@evident-ai/cli 3.3.1-dev.9eed666 → 3.3.1-dev.a4bb60b

package/dist/index.js

@@ -1700,13 +1700,22 @@ function buildNoProviderWarning(hasProvider) {
   return "Warning: opencode has no authenticated model provider configured, so it won't be able to answer prompts. Run `opencode auth login` to set one up (see https://opencode.ai for details).";
 }
 
+// src/lib/http-timeout.ts
+var REQUEST_TIMEOUT_MS = 6e4;
+function withRequestTimeout(fetchImpl, timeoutMs) {
+  return ((input, init) => fetchImpl(input, { ...init, signal: AbortSignal.timeout(timeoutMs) }));
+}
+
 // src/lib/opencode/session.ts
+function timedFetch(input, init) {
+  return withRequestTimeout(fetch, REQUEST_TIMEOUT_MS)(input, init);
+}
 function opencodeBase(port) {
   return `http://127.0.0.1:${port}`;
 }
 async function getOpenCodeDirectory(port) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/path`);
+    const res = await timedFetch(`${opencodeBase(port)}/path`);
     if (!res.ok) return null;
     const body = await res.json();
     const dir = typeof body.directory === "string" && body.directory || typeof body.worktree === "string" && body.worktree || typeof body.path?.cwd === "string" && body.path.cwd || typeof body.path?.directory === "string" && body.path.directory || null;
@@ -1757,7 +1766,7 @@ function isAssistantInFlight(m) {
 }
 async function getSessionMessages(port, sessionId) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/session/${sessionId}/message`);
+    const res = await timedFetch(`${opencodeBase(port)}/session/${sessionId}/message`);
     if (!res.ok) return null;
     const body = await res.json();
     return Array.isArray(body) ? body : null;
@@ -1787,7 +1796,7 @@ function sessionLastActivityMs(session) {
 }
 async function listSessions(port) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/session`);
+    const res = await timedFetch(`${opencodeBase(port)}/session`);
     if (!res.ok) return null;
     const body = await res.json();
     return Array.isArray(body) ? body : null;
@@ -1797,7 +1806,7 @@ async function listSessions(port) {
 }
 async function deleteSession(port, id) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/session/${id}`, { method: "DELETE" });
+    const res = await timedFetch(`${opencodeBase(port)}/session/${id}`, { method: "DELETE" });
     return res.status >= 200 && res.status < 300;
   } catch {
     return false;
@@ -1805,7 +1814,7 @@ async function deleteSession(port, id) {
 }
 async function sessionExists(port, id) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/session/${id}`);
+    const res = await timedFetch(`${opencodeBase(port)}/session/${id}`);
     if (res.status >= 200 && res.status < 300) return true;
     if (res.status === 404) return false;
     return null;
@@ -1815,7 +1824,7 @@ async function sessionExists(port, id) {
 }
 async function getSessionStatuses(port) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/session/status`);
+    const res = await timedFetch(`${opencodeBase(port)}/session/status`);
     if (!res.ok) {
       console.error(
         `[getSessionStatuses] GET /session/status returned HTTP ${res.status} (port ${port})`
@@ -1848,7 +1857,7 @@ async function createOpenCodeSession(port, directory) {
   if (directory && directory.trim()) {
     url.searchParams.set("directory", directory.trim());
   }
-  const response = await fetch(url, {
+  const response = await timedFetch(url, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({})
@@ -1862,7 +1871,7 @@ async function createOpenCodeSession(port, directory) {
 }
 async function getModelAttachmentCapability(port, model) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/config/providers`);
+    const res = await timedFetch(`${opencodeBase(port)}/config/providers`);
     if (!res.ok) {
       console.error(
         `[getModelAttachmentCapability] GET /config/providers returned HTTP ${res.status} (port ${port})`
@@ -1995,7 +2004,7 @@ async function sendPromptAsync(port, sessionId, content, options, attachments) {
       };
     }
   }
-  const res = await fetch(`${opencodeBase(port)}/session/${sessionId}/prompt_async`, {
+  const res = await timedFetch(`${opencodeBase(port)}/session/${sessionId}/prompt_async`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify(body)
@@ -2244,7 +2253,7 @@ function hasRunningAssistantExcept(messages, exceptUserMessageId) {
 }
 async function hasAnyConfiguredProvider(port) {
   try {
-    const res = await fetch(`${opencodeBase(port)}/config/providers`);
+    const res = await timedFetch(`${opencodeBase(port)}/config/providers`);
     if (!res.ok) {
       console.error(
         `[hasAnyConfiguredProvider] GET /config/providers returned HTTP ${res.status} (port ${port})`
@@ -3413,8 +3422,13 @@ var B2_ABANDONMENT_MIN_PINNED_MS = 3 * 6e4;
 var AMBIGUOUS_FINISH_MAX_PINNED_MS = 3 * 6e4;
 var B2_ABANDONMENT_RECHECK_MS = HEARTBEAT_MS;
 var POLL_MISS_GRACE_MS = HEARTBEAT_MS;
+var WATCHER_STALL_MS = 3 * POLL_MISS_GRACE_MS;
+var MAX_WATCHER_STALL_RESTARTS = 3;
+var MAX_RELEASED_OPENCODE_IDS = 256;
 var MAX_SUPERSEDED_CONVERSATIONS = 256;
 var MAX_IDENTICAL_REDRIVE_POLL_FAILURES = 5;
+var WEDGE_WARNING_INTERVAL_MS = 5 * 60 * 1e3;
+var MAX_WEDGED_CONVERSATIONS = 256;
 var ChannelAuthError = class extends Error {
   constructor(message) {
     super(message);
@@ -3458,6 +3472,8 @@ var ChannelDriver = class _ChannelDriver {
   fileSyncDirectories;
   homeDir;
   maxActiveSessions;
+  watcherStallMs;
+  wedgeWarningIntervalMs;
   /** Cache of conversationId → opencode sessionId. */
   sessions = /* @__PURE__ */ new Map();
   /**
@@ -3488,6 +3504,40 @@ var ChannelDriver = class _ChannelDriver {
    * bounded cost.
    */
   supersededSessions = /* @__PURE__ */ new Map();
+  /**
+   * Local re-drive fence for a message force-released by the stall watchdog
+   * (#1618, `reconcileWatchers`'s `unrecoverable_released` arm — the only writer,
+   * see `recordReleasedOpencodeId`). The row's server-side `opencode_message_id`
+   * is `null` for exactly this shape (its `markProcessing` never landed), so
+   * without a local record of the id the driver last knew, the next drain's
+   * `if (message.opencode_message_id)` re-drive-fence check at
+   * `processConversation` would not engage and it would blind-`prompt_async`
+   * a turn that may still be running in opencode — the one duplicate-turn
+   * hazard this whole design exists to close (§3/D1 of the drain-wedge plan).
+   * `processConversation` reads `message.opencode_message_id ?? this
+   * .releasedOpencodeIds.get(id)?.opencodeMessageId` as the EFFECTIVE id and
+   * threads it into `resolveRedrive`, which asks opencode itself whether the
+   * turn is still ongoing before ever dispatching.
+   *
+   * Bounded FIFO, mirroring `supersededSessions` above (`MAX_RELEASED_OPENCODE_IDS`,
+   * `recordReleasedOpencodeId`). Cleared by `clearRedriveUnresolved` (every
+   * non-`unresolved` `resolveRedrive` outcome fires it, including a fresh
+   * dispatch) and at the top-level fresh-dispatch site, so it does not outlive
+   * the row it was recorded for.
+   */
+  releasedOpencodeIds = /* @__PURE__ */ new Map();
+  /**
+   * Per-conversation throttle state for the #183 recurrence warning (#1618
+   * WI-4) — see `reportWedgedConversation`'s doc comment for why this exists.
+   * `firstWedgedAt` anchors `stuck_for_ms`; `lastWarnedAt` throttles both the
+   * log line and the `dispatch_wedged` signal to at most once per
+   * `wedgeWarningIntervalMs`; `consecutiveTicks` is reported in the log text
+   * so the operator sees magnitude, not repetition. Cleared the moment the
+   * conversation dispatches anything (a fresh wedge, if it recurs, is a new
+   * incident). Bounded FIFO, mirroring `supersededSessions`
+   * (`MAX_WEDGED_CONVERSATIONS`).
+   */
+  wedgeWarnings = /* @__PURE__ */ new Map();
   /**
    * Per-opencode-session dispatch lock (Task 2.1a). `sendPromptAsync` is no
    * longer idempotent (no caller-supplied `messageID`), and its read-back picks
@@ -3730,7 +3780,10 @@ var ChannelDriver = class _ChannelDriver {
     this.retry = { ...DEFAULT_RETRY_POLICY, ...config.retry };
     this.log = config.log ?? (() => {
     });
-    this.fetchImpl = config.fetchImpl ?? fetch;
+    this.fetchImpl = withRequestTimeout(
+      config.fetchImpl ?? fetch,
+      config.requestTimeoutMs ?? REQUEST_TIMEOUT_MS
+    );
     this.sleep = config.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     this.pausedPollIntervalMs = config.pausedPollIntervalMs ?? DEFAULT_PAUSED_POLL_INTERVAL_MS;
     this.pausedMaxWaitMs = config.pausedMaxWaitMs ?? DEFAULT_PAUSED_MAX_WAIT_MS;
@@ -3739,6 +3792,8 @@ var ChannelDriver = class _ChannelDriver {
     this.fileSyncDirectories = config.fileSyncDirectories ?? [];
     this.homeDir = config.homeDir ?? homedir2();
     this.maxActiveSessions = config.maxActiveSessions;
+    this.watcherStallMs = config.watcherStallMs ?? WATCHER_STALL_MS;
+    this.wedgeWarningIntervalMs = config.wedgeWarningIntervalMs ?? WEDGE_WARNING_INTERVAL_MS;
   }
   /** The IPv4-loopback base URL for the local `opencode serve`. */
   get opencodeBase() {
@@ -3752,6 +3807,14 @@ var ChannelDriver = class _ChannelDriver {
    * @returns the number of messages NEWLY dispatched to opencode's native queue.
    */
   async drainPending() {
+    try {
+      this.reconcileWatchers();
+    } catch (err) {
+      this.log({
+        level: "error",
+        message: `Watchdog: reconcileWatchers threw unexpectedly (drain continues): ${err instanceof Error ? err.message : String(err)}`
+      });
+    }
     if (this.stopped) return 0;
     if (this.draining) return 0;
     this.draining = true;
@@ -4005,8 +4068,15 @@ var ChannelDriver = class _ChannelDriver {
         skippedAlreadyDispatched += 1;
         continue;
       }
-      if (message.opencode_message_id) {
-        const outcome = await this.resolveRedrive(conv, sessionId, message, sessionCreated);
+      const effectiveOpencodeMessageId = message.opencode_message_id ?? this.releasedOpencodeIds.get(message.id)?.opencodeMessageId ?? null;
+      if (effectiveOpencodeMessageId) {
+        const outcome = await this.resolveRedrive(
+          conv,
+          sessionId,
+          message,
+          sessionCreated,
+          effectiveOpencodeMessageId
+        );
         if (outcome === "abandoned") {
           continue;
         }
@@ -4117,21 +4187,102 @@ var ChannelDriver = class _ChannelDriver {
       }
       this.unconfirmedDispatchFailures.delete(message.id);
       this.dispatchNotStartedSignalled.delete(message.id);
+      this.releasedOpencodeIds.delete(message.id);
       this.dispatched.add(message.id);
       this.registerInFlight(conv, sessionId, message, opencodeMessageId);
       dispatched += 1;
       void this.postSignal(conv.id, message.id, "dispatched");
     }
     if (messages.length > 0 && dispatched === 0 && skippedAlreadyDispatched === messages.length) {
-      this.log({
-        level: "warn",
-        message: `Conversation ${conv.id.slice(0, 8)} has ${messages.length} pending message(s) but ALL are already marked dispatched locally (in-flight set: ${this.dispatched.size}) \u2014 none sent to OpenCode this tick. If this repeats, a message may be stuck acknowledged-but-never-dispatched (its watcher never settled).`,
-        conversation_id: conv.id
-      });
+      this.reportWedgedConversation(conv, messages);
+    } else if (dispatched > 0) {
+      this.wedgeWarnings.delete(conv.id);
     }
     this.ensureWatcherRunning(sessionId);
     return dispatched;
   }
+  /**
+   * The #183 "eyes but nothing sent" recurrence for `conv`, throttled and
+   * escalated (#1618 WI-4). `messages` is the conversation's full pending list
+   * on THIS tick — the caller has already confirmed every one of them is a
+   * skip-because-already-`dispatched`, the exact signature of a message stuck
+   * acknowledged-but-never-worked.
+   *
+   * Unthrottled, this fired every ~6s drain tick for as long as a wedge lasted
+   * (52,843 occurrences observed in one incident) — burning the GLOBAL
+   * 30-events/60s `runner-activity-telemetry.ts` budget that was itself
+   * suppressing the diagnostics needed to debug the wedge. The `warn` log (and
+   * the `dispatch_wedged` signal once the wedge has persisted past the same
+   * interval) fire at most once per `wedgeWarningIntervalMs` per conversation,
+   * naming the consecutive-tick count so the operator sees magnitude rather
+   * than repetition.
+   *
+   * Deliberately does NOT trigger a release: WI-1's `reconcileWatchers` runs
+   * unconditionally on this same tick and is already recovering anything it
+   * can see. This is reporting only — see `countUntrackedIds`'s doc for the
+   * one case it recovers nothing FOR (§3/D5 of the drain-wedge plan).
+   */
+  reportWedgedConversation(conv, messages) {
+    const now = this.now();
+    const existing = this.wedgeWarnings.get(conv.id);
+    const firstWedgedAt = existing?.firstWedgedAt ?? now;
+    const consecutiveTicks = (existing?.consecutiveTicks ?? 0) + 1;
+    const dueForWarn = !existing || now - existing.lastWarnedAt >= this.wedgeWarningIntervalMs;
+    if (!dueForWarn) {
+      this.wedgeWarnings.delete(conv.id);
+      this.wedgeWarnings.set(conv.id, {
+        firstWedgedAt,
+        lastWarnedAt: existing.lastWarnedAt,
+        consecutiveTicks
+      });
+      return;
+    }
+    const stuckForMs = now - firstWedgedAt;
+    const untracked = this.countUntrackedIds(messages);
+    this.log({
+      level: "warn",
+      message: `Conversation ${conv.id.slice(0, 8)} has ${messages.length} pending message(s) but ALL are already marked dispatched locally (in-flight set: ${this.dispatched.size}) \u2014 none sent to OpenCode for ${consecutiveTicks} consecutive tick(s) now (${stuckForMs}ms stuck). ` + (untracked > 0 ? `${untracked} of these id(s) are tracked by NO watcher \u2014 the dispatched/in-flight pairing invariant is violated for this conversation, which will NOT self-heal and needs a runner restart.` : `A watcher is tracking this work; the loop-liveness watchdog is already recovering it.`),
+      conversation_id: conv.id
+    });
+    this.wedgeWarnings.delete(conv.id);
+    this.wedgeWarnings.set(conv.id, { firstWedgedAt, lastWarnedAt: now, consecutiveTicks });
+    while (this.wedgeWarnings.size > MAX_WEDGED_CONVERSATIONS) {
+      const oldest = this.wedgeWarnings.keys().next().value;
+      if (oldest === void 0) break;
+      this.wedgeWarnings.delete(oldest);
+    }
+    if (stuckForMs >= this.wedgeWarningIntervalMs) {
+      void this.postSignal(conv.id, messages[0].id, "dispatch_wedged", {
+        stuck_for_ms: stuckForMs,
+        untracked
+      });
+    }
+  }
+  /**
+   * How many of `messages`' ids are tracked by NO watcher's `inFlight` (#1618
+   * WI-4) — the §3/D5 orphan discriminator. `reconcileWatchers` proves the
+   * `dispatched`/`inFlight` pairing invariant holds by construction across
+   * every `dispatched.add` site (see its own doc comment), so `> 0` here means
+   * that invariant has actually been violated for this conversation: there is
+   * no watcher for WI-1's watchdog to restart, so it will NOT self-heal.
+   * `=== 0` means an ordinary stalled/exited watcher, which WI-1 is already
+   * recovering. One pass over `this.watchers`, called only when the throttled
+   * warning above is due to fire — not every tick.
+   */
+  countUntrackedIds(messages) {
+    let untracked = 0;
+    for (const message of messages) {
+      let tracked = false;
+      for (const watcher of this.watchers.values()) {
+        if (watcher.inFlight.has(message.id)) {
+          tracked = true;
+          break;
+        }
+      }
+      if (!tracked) untracked += 1;
+    }
+    return untracked;
+  }
   /**
    * Poll a session's message list for the re-drive fence (#965), via the
    * INJECTED `fetchImpl` — NOT the imported `getSessionMessages` helper, which
@@ -4200,9 +4351,16 @@ var ChannelDriver = class _ChannelDriver {
    * for, `resolveRedriveUnresolved`'s own `pausedMaxWaitMs` bound below. Every
    * other failure resolves to `unresolved` and is retried whole on the next
    * ~2s drain tick.
+   *
+   * `effectiveOpencodeMessageId` (#1618) is the caller-resolved id: the real
+   * server `opencode_message_id` when present, else the stall watchdog's local
+   * `releasedOpencodeIds` fence. Read it here rather than re-deriving it from
+   * `message` so every line below — and the signals this method posts —
+   * keeps reporting the REAL server row; a shadow-copied `message` would
+   * silently diverge from it.
    */
-  async resolveRedrive(conv, sessionId, message, sessionCreated) {
-    const ocId = message.opencode_message_id ?? null;
+  async resolveRedrive(conv, sessionId, message, sessionCreated, effectiveOpencodeMessageId) {
+    const ocId = effectiveOpencodeMessageId;
     if (sessionCreated) {
       this.clearRedriveUnresolved(message.id);
       void this.postSignal(conv.id, message.id, "redrive_redispatched");
@@ -4432,7 +4590,13 @@ var ChannelDriver = class _ChannelDriver {
     }
     return "unresolved";
   }
-  /** Clear all `unresolved`/failure-streak trackers for a row (any non-`unresolved` outcome). */
+  /**
+   * Clear all `unresolved`/failure-streak trackers for a row (any non-`unresolved`
+   * outcome) — including the stall watchdog's local re-drive fence (#1618): once
+   * `resolveRedrive` has resolved to dispatch/reattach/settle, the row either has
+   * a real server-side `opencode_message_id` again or is no longer pending, so
+   * the fence entry is no longer needed.
+   */
   clearRedriveUnresolved(messageId) {
     this.redriveUnresolvedSince.delete(messageId);
     this.redriveUnresolvedSignalled.delete(messageId);
@@ -4440,6 +4604,7 @@ var ChannelDriver = class _ChannelDriver {
     this.redriveOutcomeUnreportedSignalled.delete(messageId);
     this.redriveOutcomeFailingSince.delete(messageId);
     this.redriveOutcomeAbandonedSignalled.delete(messageId);
+    this.releasedOpencodeIds.delete(messageId);
   }
   /**
    * #1340: the dispatch loop reached a message and did NOT start a turn. Fires at
@@ -4594,6 +4759,21 @@ var ChannelDriver = class _ChannelDriver {
       this.supersededSessions.delete(oldest);
     }
   }
+  /**
+   * Record the local re-drive fence for a message force-released without
+   * completing (#1618) — see the `releasedOpencodeIds` field doc. Call BEFORE
+   * `removeInFlight`, which is about to drop the `InFlightMessage` this reads
+   * `opencodeMessageId` from. Hard-capped FIFO, same shape as `supersede`.
+   */
+  recordReleasedOpencodeId(evidentMessageId, sessionId, opencodeMessageId) {
+    this.releasedOpencodeIds.delete(evidentMessageId);
+    this.releasedOpencodeIds.set(evidentMessageId, { sessionId, opencodeMessageId });
+    while (this.releasedOpencodeIds.size > MAX_RELEASED_OPENCODE_IDS) {
+      const oldest = this.releasedOpencodeIds.keys().next().value;
+      if (oldest === void 0) return;
+      this.releasedOpencodeIds.delete(oldest);
+    }
+  }
   /** Whether `sessionId` is the session this conversation has abandoned (#553). */
   isSuperseded(conversationId, sessionId) {
     return this.supersededSessions.get(conversationId) === sessionId;
@@ -4825,15 +5005,7 @@ var ChannelDriver = class _ChannelDriver {
   registerInFlight(conv, sessionId, message, opencodeMessageId) {
     let watcher = this.watchers.get(sessionId);
     if (!watcher) {
-      watcher = {
-        conv,
-        inFlight: /* @__PURE__ */ new Map(),
-        loop: null,
-        reportedQuestions: /* @__PURE__ */ new Set(),
-        reportedPermissions: /* @__PURE__ */ new Set(),
-        lastGoodPollAt: this.now(),
-        hadUsablePoll: false
-      };
+      watcher = this.newSessionWatcher(conv);
       this.watchers.set(sessionId, watcher);
     }
     const now = this.now();
@@ -4864,6 +5036,27 @@ var ChannelDriver = class _ChannelDriver {
       ambiguousResolved: false
     });
   }
+  /**
+   * Build a fresh `SessionWatcher`. Seeds `lastTickAt`/`lastObservedTickAt`
+   * EQUAL (#1618) so a watcher whose loop has not started ticking yet is never
+   * misread as stalled by the very first reconciliation that sees it.
+   */
+  newSessionWatcher(conv) {
+    const now = this.now();
+    return {
+      conv,
+      inFlight: /* @__PURE__ */ new Map(),
+      loop: null,
+      reportedQuestions: /* @__PURE__ */ new Set(),
+      reportedPermissions: /* @__PURE__ */ new Set(),
+      lastGoodPollAt: now,
+      hadUsablePoll: false,
+      generation: 0,
+      lastTickAt: now,
+      lastObservedTickAt: now,
+      consecutiveStallRestarts: 0
+    };
+  }
   /**
    * Register a RE-ADOPTED `processing` message with its session watcher
    * (ADR-0046, WI-4). Mirrors `registerInFlight` but anchors the give-up
@@ -4893,15 +5086,7 @@ var ChannelDriver = class _ChannelDriver {
   registerReadopted(conv, sessionId, message, opencodeMessageId, processedAtMs) {
     let watcher = this.watchers.get(sessionId);
     if (!watcher) {
-      watcher = {
-        conv,
-        inFlight: /* @__PURE__ */ new Map(),
-        loop: null,
-        reportedQuestions: /* @__PURE__ */ new Set(),
-        reportedPermissions: /* @__PURE__ */ new Set(),
-        lastGoodPollAt: this.now(),
-        hadUsablePoll: false
-      };
+      watcher = this.newSessionWatcher(conv);
       this.watchers.set(sessionId, watcher);
     }
     watcher.inFlight.set(message.id, {
@@ -4945,12 +5130,110 @@ var ChannelDriver = class _ChannelDriver {
       ambiguousResolved: false
     });
   }
+  /**
+   * Loop-liveness watchdog (#1618). Runs once per `drainPending()` tick and
+   * restarts any per-session watcher whose loop has exited or stopped ticking
+   * — escalating to a bounded force-release only once
+   * `MAX_WATCHER_STALL_RESTARTS` consecutive restarts have failed to recover
+   * it. Fully synchronous: it only inspects in-memory state and calls the
+   * synchronous `ensureWatcherRunning`/`removeInFlight`, which is what lets it
+   * run from the very top of `drainPending()` — ahead of the un-timed
+   * `getPendingConversations()` await that would otherwise be able to disable
+   * it (`run.ts`'s poll loop is sequential, so a hung fetch there stops
+   * `drainPending()` from being CALLED again at all, not just from finishing).
+   *
+   * Restarts the loop rather than releasing messages directly: a blind release
+   * would let the next drain re-`prompt_async` a turn that may still be
+   * running (ADR-0047; see `releasedOpencodeIds`'s doc). A restarted loop
+   * re-polls with each message's `opencodeMessageId` still in hand and lets
+   * the existing, audited `!activelyRunning` give-up decide, same as it always
+   * has.
+   *
+   * Deliberately does NOT sweep `this.dispatched` for an id no watcher tracks:
+   * that shape has no in-flight entry and therefore no `opencodeMessageId` to
+   * fence a release with, so releasing it here would blind-re-POST a possibly-
+   * running turn — and there is no conversation id in hand to signal with
+   * either. Detection for that shape lives on WI-4's `dispatch_wedged` signal
+   * instead, where a conversation id already exists. If you find yourself
+   * wanting to add a `dispatched` sweep here, don't — read the drain-wedge
+   * plan's §3/D5 first.
+   */
+  reconcileWatchers() {
+    const now = this.now();
+    for (const [sessionId, watcher] of [...this.watchers]) {
+      if (watcher.lastTickAt !== watcher.lastObservedTickAt) {
+        watcher.consecutiveStallRestarts = 0;
+      }
+      watcher.lastObservedTickAt = watcher.lastTickAt;
+      if (watcher.inFlight.size === 0 && watcher.loop === null) {
+        this.watchers.delete(sessionId);
+        continue;
+      }
+      if (watcher.loop === null && watcher.inFlight.size > 0) {
+        if (now - watcher.lastTickAt < this.watcherStallMs) continue;
+        this.log({
+          level: "warn",
+          message: `Watchdog: session ${sessionId.slice(0, 8)}'s watcher loop had exited with ${watcher.inFlight.size} message(s) still in flight (idle ${now - watcher.lastTickAt}ms) \u2014 restarting`,
+          conversation_id: watcher.conv.id
+        });
+        this.ensureWatcherRunning(sessionId);
+        for (const evidentMessageId of watcher.inFlight.keys()) {
+          void this.postSignal(watcher.conv.id, evidentMessageId, "watcher_recovered", {
+            recovery: "loop_exited"
+          });
+        }
+        continue;
+      }
+      if (watcher.loop !== null && now - watcher.lastTickAt >= this.watcherStallMs) {
+        const stalledForMs = now - watcher.lastTickAt;
+        watcher.consecutiveStallRestarts += 1;
+        if (watcher.consecutiveStallRestarts > MAX_WATCHER_STALL_RESTARTS) {
+          this.log({
+            level: "error",
+            message: `Watchdog: session ${sessionId.slice(0, 8)}'s watcher loop stalled through ${watcher.consecutiveStallRestarts} restarts (last stall ${stalledForMs}ms) \u2014 releasing its ${watcher.inFlight.size} in-flight message(s)`,
+            conversation_id: watcher.conv.id
+          });
+          for (const [evidentMessageId, inFlight] of [...watcher.inFlight]) {
+            this.recordReleasedOpencodeId(evidentMessageId, sessionId, inFlight.opencodeMessageId);
+            this.removeInFlight(watcher, evidentMessageId);
+            void this.postSignal(watcher.conv.id, evidentMessageId, "watcher_recovered", {
+              recovery: "unrecoverable_released"
+            });
+          }
+          watcher.generation += 1;
+          this.watchers.delete(sessionId);
+          continue;
+        }
+        watcher.generation += 1;
+        watcher.loop = null;
+        watcher.lastGoodPollAt = now;
+        watcher.lastTickAt = now;
+        watcher.lastObservedTickAt = watcher.lastTickAt;
+        this.ensureWatcherRunning(sessionId);
+        this.log({
+          level: "warn",
+          message: `Watchdog: session ${sessionId.slice(0, 8)}'s watcher loop had not ticked in ${stalledForMs}ms \u2014 restarted under generation ${watcher.generation} (${watcher.consecutiveStallRestarts}/${MAX_WATCHER_STALL_RESTARTS})`,
+          conversation_id: watcher.conv.id
+        });
+        for (const evidentMessageId of watcher.inFlight.keys()) {
+          void this.postSignal(watcher.conv.id, evidentMessageId, "watcher_recovered", {
+            recovery: "loop_stalled"
+          });
+        }
+      }
+    }
+  }
   /**
    * Start (but do NOT await) the per-session watcher loop if it has in-flight
    * work and is not already running. Single-flight per session. The loop is
    * tracked on the watcher and cleared when it settles; it never rejects (fully
    * guarded), so a failed poll/callback can never crash the run loop — the cron
    * stays as the safety net.
+   *
+   * The generation started here (#1618) is captured in the `.finally` closure
+   * so a RETIRED loop settling late — after `reconcileWatchers` has already
+   * restarted this watcher under a newer generation — can neither null the new
+   * loop's handle nor delete a watcher that still has live work.
    */
   ensureWatcherRunning(sessionId) {
     const watcher = this.watchers.get(sessionId);
@@ -4960,7 +5243,9 @@ var ChannelDriver = class _ChannelDriver {
       this.watchers.delete(sessionId);
       return;
     }
-    const loop = this.runWatcherLoop(sessionId, watcher).finally(() => {
+    const generation = watcher.generation;
+    const loop = this.runWatcherLoop(sessionId, watcher, generation).finally(() => {
+      if (watcher.generation !== generation) return;
       watcher.loop = null;
       if (watcher.inFlight.size === 0) {
         this.watchers.delete(sessionId);
@@ -4980,11 +5265,25 @@ var ChannelDriver = class _ChannelDriver {
    *      `source_message_id`;
    *   4. drops messages that completed or timed out from the in-flight set.
    * Exits when the in-flight set empties. Never throws.
+   *
+   * `generation` (#1618) is the incarnation this call was started under.
+   * `reconcileWatchers` can restart a stalled loop by bumping
+   * `watcher.generation` and starting a NEW `runWatcherLoop` over the same
+   * `SessionWatcher` object — the stalled promise itself cannot be cancelled,
+   * so this loop instead checks at the top of every iteration, right after
+   * waking from `sleep`, and right before servicing any message, and quietly
+   * retires (returns without touching anything) the moment it is no longer the
+   * watcher's current generation. Retiring mid-tick can still let ONE
+   * `serviceInFlightMessage` pass complete first — acceptable, since that
+   * method contains no non-idempotent action.
    */
-  async runWatcherLoop(sessionId, watcher) {
+  async runWatcherLoop(sessionId, watcher, generation) {
     try {
       while (watcher.inFlight.size > 0) {
+        if (watcher.generation !== generation) return;
+        watcher.lastTickAt = this.now();
         await this.sleep(this.pausedPollIntervalMs);
+        if (watcher.generation !== generation) return;
         let messages = null;
         try {
           const res = await this.fetchImpl(`${this.opencodeBase}/session/${sessionId}/message`);
@@ -5005,6 +5304,7 @@ var ChannelDriver = class _ChannelDriver {
           }
         }
         const { openQuestions, openPermissions, questionsPolledOk, permissionsPolledOk } = await this.pollInteractions(sessionId, watcher, messages);
+        if (watcher.generation !== generation) return;
         for (const inFlight of [...watcher.inFlight.values()]) {
           await this.serviceInFlightMessage(
             sessionId,
@@ -7418,23 +7718,46 @@ function scheduleClaudeUsageReporting(state, options) {
     return null;
   }
   let consecutiveFailures = 0;
-  let armed = false;
+  let phase = "dormant";
   let rearmRequested = false;
-  const scheduleNextTick = () => {
-    armed = true;
-    rearmRequested = false;
+  const armProbe = () => {
+    phase = "probe-pending";
+    state.claudeUsageTimer = setTimeout(() => void tick(true), FIRST_REPORT_DELAY_MS);
+  };
+  const scheduleNextTick = (reportedSuccessfully) => {
+    if (rearmRequested) {
+      rearmRequested = false;
+      armProbe();
+      return;
+    }
+    phase = reportedSuccessfully ? "steady-pending-healthy" : "steady-pending-retry";
     state.claudeUsageTimer = setTimeout(() => void tick(false), nextReportDelayMs());
   };
   const rearm = () => {
-    if (armed) {
-      rearmRequested = true;
-      return;
+    switch (phase) {
+      case "tick-in-flight":
+        rearmRequested = true;
+        return;
+      case "probe-pending":
+        return;
+      case "steady-pending-healthy":
+        return;
+      case "steady-pending-retry":
+        if (state.claudeUsageTimer) {
+          clearTimeout(state.claudeUsageTimer);
+          state.claudeUsageTimer = null;
+        }
+        rearmRequested = false;
+        armProbe();
+        return;
+      case "dormant":
+        rearmRequested = false;
+        armProbe();
+        return;
     }
-    rearmRequested = false;
-    armed = true;
-    state.claudeUsageTimer = setTimeout(() => void tick(true), FIRST_REPORT_DELAY_MS);
   };
   const tick = async (isProbe) => {
+    phase = "tick-in-flight";
     try {
       const usage = await getClaudeUsage();
       const result = await reportClaudeUsage(state.agentId, state.authHeader, usage);
@@ -7460,7 +7783,7 @@ function scheduleClaudeUsageReporting(state, options) {
           message: `Failed to report Claude usage: ${result.error}${claudeUsageFailureStreakSuffix(consecutiveFailures)}`
         });
       }
-      scheduleNextTick();
+      scheduleNextTick(result.ok);
     } catch (error2) {
       if (error2 instanceof ClaudeUsageError && isLocalCredentialProblem(error2)) {
         if (mode === "on") {
@@ -7469,14 +7792,14 @@ function scheduleClaudeUsageReporting(state, options) {
             level: "warn",
             message: "Claude usage reporting is forced on but no usable Claude Code login was found \u2014 run `claude` to sign in; reporting will keep retrying"
           });
-          scheduleNextTick();
+          scheduleNextTick(false);
         } else if (isProbe) {
           logActivity(state, {
             type: "info",
             level: "debug",
             message: `Claude usage reporting: ${error2.message}`
           });
-          armed = false;
+          phase = "dormant";
           if (rearmRequested) rearm();
         } else {
           logActivity(state, {
@@ -7484,7 +7807,7 @@ function scheduleClaudeUsageReporting(state, options) {
             level: "debug",
             message: `Claude usage reporting: ${error2.message}`
           });
-          scheduleNextTick();
+          scheduleNextTick(false);
         }
       } else {
         consecutiveFailures++;
@@ -7494,12 +7817,11 @@ function scheduleClaudeUsageReporting(state, options) {
           level: claudeUsageFailureLogLevel(consecutiveFailures),
           message: `Claude usage reporting failed: ${message}${claudeUsageFailureStreakSuffix(consecutiveFailures)}`
         });
-        scheduleNextTick();
+        scheduleNextTick(false);
       }
     }
   };
-  armed = true;
-  state.claudeUsageTimer = setTimeout(() => void tick(true), FIRST_REPORT_DELAY_MS);
+  armProbe();
   return rearm;
 }
 async function notifyOffline(state) {