId = reply?.info?.modelID ?? null;
+  if (e.name === "ProviderAuthError") {
+    const data = e.data;
+    const providerId = typeof data?.providerID === "string" && data.providerID || replyProviderId;
+    return { kind: "model_auth", providerId, modelId: replyModelId, reason: "missing" };
+  }
+  if (e.name === "APIError") {
+    const data = e.data;
+    const statusCode = data?.statusCode;
+    if (statusCode === 401 || statusCode === 403) {
+      return {
+        kind: "model_auth",
+        providerId: replyProviderId,
+        modelId: replyModelId,
+        reason: "rejected"
+      };
+    }
+  }
+  return null;
+}
+function applyZeroProviderFallback(classified, hasConfiguredProvider, replyProviderId, replyModelId = null) {
+  if (classified != null) return classified;
+  if (hasConfiguredProvider !== false) return null;
+  return {
+    kind: "model_auth",
+    providerId: replyProviderId,
+    modelId: replyModelId,
+    reason: "missing"
+  };
+}
 function hasRunningAssistantExcept(messages, exceptUserMessageId) {
   if (!messages || messages.length === 0) return false;
   return messages.some(
@@ -2073,13 +2668,56 @@ var RunnerConnection = class {
   }
 };
 
+// src/lib/tunnel/ready-marker.ts
+import { writeFileSync } from "fs";
+function writeTunnelReadyMarker(path, agentId) {
+  try {
+    writeFileSync(path, `${agentId}
+`);
+    return { ok: true };
+  } catch (error2) {
+    return { ok: false, error: error2 instanceof Error ? error2.message : String(error2) };
+  }
+}
+
+// src/lib/claude-usage-reporting.ts
+var VALID_MODES = ["auto", "on", "off"];
+function resolveClaudeUsageReportingMode(flagValue, env) {
+  const raw = flagValue ?? env.EVIDENT_CLAUDE_USAGE_REPORTING;
+  if (raw === void 0 || raw === "") {
+    return { mode: "auto", warnings: [] };
+  }
+  const normalized = raw.trim().toLowerCase();
+  if (VALID_MODES.includes(normalized)) {
+    return { mode: normalized, warnings: [] };
+  }
+  const source = flagValue !== void 0 ? "--claude-usage-reporting" : "EVIDENT_CLAUDE_USAGE_REPORTING";
+  return {
+    mode: "auto",
+    warnings: [
+      `Ignoring invalid ${source} "${raw}": expected one of ${VALID_MODES.join(", ")}; using auto`
+    ]
+  };
+}
+var BASE_REPORT_DELAY_MS = 10 * 6e4;
+var REPORT_DELAY_JITTER_FRACTION = 0.2;
+function nextReportDelayMs(random = Math.random) {
+  const jitterRangeMs = BASE_REPORT_DELAY_MS * REPORT_DELAY_JITTER_FRACTION;
+  return BASE_REPORT_DELAY_MS - jitterRangeMs + random() * (2 * jitterRangeMs);
+}
+var FIRST_REPORT_DELAY_MS = 5e3 + Math.random() * 1e4;
+var CLAUDE_USAGE_FAILURE_REESCALATION_TICKS = 6;
+function claudeUsageFailureLogLevel(consecutiveFailures) {
+  return consecutiveFailures === 1 || consecutiveFailures % CLAUDE_USAGE_FAILURE_REESCALATION_TICKS === 0 ? "warn" : "debug";
+}
+
 // src/lib/channels/driver.ts
-import { homedir } from "os";
+import { homedir as homedir2 } from "os";
 
 // src/lib/file-push.ts
 import { randomUUID } from "crypto";
 import { chmod, mkdir, open as open2, realpath, rename, unlink } from "fs/promises";
-import { basename, dirname as dirname2, isAbsolute, join, relative, resolve as resolve2, sep } from "path";
+import { basename, dirname as dirname2, isAbsolute, join as join2, relative, resolve as resolve2, sep } from "path";
 var FILE_MODE = 384;
 var DIRECTORY_MODE = 448;
 async function writePushedFile(request) {
@@ -2112,7 +2750,7 @@ async function writePushedFile(request) {
     const { existingAncestor, missingSegments } = await resolveNearestExistingAncestor(
       dirname2(candidate)
     );
-    const realTarget = join(existingAncestor, ...missingSegments, basename(candidate));
+    const realTarget = join2(existingAncestor, ...missingSegments, basename(candidate));
     const allowedDirectory = await findContainingAllowedDirectory(allowedDirectories, realTarget);
     if (allowedDirectory === null) {
       return refuse("path_not_allowed", "The runner does not allow writing to that location.", {
@@ -2148,7 +2786,7 @@ function expandAndValidate(requestedPath, homeDir) {
   if (requestedPath.trim() === "" || requestedPath.includes("\0")) {
     return null;
   }
-  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join(homeDir, requestedPath.slice(2)) : requestedPath;
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join2(homeDir, requestedPath.slice(2)) : requestedPath;
   if (expanded.split(/[/\\]/).includes("..")) {
     return null;
   }
@@ -2221,13 +2859,13 @@ function contains(realDirectory, realTarget) {
 async function createMissingDirectories(existingAncestor, missingSegments) {
   let current = existingAncestor;
   for (const segment of missingSegments) {
-    current = join(current, segment);
+    current = join2(current, segment);
     await mkdir(current, { recursive: true, mode: DIRECTORY_MODE });
     await chmod(current, DIRECTORY_MODE);
   }
 }
 async function writeAtomically(realTarget, content) {
-  const temporaryPath = join(dirname2(realTarget), `.evident-push-${randomUUID()}.tmp`);
+  const temporaryPath = join2(dirname2(realTarget), `.evident-push-${randomUUID()}.tmp`);
   let handle;
   try {
     handle = await open2(temporaryPath, "wx", FILE_MODE);
@@ -2394,8 +3032,8 @@ async function applyOne(options, file) {
   await ack(options, file, "applied");
   return true;
 }
-function durableDownloadCode(status) {
-  return status === 413 ? "file_too_large" : "write_failed";
+function durableDownloadCode(status2) {
+  return status2 === 413 ? "file_too_large" : "write_failed";
 }
 async function downloadContent(options, file, label) {
   try {
@@ -2428,8 +3066,8 @@ async function downloadContent(options, file, label) {
     return { ok: false, terminal: false };
   }
 }
-async function ack(options, file, status, reason) {
-  const outcome = `${status}${reason ? ` (${reason})` : ""}`;
+async function ack(options, file, status2, reason) {
+  const outcome = `${status2}${reason ? ` (${reason})` : ""}`;
   try {
     const res = await options.fetchImpl(
       `${options.apiUrl}/runners/${options.agentId}/files/${file.id}/ack`,
@@ -2439,7 +3077,7 @@ async function ack(options, file, status, reason) {
           Authorization: options.getAuthHeader(),
           "Content-Type": "application/json"
         },
-        body: JSON.stringify(reason ? { status, reason } : { status })
+        body: JSON.stringify(reason ? { status: status2, reason } : { status: status2 })
       }
     );
     if (!res.ok) {
@@ -2499,8 +3137,11 @@ var DEFAULT_PAUSED_MAX_WAIT_MS = 10 * 60 * 1e3;
 var DEFAULT_STUCK_QUEUED_MS = 6e4;
 var HEARTBEAT_MS = 6e4;
 var ABSOLUTE_MAX_PROCESSING_MS = 6 * 60 * 60 * 1e3;
+var B2_ABANDONMENT_MIN_PINNED_MS = 3 * 6e4;
+var B2_ABANDONMENT_RECHECK_MS = HEARTBEAT_MS;
 var POLL_MISS_GRACE_MS = HEARTBEAT_MS;
 var MAX_SUPERSEDED_CONVERSATIONS = 256;
+var MAX_IDENTICAL_REDRIVE_POLL_FAILURES = 5;
 var ChannelAuthError = class extends Error {
   constructor(message) {
     super(message);
@@ -2509,10 +3150,10 @@ var ChannelAuthError = class extends Error {
 };
 var ChannelTerminalError = class extends Error {
   status;
-  constructor(message, status) {
+  constructor(message, status2) {
     super(message);
     this.name = "ChannelTerminalError";
-    this.status = status;
+    this.status = status2;
   }
 };
 function backoffDelay(attempt, policy) {
@@ -2520,8 +3161,12 @@ function backoffDelay(attempt, policy) {
   const capped = Math.min(policy.maxDelayMs, exp);
   return Math.floor(Math.random() * capped);
 }
-function isRetryableStatus(status) {
-  return status === 429 || status >= 500 && status <= 599;
+function isRetryableStatus(status2) {
+  return status2 === 429 || status2 >= 500 && status2 <= 599;
+}
+var VOLATILE_BODY_FIELD_PATTERN = /("(?:ref|requestId|request_id|traceId|trace_id)"\s*:\s*)"[^"]*"/gi;
+function normalizeRedrivePollFailureBody(body) {
+  return body.replace(VOLATILE_BODY_FIELD_PATTERN, '$1"<redacted>"').replace(/\s+/g, " ").trim().slice(0, 200);
 }
 var ChannelDriver = class _ChannelDriver {
   agentId;
@@ -2636,6 +3281,58 @@ var ChannelDriver = class _ChannelDriver {
    * processing list, exactly like `dontRedispatch`/`doneUndeliverable`.
    */
   readoptPollUnresolvedSignalled = /* @__PURE__ */ new Set();
+  /**
+   * "Already emitted `redrive_unresolved` for this row" (#965). Mirrors
+   * `readoptPollUnresolvedSignalled`: `resolveRedrive`'s `unresolved` leaf recurs
+   * every ~2s drain until opencode's status becomes readable, but the
+   * server-visible signal is an OUTCOME, so it fires at most once per row. Cleared
+   * on any non-`unresolved` outcome so the set cannot grow beyond the currently
+   * unresolvable rows.
+   */
+  redriveUnresolvedSignalled = /* @__PURE__ */ new Set();
+  /**
+   * First `now()` a `pending` row's re-drive was observed `unresolved` (#965). A
+   * `pending` row is invisible to every cron arm (all require `status =
+   * 'processing'`), so an indefinitely-`unresolved` row would be stranded with
+   * nothing driving it. Once `now - since >= pausedMaxWaitMs`, `resolveRedrive`
+   * takes `dispatch` instead of `unresolved` (reusing the existing knob — see
+   * ADR-0047's own "unreachable ⇒ bounded" rule). Cleared on any other outcome.
+   */
+  redriveUnresolvedSince = /* @__PURE__ */ new Map();
+  /**
+   * Consecutive-identical-poll-failure streak for the re-drive fence (#1348),
+   * keyed by Evident **message id** (not session) so `clearRedriveUnresolved`
+   * can drop it with the other two trackers and it cannot leak. `sessionId` is
+   * carried inside the entry, not the key: a session change is a different
+   * situation and resets the streak, which gives the `(sessionId, message.id)`
+   * pairing #1348 asks for without a composite map key.
+   */
+  redrivePollFailures = /* @__PURE__ */ new Map();
+  /**
+   * "Already emitted `redrive_outcome_unreported` for THIS (message, outcome)
+   * streak" (Class B, #1340: the runner DECIDED reattach/settle/fail_permanent
+   * but its own PATCH to record it failed — distinct from Class A's
+   * `redrive_poll_failed`, where opencode itself can't be observed). Keyed by
+   * message id, valued by the outcome currently failing to report, so a
+   * change of outcome starts a fresh signal. Cleared by
+   * `clearRedriveUnresolved` the instant either PATCH succeeds.
+   */
+  redriveOutcomeUnreportedSignalled = /* @__PURE__ */ new Map();
+  /**
+   * Consecutive-UNCONFIRMED-dispatch streak for a `pending` row with NO stored
+   * `opencode_message_id` yet — i.e. one that has never even reached the
+   * re-drive fence above. `sendPromptAsync`'s POST may 2xx, but its own
+   * read-back retries can never confirm the assigned id when the session's
+   * message list is PERMANENTLY unreadable (e.g. a corrupted local opencode
+   * SQLite DB, #1345/#1348's exact fault, just hit BEFORE the row is ever
+   * dispatched instead of after). Unlike an already-dispatched row, THIS row has
+   * no other safety net at all: the lifecycle cron only reclaims `status =
+   * 'processing'` rows, and a row stuck here never reaches `processing`. Keyed
+   * by message id, carrying `sessionId` so a session change (a fresh one bound
+   * after abandonment) starts a new streak rather than inheriting the old
+   * session's count — same shape as `redrivePollFailures` above.
+   */
+  unconfirmedDispatchFailures = /* @__PURE__ */ new Map();
   /**
    * "A null-id re-adopt re-dispatch is in flight, awaiting its read-back" (WI-5
    * Task 5.4, High-2). Since we no longer send a caller-supplied id, a re-dispatch
@@ -2724,23 +3421,23 @@ var ChannelDriver = class _ChannelDriver {
    * and stops opencode.
    */
   stopped = false;
-  constructor(config2) {
-    this.agentId = config2.agentId;
-    this.port = config2.port;
-    this.apiUrl = config2.apiUrl.replace(/\/$/, "");
-    this.getAuthHeader = config2.getAuthHeader;
-    this.conversationFilter = config2.conversationFilter ?? null;
-    this.retry = { ...DEFAULT_RETRY_POLICY, ...config2.retry };
-    this.log = config2.log ?? (() => {
+  constructor(config) {
+    this.agentId = config.agentId;
+    this.port = config.port;
+    this.apiUrl = config.apiUrl.replace(/\/$/, "");
+    this.getAuthHeader = config.getAuthHeader;
+    this.conversationFilter = config.conversationFilter ?? null;
+    this.retry = { ...DEFAULT_RETRY_POLICY, ...config.retry };
+    this.log = config.log ?? (() => {
     });
-    this.fetchImpl = config2.fetchImpl ?? fetch;
-    this.sleep = config2.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-    this.pausedPollIntervalMs = config2.pausedPollIntervalMs ?? DEFAULT_PAUSED_POLL_INTERVAL_MS;
-    this.pausedMaxWaitMs = config2.pausedMaxWaitMs ?? DEFAULT_PAUSED_MAX_WAIT_MS;
-    this.stuckQueuedMs = config2.stuckQueuedMs ?? DEFAULT_STUCK_QUEUED_MS;
-    this.now = config2.now ?? (() => Date.now());
-    this.fileSyncDirectories = config2.fileSyncDirectories ?? [];
-    this.homeDir = config2.homeDir ?? homedir();
+    this.fetchImpl = config.fetchImpl ?? fetch;
+    this.sleep = config.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    this.pausedPollIntervalMs = config.pausedPollIntervalMs ?? DEFAULT_PAUSED_POLL_INTERVAL_MS;
+    this.pausedMaxWaitMs = config.pausedMaxWaitMs ?? DEFAULT_PAUSED_MAX_WAIT_MS;
+    this.stuckQueuedMs = config.stuckQueuedMs ?? DEFAULT_STUCK_QUEUED_MS;
+    this.now = config.now ?? (() => Date.now());
+    this.fileSyncDirectories = config.fileSyncDirectories ?? [];
+    this.homeDir = config.homeDir ?? homedir2();
   }
   /** The IPv4-loopback base URL for the local `opencode serve`. */
   get opencodeBase() {
@@ -2975,6 +3672,12 @@ var ChannelDriver = class _ChannelDriver {
         skippedAlreadyDispatched += 1;
         continue;
       }
+      if (message.opencode_message_id) {
+        const outcome = await this.resolveRedrive(conv, sessionId, message, refusedSessionId);
+        if (outcome !== "dispatch") {
+          break;
+        }
+      }
       const options = {
         agent: message.opencode_agent ?? void 0,
         model: message.opencode_model ?? void 0
@@ -3019,50 +3722,422 @@ var ChannelDriver = class _ChannelDriver {
         this.sessions.delete(conv.id);
         this.supersede(conv.id, sessionId);
         this.log({
-          level: "warn",
-          message: `Abandoning OpenCode session ${sessionId.slice(0, 8)} as the binding for conversation ${conv.id.slice(0, 8)} (it exists but failed to run a turn) \u2014 a fresh session is created on the next tick, whatever the persisted binding says by then.`,
+          level: "warn",
+          message: `Abandoning OpenCode session ${sessionId.slice(0, 8)} as the binding for conversation ${conv.id.slice(0, 8)} (it exists but failed to run a turn) \u2014 a fresh session is created on the next tick, whatever the persisted binding says by then.`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+        await this.markFailed(conv.id, message.id, null, errorMessage).catch((markErr) => {
+          this.log({
+            level: "warn",
+            message: `markFailed PATCH for message ${message.id.slice(0, 8)} (conversation ${conv.id.slice(0, 8)}) failed (best-effort, not retried): ${markErr instanceof Error ? markErr.message : String(markErr)}`,
+            conversation_id: conv.id,
+            message_id: message.id
+          });
+        });
+        this.log({
+          level: "error",
+          message: `Message ${message.id.slice(0, 8)} dispatch failed: ${errorMessage}`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+        break;
+      }
+      if (opencodeMessageId === null) {
+        const streak = this.recordUnconfirmedDispatch(message.id, sessionId);
+        if (streak < MAX_IDENTICAL_REDRIVE_POLL_FAILURES) {
+          this.log({
+            level: "warn",
+            message: `Message ${message.id.slice(0, 8)} dispatched but its opencode id could not be read back (${streak}/${MAX_IDENTICAL_REDRIVE_POLL_FAILURES}) \u2014 leaving un-tracked to retry next tick`,
+            conversation_id: conv.id,
+            message_id: message.id
+          });
+          continue;
+        }
+        this.unconfirmedDispatchFailures.delete(message.id);
+        this.sessions.delete(conv.id);
+        this.supersede(conv.id, sessionId);
+        const errorMessage = `OpenCode accepted this message ${streak} times in a row but never confirmed its assigned id (session ${sessionId.slice(0, 8)}'s message list could not be read back) \u2014 the session was abandoned; a fresh one is used for further messages.`;
+        this.log({
+          level: "error",
+          message: errorMessage,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+        await this.markFailed(conv.id, message.id, null, errorMessage).catch((markErr) => {
+          this.log({
+            level: "warn",
+            message: `markFailed PATCH for message ${message.id.slice(0, 8)} (conversation ${conv.id.slice(0, 8)}) failed (best-effort, not retried): ${markErr instanceof Error ? markErr.message : String(markErr)}`,
+            conversation_id: conv.id,
+            message_id: message.id
+          });
+        });
+        break;
+      }
+      this.unconfirmedDispatchFailures.delete(message.id);
+      this.dispatched.add(message.id);
+      this.registerInFlight(conv, sessionId, message, opencodeMessageId);
+      dispatched += 1;
+      void this.postSignal(conv.id, message.id, "dispatched");
+    }
+    if (messages.length > 0 && dispatched === 0 && skippedAlreadyDispatched === messages.length) {
+      this.log({
+        level: "warn",
+        message: `Conversation ${conv.id.slice(0, 8)} has ${messages.length} pending message(s) but ALL are already marked dispatched locally (in-flight set: ${this.dispatched.size}) \u2014 none sent to OpenCode this tick. If this repeats, a message may be stuck acknowledged-but-never-dispatched (its watcher never settled).`,
+        conversation_id: conv.id
+      });
+    }
+    this.ensureWatcherRunning(sessionId);
+    return dispatched;
+  }
+  /**
+   * Poll a session's message list for the re-drive fence (#965), via the
+   * INJECTED `fetchImpl` — NOT the imported `getSessionMessages` helper, which
+   * hits the global `fetch` and would bypass the same override every other
+   * opencode poll in this file respects. Mirrors `readoptProcessing`'s own
+   * snapshot fetch (`:3081-3111`).
+   *
+   * Returns `{ ok: true, messages }` on a readable snapshot, or
+   * `{ ok: false, signature }` on failure — `signature` is a string that
+   * repeats across attempts for the SAME underlying fault (used by the
+   * consecutive-identical-failure bound, #1348), or `null` for a thrown
+   * exception, which is NOT countable toward that bound (a network blip / an
+   * opencode restart also throws identically every tick, and must keep
+   * retrying unbounded rather than ever being treated as permanent).
+   */
+  async pollSessionMessagesForRedrive(conv, message, sessionId) {
+    try {
+      const res = await this.fetchImpl(`${this.opencodeBase}/session/${sessionId}/message`);
+      if (!res.ok) {
+        const rawBody = await res.text();
+        const normalized = normalizeRedrivePollFailureBody(rawBody);
+        this.log({
+          level: "warn",
+          message: `Re-drive: polling session ${sessionId.slice(0, 8)} for message ${message.id.slice(0, 8)} returned HTTP ${res.status}${normalized ? `: ${normalized}` : ""} \u2014 treating as unreadable this tick`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+        return { ok: false, signature: `HTTP ${res.status}${normalized ? `: ${normalized}` : ""}` };
+      }
+      const body = await res.json();
+      if (!Array.isArray(body)) {
+        this.log({
+          level: "warn",
+          message: `Re-drive: polling session ${sessionId.slice(0, 8)} for message ${message.id.slice(0, 8)} returned a non-array message body \u2014 treating as unreadable this tick`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+        return { ok: false, signature: "non-array message body" };
+      }
+      return { ok: true, messages: body };
+    } catch (err) {
+      this.log({
+        level: "warn",
+        message: `Re-drive: failed to poll session ${sessionId.slice(0, 8)} for message ${message.id.slice(0, 8)} (will retry next drain): ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conv.id,
+        message_id: message.id
+      });
+      return { ok: false, signature: null };
+    }
+  }
+  /**
+   * The re-drive fence for a `pending` row that already carries a stored
+   * `opencode_message_id` (#965) — i.e. it has already been handed to opencode at
+   * least once (see the invariant at `QueuedMessage.opencode_message_id`'s doc).
+   * The lifecycle cron can falsely reclaim a `processing` row back to `pending`
+   * mid-turn (a 5-minute liveness-staleness check racing a still-running turn);
+   * without this fence the drain loop would re-`prompt_async` the SAME turn a
+   * second time against live GitHub state. Mirrors `readoptOne`'s job for the
+   * `processing` re-adopt path, but simpler: no b1/b2 preamble cross-check is
+   * needed here because `refusedSessionId` already handles the one case
+   * (#553 abandoned session) that path exists for.
+   *
+   * Only `ChannelAuthError` propagates. A poll that fails identically
+   * `MAX_IDENTICAL_REDRIVE_POLL_FAILURES` times in a row reports the message
+   * failed instead of retrying it (#1348) — SEPARATE from, not a replacement
+   * for, `resolveRedriveUnresolved`'s own `pausedMaxWaitMs` bound below. Every
+   * other failure resolves to `unresolved` and is retried whole on the next
+   * ~2s drain tick.
+   */
+  async resolveRedrive(conv, sessionId, message, refusedSessionId) {
+    const ocId = message.opencode_message_id ?? null;
+    if (refusedSessionId) {
+      this.clearRedriveUnresolved(message.id);
+      void this.postSignal(conv.id, message.id, "redrive_redispatched");
+      return "dispatch";
+    }
+    const polled = await this.pollSessionMessagesForRedrive(conv, message, sessionId);
+    if (!polled.ok) {
+      const streak = this.recordRedrivePollFailure(message.id, sessionId, polled.signature);
+      if (streak >= MAX_IDENTICAL_REDRIVE_POLL_FAILURES && polled.signature !== null) {
+        return this.failRedrivePollPermanent(conv, sessionId, message, polled.signature, streak);
+      }
+      return this.resolveRedriveUnresolved(conv, message);
+    }
+    this.redrivePollFailures.delete(message.id);
+    const messages = polled.messages;
+    if (messages.length === 0) {
+      return this.resolveRedriveUnresolved(conv, message);
+    }
+    const state = messageRunState(messages, ocId ?? "");
+    if (state === "failed" && isAbortedTerminalReply(messages, ocId ?? "")) {
+      const ongoing = await isSessionOngoing(this.port, sessionId);
+      if (ongoing === false) {
+        this.log({
+          level: "info",
+          message: `Re-drive: message ${message.id.slice(0, 8)} carries an abort-shaped terminal error and session ${sessionId.slice(0, 8)} is not-ongoing per GET /session/status \u2014 restart orphan, re-dispatching instead of marking it permanently failed`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+        this.clearRedriveUnresolved(message.id);
+        void this.postSignal(conv.id, message.id, "redrive_redispatched");
+        return "dispatch";
+      }
+    }
+    if (state === "done" || state === "failed") {
+      return this.settleRedrive(conv, sessionId, message, ocId, messages, state);
+    }
+    if (state === "running" || state === "queued") {
+      const ongoing = await isSessionOngoing(this.port, sessionId);
+      if (ongoing === true) {
+        return this.reattachRedrive(conv, sessionId, message, ocId);
+      }
+      if (ongoing === false) {
+        this.clearRedriveUnresolved(message.id);
+        void this.postSignal(conv.id, message.id, "redrive_redispatched");
+        return "dispatch";
+      }
+      return this.resolveRedriveUnresolved(conv, message);
+    }
+    this.clearRedriveUnresolved(message.id);
+    void this.postSignal(conv.id, message.id, "redrive_redispatched");
+    return "dispatch";
+  }
+  /**
+   * The `reattached` outcome (Task 3.3): the prior turn is STILL ONGOING per
+   * opencode's own status map — undo the false reclaim instead of starting a
+   * second turn.
+   */
+  async reattachRedrive(conv, sessionId, message, ocId) {
+    let anchorMs;
+    const parsed = message.processing_started_at ? Date.parse(message.processing_started_at) : NaN;
+    if (!Number.isNaN(parsed)) {
+      anchorMs = parsed;
+    } else {
+      anchorMs = this.now();
+      this.log({
+        level: "error",
+        message: `Re-drive: message ${message.id.slice(0, 8)} has null/unparseable processing_started_at (${String(message.processing_started_at)}) \u2014 anchoring the watcher's absolute-age ceiling to now (defensive)`,
+        conversation_id: conv.id,
+        message_id: message.id
+      });
+    }
+    const title = await this.resolveSessionTitle(sessionId, conv.id);
+    try {
+      await this.markProcessing(conv.id, message.id, sessionId, ocId, title);
+    } catch (err) {
+      if (err instanceof ChannelAuthError) throw err;
+      this.log({
+        level: "warn",
+        message: `Re-drive: failed to restore message ${message.id.slice(0, 8)} to processing (will retry next drain): ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conv.id,
+        message_id: message.id
+      });
+      this.signalRedriveOutcomeUnreported(conv, message, "reattach");
+      return "unresolved";
+    }
+    this.clearRedriveUnresolved(message.id);
+    this.registerReadopted(conv, sessionId, message, ocId ?? "", anchorMs);
+    this.dispatched.add(message.id);
+    this.readopted.add(message.id);
+    this.ensureWatcherRunning(sessionId);
+    const watchedForMs = this.now() - anchorMs;
+    void this.postSignal(conv.id, message.id, "redrive_reattached", {
+      watched_for_ms: watchedForMs
+    });
+    this.log({
+      level: "warn",
+      message: `Re-drive: message ${message.id.slice(0, 8)} (session ${sessionId.slice(0, 8)}) was wrongly reclaimed to pending while its turn was still running (watched ${watchedForMs}ms) \u2014 restored to processing instead of re-dispatching`,
+      conversation_id: conv.id,
+      message_id: message.id
+    });
+    return "reattached";
+  }
+  /**
+   * The `settled` outcome (Task 3.2): the prior turn already finished (or
+   * errored) while nobody was watching — deliver/report it instead of re-running.
+   * Mirrors `readoptOne`'s `done`/`failed` branches' error discipline, simplified
+   * (no `doneUndeliverable` park: a terminal PATCH failure here just retries next
+   * drain, same as any other non-auth failure). The restart-abort carve-out that
+   * keeps the two in step for `failed` lives in the caller (`resolveRedrive`, #1310),
+   * so a row reaching this `failed` branch is a GENUINE failure.
+   */
+  async settleRedrive(conv, sessionId, message, ocId, messages, state) {
+    try {
+      if (state === "done") {
+        const title = await this.resolveSessionTitle(sessionId, conv.id);
+        const usage = messageUsage(messages, ocId ?? "");
+        this.log({
+          level: "info",
+          message: `Re-drive: message ${message.id.slice(0, 8)} completed while its row was wrongly reclaimed to pending \u2014 marking done instead of re-dispatching`,
           conversation_id: conv.id,
           message_id: message.id
         });
-        await this.markFailed(conv.id, message.id, null, errorMessage).catch((markErr) => {
-          this.log({
-            level: "warn",
-            message: `markFailed PATCH for message ${message.id.slice(0, 8)} (conversation ${conv.id.slice(0, 8)}) failed (best-effort, not retried): ${markErr instanceof Error ? markErr.message : String(markErr)}`,
-            conversation_id: conv.id,
-            message_id: message.id
-          });
-        });
+        await this.markDone(conv.id, message.id, sessionId, ocId, title, usage);
+      } else {
+        const error2 = messageError(messages, ocId ?? "") ?? void 0;
+        const usage = messageUsage(messages, ocId ?? "");
+        const failure = await this.classifyModelAuthFailure(messages, ocId ?? "");
         this.log({
           level: "error",
-          message: `Message ${message.id.slice(0, 8)} dispatch failed: ${errorMessage}`,
-          conversation_id: conv.id,
-          message_id: message.id
-        });
-        break;
-      }
-      if (opencodeMessageId === null) {
-        this.log({
-          level: "warn",
-          message: `Message ${message.id.slice(0, 8)} dispatched but its opencode id could not be read back \u2014 leaving un-tracked to retry next tick`,
+          message: `Re-drive: message ${message.id.slice(0, 8)} errored while its row was wrongly reclaimed to pending \u2014 marking failed instead of re-dispatching: ${error2 ?? "(no error text)"}`,
           conversation_id: conv.id,
           message_id: message.id
         });
-        continue;
+        await this.markFailed(conv.id, message.id, sessionId, error2, usage, failure);
       }
-      this.dispatched.add(message.id);
-      this.registerInFlight(conv, sessionId, message, opencodeMessageId);
-      dispatched += 1;
-      void this.postSignal(conv.id, message.id, "dispatched");
+    } catch (err) {
+      if (err instanceof ChannelAuthError) throw err;
+      this.log({
+        level: "warn",
+        message: `Re-drive: failed to report message ${message.id.slice(0, 8)} ${state} (will retry next drain): ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conv.id,
+        message_id: message.id
+      });
+      this.signalRedriveOutcomeUnreported(conv, message, "settle");
+      return "unresolved";
     }
-    if (messages.length > 0 && dispatched === 0 && skippedAlreadyDispatched === messages.length) {
+    this.clearRedriveUnresolved(message.id);
+    void this.postSignal(conv.id, message.id, "redrive_settled");
+    return "settled";
+  }
+  /**
+   * The permanent-failure outcome (#1348): the fence's own poll of this session
+   * failed with the SAME opencode-answered signature
+   * `MAX_IDENTICAL_REDRIVE_POLL_FAILURES` times in a row — a transient blip
+   * would have varied or eventually cleared (see `pollSessionMessagesForRedrive`
+   * and `recordRedrivePollFailure`), so this is a durable fault (e.g. #1345's
+   * corrupted opencode session) rather than something worth retrying forever.
+   * Mirrors `settleRedrive`'s error discipline: no `usage`/`failure` args to
+   * `markFailed` (no opencode snapshot to extract them from — this poll never
+   * got a readable one).
+   */
+  async failRedrivePollPermanent(conv, sessionId, message, signature, streak) {
+    this.log({
+      level: "error",
+      message: `Re-drive: message ${message.id.slice(0, 8)} (session ${sessionId.slice(0, 8)}) failed to poll with the identical signature "${signature}" ${streak} times in a row \u2014 reporting the message failed instead of retrying forever`,
+      conversation_id: conv.id,
+      message_id: message.id
+    });
+    try {
+      await this.markFailed(
+        conv.id,
+        message.id,
+        sessionId,
+        `The runner could not read this conversation's state from OpenCode (${signature}). The same failure repeated ${streak} times in a row, so the message was not retried further.`
+      );
+    } catch (err) {
+      if (err instanceof ChannelAuthError) throw err;
       this.log({
         level: "warn",
-        message: `Conversation ${conv.id.slice(0, 8)} has ${messages.length} pending message(s) but ALL are already marked dispatched locally (in-flight set: ${this.dispatched.size}) \u2014 none sent to OpenCode this tick. If this repeats, a message may be stuck acknowledged-but-never-dispatched (its watcher never settled).`,
-        conversation_id: conv.id
+        message: `Re-drive: failed to report message ${message.id.slice(0, 8)} permanently failed (will retry next drain): ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conv.id,
+        message_id: message.id
       });
+      this.signalRedriveOutcomeUnreported(conv, message, "fail_permanent");
+      return "unresolved";
     }
-    this.ensureWatcherRunning(sessionId);
-    return dispatched;
+    this.clearRedriveUnresolved(message.id);
+    void this.postSignal(conv.id, message.id, "redrive_poll_failed");
+    return "settled";
+  }
+  /**
+   * The bounded `unresolved` outcome (Task 3.4): opencode's state could not be
+   * observed (snapshot unreadable/empty, or `isSessionOngoing` returned `null`).
+   * A `pending` row is invisible to every cron arm (all require `status =
+   * 'processing'`), so an indefinitely-`unresolved` row would be stranded with
+   * nothing driving it — bound it to the existing `pausedMaxWaitMs` window
+   * (reusing the knob, not a new constant) and take `dispatch` once elapsed.
+   */
+  resolveRedriveUnresolved(conv, message) {
+    const now = this.now();
+    const since = this.redriveUnresolvedSince.get(message.id);
+    if (since !== void 0 && now - since >= this.pausedMaxWaitMs) {
+      this.clearRedriveUnresolved(message.id);
+      void this.postSignal(conv.id, message.id, "redrive_redispatched");
+      return "dispatch";
+    }
+    if (since === void 0) {
+      this.redriveUnresolvedSince.set(message.id, now);
+    }
+    if (!this.redriveUnresolvedSignalled.has(message.id)) {
+      this.redriveUnresolvedSignalled.add(message.id);
+      void this.postSignal(conv.id, message.id, "redrive_unresolved");
+    }
+    return "unresolved";
+  }
+  /** Clear all `unresolved`/failure-streak trackers for a row (any non-`unresolved` outcome). */
+  clearRedriveUnresolved(messageId) {
+    this.redriveUnresolvedSince.delete(messageId);
+    this.redriveUnresolvedSignalled.delete(messageId);
+    this.redrivePollFailures.delete(messageId);
+    this.redriveOutcomeUnreportedSignalled.delete(messageId);
+  }
+  /**
+   * Class B (#1340): the runner DECIDED an outcome (reattach/settle/fail_permanent)
+   * but its own PATCH to record it failed. Deliberately NOT bounded like
+   * `resolveRedriveUnresolved`, for two load-bearing reasons: (1) the only
+   * remedy is a PATCH to the server — the very call that is failing, so a bound
+   * would act by retrying it; (2) this class is self-clearing by construction
+   * (the next successful PATCH resolves it via `clearRedriveUnresolved`),
+   * unlike #1340's deterministic, permanent shape. Fires at most once per
+   * (message, outcome) streak.
+   */
+  signalRedriveOutcomeUnreported(conv, message, outcome) {
+    if (this.redriveOutcomeUnreportedSignalled.get(message.id) === outcome) return;
+    this.redriveOutcomeUnreportedSignalled.set(message.id, outcome);
+    void this.postSignal(conv.id, message.id, "redrive_outcome_unreported", {
+      attempted_outcome: outcome
+    });
+  }
+  /**
+   * Record one poll outcome toward the re-drive fence's consecutive-identical-
+   * failure streak (#1348) and return the resulting count. `signature === null`
+   * (a thrown exception, H1) always clears the streak and returns `0` — it is
+   * never countable. Otherwise the streak continues only when BOTH the session
+   * and the signature match the previous failure; anything else (a different
+   * session, or the same session failing a DIFFERENT way) starts a fresh streak
+   * at `1`.
+   */
+  recordRedrivePollFailure(messageId, sessionId, signature) {
+    if (signature === null) {
+      this.redrivePollFailures.delete(messageId);
+      return 0;
+    }
+    const existing = this.redrivePollFailures.get(messageId);
+    if (existing && existing.sessionId === sessionId && existing.signature === signature) {
+      existing.count += 1;
+      return existing.count;
+    }
+    this.redrivePollFailures.set(messageId, { sessionId, signature, count: 1 });
+    return 1;
+  }
+  /**
+   * Record one UNCONFIRMED-dispatch outcome (a `pending` row with no stored
+   * `opencode_message_id` whose `sendPromptAsync` returned `null`) toward the
+   * bound in `processConversation`'s dispatch loop, and return the resulting
+   * count. Mirrors `recordRedrivePollFailure`'s session-scoping: a session
+   * change starts a fresh streak at `1` rather than inheriting the old one's
+   * count, since a new session is a genuinely different attempt.
+   */
+  recordUnconfirmedDispatch(messageId, sessionId) {
+    const existing = this.unconfirmedDispatchFailures.get(messageId);
+    if (existing && existing.sessionId === sessionId) {
+      existing.count += 1;
+      return existing.count;
+    }
+    this.unconfirmedDispatchFailures.set(messageId, { sessionId, count: 1 });
+    return 1;
   }
   /**
    * Record that `sessionId` is no longer a valid binding for `conversationId`
@@ -3125,7 +4200,12 @@ var ChannelDriver = class _ChannelDriver {
     const directory = await this.resolveOpenCodeDirectory();
     const sessionId = await createOpenCodeSession(this.port, directory);
     this.sessions.set(conversationId, sessionId);
-    await this.persistSession(conversationId, sessionId).catch(() => {
+    await this.persistSession(conversationId, sessionId).catch((err) => {
+      this.log({
+        level: "warn",
+        message: `Persisting the OpenCode session binding ${sessionId.slice(0, 8)} for conversation ${conversationId.slice(0, 8)} failed (best-effort, not retried) \u2014 the completion PATCH also carries opencode_session_id, so the binding is repaired when the turn finishes: ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conversationId
+      });
     });
     return sessionId;
   }
@@ -3317,12 +4397,17 @@ var ChannelDriver = class _ChannelDriver {
       stuckReported: false,
       lastAliveAt: 0,
       aliveInFlight: false,
+      titleSynced: false,
+      titleSyncInFlight: false,
       awaitingHumanLatched: false,
       pausedOnQuestion: false,
       pausedOnPermission: false,
       pausedClearConfirmed: false,
       pausedInFlight: false,
-      deliveryDeadlineAnchored: false
+      deliveryDeadlineAnchored: false,
+      b2PinnedSinceMs: 0,
+      b2LastDescendantCheckMs: 0,
+      b2AbandonedSignalled: false
     });
   }
   /**
@@ -3337,9 +4422,10 @@ var ChannelDriver = class _ChannelDriver {
    * opencode reports ACTIVELY `running` is watched to completion (its liveness
    * heartbeat keeps the cron off its row), while a re-adopted turn that is paused
    * awaiting a human — or queued/unreachable — is still bounded by `deadline` and
-   * handed to the cron. The old "the `deadline` must settle before the ~15-min
-   * cron or they double-drive" reasoning is superseded: liveness now settles the
-   * actively-running case; `deadline` settles the rest. `dispatchedAt` stays `now`
+   * handed to the cron. Real invariant (#965): the cron MAY reclaim a row this
+   * runner still holds; a reclaimed row that already ran is never re-dispatched
+   * while opencode reports its turn ongoing (readopt's own gate here, and the
+   * `pending`-row re-drive fence, `resolveRedrive`). `dispatchedAt` stays `now`
    * (only the appear-guard uses it).
    *
    * `evidentMessageId` addresses the SERVER row (for markProcessing/markDone);
@@ -3390,12 +4476,17 @@ var ChannelDriver = class _ChannelDriver {
       // with no extra `re_adopted` signal needed (folds old WI-6).
       lastAliveAt: 0,
       aliveInFlight: false,
+      titleSynced: false,
+      titleSyncInFlight: false,
       awaitingHumanLatched: false,
       pausedOnQuestion: false,
       pausedOnPermission: false,
       pausedClearConfirmed: false,
       pausedInFlight: false,
-      deliveryDeadlineAnchored: false
+      deliveryDeadlineAnchored: false,
+      b2PinnedSinceMs: 0,
+      b2LastDescendantCheckMs: 0,
+      b2AbandonedSignalled: false
     });
   }
   /**
@@ -3557,58 +4648,7 @@ var ChannelDriver = class _ChannelDriver {
       }
     }
     if (state === "done") {
-      this.anchorDeliveryDeadline(inFlight);
-      if (!inFlight.done) {
-        this.log({
-          level: "info",
-          message: `Message ${inFlight.evidentMessageId.slice(0, 8)} completed \u2014 marking done`,
-          conversation_id: conv.id,
-          message_id: inFlight.evidentMessageId
-        });
-        const title = await this.resolveSessionTitle(sessionId, watcher.conv.id);
-        const usage = messageUsage(messages, inFlight.opencodeMessageId);
-        try {
-          await this.markDone(
-            conv.id,
-            inFlight.evidentMessageId,
-            sessionId,
-            inFlight.opencodeMessageId,
-            title,
-            usage
-          );
-        } catch (err) {
-          if (err instanceof ChannelAuthError) throw err;
-          if (err instanceof ChannelTerminalError) {
-            this.log({
-              level: "warn",
-              message: `Failed to mark message ${inFlight.evidentMessageId.slice(0, 8)} done (terminal HTTP ${err.status}) \u2014 leaving for the cron safety net: ${err.message}`,
-              conversation_id: conv.id,
-              message_id: inFlight.evidentMessageId
-            });
-            this.removeInFlight(watcher, inFlight.evidentMessageId);
-            return;
-          }
-          if (this.now() >= inFlight.deadline) {
-            this.log({
-              level: "warn",
-              message: `Failed to mark message ${inFlight.evidentMessageId.slice(0, 8)} done within the watch window \u2014 leaving for the cron safety net: ${err instanceof Error ? err.message : String(err)}`,
-              conversation_id: conv.id,
-              message_id: inFlight.evidentMessageId
-            });
-            this.removeInFlight(watcher, inFlight.evidentMessageId);
-            return;
-          }
-          this.log({
-            level: "warn",
-            message: `Failed to mark message ${inFlight.evidentMessageId.slice(0, 8)} done (will retry next tick): ${err instanceof Error ? err.message : String(err)}`,
-            conversation_id: conv.id,
-            message_id: inFlight.evidentMessageId
-          });
-          return;
-        }
-        inFlight.done = true;
-      }
-      this.removeInFlight(watcher, inFlight.evidentMessageId);
+      await this.settleMessageDone(sessionId, watcher, inFlight, messages);
       return;
     }
     if (state === "failed") {
@@ -3622,8 +4662,16 @@ var ChannelDriver = class _ChannelDriver {
           message_id: inFlight.evidentMessageId
         });
         const usage = messageUsage(messages, inFlight.opencodeMessageId);
+        const failure = await this.classifyModelAuthFailure(messages, inFlight.opencodeMessageId);
         try {
-          await this.markFailed(conv.id, inFlight.evidentMessageId, sessionId, error2, usage);
+          await this.markFailed(
+            conv.id,
+            inFlight.evidentMessageId,
+            sessionId,
+            error2,
+            usage,
+            failure
+          );
         } catch (err) {
           if (err instanceof ChannelAuthError) throw err;
           if (err instanceof ChannelTerminalError) {
@@ -3668,6 +4716,44 @@ var ChannelDriver = class _ChannelDriver {
       });
     }
     const activelyRunning = state === "running" && !awaitingHuman;
+    const pinnedNow = activelyRunning && isPreamblePinnedRunning(messages, inFlight.opencodeMessageId);
+    const snapshotReadable = messages != null && messages.length > 0;
+    if (!pinnedNow) {
+      if (snapshotReadable) {
+        inFlight.b2PinnedSinceMs = 0;
+        inFlight.b2LastDescendantCheckMs = 0;
+        inFlight.b2AbandonedSignalled = false;
+      }
+    } else {
+      if (inFlight.b2AbandonedSignalled) {
+        await this.settleMessageDone(sessionId, watcher, inFlight, messages);
+        return;
+      }
+      if (inFlight.b2PinnedSinceMs === 0) inFlight.b2PinnedSinceMs = this.now();
+      const pinnedForMs = this.now() - inFlight.b2PinnedSinceMs;
+      if (pinnedForMs >= B2_ABANDONMENT_MIN_PINNED_MS && this.now() - inFlight.b2LastDescendantCheckMs >= B2_ABANDONMENT_RECHECK_MS) {
+        inFlight.b2LastDescendantCheckMs = this.now();
+        const descendantOngoing = await this.isAnyDescendantSessionOngoing(sessionId);
+        if (isB2AbandonmentConfirmed({
+          pinnedForMs,
+          minPinnedMs: B2_ABANDONMENT_MIN_PINNED_MS,
+          descendantOngoing
+        })) {
+          inFlight.b2AbandonedSignalled = true;
+          this.log({
+            level: "warn",
+            message: `Message ${id.slice(0, 8)} b2-pinned for ${Math.round(pinnedForMs / 1e3)}s with no ongoing descendant sub-agent session (status-map confirmed) \u2014 treating the delegated/tool turn as abandoned, resolving done`,
+            conversation_id: conv.id,
+            message_id: id
+          });
+          void this.postSignal(conv.id, id, "b2_abandoned_resolved", {
+            watched_for_ms: pinnedForMs
+          });
+          await this.settleMessageDone(sessionId, watcher, inFlight, messages);
+          return;
+        }
+      }
+    }
     if (activelyRunning && this.now() - inFlight.processingAnchorMs >= ABSOLUTE_MAX_PROCESSING_MS) {
       this.log({
         level: "warn",
@@ -3687,6 +4773,18 @@ var ChannelDriver = class _ChannelDriver {
         inFlight.aliveInFlight = false;
         if (ok) inFlight.lastAliveAt = this.now();
       });
+      if (!inFlight.titleSynced && !inFlight.titleSyncInFlight) {
+        inFlight.titleSyncInFlight = true;
+        void this.resolveSessionTitle(sessionId, conv.id).then(async (title) => {
+          if (!title) {
+            inFlight.titleSyncInFlight = false;
+            return;
+          }
+          const ok = await this.patchConversationTitle(conv.id, title);
+          inFlight.titleSyncInFlight = false;
+          if (ok) inFlight.titleSynced = true;
+        });
+      }
     }
     if (awaitingHuman) {
       if (!inFlight.awaitingHumanLatched) {
@@ -3724,6 +4822,70 @@ var ChannelDriver = class _ChannelDriver {
       this.removeInFlight(watcher, inFlight.evidentMessageId);
     }
   }
+  /**
+   * Settle a message whose run-state has resolved `'done'` — extracted verbatim
+   * (pure refactor, no behavior change) from `serviceInFlightMessage`'s former
+   * inline `state === 'done'` branch body, so a SECOND caller (the #721
+   * b2-abandonment resolution) can reach the exact same completion behavior
+   * (delivery-deadline anchoring, title resolution, usage extraction, and
+   * `markDone`'s auth/terminal/transient-retry discipline) without duplicating it
+   * and risking the two copies silently drifting apart.
+   */
+  async settleMessageDone(sessionId, watcher, inFlight, messages) {
+    const conv = watcher.conv;
+    this.anchorDeliveryDeadline(inFlight);
+    if (!inFlight.done) {
+      this.log({
+        level: "info",
+        message: `Message ${inFlight.evidentMessageId.slice(0, 8)} completed \u2014 marking done`,
+        conversation_id: conv.id,
+        message_id: inFlight.evidentMessageId
+      });
+      const title = await this.resolveSessionTitle(sessionId, watcher.conv.id);
+      const usage = messageUsage(messages, inFlight.opencodeMessageId);
+      try {
+        await this.markDone(
+          conv.id,
+          inFlight.evidentMessageId,
+          sessionId,
+          inFlight.opencodeMessageId,
+          title,
+          usage
+        );
+      } catch (err) {
+        if (err instanceof ChannelAuthError) throw err;
+        if (err instanceof ChannelTerminalError) {
+          this.log({
+            level: "warn",
+            message: `Failed to mark message ${inFlight.evidentMessageId.slice(0, 8)} done (terminal HTTP ${err.status}) \u2014 leaving for the cron safety net: ${err.message}`,
+            conversation_id: conv.id,
+            message_id: inFlight.evidentMessageId
+          });
+          this.removeInFlight(watcher, inFlight.evidentMessageId);
+          return;
+        }
+        if (this.now() >= inFlight.deadline) {
+          this.log({
+            level: "warn",
+            message: `Failed to mark message ${inFlight.evidentMessageId.slice(0, 8)} done within the watch window \u2014 leaving for the cron safety net: ${err instanceof Error ? err.message : String(err)}`,
+            conversation_id: conv.id,
+            message_id: inFlight.evidentMessageId
+          });
+          this.removeInFlight(watcher, inFlight.evidentMessageId);
+          return;
+        }
+        this.log({
+          level: "warn",
+          message: `Failed to mark message ${inFlight.evidentMessageId.slice(0, 8)} done (will retry next tick): ${err instanceof Error ? err.message : String(err)}`,
+          conversation_id: conv.id,
+          message_id: inFlight.evidentMessageId
+        });
+        return;
+      }
+      inFlight.done = true;
+    }
+    this.removeInFlight(watcher, inFlight.evidentMessageId);
+  }
   // Restart recovery: re-adopt `processing` messages (ADR-0046, WI-3/4/5)
   /**
    * Re-adopt this agent's `processing` messages on drain (ADR-0046 Decision §1).
@@ -3823,7 +4985,10 @@ var ChannelDriver = class _ChannelDriver {
    * re-dispatched (at most once, see `forceReadoptRun`):
    *   - `done`             → `markDone` now (guarded like the watcher's done branch);
    *   - `failed`           → `markFailed` with the surfaced error (issue #182), so an
-   *                          errored turn is reported failed on restart, NOT re-dispatched;
+   *                          errored turn is reported failed on restart, NOT re-dispatched —
+   *                          EXCEPT a restart-ABORTED turn under a not-ongoing session,
+   *                          which is a restart orphan wearing a terminal error and is
+   *                          re-dispatched instead (issue #1310, see the branch below);
    *   - `running`/`queued` → re-attach a watcher via `registerReadopted` (no re-dispatch),
    *                          tracking the stored id so the reply correlates by it;
    *   - `unknown`/null id  → re-dispatch (opencode assigns a fresh id) + attach a watcher.
@@ -3887,9 +5052,19 @@ var ChannelDriver = class _ChannelDriver {
       void this.postSignal(row.conversation_id, row.id, "readopt_done");
       return;
     }
-    if (state === "failed") {
+    const restartAborted = state === "failed" && sessionOngoing === false && isAbortedTerminalReply(messages, ocId ?? "");
+    if (restartAborted) {
+      this.log({
+        level: "info",
+        message: `Re-adopt: message ${row.id.slice(0, 8)} carries an abort-shaped terminal error and session ${sessionId.slice(0, 8)} is not-ongoing per GET /session/status \u2014 restart orphan, re-dispatching instead of marking it permanently failed`,
+        conversation_id: row.conversation_id,
+        message_id: row.id
+      });
+    }
+    if (state === "failed" && !restartAborted) {
       const error2 = messageError(messages, ocId ?? "") ?? void 0;
       const usage = messageUsage(messages, ocId ?? "");
+      const failure = await this.classifyModelAuthFailure(messages, ocId ?? "");
       this.log({
         level: "error",
         message: `Re-adopt: message ${row.id.slice(0, 8)} errored while unwatched \u2014 marking failed: ${error2 ?? "(no error text)"}`,
@@ -3897,7 +5072,7 @@ var ChannelDriver = class _ChannelDriver {
         message_id: row.id
       });
       try {
-        await this.markFailed(row.conversation_id, row.id, sessionId, error2, usage);
+        await this.markFailed(row.conversation_id, row.id, sessionId, error2, usage, failure);
       } catch (err) {
         if (err instanceof ChannelAuthError) throw err;
         if (err instanceof ChannelTerminalError) {
@@ -4100,15 +5275,39 @@ var ChannelDriver = class _ChannelDriver {
     }
     if (ocId === null) {
       this.awaitingReadopt.delete(row.id);
+      const streak = this.recordUnconfirmedDispatch(row.id, sessionId);
+      if (streak >= MAX_IDENTICAL_REDRIVE_POLL_FAILURES) {
+        this.unconfirmedDispatchFailures.delete(row.id);
+        this.sessions.delete(readoptConv.id);
+        this.supersede(readoptConv.id, sessionId);
+        const errorMessage = `OpenCode accepted this re-dispatched message ${streak} times in a row but never confirmed its assigned id (session ${sessionId.slice(0, 8)}'s message list could not be read back) \u2014 the session was abandoned; a fresh one is used for further messages.`;
+        this.log({
+          level: "error",
+          message: errorMessage,
+          conversation_id: row.conversation_id,
+          message_id: row.id
+        });
+        await this.markFailed(row.conversation_id, row.id, null, errorMessage).catch((markErr) => {
+          this.log({
+            level: "warn",
+            message: `markFailed PATCH for message ${row.id.slice(0, 8)} (conversation ${row.conversation_id.slice(0, 8)}) failed (best-effort, not retried): ${markErr instanceof Error ? markErr.message : String(markErr)}`,
+            conversation_id: row.conversation_id,
+            message_id: row.id
+          });
+        });
+        void this.postSignal(row.conversation_id, row.id, "readopt_orphan_unsent");
+        return;
+      }
       this.log({
         level: "warn",
-        message: `Re-adopt: message ${row.id.slice(0, 8)} re-dispatched but its opencode id could not be read back \u2014 leaving un-tracked to retry next drain`,
+        message: `Re-adopt: message ${row.id.slice(0, 8)} re-dispatched but its opencode id could not be read back (${streak}/${MAX_IDENTICAL_REDRIVE_POLL_FAILURES}) \u2014 leaving un-tracked to retry next drain`,
         conversation_id: row.conversation_id,
         message_id: row.id
       });
       void this.postSignal(row.conversation_id, row.id, "readopt_orphan_unsent");
       return;
     }
+    this.unconfirmedDispatchFailures.delete(row.id);
     this.registerReadopted(readoptConv, sessionId, readoptMessage, ocId, this.processedAtMs(row));
     this.dispatched.add(row.id);
     this.readopted.add(row.id);
@@ -4164,7 +5363,8 @@ var ChannelDriver = class _ChannelDriver {
       opencode_model: row.opencode_model,
       source_message_id: row.source_message_id,
       slack_user_id: row.slack_user_id,
-      attachments: row.attachments ?? null
+      attachments: row.attachments ?? null,
+      opencode_message_id: row.opencode_message_id
     };
   }
   /**
@@ -4303,6 +5503,47 @@ var ChannelDriver = class _ChannelDriver {
     }
     return false;
   }
+  /**
+   * Tri-state variant of the upward parentID membership walk (#721), used ONLY
+   * by `isAnyDescendantSessionOngoing`. Walks the SAME cached
+   * `resolveSessionParent` chain `sessionBelongsTo` uses above, but — unlike
+   * `sessionBelongsTo`, which deliberately collapses "confirmed not a
+   * descendant" and "the walk's fetch failed" into the same `false` (safe for
+   * its OTHER callers: interaction attribution and the recovery-path
+   * `isAnyDescendantSessionAlive`, both of which just retry next tick with no
+   * safety consequence either way) — this variant keeps those two outcomes
+   * SEPARATE, because `isAnyDescendantSessionOngoing`'s caller
+   * (`isB2AbandonmentConfirmed`) must never treat "couldn't tell" as "confirmed
+   * not ongoing".
+   *
+   * Return contract:
+   *  - `true`  → the walk reached `rootSessionId` — `sessionId` IS a descendant.
+   *  - `false` → the walk reached a definitive, parent-less root session
+   *              WITHOUT ever matching `rootSessionId` — `sessionId` is
+   *              CONFIRMED NOT a descendant of it.
+   *  - `null`  → INDETERMINATE: a `GET /session/:id` fetch failed partway
+   *              through the walk (`resolveSessionParent` returned `undefined`),
+   *              or the depth cap (32) was hit without a definitive answer (a
+   *              pathological/cyclic chain proves nothing either way). NEVER
+   *              treat this the same as `false` — see `sessionBelongsTo`'s own
+   *              doc comment above for why that collapse is safe THERE but not
+   *              here.
+   *
+   * `sessionBelongsTo` itself is UNCHANGED — this is an additive helper scoped
+   * to the live-path descendant check, not a modification of shared code used
+   * by interaction attribution or the recovery path.
+   */
+  async resolveSessionMembership(sessionId, rootSessionId) {
+    let current = sessionId;
+    for (let depth = 0; current && depth < 32; depth++) {
+      if (current === rootSessionId) return true;
+      const parent = await this.resolveSessionParent(current);
+      if (parent === void 0) return null;
+      if (parent === null) return false;
+      current = parent;
+    }
+    return null;
+  }
   /**
    * Resolve (and cache) a session's `parentID` via `GET /session/:id`. Returns
    * `null` for a root session (no parent) and `undefined` when opencode is
@@ -4381,11 +5622,59 @@ var ChannelDriver = class _ChannelDriver {
     } catch (err) {
       this.log({
         level: "debug",
-        message: `Best-effort session title fetch failed for session ${sessionId.slice(0, 8)} (agent ${this.agentId.slice(0, 8)}) \u2014 omitting title: ${err instanceof Error ? err.message : String(err)}`,
+        message: `Best-effort session title fetch failed for session ${sessionId.slice(0, 8)} (agent ${this.agentId.slice(0, 8)}) \u2014 omitting title: ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conversationId
+      });
+    }
+    return null;
+  }
+  /**
+   * Best-effort mid-turn title sync (#711 follow-up): PATCH a resolved OpenCode
+   * session title onto the conversation via the PLAIN conversation-update
+   * endpoint (`PATCH /runners/:agentId/conversations/:conversationId`) — NOT the
+   * message-status endpoint `markProcessing`/`markDone` use. Deliberately a
+   * separate, lighter call: it carries no `status`, so it cannot re-trigger the
+   * `processing`/`done` transition side effects (Slack notices, activity-log
+   * rows, delivery jobs) those PATCHes gate on `transitioned` — this call only
+   * ever touches `conversations.title`. That route (`routes/conversations.ts`)
+   * skips a title write matching the stored value, so a redundant call with the
+   * same title is a real no-op — it does not bump `updated_at`, which the
+   * conversation list sorts and paginates on. (Note this is a DIFFERENT guard
+   * from `threads.ts`'s "non-empty AND changed" one, which only covers the
+   * message-status PATCH; the non-empty half is enforced here instead, by
+   * `resolveSessionTitle` never returning an empty/placeholder title.)
+   *
+   * Telemetry-only / never blocks the caller, mirroring `postSignal`: a failure
+   * is logged and the title is simply retried on the next heartbeat tick (the
+   * caller only latches `titleSynced` on `true`).
+   */
+  async patchConversationTitle(conversationId, title) {
+    try {
+      const res = await this.fetchImpl(
+        `${this.apiUrl}/runners/${this.agentId}/conversations/${conversationId}`,
+        {
+          method: "PATCH",
+          headers: { Authorization: this.getAuthHeader(), "Content-Type": "application/json" },
+          body: JSON.stringify({ title })
+        }
+      );
+      if (!res.ok) {
+        this.log({
+          level: "debug",
+          message: `Mid-turn title sync PATCH for conversation ${conversationId.slice(0, 8)} returned HTTP ${res.status} (best-effort, will retry next heartbeat)`,
+          conversation_id: conversationId
+        });
+        return false;
+      }
+      return true;
+    } catch (err) {
+      this.log({
+        level: "debug",
+        message: `Best-effort mid-turn title sync PATCH failed for conversation ${conversationId.slice(0, 8)} (will retry next heartbeat): ${err instanceof Error ? err.message : String(err)}`,
         conversation_id: conversationId
       });
+      return false;
     }
-    return null;
   }
   /**
    * DEFENSIVE cross-check for the restart-recovery path (WI-2): is any descendant
@@ -4445,6 +5734,84 @@ var ChannelDriver = class _ChannelDriver {
     }
     return false;
   }
+  /**
+   * LIVE-PATH descendant-liveness check (#721): is any descendant (`task`
+   * sub-agent) session under `rootSessionId` currently ONGOING per OpenCode's own
+   * in-memory status map (`isSessionOngoing` — `busy`/`retry`)?
+   *
+   * Deliberately NOT `isAnyDescendantSessionAlive` (the RECOVERY-path
+   * cross-check above): that method judges liveness from the child's OWN
+   * TRANSCRIPT (`isSessionActivelyGenerating`), which is the right (only) option
+   * on the recovery path because a restart WIPES `SessionStatus`. On the LIVE
+   * path the local opencode server IS running, so its in-memory status map is
+   * live and authoritative — and per ADR-0047 §4a ("the child has its own entry
+   * [in the map]"), a `task` descendant's OWN busy/retry entry reflects its
+   * ENTIRE turn (including any tool call it is itself executing), not a
+   * per-message transcript snapshot. This sidesteps the "child's own tool is
+   * executing, between its step's completion and the next generation step"
+   * transcript gap that a transcript-based check would need a second,
+   * sustained-window bound to guard against — it is simply not derived from
+   * message timestamps at all.
+   *
+   * Why not just check `isSessionOngoing(port, rootSessionId)` (the ROOT's own
+   * status, as the recovery path does per §4a)? Because on the LIVE path the
+   * root session can be shared: a SECOND, unrelated user message can land on the
+   * SAME session (issue #721's own root cause) and keep the root `busy` for a
+   * reason that has nothing to do with THIS message's delegation. A `task`
+   * descendant session is spawned for exactly one delegated turn and never
+   * reused, so its OWN status-map entry is unambiguous evidence about that one
+   * delegation — which the root's status is not.
+   *
+   * Why membership is checked via `resolveSessionMembership`, NOT
+   * `sessionBelongsTo`: `sessionBelongsTo` collapses a transient
+   * `GET /session/:id` fetch failure into "not a descendant", which would
+   * silently drop a genuinely-live candidate from consideration on the one
+   * unlucky tick its membership-walk fetch hiccups (#721).
+   * `resolveSessionMembership` keeps that failure mode as a distinct `null`
+   * (indeterminate) so it is folded into THIS method's own `indeterminate` flag
+   * instead.
+   *
+   * Return contract (note the DIFFERENT judge vs. `isAnyDescendantSessionAlive`):
+   *  - `true`  → some descendant session is `busy`/`retry` (genuinely ongoing).
+   *  - `false` → enumeration succeeded, EVERY candidate's MEMBERSHIP was
+   *              confirmed either way (`resolveSessionMembership` never
+   *              returned `null`), and every CONFIRMED descendant's status read
+   *              succeeded and is not ongoing (includes "no descendant session
+   *              exists at all" — e.g. a plain, non-`task` tool call).
+   *  - `null`  → INDETERMINATE: `listSessions` failed, OR at least one
+   *              candidate's MEMBERSHIP could not be confirmed
+   *              (`resolveSessionMembership` returned `null` — a fetch failure
+   *              or pathological chain partway through the parent walk), OR at
+   *              least one CONFIRMED descendant's `isSessionOngoing` read
+   *              failed — and no OTHER candidate was already confirmed `true`.
+   *              The caller MUST NOT treat `null` the same as `false` here
+   *              (unlike the recovery cross-check's contract) — see
+   *              `isB2AbandonmentConfirmed`.
+   */
+  async isAnyDescendantSessionOngoing(rootSessionId) {
+    const sessions = await listSessions(this.port);
+    if (!sessions) {
+      this.log({
+        level: "warn",
+        message: `Could not enumerate sessions to check descendant liveness for root ${rootSessionId} (listSessions failed) \u2014 treating descendant liveness as indeterminate`
+      });
+      return null;
+    }
+    let indeterminate = false;
+    for (const candidate of sessions) {
+      if (!candidate?.id || candidate.id === rootSessionId) continue;
+      const membership = await this.resolveSessionMembership(candidate.id, rootSessionId);
+      if (membership === null) {
+        indeterminate = true;
+        continue;
+      }
+      if (membership === false) continue;
+      const ongoing = await isSessionOngoing(this.port, candidate.id);
+      if (ongoing === true) return true;
+      if (ongoing === null) indeterminate = true;
+    }
+    return indeterminate ? null : false;
+  }
   /**
    * Cheap decision-telemetry label for a running row's LAST correlated reply
    * (WI-2 Task 2.2): which running SHAPE it is, for the status-gated recovery log.
@@ -4589,11 +5956,11 @@ var ChannelDriver = class _ChannelDriver {
    * `ensureSession` guard, not this suppression, is what makes the self-heal
    * stick.
    */
-  sessionIdBody(sessionId, conversationId, messageId, status) {
+  sessionIdBody(sessionId, conversationId, messageId, status2) {
     if (!this.isSuperseded(conversationId, sessionId)) return { opencode_session_id: sessionId };
     this.log({
       level: "debug",
-      message: `Omitting the abandoned OpenCode session ${sessionId.slice(0, 8)} from the '${status}' update for message ${messageId.slice(0, 8)} so it is not re-bound to conversation ${conversationId.slice(0, 8)}`,
+      message: `Omitting the abandoned OpenCode session ${sessionId.slice(0, 8)} from the '${status2}' update for message ${messageId.slice(0, 8)} so it is not re-bound to conversation ${conversationId.slice(0, 8)}`,
       conversation_id: conversationId,
       message_id: messageId
     });
@@ -4708,7 +6075,7 @@ var ChannelDriver = class _ChannelDriver {
    *     exists but is wedged, so the next attempt must get a fresh one
    *     instead of reusing it — see WI-1's server-side null-clearing PATCH).
    */
-  async markFailed(conversationId, messageId, sessionId, error2, usage) {
+  async markFailed(conversationId, messageId, sessionId, error2, usage, failure) {
     const body = { status: "failed" };
     if (sessionId === null) {
       body.opencode_session_id = null;
@@ -4717,6 +6084,12 @@ var ChannelDriver = class _ChannelDriver {
     }
     if (error2 !== void 0) body.error = error2;
     if (usage) Object.assign(body, usage);
+    if (failure) {
+      body.failure_kind = failure.kind;
+      body.failure_provider_id = failure.providerId;
+      body.failure_model_id = failure.modelId;
+      body.failure_reason = failure.reason;
+    }
     await this.callWithRetry(
       "marking message as failed",
       () => this.fetchImpl(
@@ -4729,6 +6102,29 @@ var ChannelDriver = class _ChannelDriver {
       )
     );
   }
+  /**
+   * Classify an errored turn as a model-auth failure (#736 P1-4), for `markFailed`.
+   *
+   * `messageFailure` alone (structured OpenCode error → `model_auth`) covers
+   * most cases; when it returns `null` on this ALREADY-FAILED turn, fall back
+   * to the P1-2b zero-provider check — one extra loopback call to
+   * `hasAnyConfiguredProvider`, only reached when the structured classifier
+   * couldn't place it. Fails open (never throws): a fallback probe failure
+   * (`null`/indeterminate) leaves the classification `null`, which produces
+   * today's byte-identical PATCH body via `markFailed`'s `if (failure)` guard.
+   */
+  async classifyModelAuthFailure(messages, userMessageId) {
+    const classified = messageFailure(messages, userMessageId);
+    if (classified != null) return classified;
+    const reply = findLastAssistantReplyFor(messages, userMessageId);
+    const hasProvider = await hasAnyConfiguredProvider(this.port);
+    return applyZeroProviderFallback(
+      classified,
+      hasProvider,
+      reply?.info?.providerID ?? null,
+      reply?.info?.modelID ?? null
+    );
+  }
   /**
    * Best-effort, SINGLE-ATTEMPT runner→server telemetry ping
    * (queued-followup-redrive). `POST .../messages/:id/signal {signal, ...extra}`
@@ -4881,10 +6277,16 @@ var ChannelDriver = class _ChannelDriver {
 import chalk5 from "chalk";
 import ora2 from "ora";
 import { select as select2 } from "@inquirer/prompts";
+var INTERACTIVE_START_TIMEOUT_MS = 3e4;
 async function ensureOpenCodeRunning(ctx) {
   const healthCheck = await checkOpenCodeHealth(ctx.port);
   if (healthCheck.healthy) {
-    return { port: ctx.port, process: null, version: healthCheck.version ?? null };
+    return {
+      port: ctx.port,
+      process: null,
+      version: healthCheck.version ?? null,
+      notReadyReason: null
+    };
   }
   const runningInstances = await findHealthyOpenCodeInstances();
   if (runningInstances.length > 0) {
@@ -4905,7 +6307,7 @@ async function ensureOpenCodeRunning(ctx) {
       console.log(chalk5.yellow("Tip: Run with the correct port:"));
       console.log(
         chalk5.dim(
-          `  ${getCliName()} run --agent ${ctx.agentId} --port ${runningInstances[0].port}`
+          `  ${getCliName()} run --runner ${ctx.agentId} --port ${runningInstances[0].port}`
         )
       );
     }
@@ -4925,14 +6327,22 @@ async function ensureOpenCodeRunning(ctx) {
   if (!ctx.interactive) {
     ctx.log(`OpenCode is not running on port ${ctx.port}. Starting it automatically...`);
     const proc = await startOpenCode(ctx.port);
-    const health = await waitForOpenCodeHealth(ctx.port, 3e4);
+    const health = await waitForOpenCodeHealth(ctx.port, ctx.startTimeoutMs);
     if (!health.healthy) {
-      throw new Error(
-        `OpenCode failed to start on port ${ctx.port}. Install with: npm install -g opencode-ai`
-      );
+      return {
+        port: ctx.port,
+        process: proc,
+        version: null,
+        notReadyReason: `it did not become healthy within ${Math.round(ctx.startTimeoutMs / 1e3)}s`
+      };
     }
     ctx.log(`OpenCode started on port ${ctx.port}${health.version ? ` (v${health.version})` : ""}`);
-    return { port: ctx.port, process: proc, version: health.version ?? null };
+    return {
+      port: ctx.port,
+      process: proc,
+      version: health.version ?? null,
+      notReadyReason: null
+    };
   }
   let port = ctx.port;
   if (isPortInUse(port)) {
@@ -4985,128 +6395,15 @@ Port ${port} is already in use.`));
   if (action === "start") {
     const spinner = ora2("Starting OpenCode...").start();
     const proc = await startOpenCode(port);
-    const health = await waitForOpenCodeHealth(port, 3e4);
+    const health = await waitForOpenCodeHealth(port, INTERACTIVE_START_TIMEOUT_MS);
     if (!health.healthy) {
       spinner.fail("Failed to start OpenCode");
       throw new Error("OpenCode failed to start");
     }
     spinner.stop();
-    return { port, process: proc, version: health.version ?? null };
-  }
-  return { port, process: null, version: null };
-}
-
-// src/commands/agent-lookup.ts
-async function readErrorMessage(response) {
-  const text = await response.text().catch(() => "");
-  if (!text) return response.statusText || void 0;
-  try {
-    const data = JSON.parse(text);
-    const message = data.message ?? data.error;
-    if (typeof message === "string" && message.trim()) {
-      return message;
-    }
-  } catch {
-  }
-  return text.trim() || response.statusText || void 0;
-}
-function authFailureHint(apiUrl, serverMessage) {
-  const reason = serverMessage ? `: ${serverMessage}` : "";
-  return `Authentication failed${reason}. Your credentials were rejected by ${apiUrl}. This usually means you logged in against a different environment, or your session expired \u2014 log in again pointing at this endpoint and retry.`;
-}
-async function resolveAgentIdFromKey(authHeader) {
-  const apiUrl = getApiUrlConfig();
-  try {
-    const response = await fetch(`${apiUrl}/me`, {
-      headers: { Authorization: authHeader }
-    });
-    if (response.status === 401) {
-      const serverMessage = await readErrorMessage(response);
-      return { error: authFailureHint(apiUrl, serverMessage), authFailed: true };
-    }
-    if (!response.ok) {
-      const serverMessage = await readErrorMessage(response);
-      return {
-        error: `Failed to resolve runner from key (HTTP ${response.status})${serverMessage ? `: ${serverMessage}` : ""}`
-      };
-    }
-    const data = await response.json();
-    if (data.auth_type === "agent_key" && data.agent_id) {
-      return { agent_id: data.agent_id };
-    }
-    return {
-      error: "Cannot resolve runner ID: auth type is not agent_key. Please provide --agent explicitly."
-    };
-  } catch (error2) {
-    const message = error2 instanceof Error ? error2.message : "Unknown error";
-    return { error: `Failed to resolve runner from key: ${message}` };
-  }
-}
-var OFFLINE_NOTIFY_TIMEOUT_MS = 2e3;
-async function notifyAgentDisconnected(agentId, authHeader) {
-  const apiUrl = getApiUrlConfig();
-  try {
-    const response = await fetch(`${apiUrl}/runners/${agentId}/disconnect`, {
-      method: "POST",
-      headers: { Authorization: authHeader },
-      signal: AbortSignal.timeout(OFFLINE_NOTIFY_TIMEOUT_MS)
-    });
-    if (!response.ok) {
-      const serverMessage = await readErrorMessage(response);
-      return {
-        ok: false,
-        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
-      };
-    }
-    return { ok: true };
-  } catch (error2) {
-    const name = error2?.name;
-    if (name === "TimeoutError" || name === "AbortError") {
-      return { ok: false, error: `timed out after ${OFFLINE_NOTIFY_TIMEOUT_MS}ms` };
-    }
-    return { ok: false, error: error2 instanceof Error ? error2.message : String(error2) };
-  }
-}
-async function getAgentInfo(agentId, authHeader) {
-  const apiUrl = getApiUrlConfig();
-  try {
-    const response = await fetch(`${apiUrl}/runners/${agentId}`, {
-      headers: { Authorization: authHeader }
-    });
-    if (response.status === 401) {
-      const serverMessage = await readErrorMessage(response);
-      return { valid: false, error: authFailureHint(apiUrl, serverMessage), authFailed: true };
-    }
-    if (response.status === 403) {
-      const serverMessage = await readErrorMessage(response);
-      return {
-        valid: false,
-        error: serverMessage ?? "You do not have access to this runner (it may belong to a different team or organization)."
-      };
-    }
-    if (response.status === 404) {
-      const serverMessage = await readErrorMessage(response);
-      return { valid: false, error: serverMessage ?? `Runner ${agentId} not found` };
-    }
-    if (!response.ok) {
-      const serverMessage = await readErrorMessage(response);
-      return {
-        valid: false,
-        error: `API error (HTTP ${response.status})${serverMessage ? `: ${serverMessage}` : ""}`
-      };
-    }
-    const agent = await response.json();
-    if (agent.agent_type !== "local") {
-      return {
-        valid: false,
-        error: `Runner is type '${agent.agent_type}', must be 'local' for CLI connection`
-      };
-    }
-    return { valid: true, agent };
-  } catch (error2) {
-    const message = error2 instanceof Error ? error2.message : "Unknown error";
-    return { valid: false, error: `Failed to validate runner: ${message}` };
+    return { port, process: proc, version: health.version ?? null, notReadyReason: null };
   }
+  return { port, process: null, version: null, notReadyReason: "you chose to continue without it" };
 }
 
 // src/commands/run.ts
@@ -5145,7 +6442,7 @@ function resolveFileSyncDirectories(raw, homeDir) {
     if (trimmed === "") {
       throw new Error("--enable-file-sync-to requires a directory path (got an empty value)");
     }
-    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join2(homeDir, trimmed.slice(2)) : trimmed;
+    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join3(homeDir, trimmed.slice(2)) : trimmed;
     if (!isAbsolute2(expanded)) {
       throw new Error(`--enable-file-sync-to requires an absolute directory path; got "${entry}"`);
     }
@@ -5166,6 +6463,35 @@ function resolveFileSyncDirectories(raw, homeDir) {
   }
   return directories;
 }
+var DEFAULT_OPENCODE_START_TIMEOUT_SECONDS = 180;
+var MAX_OPENCODE_START_TIMEOUT_SECONDS = 3600;
+var OPENCODE_START_TIMEOUT_ENV = "EVIDENT_OPENCODE_START_TIMEOUT";
+function resolveOpenCodeStartTimeoutMs(options, env = process.env) {
+  const defaultMs = DEFAULT_OPENCODE_START_TIMEOUT_SECONDS * 1e3;
+  let raw;
+  let source;
+  if (options.opencodeStartTimeout !== void 0) {
+    raw = options.opencodeStartTimeout;
+    source = "--opencode-start-timeout";
+  } else if (env[OPENCODE_START_TIMEOUT_ENV] !== void 0 && env[OPENCODE_START_TIMEOUT_ENV] !== "") {
+    raw = env[OPENCODE_START_TIMEOUT_ENV];
+    source = OPENCODE_START_TIMEOUT_ENV;
+  } else {
+    return { timeoutMs: defaultMs, warnings: [] };
+  }
+  const trimmed = raw.trim();
+  const seconds = Number(trimmed);
+  const isPositiveInteger = /^\d+$/.test(trimmed) && Number.isInteger(seconds) && seconds > 0;
+  if (!isPositiveInteger || seconds > MAX_OPENCODE_START_TIMEOUT_SECONDS) {
+    return {
+      timeoutMs: defaultMs,
+      warnings: [
+        `Ignoring invalid ${source} "${raw}": expected a positive integer number of seconds (at most ${MAX_OPENCODE_START_TIMEOUT_SECONDS}); using the default ${DEFAULT_OPENCODE_START_TIMEOUT_SECONDS}s`
+      ]
+    };
+  }
+  return { timeoutMs: seconds * 1e3, warnings: [] };
+}
 function meetsThreshold(state, level) {
   return LOG_LEVELS[level] >= LOG_LEVELS[state.logLevel];
 }
@@ -5187,6 +6513,10 @@ function log2(state, message, level = "info") {
 function logActivity(state, entry) {
   const level = entry.level ?? (entry.type === "error" ? "error" : "info");
   if (!meetsThreshold(state, level)) return;
+  forwardRunnerActivity(
+    { level, message: entry.message, error: entry.error },
+    { agentId: state.agentId, authHeader: state.authHeader }
+  );
   const fullEntry = {
     ...entry,
     level,
@@ -5286,9 +6616,15 @@ async function handleAuthError(state, error2) {
 }
 async function driveChannels(state, driver) {
   let idlePolls = 0;
+  let idleMs = 0;
+  let consecutiveDrainFailures = 0;
+  let unreachableMs = 0;
   let lastSeenProxiedActivityAt = state.lastProxiedActivityAt;
   let lastSeenAppliedFiles = driver.fileSyncActivity().appliedFiles;
   while (state.running) {
+    const cycleStartedAtMs = performance.now();
+    let idleThisCycle = false;
+    let unreachableThisCycle = false;
     if (state.connection?.reconnecting && state.connection.reconnectPromise) {
       logActivity(state, { type: "info", message: "Waiting for tunnel reconnection..." });
       if (state.interactive) displayStatus(state);
@@ -5303,17 +6639,23 @@ async function driveChannels(state, driver) {
     );
     try {
       const processed = await driver.drainPending();
+      consecutiveDrainFailures = 0;
+      unreachableMs = 0;
       state.messageCount += processed;
       const proxiedActivity = state.lastProxiedActivityAt !== lastSeenProxiedActivityAt;
       lastSeenProxiedActivityAt = state.lastProxiedActivityAt;
       const appliedFiles = driver.fileSyncActivity().appliedFiles;
-      const fileActivity = carriedOverFileSync || appliedFiles !== lastSeenAppliedFiles;
+      const filesApplied = appliedFiles !== lastSeenAppliedFiles;
+      const fileActivity = carriedOverFileSync || filesApplied;
       lastSeenAppliedFiles = appliedFiles;
+      if (filesApplied) state.claudeUsageRearm?.();
       if (processed > 0 || driver.hasInFlightWatchers() || proxiedActivity || fileActivity) {
         idlePolls = 0;
+        idleMs = 0;
         if (processed > 0 && state.interactive) displayStatus(state);
       } else if (state.idleTimeout !== null) {
         idlePolls++;
+        idleThisCycle = true;
         if (idlePolls === 1) {
           logActivity(state, {
             type: "info",
@@ -5337,21 +6679,44 @@ async function driveChannels(state, driver) {
       const errorMessage = error2 instanceof Error ? error2.message : String(error2);
       logActivity(state, { type: "error", error: `Channel processing error: ${errorMessage}` });
       if (state.interactive) displayStatus(state);
+      if (driver.hasInFlightWatchers()) {
+        consecutiveDrainFailures = 0;
+        unreachableMs = 0;
+      } else if (state.idleTimeout !== null) {
+        consecutiveDrainFailures++;
+        unreachableThisCycle = true;
+        if (consecutiveDrainFailures === 1) {
+          logActivity(state, {
+            type: "info",
+            message: `Cannot reach Evident, will exit if this persists past the idle timeout (timeout: ${state.idleTimeout}s)...`
+          });
+          if (state.interactive) displayStatus(state);
+        }
+      }
     }
     await new Promise((resolve3) => setTimeout(resolve3, CHANNEL_POLL_INTERVAL_MS));
-    if (state.idleTimeout !== null && idlePolls >= 2) {
-      const idleMs = idlePolls * CHANNEL_POLL_INTERVAL_MS;
-      if (idleMs > state.idleTimeout * 1e3) {
-        logActivity(state, { type: "info", message: "Idle timeout reached" });
-        if (state.interactive) displayStatus(state);
-        break;
-      }
+    const cycleMs = performance.now() - cycleStartedAtMs;
+    if (idleThisCycle) idleMs += cycleMs;
+    if (unreachableThisCycle) unreachableMs += cycleMs;
+    if (state.idleTimeout !== null && consecutiveDrainFailures >= 2 && unreachableMs > state.idleTimeout * 1e3) {
+      logActivity(state, {
+        type: "info",
+        level: "warn",
+        message: `Exiting: could not reach Evident for ${consecutiveDrainFailures} consecutive polls (${Math.round(unreachableMs / 1e3)}s)`
+      });
+      if (state.interactive) displayStatus(state);
+      break;
+    }
+    if (state.idleTimeout !== null && idlePolls >= 2 && idleMs > state.idleTimeout * 1e3) {
+      logActivity(state, { type: "info", message: "Idle timeout reached" });
+      if (state.interactive) displayStatus(state);
+      break;
     }
   }
 }
 var SESSION_CLEANUP_FIRST_SWEEP_MS = 1e4;
-async function runSweep(state, driver, config2) {
-  const mode = `age=${config2.maxAgeMs ?? "\u2014"} count=${config2.maxCount ?? "\u2014"}`;
+async function runSweep(state, driver, config) {
+  const mode = `age=${config.maxAgeMs ?? "\u2014"} count=${config.maxCount ?? "\u2014"}`;
   try {
     const sessions = await listSessions(state.port);
     if (sessions === null) {
@@ -5364,8 +6729,8 @@ async function runSweep(state, driver, config2) {
     const toDelete = selectSessionsToDelete(
       sessions.map((s) => ({ id: s.id, lastActivityMs: sessionLastActivityMs(s) })),
       {
-        maxAgeMs: config2.maxAgeMs,
-        maxCount: config2.maxCount,
+        maxAgeMs: config.maxAgeMs,
+        maxCount: config.maxCount,
         nowMs: Date.now(),
         protectedIds: driver.protectedSessionIds()
       }
@@ -5401,7 +6766,7 @@ async function runSweep(state, driver, config2) {
   }
 }
 function scheduleSessionCleanup(state, driver, options) {
-  const config2 = resolveSessionCleanupConfig(
+  const config = resolveSessionCleanupConfig(
     {
       maxAge: options.sessionCleanupMaxAge,
       maxCount: options.sessionCleanupMaxCount,
@@ -5409,21 +6774,129 @@ function scheduleSessionCleanup(state, driver, options) {
     },
     process.env
   );
-  for (const warning2 of config2.warnings) {
+  for (const warning2 of config.warnings) {
     logActivity(state, { type: "info", level: "warn", message: `Session cleanup: ${warning2}` });
   }
-  if (!config2.enabled) return;
+  if (!config.enabled) return;
   logActivity(state, {
     type: "info",
-    message: `Session cleanup enabled (age=${config2.maxAgeMs ?? "\u2014"}, count=${config2.maxCount ?? "\u2014"}, interval=${config2.intervalMs}ms)`
+    message: `Session cleanup enabled (age=${config.maxAgeMs ?? "\u2014"}, count=${config.maxCount ?? "\u2014"}, interval=${config.intervalMs}ms)`
   });
-  const interval = setInterval(() => void runSweep(state, driver, config2), config2.intervalMs);
+  const interval = setInterval(() => void runSweep(state, driver, config), config.intervalMs);
   const firstSweep = setTimeout(
-    () => void runSweep(state, driver, config2),
+    () => void runSweep(state, driver, config),
     SESSION_CLEANUP_FIRST_SWEEP_MS
   );
   state.sessionCleanupTimers.push(interval, firstSweep);
 }
+function claudeUsageFailureStreakSuffix(consecutiveFailures) {
+  return consecutiveFailures > 1 ? ` (${consecutiveFailures} consecutive failures)` : "";
+}
+function scheduleClaudeUsageReporting(state, options) {
+  const { mode, warnings } = resolveClaudeUsageReportingMode(
+    options.claudeUsageReporting,
+    process.env
+  );
+  for (const warning2 of warnings) {
+    logActivity(state, {
+      type: "info",
+      level: "warn",
+      message: `Claude usage reporting: ${warning2}`
+    });
+  }
+  if (mode === "off") {
+    logActivity(state, {
+      type: "info",
+      level: "debug",
+      message: "Claude usage reporting is off (--claude-usage-reporting off)"
+    });
+    return null;
+  }
+  let consecutiveFailures = 0;
+  let armed = false;
+  let rearmRequested = false;
+  const scheduleNextTick = () => {
+    armed = true;
+    rearmRequested = false;
+    state.claudeUsageTimer = setTimeout(() => void tick(false), nextReportDelayMs());
+  };
+  const rearm = () => {
+    if (armed) {
+      rearmRequested = true;
+      return;
+    }
+    rearmRequested = false;
+    armed = true;
+    state.claudeUsageTimer = setTimeout(() => void tick(true), FIRST_REPORT_DELAY_MS);
+  };
+  const tick = async (isProbe) => {
+    try {
+      const usage = await getClaudeUsage();
+      const result = await reportClaudeUsage(state.agentId, state.authHeader, usage);
+      if (result.ok) {
+        if (consecutiveFailures > 0) {
+          logActivity(state, {
+            type: "info",
+            level: "info",
+            message: "Claude usage reporting recovered"
+          });
+        }
+        consecutiveFailures = 0;
+        logActivity(state, {
+          type: "info",
+          level: "debug",
+          message: "Reported Claude usage to Evident"
+        });
+      } else {
+        consecutiveFailures++;
+        logActivity(state, {
+          type: "info",
+          level: claudeUsageFailureLogLevel(consecutiveFailures),
+          message: `Failed to report Claude usage: ${result.error}${claudeUsageFailureStreakSuffix(consecutiveFailures)}`
+        });
+      }
+      scheduleNextTick();
+    } catch (error2) {
+      if (error2 instanceof ClaudeUsageError && isLocalCredentialProblem(error2)) {
+        if (mode === "on") {
+          logActivity(state, {
+            type: "info",
+            level: "warn",
+            message: "Claude usage reporting is forced on but no usable Claude Code login was found \u2014 run `claude` to sign in; reporting will keep retrying"
+          });
+          scheduleNextTick();
+        } else if (isProbe) {
+          logActivity(state, {
+            type: "info",
+            level: "debug",
+            message: `Claude usage reporting: ${error2.message}`
+          });
+          armed = false;
+          if (rearmRequested) rearm();
+        } else {
+          logActivity(state, {
+            type: "info",
+            level: "debug",
+            message: `Claude usage reporting: ${error2.message}`
+          });
+          scheduleNextTick();
+        }
+      } else {
+        consecutiveFailures++;
+        const message = error2 instanceof Error ? error2.message : String(error2);
+        logActivity(state, {
+          type: "info",
+          level: claudeUsageFailureLogLevel(consecutiveFailures),
+          message: `Claude usage reporting failed: ${message}${claudeUsageFailureStreakSuffix(consecutiveFailures)}`
+        });
+        scheduleNextTick();
+      }
+    }
+  };
+  armed = true;
+  state.claudeUsageTimer = setTimeout(() => void tick(true), FIRST_REPORT_DELAY_MS);
+  return rearm;
+}
 async function notifyOffline(state) {
   if (!state.agentId || !state.authHeader) return;
   if (!state.connected) {
@@ -5459,6 +6932,11 @@ async function cleanup(state, opts = {}) {
     clearTimeout(timer);
   }
   state.sessionCleanupTimers = [];
+  if (state.claudeUsageTimer) {
+    clearTimeout(state.claudeUsageTimer);
+    state.claudeUsageTimer = null;
+  }
+  state.claudeUsageRearm = null;
   if (opts.graceful && state.channelDriver) {
     state.channelDriver.stop();
     log2(state, "Draining in-flight channel work before shutdown...");
@@ -5506,7 +6984,7 @@ async function run(options) {
   let fileSyncDirectories;
   try {
     logLevel = resolveLogLevel(options);
-    fileSyncDirectories = resolveFileSyncDirectories(options.enableFileSyncTo, homedir2());
+    fileSyncDirectories = resolveFileSyncDirectories(options.enableFileSyncTo, homedir3());
   } catch (error2) {
     const message = error2 instanceof Error ? error2.message : String(error2);
     if (options.json) {
@@ -5539,8 +7017,11 @@ async function run(options) {
     messageCount: 0,
     lastProxiedActivityAt: null,
     sessionCleanupTimers: [],
+    claudeUsageTimer: null,
+    claudeUsageRearm: null,
     authHeader: ""
   };
+  setTelemetryAuthProvider(() => ({ authHeader: state.authHeader, agentId: state.agentId }));
   if (fileSyncDirectories.length > 0) {
     log2(state, `File sync enabled for: ${fileSyncDirectories.join(", ")}`);
   } else {
@@ -5617,6 +7098,7 @@ async function run(options) {
         console.log(chalk6.dim("Or run `evident login` for interactive authentication"));
         blank();
         process.exit(1);
+        return;
       }
       blank();
       console.log(chalk6.yellow("You are not logged in to Evident."));
@@ -5661,6 +7143,7 @@ async function run(options) {
         } else {
           printError(resolved.error || "Failed to resolve runner ID from key");
           process.exit(1);
+          return;
         }
       } else {
         printError(
@@ -5674,6 +7157,7 @@ async function run(options) {
         );
         blank();
         process.exit(1);
+        return;
       }
     }
     telemetry.info(
@@ -5714,40 +7198,67 @@ async function run(options) {
     }
     spinner?.succeed(`Runner: ${validation.agent.name || state.agentId}`);
     state.agentName = validation.agent.name;
+    const microvmId = process.env.MICROVM_ID?.trim();
+    if (microvmId) {
+      const reported = await reportMicrovmId(state.agentId, state.authHeader, microvmId);
+      if (reported.ok) {
+        log2(state, "Reported MicroVM identity so this runner can be resumed rather than restarted");
+      } else {
+        const message = `Could not report MicroVM identity (future wakes will cold-start): ${reported.error}`;
+        log2(state, message, "warn");
+        if (state.interactive && !state.json) {
+          logActivity(state, { type: "info", level: "warn", message });
+        }
+      }
+    } else {
+      log2(state, "Not running in a MicroVM (MICROVM_ID unset) \u2014 nothing to report", "debug");
+    }
+    const { timeoutMs: opencodeStartTimeoutMs, warnings: opencodeStartTimeoutWarnings } = resolveOpenCodeStartTimeoutMs(options, process.env);
+    for (const warning2 of opencodeStartTimeoutWarnings) {
+      logActivity(state, { type: "info", level: "warn", message: warning2 });
+    }
     const ocSpinner = interactive && !state.json ? ora3("Checking OpenCode...").start() : null;
     try {
       const oc = await ensureOpenCodeRunning({
         port: state.port,
         interactive: state.interactive,
         agentId: state.agentId,
-        log: (message) => log2(state, message)
+        log: (message) => log2(state, message),
+        startTimeoutMs: opencodeStartTimeoutMs
       });
       state.port = oc.port;
       state.opencodeProcess = oc.process;
       state.opencodeVersion = oc.version;
-      state.opencodeConnected = oc.process !== null || oc.version !== null;
+      state.opencodeConnected = oc.notReadyReason === null;
       const version2 = state.opencodeVersion ? ` (v${state.opencodeVersion})` : "";
       ocSpinner?.succeed(`OpenCode running on port ${state.port}${version2}`);
-      const versionWarning = buildOpenCodeVersionWarning(state.opencodeVersion);
-      if (versionWarning) {
-        log2(state, versionWarning, "warn");
-        if (state.interactive && !state.json) {
-          logActivity(state, { type: "info", level: "warn", message: versionWarning });
+      if (!state.interactive && oc.notReadyReason !== null) {
+        const message = `OpenCode is not ready on port ${state.port}: ${oc.notReadyReason}. The runner will still come online, but messages will fail until opencode answers \u2014 raise the wait with --opencode-start-timeout <seconds> (env ${OPENCODE_START_TIMEOUT_ENV}).`;
+        logActivity(state, { type: "info", level: "warn", message });
+      } else {
+        const versionWarning = buildOpenCodeVersionWarning(state.opencodeVersion);
+        if (versionWarning) {
+          log2(state, versionWarning, "warn");
+          if (state.interactive && !state.json) {
+            logActivity(state, { type: "info", level: "warn", message: versionWarning });
+          }
         }
-      }
-      const noProviderWarning = buildNoProviderWarning(await hasAnyConfiguredProvider(state.port));
-      if (noProviderWarning) {
-        log2(state, noProviderWarning, "warn");
-        if (state.interactive && !state.json) {
-          logActivity(state, { type: "info", level: "warn", message: noProviderWarning });
-          blank();
-          console.log(chalk6.yellow("\u26A0 No OpenCode model provider is configured."));
-          console.log(
-            chalk6.dim(
-              `Run ${chalk6.cyan("opencode auth login")} to set one up \u2014 messages will fail until then.`
-            )
-          );
-          blank();
+        const noProviderWarning = buildNoProviderWarning(
+          await hasAnyConfiguredProvider(state.port)
+        );
+        if (noProviderWarning) {
+          log2(state, noProviderWarning, "warn");
+          if (state.interactive && !state.json) {
+            logActivity(state, { type: "info", level: "warn", message: noProviderWarning });
+            blank();
+            console.log(chalk6.yellow("\u26A0 No OpenCode model provider is configured."));
+            console.log(
+              chalk6.dim(
+                `Run ${chalk6.cyan("opencode auth login")} to set one up \u2014 messages will fail until then.`
+              )
+            );
+            blank();
+          }
         }
       }
     } catch (error2) {
@@ -5765,7 +7276,7 @@ async function run(options) {
       // #559: the `--enable-file-sync-to` allow-list. Empty ⇒ pending files are
       // REJECTED with `file_sync_disabled` on the ack, not silently ignored.
       fileSyncDirectories,
-      homeDir: homedir2(),
+      homeDir: homedir3(),
       log: (entry) => (
         // Thread the driver's real level straight through so `debug`/`warn`
         // survive the sink filter (they no longer collapse to info). `type`
@@ -5792,6 +7303,18 @@ async function run(options) {
             type: "info",
             message: `Tunnel ${isReconnect ? "reconnected" : "connected"} (runner: ${agentId})`
           });
+          if (options.tunnelReadyFile) {
+            const marker = writeTunnelReadyMarker(options.tunnelReadyFile, agentId);
+            if (marker.ok) {
+              log2(state, `Wrote tunnel readiness marker to ${options.tunnelReadyFile}`, "debug");
+            } else {
+              log2(
+                state,
+                `Failed to write tunnel readiness marker to ${options.tunnelReadyFile}: ${marker.error}`,
+                "error"
+              );
+            }
+          }
           emitAgentConnected(state.agentId, {
             port: state.port,
             cli_version: getCliVersion(),
@@ -5882,6 +7405,7 @@ async function run(options) {
       throw error2;
     }
     scheduleSessionCleanup(state, channelDriver, options);
+    state.claudeUsageRearm = scheduleClaudeUsageReporting(state, options);
     if (!interactive || state.json) {
       log2(state, "Driving channel messages...");
     }
@@ -5936,13 +7460,18 @@ program.name("evident").description("Run OpenCode locally and connect it to Evid
 program.command("login").description("Authenticate with Evident").option("--token", "Use token-based authentication (for CI/CD)").option("--no-browser", "Do not open the browser automatically").action(login);
 program.command("logout").description("Remove stored credentials for the current endpoint").option("--all", "Remove stored credentials for all endpoints").action((options) => logout({ all: options.all }));
 program.command("whoami").description("Show the currently logged in user").action(whoami);
+program.command("status").description("Check whether the configured credentials can reach Evident").option("--json", "Output in JSON format").action((options) => status({ json: options.json }));
+program.command("claude-usage").description("[spike] Show Claude subscription usage (requires a local `claude login`)").action(claudeUsage);
 program.command("run").description("Connect to Evident and process messages").option("--runner [id]", "Runner ID to connect to (optional when EVIDENT_RUNNER_KEY is set)").option(
   "-a, --agent [id]",
   "Deprecated alias for --runner (still supported; --runner wins if both are given)"
 ).option("-p, --port <port>", "OpenCode port (default: 4096)", "4096").option(
   "--log-level <level>",
   "Log verbosity: debug | info | warn | error (default: info). Env: EVIDENT_LOG_LEVEL"
-).option("-v, --verbose", "Alias for --log-level debug (ignored if --log-level is set)").option("-c, --conversation <id>", "Process only this specific conversation").option("--idle-timeout <seconds>", "Exit after N seconds idle").option("--json", "Output in JSON format").option(
+).option("-v, --verbose", "Alias for --log-level debug (ignored if --log-level is set)").option("-c, --conversation <id>", "Process only this specific conversation").option("--idle-timeout <seconds>", "Exit after N seconds idle").option(
+  "--opencode-start-timeout <seconds>",
+  "Seconds to wait for OpenCode to become healthy when the runner starts it (default: 180). Env: EVIDENT_OPENCODE_START_TIMEOUT"
+).option("--json", "Output in JSON format").option(
   "--session-cleanup-max-age <duration>",
   "Delete OpenCode sessions idle longer than this (e.g. 7d, 24h). Enables cleanup. Env: EVIDENT_SESSION_CLEANUP_MAX_AGE"
 ).option(
@@ -5951,11 +7480,17 @@ program.command("run").description("Connect to Evident and process messages").op
 ).option(
   "--session-cleanup-interval <duration>",
   "How often the cleanup sweep runs (default: 1h). Env: EVIDENT_SESSION_CLEANUP_INTERVAL"
+).option(
+  "--claude-usage-reporting <mode>",
+  "Report Claude subscription usage to Evident: auto | on | off (default: auto). Env: EVIDENT_CLAUDE_USAGE_REPORTING"
 ).option(
   "--enable-file-sync-to <dir>",
   "Allow Evident to write files into this directory (repeatable). Omit to disable file sync entirely.",
   (value, previous) => previous.concat([value]),
   []
+).option(
+  "--tunnel-ready-file <path>",
+  "Path to write once the tunnel is connected (opt-in; unused unless an operator/image sets it)"
 ).action(
   (options) => {
     run({
@@ -5968,14 +7503,21 @@ program.command("run").description("Connect to Evident and process messages").op
       verbose: options.verbose,
       conversation: options.conversation,
       idleTimeout: options.idleTimeout ? parseInt(options.idleTimeout, 10) : void 0,
+      // Raw string — validation/precedence is single-sourced in run.ts's
+      // resolveOpenCodeStartTimeoutMs (flag > EVIDENT_OPENCODE_START_TIMEOUT > 180s default).
+      opencodeStartTimeout: options.opencodeStartTimeout,
       json: options.json,
       // Raw strings — the resolver in run.ts single-sources parsing (M1).
       sessionCleanupMaxAge: options.sessionCleanupMaxAge,
       sessionCleanupMaxCount: options.sessionCleanupMaxCount,
       sessionCleanupInterval: options.sessionCleanupInterval,
+      // Raw string — the resolver in run.ts single-sources parsing
+      // (resolveClaudeUsageReportingMode).
+      claudeUsageReporting: options.claudeUsageReporting,
       // Raw values — expansion/validation is single-sourced in run.ts's
       // resolveFileSyncDirectories.
-      enableFileSyncTo: options.enableFileSyncTo
+      enableFileSyncTo: options.enableFileSyncTo,
+      tunnelReadyFile: options.tunnelReadyFile
     });
   }
 );