@evident-ai/cli 3.1.1-dev.df276eb → 3.1.1-dev.eec1cca

package/dist/index.js

@@ -797,6 +797,16 @@ async function checkStatus(jsonMode) {
       exitCode: 1
     };
   }
+  if (response.status === 404) {
+    return {
+      ok: false,
+      endpoint: apiUrl,
+      authLabel: authLabelFor(credentials2),
+      reason: "endpoint_not_found",
+      error: `${apiUrl}/me returned HTTP 404 \u2014 that endpoint has no /me route, so it is probably missing the /v1 prefix. The credentials were NOT validated.`,
+      exitCode: 75
+    };
+  }
   if (response.status >= 500) {
     const serverMessage = await readErrorMessage(response);
     return {
@@ -3141,6 +3151,7 @@ var B2_ABANDONMENT_MIN_PINNED_MS = 3 * 6e4;
 var B2_ABANDONMENT_RECHECK_MS = HEARTBEAT_MS;
 var POLL_MISS_GRACE_MS = HEARTBEAT_MS;
 var MAX_SUPERSEDED_CONVERSATIONS = 256;
+var MAX_IDENTICAL_REDRIVE_POLL_FAILURES = 5;
 var ChannelAuthError = class extends Error {
   constructor(message) {
     super(message);
@@ -3163,6 +3174,10 @@ function backoffDelay(attempt, policy) {
 function isRetryableStatus(status2) {
   return status2 === 429 || status2 >= 500 && status2 <= 599;
 }
+var VOLATILE_BODY_FIELD_PATTERN = /("(?:ref|requestId|request_id|traceId|trace_id)"\s*:\s*)"[^"]*"/gi;
+function normalizeRedrivePollFailureBody(body) {
+  return body.replace(VOLATILE_BODY_FIELD_PATTERN, '$1"<redacted>"').replace(/\s+/g, " ").trim().slice(0, 200);
+}
 var ChannelDriver = class _ChannelDriver {
   agentId;
   port;
@@ -3294,6 +3309,66 @@ var ChannelDriver = class _ChannelDriver {
    * ADR-0047's own "unreachable ⇒ bounded" rule). Cleared on any other outcome.
    */
   redriveUnresolvedSince = /* @__PURE__ */ new Map();
+  /**
+   * Consecutive-identical-poll-failure streak for the re-drive fence (#1348),
+   * keyed by Evident **message id** (not session) so `clearRedriveUnresolved`
+   * can drop it with the other two trackers and it cannot leak. `sessionId` is
+   * carried inside the entry, not the key: a session change is a different
+   * situation and resets the streak, which gives the `(sessionId, message.id)`
+   * pairing #1348 asks for without a composite map key.
+   */
+  redrivePollFailures = /* @__PURE__ */ new Map();
+  /**
+   * "Already emitted `redrive_outcome_unreported` for THIS (message, outcome)
+   * streak" (Class B, #1340: the runner DECIDED reattach/settle/fail_permanent
+   * but its own PATCH to record it failed — distinct from Class A's
+   * `redrive_poll_failed`, where opencode itself can't be observed). Keyed by
+   * message id, valued by the outcome currently failing to report, so a
+   * change of outcome starts a fresh signal. Cleared by
+   * `clearRedriveUnresolved` the instant either PATCH succeeds.
+   */
+  redriveOutcomeUnreportedSignalled = /* @__PURE__ */ new Map();
+  /**
+   * First `now()` a Class B outcome PATCH (reattach/settle/fail_permanent) was
+   * observed to fail for this message (#1366's failure-window trip arm,
+   * `boundRedriveOutcome`). Duration, not a tick count — bounded by the
+   * existing `pausedMaxWaitMs` window (reusing the knob, not a new constant).
+   * Cleared by `clearRedriveUnresolved` the instant the original PATCH
+   * succeeds.
+   */
+  redriveOutcomeFailingSince = /* @__PURE__ */ new Map();
+  /**
+   * "Already posted `redrive_outcome_abandoned` with `reported: false` for this
+   * row" (#1366) — the bound tripped but the terminal `markFailed` fallback ALSO
+   * failed (the route-level fault of G2), so every following tick re-attempts
+   * the same terminal PATCH. Guards that quiet retry from re-signalling on
+   * every tick. Cleared by `clearRedriveUnresolved`.
+   */
+  redriveOutcomeAbandonedSignalled = /* @__PURE__ */ new Set();
+  /**
+   * "Already emitted `dispatch_not_started` for THIS (message, branch) streak"
+   * (#1340). Valued by the branch currently firing, so a row that moves between
+   * exits re-signals — the move IS the finding. Cleared only on a CONFIRMED
+   * dispatch, never on the fence's decision to dispatch: `clearRedriveUnresolved`
+   * runs on that decision (`resolveRedriveUnresolved`), so clearing there would
+   * re-signal on every one of the 15h of re-dispatch attempts #1110 made.
+   */
+  dispatchNotStartedSignalled = /* @__PURE__ */ new Map();
+  /**
+   * Consecutive-UNCONFIRMED-dispatch streak for a `pending` row with NO stored
+   * `opencode_message_id` yet — i.e. one that has never even reached the
+   * re-drive fence above. `sendPromptAsync`'s POST may 2xx, but its own
+   * read-back retries can never confirm the assigned id when the session's
+   * message list is PERMANENTLY unreadable (e.g. a corrupted local opencode
+   * SQLite DB, #1345/#1348's exact fault, just hit BEFORE the row is ever
+   * dispatched instead of after). Unlike an already-dispatched row, THIS row has
+   * no other safety net at all: the lifecycle cron only reclaims `status =
+   * 'processing'` rows, and a row stuck here never reaches `processing`. Keyed
+   * by message id, carrying `sessionId` so a session change (a fresh one bound
+   * after abandonment) starts a new streak rather than inheriting the old
+   * session's count — same shape as `redrivePollFailures` above.
+   */
+  unconfirmedDispatchFailures = /* @__PURE__ */ new Map();
   /**
    * "A null-id re-adopt re-dispatch is in flight, awaiting its read-back" (WI-5
    * Task 5.4, High-2). Since we no longer send a caller-supplied id, a re-dispatch
@@ -3618,7 +3693,7 @@ var ChannelDriver = class _ChannelDriver {
    * @returns the count of messages NEWLY dispatched (not already in-flight).
    */
   async processConversation(conv) {
-    const { sessionId, refusedSessionId } = await this.ensureSession(conv);
+    const { sessionId, refusedSessionId, created: sessionCreated } = await this.ensureSession(conv);
     const messages = await this.getPendingMessages(conv.id);
     let dispatched = 0;
     let skippedAlreadyDispatched = 0;
@@ -3634,7 +3709,10 @@ var ChannelDriver = class _ChannelDriver {
         continue;
       }
       if (message.opencode_message_id) {
-        const outcome = await this.resolveRedrive(conv, sessionId, message, refusedSessionId);
+        const outcome = await this.resolveRedrive(conv, sessionId, message, sessionCreated);
+        if (outcome === "abandoned") {
+          continue;
+        }
         if (outcome !== "dispatch") {
           break;
         }
@@ -3668,6 +3746,7 @@ var ChannelDriver = class _ChannelDriver {
             conversation_id: conv.id,
             message_id: message.id
           });
+          this.signalDispatchNotStarted(conv, message, "session_deleted_race");
           break;
         }
         if (exists === null) {
@@ -3677,6 +3756,7 @@ var ChannelDriver = class _ChannelDriver {
             conversation_id: conv.id,
             message_id: message.id
           });
+          this.signalDispatchNotStarted(conv, message, "session_existence_unknown");
           break;
         }
         const errorMessage = err instanceof Error ? err.message : String(err);
@@ -3695,6 +3775,7 @@ var ChannelDriver = class _ChannelDriver {
             conversation_id: conv.id,
             message_id: message.id
           });
+          this.signalDispatchNotStarted(conv, message, "failure_unreported");
         });
         this.log({
           level: "error",
@@ -3705,14 +3786,40 @@ var ChannelDriver = class _ChannelDriver {
         break;
       }
       if (opencodeMessageId === null) {
+        const streak = this.recordUnconfirmedDispatch(message.id, sessionId);
+        if (streak < MAX_IDENTICAL_REDRIVE_POLL_FAILURES) {
+          this.log({
+            level: "warn",
+            message: `Message ${message.id.slice(0, 8)} dispatched but its opencode id could not be read back (${streak}/${MAX_IDENTICAL_REDRIVE_POLL_FAILURES}) \u2014 leaving un-tracked to retry next tick`,
+            conversation_id: conv.id,
+            message_id: message.id
+          });
+          this.signalDispatchNotStarted(conv, message, "readback_unconfirmed");
+          continue;
+        }
+        this.unconfirmedDispatchFailures.delete(message.id);
+        this.sessions.delete(conv.id);
+        this.supersede(conv.id, sessionId);
+        const errorMessage = `OpenCode accepted this message ${streak} times in a row but never confirmed its assigned id (session ${sessionId.slice(0, 8)}'s message list could not be read back) \u2014 the session was abandoned; a fresh one is used for further messages.`;
         this.log({
-          level: "warn",
-          message: `Message ${message.id.slice(0, 8)} dispatched but its opencode id could not be read back \u2014 leaving un-tracked to retry next tick`,
+          level: "error",
+          message: errorMessage,
           conversation_id: conv.id,
           message_id: message.id
         });
-        continue;
+        await this.markFailed(conv.id, message.id, null, errorMessage).catch((markErr) => {
+          this.log({
+            level: "warn",
+            message: `markFailed PATCH for message ${message.id.slice(0, 8)} (conversation ${conv.id.slice(0, 8)}) failed (best-effort, not retried): ${markErr instanceof Error ? markErr.message : String(markErr)}`,
+            conversation_id: conv.id,
+            message_id: message.id
+          });
+          this.signalDispatchNotStarted(conv, message, "abandon_unreported");
+        });
+        break;
       }
+      this.unconfirmedDispatchFailures.delete(message.id);
+      this.dispatchNotStartedSignalled.delete(message.id);
       this.dispatched.add(message.id);
       this.registerInFlight(conv, sessionId, message, opencodeMessageId);
       dispatched += 1;
@@ -3733,21 +3840,29 @@ var ChannelDriver = class _ChannelDriver {
    * INJECTED `fetchImpl` — NOT the imported `getSessionMessages` helper, which
    * hits the global `fetch` and would bypass the same override every other
    * opencode poll in this file respects. Mirrors `readoptProcessing`'s own
-   * snapshot fetch (`:3081-3111`). `null` = unreadable (non-OK response,
-   * non-array body, or a network exception) — treated as "can't observe",
-   * never as "confirmed gone".
+   * snapshot fetch (`:3081-3111`).
+   *
+   * Returns `{ ok: true, messages }` on a readable snapshot, or
+   * `{ ok: false, signature }` on failure — `signature` is a string that
+   * repeats across attempts for the SAME underlying fault (used by the
+   * consecutive-identical-failure bound, #1348), or `null` for a thrown
+   * exception, which is NOT countable toward that bound (a network blip / an
+   * opencode restart also throws identically every tick, and must keep
+   * retrying unbounded rather than ever being treated as permanent).
    */
   async pollSessionMessagesForRedrive(conv, message, sessionId) {
     try {
       const res = await this.fetchImpl(`${this.opencodeBase}/session/${sessionId}/message`);
       if (!res.ok) {
+        const rawBody = await res.text();
+        const normalized = normalizeRedrivePollFailureBody(rawBody);
         this.log({
           level: "warn",
-          message: `Re-drive: polling session ${sessionId.slice(0, 8)} for message ${message.id.slice(0, 8)} returned HTTP ${res.status} \u2014 treating as unreadable this tick`,
+          message: `Re-drive: polling session ${sessionId.slice(0, 8)} for message ${message.id.slice(0, 8)} returned HTTP ${res.status}${normalized ? `: ${normalized}` : ""} \u2014 treating as unreadable this tick`,
           conversation_id: conv.id,
           message_id: message.id
         });
-        return null;
+        return { ok: false, signature: `HTTP ${res.status}${normalized ? `: ${normalized}` : ""}` };
       }
       const body = await res.json();
       if (!Array.isArray(body)) {
@@ -3757,9 +3872,9 @@ var ChannelDriver = class _ChannelDriver {
           conversation_id: conv.id,
           message_id: message.id
         });
-        return null;
+        return { ok: false, signature: "non-array message body" };
       }
-      return body;
+      return { ok: true, messages: body };
     } catch (err) {
       this.log({
         level: "warn",
@@ -3767,7 +3882,7 @@ var ChannelDriver = class _ChannelDriver {
         conversation_id: conv.id,
         message_id: message.id
       });
-      return null;
+      return { ok: false, signature: null };
     }
   }
   /**
@@ -3779,21 +3894,34 @@ var ChannelDriver = class _ChannelDriver {
    * without this fence the drain loop would re-`prompt_async` the SAME turn a
    * second time against live GitHub state. Mirrors `readoptOne`'s job for the
    * `processing` re-adopt path, but simpler: no b1/b2 preamble cross-check is
-   * needed here because `refusedSessionId` already handles the one case
-   * (#553 abandoned session) that path exists for.
+   * needed here because `sessionCreated` already handles the cases (a #553
+   * abandoned session, a #190 vanished one) that path exists for.
    *
-   * Only `ChannelAuthError` propagates; every other failure resolves to
-   * `unresolved` and is retried whole on the next ~2s drain tick.
+   * Only `ChannelAuthError` propagates. A poll that fails identically
+   * `MAX_IDENTICAL_REDRIVE_POLL_FAILURES` times in a row reports the message
+   * failed instead of retrying it (#1348) — SEPARATE from, not a replacement
+   * for, `resolveRedriveUnresolved`'s own `pausedMaxWaitMs` bound below. Every
+   * other failure resolves to `unresolved` and is retried whole on the next
+   * ~2s drain tick.
    */
-  async resolveRedrive(conv, sessionId, message, refusedSessionId) {
+  async resolveRedrive(conv, sessionId, message, sessionCreated) {
     const ocId = message.opencode_message_id ?? null;
-    if (refusedSessionId) {
+    if (sessionCreated) {
       this.clearRedriveUnresolved(message.id);
       void this.postSignal(conv.id, message.id, "redrive_redispatched");
       return "dispatch";
     }
-    const messages = await this.pollSessionMessagesForRedrive(conv, message, sessionId);
-    if (messages == null || messages.length === 0) {
+    const polled = await this.pollSessionMessagesForRedrive(conv, message, sessionId);
+    if (!polled.ok) {
+      const streak = this.recordRedrivePollFailure(message.id, sessionId, polled.signature);
+      if (streak >= MAX_IDENTICAL_REDRIVE_POLL_FAILURES && polled.signature !== null) {
+        return this.failRedrivePollPermanent(conv, sessionId, message, polled.signature, streak);
+      }
+      return this.resolveRedriveUnresolved(conv, message);
+    }
+    this.redrivePollFailures.delete(message.id);
+    const messages = polled.messages;
+    if (messages.length === 0) {
       return this.resolveRedriveUnresolved(conv, message);
     }
     const state = messageRunState(messages, ocId ?? "");
@@ -3854,13 +3982,23 @@ var ChannelDriver = class _ChannelDriver {
       await this.markProcessing(conv.id, message.id, sessionId, ocId, title);
     } catch (err) {
       if (err instanceof ChannelAuthError) throw err;
-      this.log({
-        level: "warn",
-        message: `Re-drive: failed to restore message ${message.id.slice(0, 8)} to processing (will retry next drain): ${err instanceof Error ? err.message : String(err)}`,
-        conversation_id: conv.id,
-        message_id: message.id
-      });
-      return "unresolved";
+      if (err instanceof ChannelTerminalError) {
+        this.log({
+          level: "error",
+          message: `Re-drive: the server definitively refused to restore message ${message.id.slice(0, 8)} to processing (terminal HTTP ${err.status} \u2014 the row is gone or the update was rejected); NOT reporting a re-attach`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+      } else {
+        this.log({
+          level: "warn",
+          message: `Re-drive: failed to restore message ${message.id.slice(0, 8)} to processing (will retry next drain): ${err instanceof Error ? err.message : String(err)}`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+      }
+      const bound = await this.boundRedriveOutcome(conv, message, "reattach");
+      return bound === "abandoned" ? "abandoned" : "unresolved";
     }
     this.clearRedriveUnresolved(message.id);
     this.registerReadopted(conv, sessionId, message, ocId ?? "", anchorMs);
@@ -3920,19 +4058,62 @@ var ChannelDriver = class _ChannelDriver {
         conversation_id: conv.id,
         message_id: message.id
       });
-      return "unresolved";
+      const bound = await this.boundRedriveOutcome(conv, message, "settle");
+      return bound === "abandoned" ? "abandoned" : "unresolved";
     }
     this.clearRedriveUnresolved(message.id);
     void this.postSignal(conv.id, message.id, "redrive_settled");
     return "settled";
   }
+  /**
+   * The permanent-failure outcome (#1348): the fence's own poll of this session
+   * failed with the SAME opencode-answered signature
+   * `MAX_IDENTICAL_REDRIVE_POLL_FAILURES` times in a row — a transient blip
+   * would have varied or eventually cleared (see `pollSessionMessagesForRedrive`
+   * and `recordRedrivePollFailure`), so this is a durable fault (e.g. #1345's
+   * corrupted opencode session) rather than something worth retrying forever.
+   * Mirrors `settleRedrive`'s error discipline: no `usage`/`failure` args to
+   * `markFailed` (no opencode snapshot to extract them from — this poll never
+   * got a readable one).
+   */
+  async failRedrivePollPermanent(conv, sessionId, message, signature, streak) {
+    this.log({
+      level: "error",
+      message: `Re-drive: message ${message.id.slice(0, 8)} (session ${sessionId.slice(0, 8)}) failed to poll with the identical signature "${signature}" ${streak} times in a row \u2014 reporting the message failed instead of retrying forever`,
+      conversation_id: conv.id,
+      message_id: message.id
+    });
+    try {
+      await this.markFailed(
+        conv.id,
+        message.id,
+        sessionId,
+        `The runner could not read this conversation's state from OpenCode (${signature}). The same failure repeated ${streak} times in a row, so the message was not retried further.`
+      );
+    } catch (err) {
+      if (err instanceof ChannelAuthError) throw err;
+      this.log({
+        level: "warn",
+        message: `Re-drive: failed to report message ${message.id.slice(0, 8)} permanently failed (will retry next drain): ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conv.id,
+        message_id: message.id
+      });
+      const bound = await this.boundRedriveOutcome(conv, message, "fail_permanent");
+      return bound === "abandoned" ? "abandoned" : "unresolved";
+    }
+    this.clearRedriveUnresolved(message.id);
+    void this.postSignal(conv.id, message.id, "redrive_poll_failed");
+    return "settled";
+  }
   /**
    * The bounded `unresolved` outcome (Task 3.4): opencode's state could not be
    * observed (snapshot unreadable/empty, or `isSessionOngoing` returned `null`).
-   * A `pending` row is invisible to every cron arm (all require `status =
-   * 'processing'`), so an indefinitely-`unresolved` row would be stranded with
-   * nothing driving it — bound it to the existing `pausedMaxWaitMs` window
-   * (reusing the knob, not a new constant) and take `dispatch` once elapsed.
+   * A `pending` row is swept by the server's own `PENDING_MAX_AGE_MS` (24h,
+   * #1368) cron arm, but that is a day-scale backstop — this local bound acts
+   * in minutes so the row (and the conversation it starves, per the ordering
+   * invariant below) isn't left stranded for that long. Bound to the existing
+   * `pausedMaxWaitMs` window (reusing the knob, not a new constant); takes
+   * `dispatch` once elapsed.
    */
   resolveRedriveUnresolved(conv, message) {
     const now = this.now();
@@ -3951,10 +4132,153 @@ var ChannelDriver = class _ChannelDriver {
     }
     return "unresolved";
   }
-  /** Clear both `unresolved`-bound trackers for a row (any non-`unresolved` outcome). */
+  /** Clear all `unresolved`/failure-streak trackers for a row (any non-`unresolved` outcome). */
   clearRedriveUnresolved(messageId) {
     this.redriveUnresolvedSince.delete(messageId);
     this.redriveUnresolvedSignalled.delete(messageId);
+    this.redrivePollFailures.delete(messageId);
+    this.redriveOutcomeUnreportedSignalled.delete(messageId);
+    this.redriveOutcomeFailingSince.delete(messageId);
+    this.redriveOutcomeAbandonedSignalled.delete(messageId);
+  }
+  /**
+   * #1340: the dispatch loop reached a message and did NOT start a turn. Fires at
+   * most once per (message, branch) streak — a wedged row is re-tried every tick,
+   * and the per-tick count is already carried by the co-occurring
+   * `redrive_unresolved`/`redrive_redispatched` signals.
+   */
+  signalDispatchNotStarted(conv, message, branch) {
+    if (this.dispatchNotStartedSignalled.get(message.id) === branch) return;
+    this.dispatchNotStartedSignalled.set(message.id, branch);
+    void this.postSignal(conv.id, message.id, "dispatch_not_started", { branch });
+  }
+  /**
+   * Class B (#1340): the runner DECIDED an outcome (reattach/settle/fail_permanent)
+   * but its own PATCH to record it failed. Fires at most once per (message,
+   * outcome) streak, and only while `boundRedriveOutcome` has not yet tripped —
+   * once it trips, `redrive_outcome_abandoned` takes over reporting for the row
+   * (#1366).
+   */
+  signalRedriveOutcomeUnreported(conv, message, outcome) {
+    if (this.redriveOutcomeUnreportedSignalled.get(message.id) === outcome) return;
+    this.redriveOutcomeUnreportedSignalled.set(message.id, outcome);
+    void this.postSignal(conv.id, message.id, "redrive_outcome_unreported", {
+      attempted_outcome: outcome
+    });
+  }
+  /**
+   * The runner-authored, honest error text for the terminal fallback a tripped
+   * `boundRedriveOutcome` sends. Distinguishable per outcome and truthful about
+   * what actually happened — the `settle`/done case must say the turn finished
+   * but its result could not be recorded, never that the runner stopped
+   * responding (that would be a lie for this shape, see #1366's "why this ships").
+   */
+  static REDRIVE_ABANDON_ERROR = {
+    reattach: "your runner could not record that this message had started, so it was given up on",
+    settle: "your runner finished this message but could not record the result, so the reply could not be delivered",
+    fail_permanent: "the runner could not read this conversation's state from OpenCode, and could not record that failure either, so the message was given up on"
+  };
+  /**
+   * Bound for Class B (#1340, #1366): the runner DECIDED an outcome but its own
+   * PATCH to record it failed. Two independent trip arms (either sufficient):
+   * (1) this failure streak has lasted `pausedMaxWaitMs` — DURATION, not a tick
+   * count, reusing the knob `resolveRedriveUnresolved` already established; (2)
+   * the turn's `processing_started_at` age has crossed
+   * `ABSOLUTE_MAX_PROCESSING_MS` — durable and restart-surviving, since arm (1)'s
+   * in-memory streak resets on a scale-to-zero restart.
+   *
+   * INVARIANT — a tripped bound never suppresses the original outcome attempt;
+   * it only adds a fallback after that attempt has failed again. This is only
+   * ever reached from inside the catch of the ORIGINAL outcome PATCH, which is
+   * attempted first on every tick whether or not this bound tripped before —
+   * there is no give-up latch that would short-circuit it. That is what lets a
+   * route-level fault that heals later still deliver the turn's real
+   * `done`/`failed` payload: once the original PATCH succeeds again, this
+   * helper is never entered and the row settles with its real result.
+   */
+  async boundRedriveOutcome(conv, message, outcome) {
+    const now = this.now();
+    const since = this.redriveOutcomeFailingSince.get(message.id);
+    if (since === void 0) this.redriveOutcomeFailingSince.set(message.id, now);
+    const durationTripped = now - (since ?? now) >= this.pausedMaxWaitMs;
+    const parsed = message.processing_started_at ? Date.parse(message.processing_started_at) : NaN;
+    const absoluteAgeTripped = !Number.isNaN(parsed) && now - parsed >= ABSOLUTE_MAX_PROCESSING_MS;
+    if (!durationTripped && !absoluteAgeTripped) {
+      this.signalRedriveOutcomeUnreported(conv, message, outcome);
+      return "retry";
+    }
+    const arm = durationTripped ? "failure_window" : "absolute_age";
+    try {
+      await this.markFailed(
+        conv.id,
+        message.id,
+        void 0,
+        _ChannelDriver.REDRIVE_ABANDON_ERROR[outcome]
+      );
+    } catch (err) {
+      if (err instanceof ChannelAuthError) throw err;
+      this.log({
+        level: "warn",
+        message: `Re-drive bound: fallback markFailed for message ${message.id.slice(0, 8)} also failed (arm ${arm}, will retry next drain): ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conv.id,
+        message_id: message.id
+      });
+      if (!this.redriveOutcomeAbandonedSignalled.has(message.id)) {
+        this.redriveOutcomeAbandonedSignalled.add(message.id);
+        void this.postSignal(conv.id, message.id, "redrive_outcome_abandoned", {
+          attempted_outcome: outcome,
+          reported: false,
+          arm
+        });
+      }
+      return "retry";
+    }
+    this.clearRedriveUnresolved(message.id);
+    void this.postSignal(conv.id, message.id, "redrive_outcome_abandoned", {
+      attempted_outcome: outcome,
+      reported: true,
+      arm
+    });
+    return "abandoned";
+  }
+  /**
+   * Record one poll outcome toward the re-drive fence's consecutive-identical-
+   * failure streak (#1348) and return the resulting count. `signature === null`
+   * (a thrown exception, H1) always clears the streak and returns `0` — it is
+   * never countable. Otherwise the streak continues only when BOTH the session
+   * and the signature match the previous failure; anything else (a different
+   * session, or the same session failing a DIFFERENT way) starts a fresh streak
+   * at `1`.
+   */
+  recordRedrivePollFailure(messageId, sessionId, signature) {
+    if (signature === null) {
+      this.redrivePollFailures.delete(messageId);
+      return 0;
+    }
+    const existing = this.redrivePollFailures.get(messageId);
+    if (existing && existing.sessionId === sessionId && existing.signature === signature) {
+      existing.count += 1;
+      return existing.count;
+    }
+    this.redrivePollFailures.set(messageId, { sessionId, signature, count: 1 });
+    return 1;
+  }
+  /**
+   * Record one UNCONFIRMED-dispatch outcome (a `pending` row with no stored
+   * `opencode_message_id` whose `sendPromptAsync` returned `null`) toward the
+   * bound in `processConversation`'s dispatch loop, and return the resulting
+   * count. Mirrors `recordRedrivePollFailure`'s session-scoping: a session
+   * change starts a fresh streak at `1` rather than inheriting the old one's
+   * count, since a new session is a genuinely different attempt.
+   */
+  recordUnconfirmedDispatch(messageId, sessionId) {
+    const existing = this.unconfirmedDispatchFailures.get(messageId);
+    if (existing && existing.sessionId === sessionId) {
+      existing.count += 1;
+      return existing.count;
+    }
+    this.unconfirmedDispatchFailures.set(messageId, { sessionId, count: 1 });
+    return 1;
   }
   /**
    * Record that `sessionId` is no longer a valid binding for `conversationId`
@@ -3980,6 +4304,13 @@ var ChannelDriver = class _ChannelDriver {
    * `refusedSessionId` is set when the #553 guard fired — i.e. the persisted
    * binding was an id this runner had abandoned, so a resurrection genuinely
    * happened and a fresh session was bound instead. The caller reports it.
+   *
+   * `created` says the returned session was made JUST NOW, so it provably holds
+   * no prior turn. The re-drive fence needs that as CONTRARY evidence ("nothing
+   * to reconcile against") — distinct from the ambiguous "I polled and saw an
+   * empty transcript", which stays a deferral. Keep it separate from
+   * `refusedSessionId`: only the latter means a #553 resurrection happened, and
+   * only it may drive the `session_superseded` signal.
    */
   async ensureSession(conv) {
     const bound = this.sessions.get(conv.id) ?? conv.opencode_session_id ?? null;
@@ -3990,7 +4321,11 @@ var ChannelDriver = class _ChannelDriver {
         conversation_id: conv.id
       });
       this.sessions.delete(conv.id);
-      return { sessionId: await this.createAndBindSession(conv.id), refusedSessionId: bound };
+      return {
+        sessionId: await this.createAndBindSession(conv.id),
+        refusedSessionId: bound,
+        created: true
+      };
     }
     if (bound) {
       const exists = await sessionExists(this.port, bound);
@@ -4001,12 +4336,12 @@ var ChannelDriver = class _ChannelDriver {
           conversation_id: conv.id
         });
         this.sessions.delete(conv.id);
-        return { sessionId: await this.createAndBindSession(conv.id) };
+        return { sessionId: await this.createAndBindSession(conv.id), created: true };
       }
       this.sessions.set(conv.id, bound);
-      return { sessionId: bound };
+      return { sessionId: bound, created: false };
     }
-    return { sessionId: await this.createAndBindSession(conv.id) };
+    return { sessionId: await this.createAndBindSession(conv.id), created: true };
   }
   /**
    * Create a fresh OpenCode session for a conversation, cache the binding, and
@@ -4435,9 +4770,8 @@ var ChannelDriver = class _ChannelDriver {
     const awaitingHuman = observedOpen || latchedPaused;
     if ((state === "running" || state === "done" || state === "failed") && !inFlight.started) {
       const title = await this.resolveSessionTitle(sessionId, watcher.conv.id);
-      let claimed;
       try {
-        claimed = await this.markProcessing(
+        await this.markProcessing(
           conv.id,
           inFlight.evidentMessageId,
           sessionId,
@@ -4446,23 +4780,24 @@ var ChannelDriver = class _ChannelDriver {
         );
       } catch (err) {
         if (err instanceof ChannelAuthError) throw err;
-        this.log({
-          level: "warn",
-          message: `Failed to mark message ${inFlight.evidentMessageId.slice(0, 8)} processing (will retry next tick): ${err instanceof Error ? err.message : String(err)}`,
-          conversation_id: conv.id,
-          message_id: inFlight.evidentMessageId
-        });
-        return;
+        if (err instanceof ChannelTerminalError) {
+          this.log({
+            level: "error",
+            message: `Failed to mark message ${inFlight.evidentMessageId.slice(0, 8)} processing (terminal HTTP ${err.status}) \u2014 the server definitively refused the swap`,
+            conversation_id: conv.id,
+            message_id: inFlight.evidentMessageId
+          });
+        } else {
+          this.log({
+            level: "warn",
+            message: `Failed to mark message ${inFlight.evidentMessageId.slice(0, 8)} processing (will retry next tick): ${err instanceof Error ? err.message : String(err)}`,
+            conversation_id: conv.id,
+            message_id: inFlight.evidentMessageId
+          });
+          return;
+        }
       }
       inFlight.started = true;
-      if (!claimed) {
-        this.log({
-          level: "debug",
-          message: `Message ${inFlight.evidentMessageId.slice(0, 8)} already marked processing \u2014 continuing`,
-          conversation_id: conv.id,
-          message_id: inFlight.evidentMessageId
-        });
-      }
     }
     if (state === "done") {
       await this.settleMessageDone(sessionId, watcher, inFlight, messages);
@@ -5092,15 +5427,39 @@ var ChannelDriver = class _ChannelDriver {
     }
     if (ocId === null) {
       this.awaitingReadopt.delete(row.id);
+      const streak = this.recordUnconfirmedDispatch(row.id, sessionId);
+      if (streak >= MAX_IDENTICAL_REDRIVE_POLL_FAILURES) {
+        this.unconfirmedDispatchFailures.delete(row.id);
+        this.sessions.delete(readoptConv.id);
+        this.supersede(readoptConv.id, sessionId);
+        const errorMessage = `OpenCode accepted this re-dispatched message ${streak} times in a row but never confirmed its assigned id (session ${sessionId.slice(0, 8)}'s message list could not be read back) \u2014 the session was abandoned; a fresh one is used for further messages.`;
+        this.log({
+          level: "error",
+          message: errorMessage,
+          conversation_id: row.conversation_id,
+          message_id: row.id
+        });
+        await this.markFailed(row.conversation_id, row.id, null, errorMessage).catch((markErr) => {
+          this.log({
+            level: "warn",
+            message: `markFailed PATCH for message ${row.id.slice(0, 8)} (conversation ${row.conversation_id.slice(0, 8)}) failed (best-effort, not retried): ${markErr instanceof Error ? markErr.message : String(markErr)}`,
+            conversation_id: row.conversation_id,
+            message_id: row.id
+          });
+        });
+        void this.postSignal(row.conversation_id, row.id, "readopt_orphan_unsent");
+        return;
+      }
       this.log({
         level: "warn",
-        message: `Re-adopt: message ${row.id.slice(0, 8)} re-dispatched but its opencode id could not be read back \u2014 leaving un-tracked to retry next drain`,
+        message: `Re-adopt: message ${row.id.slice(0, 8)} re-dispatched but its opencode id could not be read back (${streak}/${MAX_IDENTICAL_REDRIVE_POLL_FAILURES}) \u2014 leaving un-tracked to retry next drain`,
         conversation_id: row.conversation_id,
         message_id: row.id
       });
       void this.postSignal(row.conversation_id, row.id, "readopt_orphan_unsent");
       return;
     }
+    this.unconfirmedDispatchFailures.delete(row.id);
     this.registerReadopted(readoptConv, sessionId, readoptMessage, ocId, this.processedAtMs(row));
     this.dispatched.add(row.id);
     this.readopted.add(row.id);
@@ -5765,18 +6124,22 @@ var ChannelDriver = class _ChannelDriver {
    * opencode_session_id}` → `notifyMessageStarted` (hourglass→runner swap +
    * deep-linked "View in Evident" notice).
    *
-   * Return/throw contract (consumed by the watcher's swap-to-running guard):
-   *   - returns `true`  → the server transitioned the row to processing;
-   *   - returns `false` → the server gave a DEFINITIVE "already-processing"
-   *                       answer (a non-retryable, non-auth status — e.g. a
-   *                       conflict because a duplicate already transitioned it),
-   *                       so the caller treats it as already-started and does NOT
-   *                       retry;
-   *   - throws `ChannelAuthError` on 401/403 (terminal auth failure);
-   *   - throws on a TRANSIENT failure (retryable 5xx/429 status, or a
-   *     network-level error from `fetch`) — i.e. NO definitive server response —
-   *     so the caller leaves the message un-started and retries the swap on the
-   *     next tick.
+   * Outcome contract (consumed by the watcher's swap-to-running guard):
+   *   - resolves (`void`)             → the server transitioned the row to
+   *                                     processing (or idempotently confirmed
+   *                                     already-processing — that answer is
+   *                                     still a 200, never a refusal);
+   *   - throws `ChannelAuthError`     → 401/403 (terminal auth failure);
+   *   - throws `ChannelTerminalError` → a definitive non-retryable, non-auth 4xx
+   *                                     (404 the row or its conversation is
+   *                                     gone, 400 the update was rejected).
+   *                                     Retrying cannot help;
+   *   - throws a plain `Error`       → a TRANSIENT failure (retryable 5xx/429
+   *                                     status, or a network-level error from
+   *                                     `fetch`) — i.e. NO definitive server
+   *                                     response — so the caller leaves the
+   *                                     message un-started and retries the swap
+   *                                     on the next tick.
    * A single attempt (no internal retry): the watcher's per-tick loop is the
    * retry vehicle for the swap-to-running.
    */
@@ -5795,11 +6158,11 @@ var ChannelDriver = class _ChannelDriver {
       }
     );
     this.assertAuth(res, "marking message as processing");
-    if (res.ok) return true;
+    if (res.ok) return;
     if (isRetryableStatus(res.status)) {
       throw new Error(`marking message as processing: HTTP ${res.status}`);
     }
-    return false;
+    throw new ChannelTerminalError(`marking message as processing: HTTP ${res.status}`, res.status);
   }
   /**
    * EXISTING combinedAuth completion route — idempotent (WI-CHAN-2). `PATCH