@evident-ai/cli 3.5.2-dev.817a271 → 3.5.2-dev.8c3e0f7

package/dist/index.js

@@ -703,6 +703,31 @@ async function reportResourceUsage(agentId, authHeader, usage) {
     opencode_db_bytes: usage.opencodeDbBytes
   });
 }
+async function getRunnerCredentialVault(agentId, authHeader) {
+  const empty = { prefix: null, vaultId: null, source: null };
+  try {
+    const apiUrl = getApiUrlConfig();
+    const response = await fetch(`${apiUrl}/runners/${agentId}/credential-vault`, {
+      headers: { Authorization: authHeader },
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!response.ok) {
+      const serverMessage = await readErrorMessage(response);
+      return {
+        ...empty,
+        error: `HTTP ${response.status}${serverMessage ? `: ${serverMessage}` : ""}`
+      };
+    }
+    const data = await response.json();
+    return {
+      prefix: data.credential_vault_prefix,
+      vaultId: data.vault_id,
+      source: data.source
+    };
+  } catch (error2) {
+    return { ...empty, error: describeTimeoutError(error2, 1e4) };
+  }
+}
 async function getAgentInfo(agentId, authHeader) {
   const apiUrl = getApiUrlConfig();
   try {
@@ -877,6 +902,76 @@ async function status(options = {}) {
   process.exit(result.exitCode);
 }
 
+// src/commands/credential-vault-env.ts
+function shellQuote(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function printAssignment(prefix) {
+  console.log(`CREDENTIAL_VAULT_PREFIX=${shellQuote(prefix ?? "")}`);
+}
+function safeReason(reason, credentials2, authHeader) {
+  let safe = reason;
+  for (const secret of [
+    authHeader,
+    credentials2?.token,
+    process.env.EVIDENT_RUNNER_KEY,
+    process.env.EVIDENT_AGENT_KEY,
+    process.env.EVIDENT_TOKEN
+  ]) {
+    if (secret) safe = safe.replaceAll(secret, "[redacted]");
+  }
+  return safe.replace(/[\r\n]+/g, " ");
+}
+function printFallback(reason, credentials2, authHeader) {
+  printAssignment(null);
+  console.error(
+    `WARNING: ${safeReason(reason, credentials2, authHeader)}; using this runner's own credential prefix.`
+  );
+}
+async function credentialVaultEnv() {
+  let credentials2 = null;
+  let authHeader;
+  try {
+    credentials2 = await getAuthCredentials();
+    if (!credentials2) {
+      printFallback("no runner credentials are configured");
+      return;
+    }
+    authHeader = getAuthHeader(credentials2);
+    const runner = await resolveAgentIdFromKey(authHeader);
+    if (!runner.agent_id) {
+      printFallback(
+        runner.error ?? "the runner identity could not be resolved",
+        credentials2,
+        authHeader
+      );
+      return;
+    }
+    const lookup = await getRunnerCredentialVault(runner.agent_id, authHeader);
+    if (lookup.error) {
+      printFallback(`credential vault lookup failed: ${lookup.error}`, credentials2, authHeader);
+      return;
+    }
+    if (lookup.prefix === null) {
+      printFallback("this runner is not linked to a credential vault", credentials2, authHeader);
+      return;
+    }
+    if (/[\r\n]/.test(lookup.prefix)) {
+      printFallback("credential vault lookup returned an invalid prefix", credentials2, authHeader);
+      return;
+    }
+    printAssignment(lookup.prefix);
+    console.error(
+      `VAULT-MODE: credential stores use vault=${lookup.vaultId} source=${lookup.source} prefix=${lookup.prefix}.`
+    );
+  } catch (error2) {
+    const detail = credentials2 === null ? "credential resolution failed" : `credential vault lookup could not be completed: ${error2 instanceof Error ? error2.message : String(error2)}`;
+    printFallback(detail, credentials2, authHeader);
+  } finally {
+    process.exitCode = 0;
+  }
+}
+
 // src/lib/claude-usage.ts
 import { execFileSync } from "node:child_process";
 import { readFileSync } from "node:fs";
@@ -1069,6 +1164,76 @@ import chalk7 from "chalk";
 // ../../packages/types/src/agents/index.ts
 var MICROVM_MAX_LIFETIME_MS = 8 * 60 * 6e4;
 
+// ../../packages/types/src/opencode/index.ts
+function roleOf(m) {
+  if (!m || typeof m !== "object") return void 0;
+  if (typeof m.role === "string") return m.role;
+  const infoRole = m.info?.role;
+  return typeof infoRole === "string" ? infoRole : void 0;
+}
+function idOf(m) {
+  if (!m || typeof m !== "object") return void 0;
+  if (typeof m.id === "string") return m.id;
+  const infoId = m.info?.id;
+  return typeof infoId === "string" ? infoId : void 0;
+}
+function parentIdOf(m) {
+  if (!m || typeof m !== "object") return void 0;
+  if (typeof m.parentID === "string") return m.parentID;
+  const infoParent = m.info?.parentID;
+  return typeof infoParent === "string" ? infoParent : void 0;
+}
+function textPartsOf(m) {
+  if (!m || typeof m !== "object") return [];
+  const parts = Array.isArray(m.parts) ? m.parts : [];
+  return parts.filter((p) => p.type === "text" && typeof p.text === "string").map((p) => p.text ?? "").filter(Boolean);
+}
+function correlatedAssistantRun(messages, userMessageId) {
+  if (!messages || messages.length === 0) return [];
+  const byParent = messages.filter(
+    (m) => roleOf(m) === "assistant" && parentIdOf(m) === userMessageId
+  );
+  if (byParent.length > 0) return byParent;
+  const userIndex = messages.findIndex((m) => idOf(m) === userMessageId);
+  if (userIndex === -1) return [];
+  const run2 = [];
+  for (let i = userIndex + 1; i < messages.length; i++) {
+    const role = roleOf(messages[i]);
+    if (role === "user") break;
+    if (role === "assistant") run2.push(messages[i]);
+  }
+  return run2;
+}
+function lastText(assistantRun) {
+  for (let i = assistantRun.length - 1; i >= 0; i--) {
+    const textParts = textPartsOf(assistantRun[i]);
+    if (textParts.length > 0) return textParts.join("\n").trim() || null;
+  }
+  return null;
+}
+function effectiveCorrelatedRun(messages, userMessageId) {
+  const run2 = correlatedAssistantRun(messages, userMessageId);
+  if (lastText(run2) !== null) return run2;
+  const userIndex = messages?.findIndex((m) => idOf(m) === userMessageId) ?? -1;
+  if (userIndex === -1) return run2;
+  let continuation;
+  for (let i = userIndex + 1; messages && i < messages.length; i++) {
+    if (roleOf(messages[i]) === "user") {
+      continuation = messages[i];
+      break;
+    }
+  }
+  const continuationId = idOf(continuation);
+  if (roleOf(continuation) === "user" && textPartsOf(continuation).join("\n").trim().toLowerCase() === "continue" && continuationId) {
+    const continuationRun = correlatedAssistantRun(messages, continuationId);
+    if (continuationRun.length > 0) return continuationRun;
+  }
+  return run2;
+}
+function extractReplyTextForMessage(messages, opencodeUserMessageId) {
+  return lastText(effectiveCorrelatedRun(messages, opencodeUserMessageId));
+}
+
 // ../../packages/types/src/telemetry/index.ts
 var TelemetryEventTypes = {
   // Agent activity events (shown in web UI activity log)
@@ -1157,7 +1322,7 @@ import ora4 from "ora";
 import { select as select4 } from "@inquirer/prompts";
 
 // src/lib/telemetry.ts
-var CLI_VERSION = (true ? "3.5.2-dev.817a271" : void 0) ?? process.env.npm_package_version ?? "unknown";
+var CLI_VERSION = (true ? "3.5.2-dev.8c3e0f7" : void 0) ?? process.env.npm_package_version ?? "unknown";
 function getCliVersion() {
   return CLI_VERSION;
 }
@@ -1318,8 +1483,334 @@ var EventTypes = {
   DEPRECATED_AGENT_KEY_ENV_USED: "cli.deprecated_agent_key_env_used"
 };
 
-// src/lib/runner-activity-telemetry.ts
+// src/lib/opencode/session-db-reclaim.ts
+import { statSync as statSync2, statfsSync } from "node:fs";
+import { dirname as dirname2 } from "node:path";
+
+// src/lib/diagnostic-redaction.ts
 import { homedir as homedir2 } from "node:os";
+function redactHomeDirectory(message) {
+  const home = homedir2();
+  if (!home || home === "/") {
+    return message;
+  }
+  const pathSegmentCharacters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._-";
+  let result = "";
+  let searchFrom = 0;
+  let homeIndex;
+  while ((homeIndex = message.indexOf(home, searchFrom)) !== -1) {
+    const homeEnd = homeIndex + home.length;
+    const previousCharacter = message[homeIndex - 1];
+    const nextCharacter = message[homeEnd];
+    const atPathBoundary = (!previousCharacter || !pathSegmentCharacters.includes(previousCharacter)) && (!nextCharacter || !pathSegmentCharacters.includes(nextCharacter));
+    result += message.slice(searchFrom, homeIndex);
+    result += atPathBoundary ? "~" : home;
+    searchFrom = homeEnd;
+  }
+  return result + message.slice(searchFrom);
+}
+function redactDiagnosticText(message) {
+  const redacted = message.replace(/esk_[A-Za-z0-9_-]+/g, "esk_***").replace(/ct_[A-Za-z0-9_-]+/g, "ct_***").replace(/(?<![A-Za-z0-9_-])sk-ant-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g, "sk-ant-***").replace(/(?<![A-Za-z0-9_-])sk-proj-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g, "sk-proj-***").replace(/(?<![A-Za-z0-9_-])sk-[A-Za-z0-9]{20,}(?![A-Za-z0-9_-])/g, "sk-***").replace(/(?<![A-Za-z0-9_-])(gh[oprsu])_[A-Za-z0-9]{20,}(?![A-Za-z0-9_-])/g, "$1_***").replace(/(?<![A-Za-z0-9_-])github_pat_[A-Za-z0-9_]{20,}(?![A-Za-z0-9_-])/g, "github_pat_***").replace(/https?:\/\/\S+/g, "<url>");
+  return redactHomeDirectory(redacted);
+}
+
+// src/lib/opencode/session-db-reclaim.ts
+var SESSION_DB_RECLAIM_CHUNK_PAGES = 100;
+var SESSION_DB_RECLAIM_TIME_BUDGET_MS = 500;
+var SESSION_DB_RECLAIM_PAGE_CEILING = 4e4;
+var SESSION_DB_RECLAIM_BUSY_TIMEOUT_MS = 5e3;
+function errorMessage(error2) {
+  if (!(error2 instanceof Error)) return String(error2);
+  return error2.cause instanceof Error ? error2.cause.message : error2.message;
+}
+function errorMessages(error2) {
+  const messages = [];
+  const visited = /* @__PURE__ */ new Set();
+  let current = error2;
+  while (current !== null && current !== void 0 && !visited.has(current)) {
+    visited.add(current);
+    if (typeof current === "string") {
+      messages.push(current);
+      break;
+    }
+    if (current instanceof Error) {
+      messages.push(current.name, current.message);
+      current = current.cause;
+      continue;
+    }
+    if (typeof current === "object") {
+      const record = current;
+      if (typeof record.code === "string") messages.push(record.code);
+      if (typeof record.message === "string") messages.push(record.message);
+      current = record.cause;
+      continue;
+    }
+    break;
+  }
+  return messages;
+}
+function isSessionStoreWriteFailure(error2) {
+  return errorMessages(error2).some(
+    (message) => /(?:database or disk is full|disk is full|no space left on device|SQLITE_(?:FULL|IOERR)(?:\b|_))/i.test(
+      message
+    )
+  );
+}
+var SQLITE_CAUSE_TOKEN = /(?:^|cause:\s+)(SQLiteError:\s+[A-Za-z][A-Za-z0-9]*(?:\s+[A-Za-z][A-Za-z0-9]*){0,7})(?=\s*(?:[)\]"',;]|$))/i;
+var EFFECT_SQL_CAUSE_TOKEN = /(?:^|cause:\s+)(effect\/sql\/SqlError\/[A-Za-z][A-Za-z0-9_]*)/i;
+var PARAMS_FIELD = /\bparams\s*(?:=|:)/i;
+function isCauseBearingText(text) {
+  return /^(?:SQLiteError:\s+|effect\/sql\/SqlError\/)/i.test(text.trim()) || /(?:^|\s)cause:\s+(?:SQLiteError:\s+|effect\/sql\/SqlError\/)/i.test(text);
+}
+function structuredLogFields(line) {
+  const fields = [];
+  for (let index = 0; index < line.length; index++) {
+    if (line[index] === '"') {
+      index++;
+      while (index < line.length) {
+        if (line[index] === "\\") {
+          index++;
+        } else if (line[index] === '"') {
+          break;
+        }
+        index++;
+      }
+      continue;
+    }
+    const atFieldBoundary = index === 0 || /\s/.test(line[index - 1]);
+    const key = line.startsWith("error=", index) ? "error=" : line.startsWith("cause=", index) ? "cause=" : null;
+    if (!atFieldBoundary || key === null) continue;
+    const valueStart = index + key.length;
+    if (line[valueStart] !== '"') {
+      const valueEnd2 = line.indexOf(" ", valueStart);
+      fields.push(line.slice(valueStart, valueEnd2 === -1 ? line.length : valueEnd2));
+      index = valueEnd2 === -1 ? line.length : valueEnd2;
+      continue;
+    }
+    let valueEnd = valueStart + 1;
+    for (; valueEnd < line.length; valueEnd++) {
+      if (line[valueEnd] === "\\") {
+        valueEnd++;
+      } else if (line[valueEnd] === '"') {
+        break;
+      }
+    }
+    fields.push(line.slice(valueStart + 1, valueEnd));
+    index = valueEnd;
+  }
+  return fields;
+}
+function structuredCauseMessages(text) {
+  const fields = structuredLogFields(text);
+  if (fields.length > 0) return fields;
+  return isCauseBearingText(text) ? [text] : [];
+}
+function causeTokenFromText(text) {
+  const paramsIndex = text.search(PARAMS_FIELD);
+  for (const pattern of [SQLITE_CAUSE_TOKEN, EFFECT_SQL_CAUSE_TOKEN]) {
+    const match = pattern.exec(text);
+    if (match?.[1] && (paramsIndex === -1 || match.index < paramsIndex)) {
+      return match[1];
+    }
+  }
+  return null;
+}
+function sessionStoreCauseToken(value) {
+  for (const message of structuredCauseMessages(value)) {
+    const token = causeTokenFromText(message);
+    if (token !== null) return redactDiagnosticText(token).slice(0, 120);
+  }
+  return null;
+}
+function insufficientSpaceReason(dbPath, requiredBytes) {
+  try {
+    const fsStats = statfsSync(dirname2(dbPath));
+    const availableBytes = fsStats.bavail * fsStats.bsize;
+    if (availableBytes < requiredBytes) {
+      return `only ${availableBytes} bytes free, need ${requiredBytes} for a second copy`;
+    }
+    return null;
+  } catch (err) {
+    return `could not check free space (${err instanceof Error ? err.message : String(err)}); refusing to guess`;
+  }
+}
+function readLogicalBytes(db) {
+  const pageCount = db.prepare("PRAGMA page_count").get().page_count;
+  const pageSize = db.prepare("PRAGMA page_size").get().page_size;
+  return pageCount * pageSize;
+}
+function readFreelistCount(db) {
+  return db.prepare("PRAGMA freelist_count").get().freelist_count;
+}
+function readCheckpointResult(db) {
+  db.exec("PRAGMA busy_timeout=0");
+  const row = db.prepare("PRAGMA wal_checkpoint(TRUNCATE)").get();
+  return { busy: row.busy !== 0, log: row.log, checkpointed: row.checkpointed };
+}
+async function probeReclaimAvailability(input) {
+  const { dbPath, requiredBytes } = input;
+  let sqlite;
+  try {
+    sqlite = await import("node:sqlite");
+  } catch (err) {
+    const detail = `Node ${process.version}: ${errorMessage(err)}`;
+    console.warn(`[probeReclaimAvailability] node:sqlite unavailable for ${dbPath}: ` + detail);
+    return { reason: "sqlite-unavailable", detail };
+  }
+  let autoVacuum = null;
+  try {
+    const db = new sqlite.DatabaseSync(dbPath, { readOnly: true });
+    try {
+      db.exec(`PRAGMA busy_timeout=${SESSION_DB_RECLAIM_BUSY_TIMEOUT_MS}`);
+      autoVacuum = db.prepare("PRAGMA auto_vacuum").get().auto_vacuum;
+    } finally {
+      db.close();
+    }
+  } catch (err) {
+    console.warn(
+      `[probeReclaimAvailability] could not read auto_vacuum mode for ${dbPath}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (autoVacuum !== 0) return null;
+  return insufficientSpaceReason(dbPath, requiredBytes) !== null ? { reason: "insufficient-disk-space" } : null;
+}
+async function reclaimSessionDbSpace(input) {
+  const {
+    dbPath,
+    pageCeiling = SESSION_DB_RECLAIM_PAGE_CEILING,
+    timeBudgetMs = SESSION_DB_RECLAIM_TIME_BUDGET_MS,
+    chunkPages = SESSION_DB_RECLAIM_CHUNK_PAGES,
+    now = () => performance.now(),
+    hasLiveTurn = false,
+    hasProvenanceAnomaly = false
+  } = input;
+  let sqlite;
+  try {
+    sqlite = await import("node:sqlite");
+  } catch (err) {
+    const detail = `Node ${process.version}: ${errorMessage(err)}`;
+    console.warn(
+      `[reclaimSessionDbSpace] node:sqlite unavailable (need Node >=22.5, >=22.13 unflagged) for ${dbPath}: ${detail}`
+    );
+    return { ok: false, skipped: "sqlite-unavailable", detail };
+  }
+  const { DatabaseSync } = sqlite;
+  let db;
+  try {
+    db = new DatabaseSync(dbPath);
+    db.exec(`PRAGMA busy_timeout=${SESSION_DB_RECLAIM_BUSY_TIMEOUT_MS}`);
+    const autoVacuum = db.prepare("PRAGMA auto_vacuum").get().auto_vacuum;
+    if (autoVacuum === 0) {
+      if (hasLiveTurn || hasProvenanceAnomaly) {
+        const detail = [
+          ...hasLiveTurn ? ["a session turn is live"] : [],
+          ...hasProvenanceAnomaly ? ["session-DB provenance is anomalous"] : []
+        ].join(" and ");
+        console.warn(`[reclaimSessionDbSpace] skipping VACUUM conversion of ${dbPath}: ${detail}`);
+        return {
+          ok: false,
+          skipped: "full-vacuum-blocked",
+          detail
+        };
+      }
+      const fileBytesForGuard = statSync2(dbPath).size;
+      const skipReason = insufficientSpaceReason(dbPath, fileBytesForGuard);
+      if (skipReason !== null) {
+        console.warn(
+          `[reclaimSessionDbSpace] skipping VACUUM conversion of ${dbPath}: ${skipReason}`
+        );
+        return { ok: false, skipped: "insufficient-disk-space", detail: skipReason };
+      }
+      const beforeBytes = readLogicalBytes(db);
+      const freelistBefore = readFreelistCount(db);
+      const startedAt = now();
+      db.exec("PRAGMA auto_vacuum=INCREMENTAL");
+      db.exec("VACUUM");
+      const afterBytes = readLogicalBytes(db);
+      const freelistAfter = readFreelistCount(db);
+      const checkpointStartedAt = now();
+      const checkpoint = readCheckpointResult(db);
+      const checkpointElapsedMs = Math.max(0, now() - checkpointStartedAt);
+      return {
+        ok: true,
+        mode: "convert",
+        beforeBytes,
+        afterBytes,
+        freelistBefore,
+        freelistAfter,
+        pagesReclaimed: Math.max(0, freelistBefore - freelistAfter),
+        stoppedBy: "freelist-drained",
+        elapsedMs: Math.max(0, now() - startedAt),
+        checkpointElapsedMs,
+        checkpoint
+      };
+    }
+    if (autoVacuum === 2) {
+      if (hasLiveTurn) {
+        const detail = "a session turn is live";
+        console.warn(
+          `[reclaimSessionDbSpace] skipping incremental reclaim of ${dbPath}: ${detail}`
+        );
+        return { ok: false, skipped: "live-turn", detail };
+      }
+      const beforeBytes = readLogicalBytes(db);
+      const freelistBefore = readFreelistCount(db);
+      const startedAt = now();
+      const pageLimit = Math.max(0, Math.trunc(pageCeiling));
+      const chunkLimit = Math.max(1, Math.trunc(chunkPages));
+      const budget = Math.max(0, timeBudgetMs);
+      let pagesAttempted = 0;
+      let freelistAfter = freelistBefore;
+      let stoppedBy = "freelist-drained";
+      while (freelistAfter > 0) {
+        if (pagesAttempted >= pageLimit) {
+          stoppedBy = "page-ceiling";
+          break;
+        }
+        if (now() - startedAt >= budget) {
+          stoppedBy = "time-budget";
+          break;
+        }
+        const pages = Math.min(chunkLimit, pageLimit - pagesAttempted, freelistAfter);
+        db.exec(`PRAGMA incremental_vacuum(${pages})`);
+        pagesAttempted += pages;
+        freelistAfter = readFreelistCount(db);
+      }
+      const afterBytes = readLogicalBytes(db);
+      const checkpointStartedAt = now();
+      const checkpoint = readCheckpointResult(db);
+      const checkpointElapsedMs = Math.max(0, now() - checkpointStartedAt);
+      return {
+        ok: true,
+        mode: "incremental",
+        beforeBytes,
+        afterBytes,
+        freelistBefore,
+        freelistAfter,
+        pagesReclaimed: Math.max(0, freelistBefore - freelistAfter),
+        stoppedBy,
+        elapsedMs: Math.max(0, now() - startedAt),
+        checkpointElapsedMs,
+        checkpoint
+      };
+    }
+    console.warn(
+      `[reclaimSessionDbSpace] ${dbPath} has auto_vacuum=${autoVacuum} (neither NONE nor INCREMENTAL); nothing to reclaim`
+    );
+    return { ok: false, skipped: "auto-vacuum-not-applicable" };
+  } catch (err) {
+    console.error(`[reclaimSessionDbSpace] reclaim failed for ${dbPath}: ` + errorMessage(err));
+    return {
+      ok: false,
+      skipped: isSessionStoreWriteFailure(err) ? "disk-exhaustion" : "reclaim-error",
+      detail: errorMessage(err)
+    };
+  } finally {
+    db?.close();
+  }
+}
+
+// src/lib/runner-activity-telemetry.ts
 var FORWARDED_LEVELS_BY_SOURCE = {
   "cli.run": /* @__PURE__ */ new Set(["warn", "error"]),
   opencode: /* @__PURE__ */ new Set(["warn", "error"]),
@@ -1336,11 +1827,13 @@ function parseOpenCodeLogLine(line) {
   if (!levelMatch) return null;
   const level = levelMatch[1].toUpperCase();
   if (level !== "WARN" && level !== "ERROR") return null;
-  const sessionMatch = normalisedLine.match(/(?:^|\s)sessionID=(\S+)/);
+  const sessionMatch = normalisedLine.match(/(?:^|\s)(?:sessionID|session\.id)=(\S+)/);
+  const messageIDMatch = normalisedLine.match(/(?:^|\s)messageID=(\S+)/);
   const messageMatch = normalisedLine.match(/(?:^|\s)message=(?:"((?:\\.|[^"])*)"|(\S+))/);
   const parsed = {
     level: level === "WARN" ? "warn" : "error",
-    sessionID: sessionMatch?.[1]
+    sessionID: sessionMatch?.[1],
+    messageID: messageIDMatch?.[1]
   };
   const message = messageMatch?.[1] ?? messageMatch?.[2];
   if (message !== void 0) parsed.message = message;
@@ -1348,12 +1841,13 @@ function parseOpenCodeLogLine(line) {
 }
 var MAX_LINE_BUFFER_BYTES = 16 * 1024;
 var REPEAT_SUPPRESSION_WINDOW_MS = 6e4;
-function createOpenCodeActivityForwarder(getContext) {
+function createOpenCodeActivityForwarder(getContext, onSessionStoreWriteFailure) {
   let buffer = Buffer.alloc(0);
   const repeatStates = /* @__PURE__ */ new Map();
   const forwardLine = (line, parsed, repeatsSuppressed = 0) => {
     const metadata = {
       ...parsed.sessionID ? { sessionID: parsed.sessionID } : {},
+      ...parsed.messageID ? { messageID: parsed.messageID } : {},
       ...repeatsSuppressed > 0 ? { repeats_suppressed: repeatsSuppressed } : {}
     };
     forwardRunnerActivity(
@@ -1379,9 +1873,24 @@ function createOpenCodeActivityForwarder(getContext) {
   };
   const flushLine = (line) => {
     const parsed = parseOpenCodeLogLine(line);
+    const isDiskFailure = isSessionStoreWriteFailure(line);
+    const cause = sessionStoreCauseToken(line);
+    if (onSessionStoreWriteFailure && (isDiskFailure || cause !== null)) {
+      try {
+        onSessionStoreWriteFailure({
+          isDiskFailure,
+          sessionId: parsed?.sessionID ?? null,
+          cause
+        });
+      } catch (err) {
+        reportTelemetryDiagnostic(
+          `Runner activity telemetry could not record session-store write failure: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
     if (!parsed) return;
     const now = Date.now();
-    const key = parsed.message === void 0 ? void 0 : `${parsed.level}\0${parsed.message}`;
+    const key = parsed.message === void 0 ? void 0 : `${parsed.level}\0${parsed.message}\0${parsed.sessionID ?? ""}\0${parsed.messageID ?? ""}`;
     expireRepeatStates(now, key);
     if (key === void 0) {
       forwardLine(line, parsed);
@@ -1427,34 +1936,21 @@ function createOpenCodeActivityForwarder(getContext) {
 var MAX_MESSAGE_LENGTH = 500;
 var MAX_METADATA_VALUE_LENGTH = 200;
 var MAX_METADATA_ENTRIES = 20;
-var TRUNCATION_MARKER = "\u2026";
-function redactHomeDirectory(message) {
-  const home = homedir2();
-  if (!home || home === "/") {
-    return message;
-  }
-  const pathSegmentCharacters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._-";
-  let result = "";
-  let searchFrom = 0;
-  let homeIndex;
-  while ((homeIndex = message.indexOf(home, searchFrom)) !== -1) {
-    const homeEnd = homeIndex + home.length;
-    const previousCharacter = message[homeIndex - 1];
-    const nextCharacter = message[homeEnd];
-    const atPathBoundary = home === "/" || (!previousCharacter || !pathSegmentCharacters.includes(previousCharacter)) && (!nextCharacter || !pathSegmentCharacters.includes(nextCharacter));
-    result += message.slice(searchFrom, homeIndex);
-    result += atPathBoundary ? "~" : home;
-    searchFrom = homeEnd;
-  }
-  return result + message.slice(searchFrom);
-}
-function redactDiagnosticText(message) {
-  const redacted = message.replace(/esk_[A-Za-z0-9_-]+/g, "esk_***").replace(/ct_[A-Za-z0-9_-]+/g, "ct_***").replace(/(?<![A-Za-z0-9_-])sk-ant-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g, "sk-ant-***").replace(/(?<![A-Za-z0-9_-])sk-proj-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g, "sk-proj-***").replace(/(?<![A-Za-z0-9_-])sk-[A-Za-z0-9]{20,}(?![A-Za-z0-9_-])/g, "sk-***").replace(/(?<![A-Za-z0-9_-])(gh[oprsu])_[A-Za-z0-9]{20,}(?![A-Za-z0-9_-])/g, "$1_***").replace(/(?<![A-Za-z0-9_-])github_pat_[A-Za-z0-9_]{20,}(?![A-Za-z0-9_-])/g, "github_pat_***").replace(/https?:\/\/\S+/g, "<url>");
-  return redactHomeDirectory(redacted);
-}
 function truncate(message) {
   if (message.length <= MAX_MESSAGE_LENGTH) return message;
-  return message.slice(0, MAX_MESSAGE_LENGTH - TRUNCATION_MARKER.length) + TRUNCATION_MARKER;
+  let dropped = message.length - MAX_MESSAGE_LENGTH;
+  let marker = `\u2026${dropped} chars omitted\u2026`;
+  let previousDropped = -1;
+  while (dropped !== previousDropped) {
+    previousDropped = dropped;
+    const nextDropped = message.length - MAX_MESSAGE_LENGTH + marker.length;
+    dropped = nextDropped;
+    marker = `\u2026${dropped} chars omitted\u2026`;
+  }
+  const remaining = MAX_MESSAGE_LENGTH - marker.length;
+  const headLength = Math.ceil(remaining * 0.6);
+  const tailLength = remaining - headLength;
+  return message.slice(0, headLength) + marker + message.slice(message.length - tailLength);
 }
 function sanitiseMetadata(metadata) {
   if (!metadata) return {};
@@ -1664,12 +2160,23 @@ function buildSessionDbRecoveryActivity(record) {
         metadata: withoutContractFields(record),
         message: `This runner started without restoring session history because it could not verify where its session history is backed up. Nothing in the backup was changed; check the runner backup configuration and permissions.${replication}`
       };
-    case "session_db_boot_refused":
-      return {
-        level,
-        metadata: withoutContractFields(record),
-        message: `This runner did not come online because its damaged session database could not be safely separated from its active backup or proven removed. Backed-up session history remains readable at ${record.quarantine_destination ?? "its original location or the quarantine destination named in the boot logs"}; any local session-database files that remain were left in place and nothing opened or wrote them. See the runner boot logs for SESSION-DB-LOCAL-DISCARD-FAILED details.`
-      };
+    case "session_db_boot_refused": {
+      const message = (() => {
+        switch (record.reason) {
+          case "local_discard_failed":
+            return `This runner did not come online because its damaged session database could not be safely separated from its active backup or proven removed. Backed-up session history remains readable at ${record.quarantine_destination ?? "its original location or the quarantine destination named in the boot logs"}; any local session-database files that remain were left in place and nothing opened or wrote them. See the runner boot logs for SESSION-DB-LOCAL-DISCARD-FAILED details.`;
+          case "replica_separation_unproven":
+            return `This runner did not come online because its damaged session database could not be safely separated from its active backup. The SESSION-DB-REPLICA-SEPARATION-UNVERIFIED boot log contains the partial-quarantine moved and remaining counts. Backed-up session history remains readable at ${record.quarantine_destination ?? "its original location or the quarantine destination named in the boot logs"}; any local session-database files that remain were left in place and nothing opened or wrote them.`;
+          case "verification_timeout_before_separation":
+            return "This runner did not come online because session database verification timed out after detecting corruption, before replica separation was attempted. No replica progress is claimed. See SESSION-DB-VERIFY-TIMEOUT in the runner boot logs before retrying.";
+          case "verification_timeout_during_separation":
+            return "This runner did not come online because session database verification timed out while replica separation was in progress. Separation completion and object removal were not proven. See SESSION-DB-VERIFY-TIMEOUT in the runner boot logs before retrying.";
+          default:
+            return "This runner did not come online because session database recovery could not be completed. Inspect the runner boot logs for the refusal reason before retrying.";
+        }
+      })();
+      return { level, metadata: withoutContractFields(record), message };
+    }
     case "schema_provenance_mismatch":
       return {
         level,
@@ -1919,7 +2426,7 @@ async function getOpenCodeDirectory(port, client) {
     return null;
   }
 }
-function roleOf(m) {
+function roleOf2(m) {
   if (!m || typeof m !== "object") return void 0;
   if (typeof m.role === "string") return m.role;
   const infoRole = m.info?.role;
@@ -1933,13 +2440,13 @@ function createdOf(m) {
   if (!m || typeof m !== "object") return void 0;
   return m.info?.time?.created ?? m.time?.created;
 }
-function idOf(m) {
+function idOf2(m) {
   if (!m || typeof m !== "object") return void 0;
   if (typeof m.id === "string") return m.id;
   const infoId = m.info?.id;
   return typeof infoId === "string" ? infoId : void 0;
 }
-function parentIdOf(m) {
+function parentIdOf2(m) {
   if (!m || typeof m !== "object") return void 0;
   if (typeof m.parentID === "string") return m.parentID;
   const infoParent = m.info?.parentID;
@@ -1955,8 +2462,12 @@ function errorOf(m) {
   if (!m || typeof m !== "object") return void 0;
   return m.info?.error ?? m.error;
 }
+function isTerminalStopAnswer(m) {
+  return completedOf(m) != null && errorOf(m) == null && finishOf(m) === "stop";
+}
 function isAssistantInFlight(m) {
   if (completedOf(m) == null) return true;
+  if (errorOf(m) != null) return false;
   return finishOf(m) === "tool-calls";
 }
 async function getSessionMessages(port, sessionId, client) {
@@ -2004,9 +2515,10 @@ async function pollSessionMessagesForRedrive(port, sessionId, client) {
 function isSessionActivelyGenerating(messages) {
   if (!messages || messages.length === 0) return false;
   const last = messages[messages.length - 1];
-  if (roleOf(last) !== "assistant") return false;
+  if (roleOf2(last) !== "assistant") return false;
   return completedOf(last) == null;
 }
+var FULL_SESSION_ENUMERATION_MAX_SESSIONS = 3200;
 function sessionLastActivityMs(session) {
   const candidates = [
     session.time?.updated,
@@ -2021,30 +2533,71 @@ function sessionLastActivityMs(session) {
   }
   return null;
 }
-async function listSessions(port, client) {
-  if (client?.version === "v2") return listV2Sessions(client);
+function sessionListPath(options) {
+  const params = new URLSearchParams();
+  if (options?.limit !== void 0) params.set("limit", String(options.limit));
+  const query = params.toString();
+  return query ? `/session?${query}` : "/session";
+}
+async function listSessionPage(port, client, options) {
+  const path = sessionListPath(options);
   try {
-    const res = await requestWithClient(port, client, "/session");
+    const res = await requestWithClient(port, client, path);
     if (!res.ok) return null;
     const body = await res.json();
     return Array.isArray(body) ? body : null;
   } catch (error2) {
     console.error(
-      `[listSessions] GET /session failed: ${error2 instanceof Error ? error2.message : String(error2)}`
+      `[listSessionPage] GET ${path} failed: ${error2 instanceof Error ? error2.message : String(error2)}`
     );
     return null;
   }
 }
+async function listSessions(port, client, options) {
+  if (client?.version === "v2") return listV2Sessions(client);
+  return listSessionPage(port, client, options);
+}
+async function listAllSessions(port, client) {
+  if (client?.version === "v2") {
+    const sessions2 = await listV2Sessions(client);
+    return sessions2 === null ? { sessions: null, reason: "opencode-unreachable" } : { sessions: sessions2 };
+  }
+  const sessions = await listSessionPage(port, client, {
+    limit: FULL_SESSION_ENUMERATION_MAX_SESSIONS
+  });
+  if (sessions === null) return { sessions: null, reason: "opencode-unreachable" };
+  if (sessions.length >= FULL_SESSION_ENUMERATION_MAX_SESSIONS) {
+    return { sessions: null, reason: "session-enumeration-limit-bound" };
+  }
+  return { sessions };
+}
 async function deleteSession(port, id, client) {
   if (client?.version === "v2") return deleteV2Session(client, id);
   try {
-    const res = await requestWithClient(port, client, `/session/${id}`, { method: "DELETE" });
-    return res.status >= 200 && res.status < 300;
+    const res = await requestWithClient(
+      port,
+      client,
+      `/session/${id}`,
+      { method: "DELETE" },
+      { allowStatuses: ALL_HTTP_STATUSES }
+    );
+    if (res.status >= 200 && res.status < 300) {
+      return { ok: true, status: res.status };
+    }
+    try {
+      const body = await res.text();
+      return body ? { ok: false, status: res.status, body } : { ok: false, status: res.status };
+    } catch (error2) {
+      console.error(
+        `[deleteSession] DELETE /session/${id} response body read failed for HTTP ${res.status}: ${error2 instanceof Error ? error2.message : String(error2)}`
+      );
+      return { ok: false, status: res.status };
+    }
   } catch (error2) {
     console.error(
       `[deleteSession] DELETE /session/${id} failed: ${error2 instanceof Error ? error2.message : String(error2)}`
     );
-    return false;
+    return { ok: false, status: "threw" };
   }
 }
 async function sessionExists(port, id, client) {
@@ -2282,11 +2835,31 @@ function messageText(m) {
   if (!m || !Array.isArray(m.parts)) return "";
   return m.parts.filter((p) => p.type === "text" && typeof p.text === "string").map((p) => p.text).join("");
 }
-async function sendPromptAsync(port, sessionId, content, options, attachments, client) {
+function findDispatchedUserMessageId(messages, content, excludeIds) {
+  if (!messages || messages.length === 0) return null;
+  let best = null;
+  for (const message of messages) {
+    if (roleOf2(message) !== "user") continue;
+    const id = idOf2(message);
+    if (typeof id !== "string" || excludeIds?.has(id)) continue;
+    if (messageText(message) !== content) continue;
+    const created = createdOf(message) ?? 0;
+    if (best === null || created > best.created) best = { id, created };
+  }
+  return best?.id ?? null;
+}
+async function sendPromptAsync(port, sessionId, content, options, attachments, client, callbacks) {
   const before = await getSessionMessages(port, sessionId, client);
   const knownUserIds = new Set(
-    (before ?? []).filter((m) => roleOf(m) === "user").map((m) => idOf(m)).filter((id) => typeof id === "string")
+    (before ?? []).filter((m) => roleOf2(m) === "user").map((m) => idOf2(m)).filter((id) => typeof id === "string")
   );
+  if (callbacks) {
+    try {
+      callbacks.onKnownUserIds(before === null ? null : knownUserIds);
+    } catch (error2) {
+      callbacks.onKnownUserIdsError(error2);
+    }
+  }
   const parts = [{ type: "text", text: content }];
   let pendingOutcomes = null;
   if (attachments && attachments.inputs.length > 0) {
@@ -2325,22 +2898,10 @@ async function sendPromptAsync(port, sessionId, content, options, attachments, c
   const READ_BACK_DELAY_MS = 150;
   for (let attempt = 0; attempt < READ_BACK_ATTEMPTS; attempt++) {
     const after = await getSessionMessages(port, sessionId, client);
-    if (after) {
-      let best = null;
-      for (const m of after) {
-        if (roleOf(m) !== "user") continue;
-        const id = idOf(m);
-        if (typeof id !== "string" || knownUserIds.has(id)) continue;
-        if (messageText(m) !== content) continue;
-        const created = createdOf(m) ?? 0;
-        if (best === null || created > best.created) {
-          best = { id, created };
-        }
-      }
-      if (best) {
-        if (pendingOutcomes && attachments?.onOutcomes) attachments.onOutcomes(pendingOutcomes);
-        return best.id;
-      }
+    const dispatchedUserMessageId = findDispatchedUserMessageId(after, content, knownUserIds);
+    if (dispatchedUserMessageId !== null) {
+      if (pendingOutcomes && attachments?.onOutcomes) attachments.onOutcomes(pendingOutcomes);
+      return dispatchedUserMessageId;
     }
     if (attempt < READ_BACK_ATTEMPTS - 1) {
       await new Promise((resolve4) => setTimeout(resolve4, READ_BACK_DELAY_MS));
@@ -2351,57 +2912,68 @@ async function sendPromptAsync(port, sessionId, content, options, attachments, c
 function findAssistantReplyAfter(messages, userMessageId) {
   if (!messages || messages.length === 0) return null;
   const byParent = messages.find(
-    (m) => roleOf(m) === "assistant" && parentIdOf(m) === userMessageId
+    (m) => roleOf2(m) === "assistant" && parentIdOf2(m) === userMessageId
   );
   if (byParent) return byParent;
-  const userIndex = messages.findIndex((m) => idOf(m) === userMessageId);
+  const userIndex = messages.findIndex((m) => idOf2(m) === userMessageId);
   if (userIndex === -1) return null;
   for (let i = userIndex + 1; i < messages.length; i++) {
-    if (roleOf(messages[i]) === "assistant") return messages[i];
+    if (roleOf2(messages[i]) === "assistant") return messages[i];
   }
   return null;
 }
 function findLastAssistantReplyFor(messages, userMessageId) {
   if (!messages || messages.length === 0) return null;
   let lastCorrelated = null;
-  let lastNonErrored = null;
   for (let i = messages.length - 1; i >= 0; i--) {
     const m = messages[i];
-    if (roleOf(m) !== "assistant" || parentIdOf(m) !== userMessageId) continue;
-    if (lastCorrelated === null) lastCorrelated = m;
-    if (errorOf(m) == null) {
-      lastNonErrored = m;
-      break;
+    if (roleOf2(m) !== "assistant" || parentIdOf2(m) !== userMessageId) continue;
+    lastCorrelated = m;
+    break;
+  }
+  if (lastCorrelated) {
+    if (errorOf(lastCorrelated) == null) return lastCorrelated;
+    for (let i = messages.length - 1; i >= 0; i--) {
+      const m = messages[i];
+      if (roleOf2(m) === "assistant" && parentIdOf2(m) === userMessageId && isTerminalStopAnswer(m)) {
+        return m;
+      }
     }
+    return lastCorrelated;
   }
-  if (lastCorrelated) return lastNonErrored ?? lastCorrelated;
-  const userIndex = messages.findIndex((m) => idOf(m) === userMessageId);
+  const userIndex = messages.findIndex((m) => idOf2(m) === userMessageId);
   if (userIndex === -1) return null;
   let last = null;
-  let lastOk = null;
+  let lastAssistantIndex = -1;
   for (let i = userIndex + 1; i < messages.length; i++) {
-    const role = roleOf(messages[i]);
+    const role = roleOf2(messages[i]);
     if (role === "user") break;
     if (role === "assistant") {
       last = messages[i];
-      if (errorOf(messages[i]) == null) lastOk = messages[i];
+      lastAssistantIndex = i;
     }
   }
-  return lastOk ?? last;
+  if (last === null || errorOf(last) == null) return last;
+  for (let i = lastAssistantIndex; i > userIndex; i--) {
+    const m = messages[i];
+    if (roleOf2(m) === "user") break;
+    if (roleOf2(m) === "assistant" && isTerminalStopAnswer(m)) return m;
+  }
+  return last;
 }
 function collectSubagentSessions(messages, userMessageId) {
   if (!messages || messages.length === 0) return [];
   const byParent = messages.filter(
-    (message) => roleOf(message) === "assistant" && parentIdOf(message) === userMessageId
+    (message) => roleOf2(message) === "assistant" && parentIdOf2(message) === userMessageId
   );
   const assistants = byParent.length > 0 ? byParent : [];
   if (assistants.length === 0) {
-    const userIndex = messages.findIndex((message) => idOf(message) === userMessageId);
+    const userIndex = messages.findIndex((message) => idOf2(message) === userMessageId);
     if (userIndex === -1) return [];
     for (let i = userIndex + 1; i < messages.length; i++) {
       const message = messages[i];
-      if (roleOf(message) === "user") break;
-      if (roleOf(message) === "assistant") assistants.push(message);
+      if (roleOf2(message) === "user") break;
+      if (roleOf2(message) === "assistant") assistants.push(message);
     }
   }
   const refs = [];
@@ -2441,7 +3013,7 @@ function collectTaskCalls(messages, userMessageId) {
   if (!messages || messages.length === 0) return [];
   const calls = [];
   for (const message of messages) {
-    if (roleOf(message) !== "assistant" || parentIdOf(message) !== userMessageId) continue;
+    if (roleOf2(message) !== "assistant" || parentIdOf2(message) !== userMessageId) continue;
     for (const part of message.parts ?? []) {
       if (part.tool !== "task" || !part.callID || !part.state || part.state.status === "pending") {
         continue;
@@ -2471,7 +3043,7 @@ function attributeTaskCallUsage(messages, windows) {
   for (const window of eligibleWindows) assignments.set(window.callID, []);
   const unattributed = [];
   for (const message of messages ?? []) {
-    if (roleOf(message) !== "assistant") continue;
+    if (roleOf2(message) !== "assistant") continue;
     const created = finiteNumber(createdOf(message));
     const matching = created === null ? [] : eligibleWindows.filter(
       (window) => window.timeStart <= created && (window.timeEnd === null || window.timeEnd === void 0 || created <= window.timeEnd)
@@ -2493,8 +3065,9 @@ function attributeTaskCallUsage(messages, windows) {
 }
 function sumAssistantUsage(messages) {
   if (!messages || messages.length === 0) return null;
-  const nonErrored = messages.filter((message) => errorOf(message) == null);
-  const selected = nonErrored.length > 0 ? nonErrored : messages;
+  const hasTrailingError = errorOf(messages[messages.length - 1]) != null;
+  const hasTerminalStopAnswer = messages.some(isTerminalStopAnswer);
+  const selected = hasTrailingError && hasTerminalStopAnswer ? messages.filter((message) => errorOf(message) == null) : messages;
   let sawAnyUsage = false;
   let inputSum = 0;
   let outputSum = 0;
@@ -2503,9 +3076,11 @@ function sumAssistantUsage(messages) {
   let cacheWriteSum = 0;
   let costSum = 0;
   let sawCost = false;
+  let toolCallCount = 0;
   let modelId = null;
   let providerId = null;
   for (const m of selected) {
+    toolCallCount += m.parts?.filter((part) => part.type === "tool").length ?? 0;
     const info = m.info;
     if (!info) continue;
     const tokens = info.tokens;
@@ -2542,19 +3117,18 @@ function sumAssistantUsage(messages) {
     usage_tokens_cache_write: cacheWriteSum,
     // NULL means OpenCode never reported a cost; it is distinct from a genuine
     // zero-cost message, which sets `sawCost` with `costSum === 0`.
-    usage_cost_usd: sawCost ? costSum : null
+    usage_cost_usd: sawCost ? costSum : null,
+    turn_tool_calls: toolCallCount
   };
 }
 function messageUsage(messages, userMessageId) {
   if (!messages || messages.length === 0) return null;
   const byParentAll = messages.filter(
-    (m) => roleOf(m) === "assistant" && parentIdOf(m) === userMessageId
+    (m) => roleOf2(m) === "assistant" && parentIdOf2(m) === userMessageId
   );
-  const byParentNonErrored = byParentAll.filter((m) => errorOf(m) == null);
-  const byParent = byParentNonErrored.length > 0 ? byParentNonErrored : byParentAll;
   let correlated;
-  if (byParent.length > 0) {
-    correlated = byParent;
+  if (byParentAll.length > 0) {
+    correlated = byParentAll;
   } else {
     const reply = findAssistantReplyAfter(messages, userMessageId);
     correlated = reply ? [reply] : [];
@@ -2564,7 +3138,7 @@ function messageUsage(messages, userMessageId) {
 }
 function messageRunState(messages, userMessageId) {
   if (!messages || messages.length === 0) return "unknown";
-  const hasUser = messages.some((m) => idOf(m) === userMessageId);
+  const hasUser = messages.some((m) => idOf2(m) === userMessageId);
   const reply = findLastAssistantReplyFor(messages, userMessageId);
   if (!hasUser) {
     if (!reply) return "unknown";
@@ -2600,14 +3174,38 @@ function messageError(messages, userMessageId) {
   const reply = findLastAssistantReplyFor(messages, userMessageId);
   const error2 = errorOf(reply);
   if (error2 == null) return null;
-  if (typeof error2 === "string") return error2;
-  if (typeof error2 === "object") {
+  let rendered;
+  if (typeof error2 === "string") {
+    rendered = error2;
+  } else if (typeof error2 === "object") {
     const e = error2;
     const dataMessage = e.data?.message;
-    if (typeof dataMessage === "string") return dataMessage;
-    if (typeof e.message === "string") return e.message;
+    if (typeof dataMessage === "string") {
+      rendered = dataMessage;
+    } else if (typeof e.message === "string") {
+      rendered = e.message;
+    } else {
+      rendered = "The agent run failed.";
+    }
+  } else {
+    rendered = "The agent run failed.";
   }
-  return "The agent run failed.";
+  const toolPart = Array.isArray(reply?.parts) ? reply.parts.find(
+    (part) => part && typeof part === "object" && part.type === "tool" && part.state?.status === "error"
+  ) : void 0;
+  return typeof toolPart?.tool === "string" && toolPart.tool.length > 0 ? `${rendered} (tool "${toolPart.tool}")` : rendered;
+}
+function describeAbandonedReplyShape(messages, userMessageId) {
+  const reply = findLastAssistantReplyFor(messages, userMessageId);
+  if (!reply) return null;
+  const parts = Array.isArray(reply.parts) ? reply.parts : [];
+  const lastTool = [...parts].reverse().find((part) => part?.type === "tool");
+  return {
+    partTypes: parts.slice(-12).map((part) => typeof part?.type === "string" ? part.type : "(unknown)"),
+    droppedPartCount: Math.max(0, parts.length - 12),
+    lastToolName: typeof lastTool?.tool === "string" && lastTool.tool.length > 0 ? lastTool.tool : null,
+    lastToolStatus: typeof lastTool?.state?.status === "string" && lastTool.state.status.length > 0 ? lastTool.state.status : null
+  };
 }
 function isAbortedTerminalReply(messages, userMessageId) {
   const reply = findLastAssistantReplyFor(messages, userMessageId);
@@ -2656,7 +3254,7 @@ function findLatestSubagentAuthOutcome(messages, sinceMs) {
   if (!messages || messages.length === 0) return null;
   for (let i = messages.length - 1; i >= 0; i--) {
     const message = messages[i];
-    if (roleOf(message) !== "assistant") continue;
+    if (roleOf2(message) !== "assistant") continue;
     const created = createdOf(message);
     if (sinceMs !== null && typeof created === "number" && created < sinceMs) continue;
     const failure = classifyReplyAuthError(message);
@@ -2688,25 +3286,25 @@ function applyZeroProviderFallback(classified, hasConfiguredProvider, replyProvi
 function hasRunningAssistantExcept(messages, exceptUserMessageId) {
   if (!messages || messages.length === 0) return false;
   return messages.some(
-    (m) => roleOf(m) === "assistant" && parentIdOf(m) !== exceptUserMessageId && isAssistantInFlight(m)
+    (m) => roleOf2(m) === "assistant" && parentIdOf2(m) !== exceptUserMessageId && isAssistantInFlight(m)
   );
 }
 function hasLaterSiblingTurnStarted(messages, userMessageId, siblingUserMessageIds) {
   if (!messages || messages.length === 0) return false;
-  const userIndex = messages.findIndex((message) => idOf(message) === userMessageId);
+  const userIndex = messages.findIndex((message) => idOf2(message) === userMessageId);
   if (userIndex === -1) return false;
   let hasLaterUser = false;
   let hasStartedLaterUser = false;
   for (let i = userIndex + 1; i < messages.length; i++) {
     const message = messages[i];
-    if (roleOf(message) !== "user") continue;
+    if (roleOf2(message) !== "user") continue;
     hasLaterUser = true;
-    const laterUserMessageId = idOf(message);
+    const laterUserMessageId = idOf2(message);
     if (laterUserMessageId === void 0 || !siblingUserMessageIds.has(laterUserMessageId)) {
       return false;
     }
     if (messages.some(
-      (candidate) => roleOf(candidate) === "assistant" && parentIdOf(candidate) === laterUserMessageId
+      (candidate) => roleOf2(candidate) === "assistant" && parentIdOf2(candidate) === laterUserMessageId
     )) {
       hasStartedLaterUser = true;
     }
@@ -3177,13 +3775,28 @@ async function listV2Sessions(client) {
 }
 async function deleteV2Session(client, sessionId) {
   try {
-    await client.request(`/api/session/${encodeURIComponent(sessionId)}`, { method: "DELETE" });
-    return true;
+    const response = await client.request(
+      `/api/session/${encodeURIComponent(sessionId)}`,
+      { method: "DELETE" },
+      { allowStatuses: Array.from({ length: 500 }, (_, index) => index + 100) }
+    );
+    if (response.status >= 200 && response.status < 300) {
+      return { ok: true, status: response.status };
+    }
+    try {
+      const body = await response.text();
+      return body ? { ok: false, status: response.status, body } : { ok: false, status: response.status };
+    } catch (error2) {
+      console.error(
+        `[deleteV2Session] DELETE /api/session/${sessionId} response body read failed for HTTP ${response.status}: ${error2 instanceof Error ? error2.message : String(error2)}`
+      );
+      return { ok: false, status: response.status };
+    }
   } catch (error2) {
     console.error(
       `[deleteV2Session] DELETE /api/session/${sessionId} failed: ${error2 instanceof Error ? error2.message : String(error2)}`
     );
-    return false;
+    return { ok: false, status: "threw" };
   }
 }
 async function v2SessionExists(client, sessionId) {
@@ -3805,9 +4418,9 @@ async function importOpenCodeV2Credentials({
 
 // src/lib/opencode/session-db-boot.ts
 import { spawn as spawn2 } from "node:child_process";
-import { mkdirSync, statSync as statSync2, unlinkSync as unlinkSync2, writeFileSync } from "node:fs";
+import { mkdirSync, statSync as statSync3, unlinkSync as unlinkSync2, writeFileSync } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname2, resolve as resolvePath } from "node:path";
+import { dirname as dirname3, resolve as resolvePath } from "node:path";
 
 // src/lib/runner-synchroniser.ts
 import { spawn } from "node:child_process";
@@ -3887,9 +4500,12 @@ function runSynchroniser(args, opts) {
 
 // src/lib/opencode/session-db-boot.ts
 var SESSION_DB_RESTORE_TIMEOUT_MS = 3e5;
-var SESSION_DB_VERIFY_TIMEOUT_MS = 12e4;
+var SESSION_DB_VERIFY_TIMEOUT_MS = 36e4;
 var SESSION_DB_SYNCHRONISER_TIMEOUT_MS = 12e4;
-var SESSION_DB_VERIFY_WALKBACK_BUDGET_SECONDS = 120;
+var SESSION_DB_VERIFY_WALKBACK_BUDGET_SECONDS = 40;
+var SESSION_DB_VERIFY_RESTORE_POINTS_TIMEOUT_SECONDS = 30;
+var SESSION_DB_VERIFY_RESTORE_CANDIDATE_TIMEOUT_SECONDS = 120;
+var SESSION_DB_VERIFY_DISPOSAL_BUDGET_SECONDS = 90;
 function commandError(result) {
   return result.stderr.trim() || `process exited with code ${result.code ?? "null"}`;
 }
@@ -3932,7 +4548,7 @@ function clearMarker(options) {
 function markNoReplicate(options, message) {
   if (options.noReplicateMarker) {
     try {
-      mkdirSync(dirname2(options.noReplicateMarker), { recursive: true });
+      mkdirSync(dirname3(options.noReplicateMarker), { recursive: true });
       writeFileSync(options.noReplicateMarker, "");
     } catch (error2) {
       options.log(
@@ -4057,7 +4673,7 @@ async function ensureLitestreamConfig(options, env) {
     return null;
   }
   try {
-    if (statSync2(configPath).size > 0) return configPath;
+    if (statSync3(configPath).size > 0) return configPath;
   } catch (error2) {
     if (!(error2 instanceof Error && "code" in error2 && error2.code === "ENOENT")) {
       options.log(
@@ -4087,7 +4703,7 @@ async function ensureLitestreamConfig(options, env) {
     return null;
   }
   try {
-    mkdirSync(dirname2(configPath), { recursive: true });
+    mkdirSync(dirname3(configPath), { recursive: true });
     writeFileSync(configPath, rendered.stdout);
   } catch (error2) {
     options.log(
@@ -4200,20 +4816,37 @@ async function verifySessionDb(options, configPath, env) {
       timeoutMs: SESSION_DB_VERIFY_TIMEOUT_MS,
       env: {
         ...env,
-        // The synchroniser reads this value in SECONDS. Keep this at 120, not
-        // 120_000, so the walkback gives up before the outer process bound.
+        // The synchroniser reads all four values in SECONDS.
         EVIDENT_SESSION_DB_WALKBACK_BUDGET_SECONDS: String(
           SESSION_DB_VERIFY_WALKBACK_BUDGET_SECONDS
+        ),
+        EVIDENT_SESSION_DB_RESTORE_POINTS_TIMEOUT_SECONDS: String(
+          SESSION_DB_VERIFY_RESTORE_POINTS_TIMEOUT_SECONDS
+        ),
+        EVIDENT_SESSION_DB_RESTORE_CANDIDATE_TIMEOUT_SECONDS: String(
+          SESSION_DB_VERIFY_RESTORE_CANDIDATE_TIMEOUT_SECONDS
+        ),
+        EVIDENT_SESSION_DB_DISPOSAL_BUDGET_SECONDS: String(
+          SESSION_DB_VERIFY_DISPOSAL_BUDGET_SECONDS
         )
       }
     });
     logSynchroniserDiagnostics(result, options);
     if (result.timedOut || result.code === 124 || result.code === 137) {
+      if (result.stderr.includes("SESSION-DB-INTEGRITY-FAILED")) {
+        const reason = result.stderr.includes("SESSION-DB-REPLICA-SIZE") ? "verification_timeout_during_separation" : "verification_timeout_before_separation";
+        options.log(
+          `SESSION-DB-VERIFY-TIMEOUT: verification did not finish within its ${SESSION_DB_VERIFY_TIMEOUT_MS}ms deadline; refusing to start with the restored opencode.db (${reason})`,
+          "error"
+        );
+        reportRecord("verify", "session_db_boot_refused", reason, null, options);
+        return { verifyFatal: true, verifyFatalReason: reason };
+      }
       options.log(
         `SESSION-DB-VERIFY-TIMEOUT: verification did not finish within its ${SESSION_DB_VERIFY_TIMEOUT_MS}ms deadline; continuing with the restored opencode.db as-is, unverified`,
         "warn"
       );
-      return false;
+      return { verifyFatal: false };
     }
     if (result.code === 34) {
       reportRecord(
@@ -4223,14 +4856,14 @@ async function verifySessionDb(options, configPath, env) {
         null,
         options
       );
-      return true;
+      return { verifyFatal: true };
     }
     if (result.code === 33) {
       options.log(
         "SESSION-DB-INTEGRITY-EXHAUSTED: booting continues and litestream still replicates, starting an empty backup chain after the corrupt replica was separated.",
         "warn"
       );
-      return false;
+      return { verifyFatal: false };
     }
     if (result.code !== 0) {
       options.log(
@@ -4238,17 +4871,17 @@ async function verifySessionDb(options, configPath, env) {
         "warn"
       );
     }
-    return false;
+    return { verifyFatal: false };
   }
   options.log(
     "skipping session-DB verification: this boot's session DB was not proven safe to replicate",
     "debug"
   );
-  return false;
+  return { verifyFatal: false };
 }
 function fileExists(path) {
   try {
-    statSync2(path);
+    statSync3(path);
     return true;
   } catch (error2) {
     if (error2 instanceof Error && "code" in error2 && error2.code === "ENOENT") return false;
@@ -4331,13 +4964,13 @@ async function restoreAndVerifySessionDb(options) {
   if (options.noReplicateMarker && fileExists(options.noReplicateMarker)) {
     return { verifyFatal: false };
   }
-  return { verifyFatal: await verifySessionDb(options, configPath, env) };
+  return verifySessionDb(options, configPath, env);
 }
 
 // src/lib/opencode/session-db-provenance.ts
 import { createRequire } from "node:module";
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname3, join as join5 } from "node:path";
+import { dirname as dirname4, join as join5 } from "node:path";
 var require2 = createRequire(import.meta.url);
 function readSessionDbMigrationIds(dbPath) {
   let db;
@@ -4403,7 +5036,7 @@ function loadSessionDbProvenanceState(path) {
 }
 function saveSessionDbProvenanceState(path, state) {
   try {
-    mkdirSync2(dirname3(path), { recursive: true });
+    mkdirSync2(dirname4(path), { recursive: true });
     writeFileSync2(path, `${JSON.stringify(state, null, 2)}
 `, "utf8");
   } catch (error2) {
@@ -4984,7 +5617,10 @@ function selectSessionsToDelete(sessions, opts) {
       toDelete.push(s.id);
     }
   }
-  return toDelete;
+  const activityById = new Map(sessions.map((session) => [session.id, session.lastActivityMs]));
+  return toDelete.sort(
+    (a, b) => (activityById.get(a) ?? -Infinity) - (activityById.get(b) ?? -Infinity)
+  );
 }
 var DEFAULT_INTERVAL = "1h";
 function resolve(flag, envValue, fallback) {
@@ -5044,13 +5680,13 @@ function resolveSessionCleanupConfig(flags, env = process.env) {
 }
 
 // src/lib/opencode/session-db-size.ts
-import { statSync as statSync3 } from "node:fs";
+import { statSync as statSync4 } from "node:fs";
 import { join as join6 } from "node:path";
 var LARGE_DB_THRESHOLD_BYTES = 268435456;
 function statSessionDbBytes(homeDir) {
   const dbPath = join6(homeDir, ".local", "share", "opencode", "opencode.db");
   try {
-    return statSync3(dbPath).size;
+    return statSync4(dbPath).size;
   } catch (err) {
     const isMissingFile = err instanceof Error && "code" in err && err.code === "ENOENT";
     if (!isMissingFile) {
@@ -5076,7 +5712,7 @@ function buildSessionStoreSizeWarning(input) {
 }
 
 // src/lib/opencode/log-tail.ts
-import { statSync as statSync4 } from "node:fs";
+import { statSync as statSync5 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
 import { join as join7 } from "node:path";
 import { open as open2, stat } from "node:fs/promises";
@@ -5099,186 +5735,63 @@ function tailOpenCodeLogFile(logPath, onChunk, opts = {}) {
   let inode = null;
   let baselineReady = true;
   try {
-    const initial = statSync4(logPath);
+    const initial = statSync5(logPath);
     offset = initial.size;
     inode = initial.ino;
   } catch (error2) {
     if (!isEnoent(error2)) {
       reportFailure("initial stat", logPath, error2);
       baselineReady = false;
-    }
-  }
-  let polling = false;
-  let stopped = false;
-  const poll = async () => {
-    if (polling || stopped) return;
-    polling = true;
-    try {
-      let current;
-      try {
-        current = await stat(logPath);
-      } catch (error2) {
-        if (!isEnoent(error2)) reportFailure("stat", logPath, error2);
-        return;
-      }
-      if (!baselineReady) {
-        offset = current.size;
-        inode = current.ino;
-        baselineReady = true;
-        return;
-      }
-      if (inode !== null && current.ino !== inode || current.size < offset) {
-        offset = 0;
-      }
-      inode = current.ino;
-      if (current.size === offset) return;
-      const length = current.size - offset;
-      const fh = await open2(logPath, "r");
-      try {
-        const buf = Buffer.alloc(length);
-        const { bytesRead } = await fh.read(buf, 0, length, offset);
-        offset += bytesRead;
-        if (bytesRead > 0) onChunk(buf.subarray(0, bytesRead));
-      } finally {
-        await fh.close();
-      }
-    } catch (error2) {
-      if (!isEnoent(error2)) reportFailure("poll", logPath, error2);
-    } finally {
-      polling = false;
-    }
-  };
-  const interval = setInterval(() => void poll(), pollIntervalMs);
-  void poll();
-  return {
-    stop: () => {
-      stopped = true;
-      clearInterval(interval);
-    }
-  };
-}
-
-// src/lib/opencode/session-db-reclaim.ts
-import { statSync as statSync5, statfsSync } from "node:fs";
-import { dirname as dirname4 } from "node:path";
-function errorMessage(error2) {
-  if (!(error2 instanceof Error)) return String(error2);
-  return error2.cause instanceof Error ? error2.cause.message : error2.message;
-}
-function insufficientSpaceReason(dbPath, requiredBytes) {
-  try {
-    const fsStats = statfsSync(dirname4(dbPath));
-    const availableBytes = fsStats.bavail * fsStats.bsize;
-    if (availableBytes < requiredBytes) {
-      return `only ${availableBytes} bytes free, need ${requiredBytes} for a second copy`;
-    }
-    return null;
-  } catch (err) {
-    return `could not check free space (${err instanceof Error ? err.message : String(err)}); refusing to guess`;
-  }
-}
-function readLogicalBytes(db) {
-  const pageCount = db.prepare("PRAGMA page_count").get().page_count;
-  const pageSize = db.prepare("PRAGMA page_size").get().page_size;
-  return pageCount * pageSize;
-}
-function readCheckpointResult(db) {
-  const row = db.prepare("PRAGMA wal_checkpoint(TRUNCATE)").get();
-  return { busy: row.busy !== 0, log: row.log, checkpointed: row.checkpointed };
-}
-async function probeReclaimAvailability(input) {
-  const { dbPath, requiredBytes } = input;
-  let sqlite;
-  try {
-    sqlite = await import("node:sqlite");
-  } catch (err) {
-    const detail = `Node ${process.version}: ${errorMessage(err)}`;
-    console.warn(`[probeReclaimAvailability] node:sqlite unavailable for ${dbPath}: ` + detail);
-    return { reason: "sqlite-unavailable", detail };
-  }
-  let autoVacuum = null;
-  try {
-    const db = new sqlite.DatabaseSync(dbPath, { readOnly: true });
-    try {
-      db.exec("PRAGMA busy_timeout=5000");
-      autoVacuum = db.prepare("PRAGMA auto_vacuum").get().auto_vacuum;
-    } finally {
-      db.close();
-    }
-  } catch (err) {
-    console.warn(
-      `[probeReclaimAvailability] could not read auto_vacuum mode for ${dbPath}: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-  if (autoVacuum !== 0) return null;
-  return insufficientSpaceReason(dbPath, requiredBytes) !== null ? { reason: "insufficient-disk-space" } : null;
-}
-async function reclaimSessionDbSpace(input) {
-  const { dbPath, maxPages, allowFullVacuum = true } = input;
-  let sqlite;
-  try {
-    sqlite = await import("node:sqlite");
-  } catch (err) {
-    const detail = `Node ${process.version}: ${errorMessage(err)}`;
-    console.warn(
-      `[reclaimSessionDbSpace] node:sqlite unavailable (need Node >=22.5, >=22.13 unflagged) for ${dbPath}: ${detail}`
-    );
-    return { ok: false, skipped: "sqlite-unavailable", detail };
-  }
-  const { DatabaseSync } = sqlite;
-  let db;
-  try {
-    db = new DatabaseSync(dbPath);
-    db.exec("PRAGMA busy_timeout=5000");
-    const autoVacuum = db.prepare("PRAGMA auto_vacuum").get().auto_vacuum;
-    if (autoVacuum === 0) {
-      if (!allowFullVacuum) {
-        console.warn(
-          `[reclaimSessionDbSpace] skipping VACUUM conversion of ${dbPath}: a session turn is live`
-        );
-        return {
-          ok: false,
-          skipped: "full-vacuum-blocked",
-          detail: "a session turn is live"
-        };
+    }
+  }
+  let polling = false;
+  let stopped = false;
+  const poll = async () => {
+    if (polling || stopped) return;
+    polling = true;
+    try {
+      let current;
+      try {
+        current = await stat(logPath);
+      } catch (error2) {
+        if (!isEnoent(error2)) reportFailure("stat", logPath, error2);
+        return;
       }
-      const fileBytesForGuard = statSync5(dbPath).size;
-      const skipReason = insufficientSpaceReason(dbPath, fileBytesForGuard);
-      if (skipReason !== null) {
-        console.warn(
-          `[reclaimSessionDbSpace] skipping VACUUM conversion of ${dbPath}: ${skipReason}`
-        );
-        return { ok: false, skipped: "insufficient-disk-space", detail: skipReason };
+      if (!baselineReady) {
+        offset = current.size;
+        inode = current.ino;
+        baselineReady = true;
+        return;
       }
-      const beforeBytes = readLogicalBytes(db);
-      db.exec("PRAGMA auto_vacuum=INCREMENTAL");
-      db.exec("VACUUM");
-      const afterBytes = readLogicalBytes(db);
-      const checkpoint = readCheckpointResult(db);
-      return { ok: true, mode: "convert", beforeBytes, afterBytes, checkpoint };
+      if (inode !== null && current.ino !== inode || current.size < offset) {
+        offset = 0;
+      }
+      inode = current.ino;
+      if (current.size === offset) return;
+      const length = current.size - offset;
+      const fh = await open2(logPath, "r");
+      try {
+        const buf = Buffer.alloc(length);
+        const { bytesRead } = await fh.read(buf, 0, length, offset);
+        offset += bytesRead;
+        if (bytesRead > 0) onChunk(buf.subarray(0, bytesRead));
+      } finally {
+        await fh.close();
+      }
+    } catch (error2) {
+      if (!isEnoent(error2)) reportFailure("poll", logPath, error2);
+    } finally {
+      polling = false;
     }
-    if (autoVacuum === 2) {
-      const beforeBytes = readLogicalBytes(db);
-      const bound = Math.max(0, Math.trunc(maxPages));
-      db.exec(`PRAGMA incremental_vacuum(${bound})`);
-      const afterBytes = readLogicalBytes(db);
-      const checkpoint = readCheckpointResult(db);
-      return { ok: true, mode: "incremental", beforeBytes, afterBytes, checkpoint };
+  };
+  const interval = setInterval(() => void poll(), pollIntervalMs);
+  void poll();
+  return {
+    stop: () => {
+      stopped = true;
+      clearInterval(interval);
     }
-    console.warn(
-      `[reclaimSessionDbSpace] ${dbPath} has auto_vacuum=${autoVacuum} (neither NONE nor INCREMENTAL); nothing to reclaim`
-    );
-    return { ok: false, skipped: "auto-vacuum-not-applicable" };
-  } catch (err) {
-    console.error(`[reclaimSessionDbSpace] reclaim failed for ${dbPath}: ` + errorMessage(err));
-    return {
-      ok: false,
-      skipped: "reclaim-error",
-      detail: errorMessage(err)
-    };
-  } finally {
-    db?.close();
-  }
+  };
 }
 
 // src/lib/tunnel/connection.ts
@@ -5510,6 +6023,8 @@ var StreamForwarder = class {
           if (done) break;
           const chunk = Buffer.from(value);
           for (let i = 0; i < chunk.length; i += MAX_FRAME_BYTES) {
+            await stream.pausePromise;
+            if (ac.signal.aborted) break;
             const slice = chunk.subarray(i, i + MAX_FRAME_BYTES);
             if (this.binaryFramesSupported) {
               if (this.ws.readyState === WebSocket.OPEN) {
@@ -5552,6 +6067,7 @@ function classifyUpgradeRejection(headers) {
 }
 var MAX_RECONNECT_DELAY = 3e4;
 var BASE_RECONNECT_DELAY = 500;
+var RELAY_SILENCE_TIMEOUT_MS = 9e4;
 function getReconnectDelay(attempt) {
   const exponentialDelay = BASE_RECONNECT_DELAY * Math.pow(2, attempt);
   const jitter = Math.random() * 1e3;
@@ -5623,10 +6139,27 @@ function connectTunnel(options) {
       ws.close();
       reject(new Error("Connection timeout"));
     }, 3e4);
+    let relaySilenceTimeout;
+    let relaySilenceTimedOut = false;
+    const clearRelaySilenceTimeout = () => {
+      if (relaySilenceTimeout === void 0) return;
+      clearTimeout(relaySilenceTimeout);
+      relaySilenceTimeout = void 0;
+    };
+    const armRelaySilenceTimeout = () => {
+      clearRelaySilenceTimeout();
+      relaySilenceTimeout = setTimeout(() => {
+        relaySilenceTimeout = void 0;
+        relaySilenceTimedOut = true;
+        ws.terminate();
+      }, RELAY_SILENCE_TIMEOUT_MS);
+      relaySilenceTimeout.unref?.();
+    };
     let upgradeRejection = null;
     let upgradeRejectionReason = null;
     ws.on("unexpected-response", (_req, res) => {
       clearTimeout(connectionTimeout);
+      clearRelaySilenceTimeout();
       const reason = classifyUpgradeRejection(res.headers);
       upgradeRejectionReason = reason;
       const chunks = [];
@@ -5656,6 +6189,7 @@ function connectTunnel(options) {
       onInfo?.("WebSocket connection established");
     });
     ws.on("message", (data, isBinary) => {
+      if (relaySilenceTimeout !== void 0) armRelaySilenceTimeout();
       if (isBinary) {
         try {
           const frame = decodeBinaryBodyFrame(toUint8Array(data));
@@ -5689,6 +6223,7 @@ function connectTunnel(options) {
       switch (message.type) {
         case "connected": {
           clearTimeout(connectionTimeout);
+          armRelaySilenceTimeout();
           forwarder.setBinaryFramesSupported(message.binary_frames === true);
           const connectedAgentId = message.agent_id ?? agentId;
           onConnected?.(connectedAgentId);
@@ -5713,6 +6248,7 @@ function connectTunnel(options) {
     });
     ws.on("error", (error2) => {
       clearTimeout(connectionTimeout);
+      clearRelaySilenceTimeout();
       const detail = upgradeRejection ?? describeSocketError(error2, url);
       if (upgradeRejectionReason === "do_code_updated") {
         onWarning?.("Relay redeployed \u2014 reconnecting");
@@ -5724,7 +6260,8 @@ function connectTunnel(options) {
       );
     });
     ws.on("close", (code, reason) => {
-      const reasonStr = reason.toString() || upgradeRejection || (code === 1006 ? "abnormal closure" : "No reason provided");
+      clearRelaySilenceTimeout();
+      const reasonStr = (relaySilenceTimedOut ? "no relay heartbeat for 90s \u2014 reconnecting" : void 0) || reason.toString() || upgradeRejection || (code === 1006 ? "abnormal closure" : "No reason provided");
       forwarder.abortAll();
       onDisconnected?.(code, reasonStr);
     });
@@ -5732,7 +6269,7 @@ function connectTunnel(options) {
 }
 
 // src/lib/tunnel/runner-connection.ts
-var RunnerConnection = class {
+var RunnerConnection = class _RunnerConnection {
   opts;
   sleep;
   now;
@@ -5746,6 +6283,10 @@ var RunnerConnection = class {
   reconnectAttempt = 0;
   generation = 0;
   disconnectedAtMs = null;
+  static RELAY_RECONNECT_CLOSE_REASONS = /* @__PURE__ */ new Set([
+    "No pong received",
+    "Orphaned socket"
+  ]);
   constructor(opts) {
     this.opts = opts;
     this.resolvedAgentId = opts.agentId;
@@ -5802,7 +6343,8 @@ var RunnerConnection = class {
           onDisconnected: (code, reason) => {
             this.disconnectedAtMs = this.now();
             events.onDisconnected(code, reason, { generation: this.generation });
-            if (this.opts.isRunning() && code !== 1e3 && !this.reconnecting) {
+            const relayRequestedReconnect = code === 1e3 && _RunnerConnection.RELAY_RECONNECT_CLOSE_REASONS.has(reason);
+            if (this.opts.isRunning() && (code !== 1e3 || relayRequestedReconnect) && !this.reconnecting) {
               this.reconnectPromise = this.connectWithRetry(true).catch((err) => {
                 events.onError?.(`Reconnection failed: ${err.message}`);
               });
@@ -6141,6 +6683,101 @@ function createResourceUsageCollector(homeDir) {
   };
 }
 
+// src/lib/resource-usage-low-disk.ts
+var RUNNER_DISK_ALERT_ENTRY_FREE_BYTES = 4 * 1024 ** 3;
+var RUNNER_DISK_ALERT_ENTRY_FREE_FRACTION = 0.25;
+var RUNNER_DISK_ALERT_VERY_LOW_FREE_BYTES = 1 * 1024 ** 3;
+var RUNNER_DISK_ALERT_CRITICAL_FREE_BYTES = 256 * 1024 ** 2;
+var RUNNER_DISK_ALERT_RECOVERY_FREE_BYTES = 6 * 1024 ** 3;
+var RUNNER_DISK_ALERT_RECOVERY_FREE_FRACTION = 0.375;
+var LOCAL_DISK_WARNING_REASSERTION_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var BAND_RANK = {
+  low: 1,
+  very_low: 2,
+  critical: 3
+};
+function bandFor(freeBytes) {
+  if (freeBytes < RUNNER_DISK_ALERT_CRITICAL_FREE_BYTES) return "critical";
+  if (freeBytes < RUNNER_DISK_ALERT_VERY_LOW_FREE_BYTES) return "very_low";
+  return "low";
+}
+function formatBytes(bytes) {
+  if (bytes === null) return "unavailable";
+  const units = ["B", "KiB", "MiB", "GiB", "TiB"];
+  const unitIndex = Math.min(Math.floor(Math.log2(Math.max(bytes, 1)) / 10), units.length - 1);
+  const value = bytes / 1024 ** unitIndex;
+  const digits = unitIndex === 0 || value >= 100 ? 0 : value >= 10 ? 1 : 2;
+  return `${value.toFixed(digits)} ${units[unitIndex]}`;
+}
+function warningMessage(band, diskFreeBytes, diskTotalBytes, opencodeDbBytes) {
+  return `Low disk warning (${band} severity): ${formatBytes(diskFreeBytes)} free of ${formatBytes(diskTotalBytes)}; opencode.db is ${formatBytes(opencodeDbBytes)}. Clear space on the machine running this runner before session history or new work can no longer be saved.`;
+}
+function evaluateLowDiskWarning(input) {
+  const { diskFreeBytes, diskTotalBytes, opencodeDbBytes, nowMs, state } = input;
+  if (diskFreeBytes === null || diskTotalBytes === null || diskTotalBytes <= 0 || diskFreeBytes >= diskTotalBytes) {
+    return { warning: null, state };
+  }
+  const recovered = diskFreeBytes >= RUNNER_DISK_ALERT_RECOVERY_FREE_BYTES || diskFreeBytes >= diskTotalBytes * RUNNER_DISK_ALERT_RECOVERY_FREE_FRACTION;
+  if (recovered) {
+    return { warning: null, state: { worstBand: null, warnedAtMs: null } };
+  }
+  const low = diskFreeBytes < RUNNER_DISK_ALERT_ENTRY_FREE_BYTES && diskFreeBytes < diskTotalBytes * RUNNER_DISK_ALERT_ENTRY_FREE_FRACTION;
+  if (!low) return { warning: null, state };
+  const currentBand = bandFor(diskFreeBytes);
+  const currentRank = BAND_RANK[currentBand];
+  const previousRank = state.worstBand === null ? 0 : BAND_RANK[state.worstBand];
+  const worse = currentRank > previousRank;
+  const reassert = state.warnedAtMs !== null && nowMs - state.warnedAtMs >= LOCAL_DISK_WARNING_REASSERTION_INTERVAL_MS;
+  const nextState = {
+    worstBand: worse ? currentBand : state.worstBand ?? currentBand,
+    warnedAtMs: worse || state.warnedAtMs === null || reassert ? nowMs : state.warnedAtMs
+  };
+  return {
+    warning: worse || state.warnedAtMs === null || reassert ? warningMessage(nextState.worstBand, diskFreeBytes, diskTotalBytes, opencodeDbBytes) : null,
+    state: nextState
+  };
+}
+
+// src/lib/opencode/session-store-health.ts
+var SESSION_STORE_HEALTH_STALENESS_MS = 5 * 6e4;
+function createSessionStoreHealth(options = {}) {
+  const now = options.now ?? (() => Date.now());
+  const stalenessMs = Math.max(0, options.stalenessMs ?? SESSION_STORE_HEALTH_STALENESS_MS);
+  let lastUnwritableAt = null;
+  let lastWritableAt = null;
+  const causes = /* @__PURE__ */ new Map();
+  return {
+    observeUnwritable: () => {
+      lastUnwritableAt = now();
+    },
+    observeWritable: () => {
+      lastWritableAt = now();
+    },
+    isUnwritable: () => {
+      if (lastUnwritableAt === null) return false;
+      if (lastWritableAt !== null && lastWritableAt >= lastUnwritableAt) return false;
+      return now() - lastUnwritableAt < stalenessMs;
+    },
+    observeCause: (sessionId, cause) => {
+      if (sessionId === null) return;
+      causes.delete(sessionId);
+      causes.set(sessionId, { cause, observedAt: now() });
+      while (causes.size > 256) {
+        const oldest = causes.keys().next().value;
+        if (typeof oldest !== "string") break;
+        causes.delete(oldest);
+      }
+    },
+    readCause: (sessionId) => {
+      const observed = causes.get(sessionId);
+      if (!observed) return null;
+      causes.delete(sessionId);
+      if (now() - observed.observedAt >= stalenessMs) return null;
+      return observed.cause;
+    }
+  };
+}
+
 // src/lib/channels/driver.ts
 import { homedir as homedir6 } from "node:os";
 
@@ -6577,6 +7214,11 @@ function messageIdOf(m) {
   const infoId = m.info?.id;
   return typeof infoId === "string" ? infoId : void 0;
 }
+function composeAbandonmentNote(finish, replyShape, outcome) {
+  const base = `OpenCode ended this turn after a tool call (finish="${finish ?? "(unknown)"}") ` + (outcome === "without-answer" ? "without writing an answer, and confirmed it is no longer working on this conversation. Evident is reporting the run as failed so the failure and its reason are visible in failed runs." : "after writing only part of an answer, and confirmed it is no longer working on this conversation. Evident delivered what was written and is reporting the run as finished.");
+  if (replyShape === null) return base;
+  return `${base} ${replyShape.lastToolName === null ? "No tool call was recorded" : `The last tool call was "${replyShape.lastToolName}" with status "${replyShape.lastToolStatus ?? "(unknown)"}"`}; the reply's final part types were [${replyShape.partTypes.join(", ")}]${replyShape.droppedPartCount > 0 ? ` (${replyShape.droppedPartCount} earlier part types omitted)` : ""}.`;
+}
 function cleanImageMime(contentType) {
   if (!contentType) return null;
   const media = contentType.split(";")[0].trim().toLowerCase();
@@ -6597,8 +7239,13 @@ var SUBAGENT_TELEMETRY_FETCH_TIMEOUT_MS = 2e3;
 var SESSION_ERROR_STREAM_HEALTHY_MS = 5e3;
 var SESSION_ERROR_BUFFER_TTL_MS = SESSION_ERROR_STREAM_HEALTHY_MS;
 var MAX_BUFFERED_SESSION_ERRORS = 256;
+var SESSION_ERROR_RETENTION_TTL_MS = 6e4;
+var SESSION_STORE_UNWRITABLE_ERROR = "The runner session database could not be written, so this turn did not finish. Nothing was lost from the queue. Clear disk space and retry.";
+var SESSION_ERROR_RETAINED_DETAIL = "The runner's session database could not be written, so this turn stopped part-way. Runner-observed session error: ";
+var SESSION_ERROR_OBSERVED_CAUSE = "Runner-observed OpenCode session-store cause: ";
 var DEFAULT_PAUSED_POLL_INTERVAL_MS = 2e3;
 var DEFAULT_PAUSED_MAX_WAIT_MS = 10 * 60 * 1e3;
+var DRIVER_SESSION_ENUMERATION_LIMIT = 20;
 var DEFAULT_STUCK_QUEUED_MS = 6e4;
 var HEARTBEAT_MS = 6e4;
 var ALIVE_WITHHELD_THRESHOLD_MS = 3 * HEARTBEAT_MS;
@@ -6660,6 +7307,7 @@ var ChannelDriver = class _ChannelDriver {
   maxActiveSessions;
   watcherStallMs;
   wedgeWarningIntervalMs;
+  sessionStoreHealth;
   openCodeClient;
   /** Cache of conversationId → opencode sessionId. */
   sessions = /* @__PURE__ */ new Map();
@@ -6752,6 +7400,7 @@ var ChannelDriver = class _ChannelDriver {
    * with a short TTL so an unmatched session cannot retain an event indefinitely.
    */
   bufferedSessionErrors = /* @__PURE__ */ new Map();
+  retainedSessionErrors = /* @__PURE__ */ new Map();
   /**
    * AUTHORITATIVE local dedup (WI-3): Evident message ids that have been
    * dispatched and are still in-flight. A message in this set is never
@@ -6784,10 +7433,18 @@ var ChannelDriver = class _ChannelDriver {
    * row is `processing` or `pending`; clear it only when absent from both lists.
    */
   untrackableAck = /* @__PURE__ */ new Map();
+  /** Session binding used by the first untrackable-ack report, for retries. */
+  untrackableAckSessionIds = /* @__PURE__ */ new Map();
   /** Messages whose untrackable-ack failure signal was emitted while fenced. */
   untrackableAckSignalled = /* @__PURE__ */ new Set();
   /** Messages whose first untrackable-ack fence warning was already logged. */
   untrackableAckWarned = /* @__PURE__ */ new Set();
+  /**
+   * Accepted V1 prompts whose assigned ids were not read back; these rows are
+   * re-read instead of POSTed again. A null snapshot cannot safely exclude an older
+   * identical-text turn, so it never produces a correlation.
+   */
+  awaitingCorrelation = /* @__PURE__ */ new Map();
   /** Pending rows seen in the current drain, used to retain terminal dispatch fences. */
   pendingMessageIds = /* @__PURE__ */ new Set();
   /**
@@ -6873,21 +7530,6 @@ var ChannelDriver = class _ChannelDriver {
    * re-signal on every one of the 15h of re-dispatch attempts #1110 made.
    */
   dispatchNotStartedSignalled = /* @__PURE__ */ new Map();
-  /**
-   * Consecutive-UNCONFIRMED-dispatch streak for a `pending` row with NO stored
-   * `opencode_message_id` yet — i.e. one that has never even reached the
-   * re-drive fence above. `sendPromptAsync`'s POST may 2xx, but its own
-   * read-back retries can never confirm the assigned id when the session's
-   * message list is PERMANENTLY unreadable (e.g. a corrupted local opencode
-   * SQLite DB, #1345/#1348's exact fault, just hit BEFORE the row is ever
-   * dispatched instead of after). Unlike an already-dispatched row, THIS row has
-   * no other safety net at all: the lifecycle cron only reclaims `status =
-   * 'processing'` rows, and a row stuck here never reaches `processing`. Keyed
-   * by message id, carrying `sessionId` so a session change (a fresh one bound
-   * after abandonment) starts a new streak rather than inheriting the old
-   * session's count — same shape as `redrivePollFailures` above.
-   */
-  unconfirmedDispatchFailures = /* @__PURE__ */ new Map();
   /**
    * Consecutive give-ups for a message whose OpenCode user row remains queued.
    * The session id scopes the count: a fresh session is a new attempt after a
@@ -6905,8 +7547,8 @@ var ChannelDriver = class _ChannelDriver {
    * short-circuits while it is present, so a null-id row is re-dispatched AT MOST
    * ONCE per outstanding read-back. Cleared on a SUCCESSFUL dispatch+read-back (the
    * row is then tracked in `dispatched`, so `readoptOne`'s early skip prevents
-   * re-entry) OR on a failed/unresolved dispatch (the message is genuinely un-sent,
-   * so the NEXT tick may retry exactly once more).
+   * re-entry) OR on a failed/unresolved dispatch (the accepted prompt is handed to
+   * the terminal-report fence and is never sent again).
    */
   awaitingReadopt = /* @__PURE__ */ new Set();
   /**
@@ -7029,6 +7671,7 @@ var ChannelDriver = class _ChannelDriver {
     this.maxActiveSessions = config.maxActiveSessions;
     this.watcherStallMs = config.watcherStallMs ?? WATCHER_STALL_MS;
     this.wedgeWarningIntervalMs = config.wedgeWarningIntervalMs ?? WEDGE_WARNING_INTERVAL_MS;
+    this.sessionStoreHealth = config.sessionStoreHealth;
   }
   get isV2() {
     return this.openCodeClient.version === "v2";
@@ -7044,7 +7687,9 @@ var ChannelDriver = class _ChannelDriver {
     return fetchSessionMessages(this.port, sessionId, this.openCodeClient);
   }
   async listSessions() {
-    return this.isV2 ? listV2Sessions(this.openCodeClient) : listSessions(this.port, this.openCodeClient);
+    return this.isV2 ? listV2Sessions(this.openCodeClient) : listSessions(this.port, this.openCodeClient, {
+      limit: DRIVER_SESSION_ENUMERATION_LIMIT
+    });
   }
   async sessionExists(sessionId) {
     return this.isV2 ? v2SessionExists(this.openCodeClient, sessionId) : sessionExists(this.port, sessionId, this.openCodeClient);
@@ -7221,6 +7866,49 @@ var ChannelDriver = class _ChannelDriver {
     }
     return ids;
   }
+  /** Find an accepted prompt's user row without adopting an older or concurrent turn. */
+  findAwaitingCorrelationId(entry, sessionId, messages) {
+    if (entry.sessionId !== sessionId || entry.knownUserIds === null) return null;
+    const excludeIds = new Set(entry.knownUserIds);
+    for (const inFlight of this.watchers.get(entry.sessionId)?.inFlight.values() ?? []) {
+      excludeIds.add(inFlight.opencodeMessageId);
+    }
+    return findDispatchedUserMessageId(messages, entry.content, excludeIds);
+  }
+  /** Hand an exhausted accepted-but-untrackable prompt to the terminal-report fence. */
+  async handoffUntrackableCorrelation(conversationId, messageId, sessionId, attempts, source) {
+    this.awaitingCorrelation.delete(messageId);
+    this.awaitingReadopt.delete(messageId);
+    this.sessions.delete(conversationId);
+    this.supersede(conversationId, sessionId);
+    const dispatchDescription = source === "readopt" ? "re-dispatched message" : "message";
+    const errorMessage3 = `OpenCode accepted this ${dispatchDescription} once, but its assigned id was never confirmed after ${attempts} attempts to match it up \u2014 the message was deliberately not sent again, so no duplicate turn was created; session ${sessionId.slice(0, 8)} was abandoned; a fresh one is used for further messages.`;
+    this.untrackableAck.set(messageId, errorMessage3);
+    this.untrackableAckSessionIds.set(messageId, null);
+    this.log({
+      level: "error",
+      message: errorMessage3,
+      conversation_id: conversationId,
+      message_id: messageId
+    });
+    const reportError = await this.reportUntrackableAck(
+      conversationId,
+      messageId,
+      null,
+      errorMessage3
+    );
+    if (reportError !== null) {
+      this.log({
+        level: "warn",
+        message: `markFailed PATCH for message ${messageId.slice(0, 8)} (conversation ${conversationId.slice(0, 8)}) failed: ${reportError.message}`,
+        conversation_id: conversationId,
+        message_id: messageId
+      });
+    }
+    if (source === "readopt") {
+      void this.postSignal(conversationId, messageId, "readopt_orphan_unsent");
+    }
+  }
   /**
    * File-pull work, for `run.ts`'s idle accounting (#559).
    *
@@ -7400,6 +8088,56 @@ var ChannelDriver = class _ChannelDriver {
         }
         break;
       }
+      const correlation = this.awaitingCorrelation.get(message.id);
+      if (correlation) {
+        correlation.attempts += 1;
+        let correlatedId = null;
+        if (correlation.knownUserIds !== null && correlation.sessionId === sessionId) {
+          const polled = await this.pollSessionMessagesForRedrive(
+            conv,
+            message,
+            correlation.sessionId
+          );
+          if (polled.ok)
+            correlatedId = this.findAwaitingCorrelationId(correlation, sessionId, polled.messages);
+        } else if (correlation.knownUserIds === null) {
+          this.log({
+            level: "debug",
+            message: `Message ${message.id.slice(0, 8)} cannot be correlated because its pre-dispatch session list was unreadable`,
+            conversation_id: conv.id,
+            message_id: message.id
+          });
+        }
+        if (correlatedId !== null) {
+          this.awaitingCorrelation.delete(message.id);
+          this.dispatchNotStartedSignalled.delete(message.id);
+          this.releasedOpencodeIds.delete(message.id);
+          this.dispatched.add(message.id);
+          this.registerInFlight(conv, correlation.sessionId, message, correlatedId);
+          dispatched += 1;
+          this.log({
+            level: "info",
+            message: `Matched accepted message ${message.id.slice(0, 8)} to OpenCode turn ${correlatedId.slice(0, 8)} without sending it again`,
+            conversation_id: conv.id,
+            message_id: message.id
+          });
+          void this.postSignal(conv.id, message.id, "ack_correlated", {
+            opencode_message_id: correlatedId
+          });
+          continue;
+        }
+        if (correlation.attempts >= MAX_IDENTICAL_REDRIVE_POLL_FAILURES) {
+          await this.handoffUntrackableCorrelation(
+            conv.id,
+            message.id,
+            correlation.sessionId,
+            correlation.attempts,
+            "fresh"
+          );
+          break;
+        }
+        break;
+      }
       const effectiveOpencodeMessageId = message.opencode_message_id ?? this.releasedOpencodeIds.get(message.id)?.opencodeMessageId ?? null;
       if (effectiveOpencodeMessageId) {
         const outcome = await this.resolveRedrive(
@@ -7421,6 +8159,7 @@ var ChannelDriver = class _ChannelDriver {
         model: message.opencode_model ?? void 0
       };
       let opencodeMessageId;
+      let preDispatchUserIds = null;
       try {
         this.log({
           level: "info",
@@ -7450,7 +8189,20 @@ var ChannelDriver = class _ChannelDriver {
             message.content,
             options,
             sendAttachments,
-            this.openCodeClient
+            this.openCodeClient,
+            {
+              onKnownUserIds: (ids) => {
+                preDispatchUserIds = ids;
+              },
+              onKnownUserIdsError: (error2) => {
+                this.log({
+                  level: "warn",
+                  message: `Pre-dispatch snapshot callback failed for message ${message.id.slice(0, 8)}: ${error2 instanceof Error ? error2.message : String(error2)}`,
+                  conversation_id: conv.id,
+                  message_id: message.id
+                });
+              }
+            }
           )
         );
       } catch (err) {
@@ -7458,6 +8210,7 @@ var ChannelDriver = class _ChannelDriver {
         if (this.isV2 && err instanceof OpenCodeV2PromptAckError) {
           const errorMessage4 = err instanceof Error ? err.message : String(err);
           this.untrackableAck.set(message.id, errorMessage4);
+          this.untrackableAckSessionIds.set(message.id, null);
           this.log({
             level: "error",
             message: `V2 prompt dispatch for message ${message.id.slice(0, 8)} failed after a positive ack with no usable id: ${errorMessage4}`,
@@ -7533,39 +8286,21 @@ var ChannelDriver = class _ChannelDriver {
         if (this.isV2) {
           throw new Error("V2 prompt dispatch completed without an acknowledged message id");
         }
-        const streak = this.recordUnconfirmedDispatch(message.id, sessionId);
-        if (streak < MAX_IDENTICAL_REDRIVE_POLL_FAILURES) {
-          this.log({
-            level: "warn",
-            message: `Message ${message.id.slice(0, 8)} dispatched but its opencode id could not be read back (${streak}/${MAX_IDENTICAL_REDRIVE_POLL_FAILURES}) \u2014 leaving un-tracked to retry next tick`,
-            conversation_id: conv.id,
-            message_id: message.id
-          });
-          this.signalDispatchNotStarted(conv, message, "readback_unconfirmed");
-          continue;
-        }
-        this.unconfirmedDispatchFailures.delete(message.id);
-        this.sessions.delete(conv.id);
-        this.supersede(conv.id, sessionId);
-        const errorMessage3 = `OpenCode accepted this message ${streak} times in a row but never confirmed its assigned id (session ${sessionId.slice(0, 8)}'s message list could not be read back) \u2014 the session was abandoned; a fresh one is used for further messages.`;
+        this.awaitingCorrelation.set(message.id, {
+          sessionId,
+          content: message.content,
+          attempts: 0,
+          knownUserIds: preDispatchUserIds
+        });
         this.log({
-          level: "error",
-          message: errorMessage3,
+          level: "warn",
+          message: `OpenCode accepted message ${message.id.slice(0, 8)}, but its assigned id could not be read back \u2014 the message will not be sent again while the runner matches it to the turn already running`,
           conversation_id: conv.id,
           message_id: message.id
         });
-        await this.markFailed(conv.id, message.id, null, errorMessage3).catch((markErr) => {
-          this.log({
-            level: "warn",
-            message: `markFailed PATCH for message ${message.id.slice(0, 8)} (conversation ${conv.id.slice(0, 8)}) failed (best-effort, not retried): ${markErr instanceof Error ? markErr.message : String(markErr)}`,
-            conversation_id: conv.id,
-            message_id: message.id
-          });
-          this.signalDispatchNotStarted(conv, message, "abandon_unreported");
-        });
+        this.signalDispatchNotStarted(conv, message, "readback_unconfirmed");
         break;
       }
-      this.unconfirmedDispatchFailures.delete(message.id);
       this.dispatchNotStartedSignalled.delete(message.id);
       this.releasedOpencodeIds.delete(message.id);
       this.dispatched.add(message.id);
@@ -8170,23 +8905,6 @@ var ChannelDriver = class _ChannelDriver {
     this.redrivePollFailures.set(messageId, { sessionId, signature, count: 1 });
     return 1;
   }
-  /**
-   * Record one UNCONFIRMED-dispatch outcome (a `pending` row with no stored
-   * `opencode_message_id` whose `sendPromptAsync` returned `null`) toward the
-   * bound in `processConversation`'s dispatch loop, and return the resulting
-   * count. Mirrors `recordRedrivePollFailure`'s session-scoping: a session
-   * change starts a fresh streak at `1` rather than inheriting the old one's
-   * count, since a new session is a genuinely different attempt.
-   */
-  recordUnconfirmedDispatch(messageId, sessionId) {
-    const existing = this.unconfirmedDispatchFailures.get(messageId);
-    if (existing && existing.sessionId === sessionId) {
-      existing.count += 1;
-      return existing.count;
-    }
-    this.unconfirmedDispatchFailures.set(messageId, { sessionId, count: 1 });
-    return 1;
-  }
   /** Record one queued give-up toward the never-started bound. */
   recordNeverStartedAttempt(messageId, sessionId) {
     const existing = this.neverStartedAttempts.get(messageId);
@@ -8498,8 +9216,10 @@ var ChannelDriver = class _ChannelDriver {
       b2LastDescendantCheckMs: 0,
       b2RootOngoingHeldLogged: false,
       b2AbandonedSignalled: false,
+      b2AbandonedWithoutAnswer: false,
       ambiguousPinnedSinceMs: 0,
       ambiguousResolved: false,
+      sessionStoreFailurePending: false,
       neverStartedResolved: false
     });
     const buffered = this.bufferedSessionErrors.get(sessionId);
@@ -8521,6 +9241,28 @@ var ChannelDriver = class _ChannelDriver {
       this.bufferedSessionErrors.delete(oldest);
     }
   }
+  retainSessionError(event) {
+    this.retainedSessionErrors.delete(event.sessionId);
+    this.retainedSessionErrors.set(event.sessionId, {
+      reason: event.reason,
+      observedAt: this.now()
+    });
+    while (this.retainedSessionErrors.size > MAX_BUFFERED_SESSION_ERRORS) {
+      const oldest = this.retainedSessionErrors.keys().next().value;
+      if (typeof oldest !== "string") break;
+      this.retainedSessionErrors.delete(oldest);
+    }
+  }
+  readRetainedSessionError(sessionId) {
+    const retained = this.retainedSessionErrors.get(sessionId);
+    if (!retained) return null;
+    if (this.now() - retained.observedAt >= SESSION_ERROR_RETENTION_TTL_MS) {
+      this.retainedSessionErrors.delete(sessionId);
+      return null;
+    }
+    this.retainedSessionErrors.delete(sessionId);
+    return retained.reason;
+  }
   /**
    * Build a fresh `SessionWatcher`. Seeds `lastTickAt`/`lastObservedTickAt`
    * EQUAL (#1618) so a watcher whose loop has not started ticking yet is never
@@ -8616,8 +9358,10 @@ var ChannelDriver = class _ChannelDriver {
       b2LastDescendantCheckMs: 0,
       b2RootOngoingHeldLogged: false,
       b2AbandonedSignalled: false,
+      b2AbandonedWithoutAnswer: false,
       ambiguousPinnedSinceMs: 0,
       ambiguousResolved: false,
+      sessionStoreFailurePending: false,
       neverStartedResolved: false
     });
   }
@@ -8845,9 +9589,10 @@ var ChannelDriver = class _ChannelDriver {
         return;
       }
       if ([...watcher.inFlight.values()].some((message) => message.started && !message.done)) {
+        this.retainSessionError(event);
         this.log({
-          level: "debug",
-          message: `A turn is already running in session ${event.sessionId.slice(0, 8)} \u2014 deferring to transcript polling`,
+          level: "warn",
+          message: `A turn is already running in session ${event.sessionId.slice(0, 8)} \u2014 retaining the session error and deferring to transcript polling: ${event.reason}`,
           conversation_id: watcher.conv.id
         });
         return;
@@ -8877,9 +9622,10 @@ var ChannelDriver = class _ChannelDriver {
       const messages = await this.getSessionMessages(event.sessionId);
       const state = messageRunState(messages, inFlight.opencodeMessageId);
       if (state !== "queued") {
+        this.retainSessionError(event);
         this.log({
-          level: "debug",
-          message: `Session error for message ${inFlight.evidentMessageId.slice(0, 8)} observed state ${state}; leaving it to transcript polling`,
+          level: "warn",
+          message: `Session error for message ${inFlight.evidentMessageId.slice(0, 8)} in session ${event.sessionId.slice(0, 8)} observed state ${state}; retaining the reason for transcript polling: ${event.reason}`,
           conversation_id: watcher.conv.id,
           message_id: inFlight.evidentMessageId
         });
@@ -9031,6 +9777,10 @@ var ChannelDriver = class _ChannelDriver {
     if (state === "running" || state === "done" || state === "failed") {
       this.neverStartedAttempts.delete(id);
     }
+    if (inFlight.sessionStoreFailurePending) {
+      await this.settleMessageSessionStoreUnwritable(sessionId, watcher, inFlight);
+      return;
+    }
     if (inFlight.neverStartedResolved) {
       if (state === "running" || state === "done" || state === "failed") {
         inFlight.neverStartedResolved = false;
@@ -9104,7 +9854,16 @@ var ChannelDriver = class _ChannelDriver {
     if (state === "failed") {
       this.anchorDeliveryDeadline(inFlight);
       if (!inFlight.done) {
-        const error2 = messageError(messages, inFlight.opencodeMessageId) ?? void 0;
+        const messageErrorText = messageError(messages, inFlight.opencodeMessageId);
+        const retainedReason = this.readRetainedSessionError(sessionId);
+        const retainedError = retainedReason === null ? null : `${SESSION_ERROR_RETAINED_DETAIL}${retainedReason}`;
+        const observedCause = this.sessionStoreHealth?.readCause(sessionId);
+        const causeError = observedCause === null || observedCause === void 0 ? null : `${SESSION_ERROR_OBSERVED_CAUSE}${observedCause}`;
+        const storeError = this.sessionStoreHealth?.isUnwritable() ? SESSION_STORE_UNWRITABLE_ERROR : null;
+        const runnerDetails = [retainedError, causeError, storeError].filter(
+          (detail) => detail !== null
+        );
+        const error2 = messageErrorText === null ? runnerDetails.length === 0 ? void 0 : runnerDetails.join(" ") : [messageErrorText, ...runnerDetails].join(" ");
         this.log({
           level: "error",
           message: `Message ${inFlight.evidentMessageId.slice(0, 8)} errored \u2014 marking failed: ${error2 ?? "(no error text)"}`,
@@ -9190,10 +9949,33 @@ var ChannelDriver = class _ChannelDriver {
         inFlight.b2LastDescendantCheckMs = 0;
         inFlight.b2RootOngoingHeldLogged = false;
         inFlight.b2AbandonedSignalled = false;
+        inFlight.b2AbandonedWithoutAnswer = false;
       }
     } else {
       if (inFlight.b2AbandonedSignalled) {
-        await this.settleMessageDone(sessionId, watcher, inFlight, messages);
+        const reply = findLastAssistantReplyFor(messages, inFlight.opencodeMessageId);
+        const finish = reply?.info?.finish ?? reply?.finish;
+        if (inFlight.b2AbandonedWithoutAnswer) {
+          await this.settleMessageAbandonedWithoutAnswer(
+            sessionId,
+            watcher,
+            inFlight,
+            messages,
+            finish
+          );
+        } else {
+          await this.settleMessageDone(
+            sessionId,
+            watcher,
+            inFlight,
+            messages,
+            composeAbandonmentNote(
+              finish,
+              describeAbandonedReplyShape(messages, inFlight.opencodeMessageId),
+              "with-answer"
+            )
+          );
+        }
         return;
       }
       if (inFlight.b2PinnedSinceMs === 0) inFlight.b2PinnedSinceMs = this.now();
@@ -9210,22 +9992,62 @@ var ChannelDriver = class _ChannelDriver {
           descendantOngoing,
           rootOngoing
         })) {
+          if (this.sessionStoreHealth?.isUnwritable()) {
+            inFlight.sessionStoreFailurePending = true;
+            void this.postSignal(conv.id, id, "b2_abandoned_resolved", {
+              watched_for_ms: pinnedForMs,
+              run_state: "failed",
+              opencode_message_id: inFlight.opencodeMessageId
+            });
+            await this.settleMessageSessionStoreUnwritable(sessionId, watcher, inFlight);
+            return;
+          }
           inFlight.b2AbandonedSignalled = true;
+          const reply = findLastAssistantReplyFor(messages, inFlight.opencodeMessageId);
+          const finish = reply?.info?.finish ?? reply?.finish;
+          if (extractReplyTextForMessage(messages, inFlight.opencodeMessageId) === null) {
+            inFlight.b2AbandonedWithoutAnswer = true;
+            void this.postSignal(conv.id, id, "b2_abandoned_resolved", {
+              watched_for_ms: pinnedForMs,
+              run_state: "failed",
+              finish,
+              ...rootOngoing != null ? { root_ongoing: rootOngoing } : {},
+              ...descendantOngoing != null ? { descendant_ongoing: descendantOngoing } : {},
+              opencode_message_id: inFlight.opencodeMessageId
+            });
+            await this.settleMessageAbandonedWithoutAnswer(
+              sessionId,
+              watcher,
+              inFlight,
+              messages,
+              finish
+            );
+            return;
+          }
           this.log({
             level: "warn",
             message: `Message ${id.slice(0, 8)} b2-pinned for ${Math.round(pinnedForMs / 1e3)}s with no ongoing descendant sub-agent session (status-map confirmed) \u2014 treating the delegated/tool turn as abandoned, resolving done`,
             conversation_id: conv.id,
             message_id: id
           });
-          const reply = findLastAssistantReplyFor(messages, inFlight.opencodeMessageId);
           void this.postSignal(conv.id, id, "b2_abandoned_resolved", {
             watched_for_ms: pinnedForMs,
-            finish: reply?.info?.finish ?? reply?.finish,
+            finish,
             ...rootOngoing != null ? { root_ongoing: rootOngoing } : {},
             ...descendantOngoing != null ? { descendant_ongoing: descendantOngoing } : {},
             opencode_message_id: inFlight.opencodeMessageId
           });
-          await this.settleMessageDone(sessionId, watcher, inFlight, messages);
+          await this.settleMessageDone(
+            sessionId,
+            watcher,
+            inFlight,
+            messages,
+            composeAbandonmentNote(
+              finish,
+              describeAbandonedReplyShape(messages, inFlight.opencodeMessageId),
+              "with-answer"
+            )
+          );
           return;
         }
         if (rootOngoing === true && !inFlight.b2RootOngoingHeldLogged) {
@@ -9268,6 +10090,16 @@ var ChannelDriver = class _ChannelDriver {
         maxPinnedMs: AMBIGUOUS_FINISH_MAX_PINNED_MS,
         sessionOngoing: ongoing
       })) {
+        if (this.sessionStoreHealth?.isUnwritable()) {
+          inFlight.sessionStoreFailurePending = true;
+          void this.postSignal(conv.id, id, "ambiguous_finish_resolved", {
+            watched_for_ms: pinnedForMs,
+            run_state: "failed",
+            opencode_message_id: inFlight.opencodeMessageId
+          });
+          await this.settleMessageSessionStoreUnwritable(sessionId, watcher, inFlight);
+          return;
+        }
         inFlight.ambiguousResolved = true;
         this.log({
           level: "warn",
@@ -9415,15 +10247,11 @@ var ChannelDriver = class _ChannelDriver {
     }
   }
   /**
-   * Settle a message whose run-state has resolved `'done'` — extracted verbatim
-   * (pure refactor, no behavior change) from `serviceInFlightMessage`'s former
-   * inline `state === 'done'` branch body, so a SECOND caller (the #721
-   * b2-abandonment resolution) can reach the exact same completion behavior
-   * (delivery-deadline anchoring, title resolution, usage extraction, and
-   * `markDone`'s auth/terminal/transient-retry discipline) without duplicating it
-   * and risking the two copies silently drifting apart.
+   * Settle a message whose run-state has resolved `'done'`. Normal completion and
+   * confirmed b2 abandonment share the same delivery, usage, and terminal handling.
+   * Normal completions omit the optional terminal diagnostic.
    */
-  async settleMessageDone(sessionId, watcher, inFlight, messages) {
+  async settleMessageDone(sessionId, watcher, inFlight, messages, note) {
     const conv = watcher.conv;
     this.anchorDeliveryDeadline(inFlight);
     if (!inFlight.done) {
@@ -9450,7 +10278,8 @@ var ChannelDriver = class _ChannelDriver {
           title,
           usage,
           usageAgentName,
-          subagentInvocations
+          subagentInvocations,
+          note
         );
       } catch (err) {
         if (err instanceof ChannelAuthError) throw err;
@@ -9492,6 +10321,78 @@ var ChannelDriver = class _ChannelDriver {
     }
     this.removeInFlight(watcher, inFlight.evidentMessageId);
   }
+  /** Report a confirmed b2 abandonment that produced no answer text. */
+  async settleMessageAbandonedWithoutAnswer(sessionId, watcher, inFlight, messages, finish) {
+    const conv = watcher.conv;
+    const error2 = composeAbandonmentNote(
+      finish,
+      describeAbandonedReplyShape(messages, inFlight.opencodeMessageId),
+      "without-answer"
+    );
+    this.anchorDeliveryDeadline(inFlight);
+    this.log({
+      level: "warn",
+      message: `Message ${inFlight.evidentMessageId.slice(0, 8)} was abandoned without an answer \u2014 ${error2}`,
+      conversation_id: conv.id,
+      message_id: inFlight.evidentMessageId
+    });
+    const usage = messageUsage(messages, inFlight.opencodeMessageId);
+    const usageAgentName = this.usageAgentName(messages ?? [], inFlight.opencodeMessageId);
+    const subagentInvocations = await this.resolveSubagentInvocations(
+      messages,
+      inFlight.opencodeMessageId,
+      inFlight.evidentMessageId
+    );
+    try {
+      await this.markFailed(
+        conv.id,
+        inFlight.evidentMessageId,
+        sessionId,
+        error2,
+        usage,
+        void 0,
+        usageAgentName,
+        subagentInvocations
+      );
+    } catch (err) {
+      if (err instanceof ChannelAuthError) throw err;
+      if (err instanceof ChannelTerminalError) {
+        this.log({
+          level: "warn",
+          message: `Failed to report abandoned no-answer message ${inFlight.evidentMessageId.slice(0, 8)} as failed (terminal HTTP ${err.status}) \u2014 leaving it for the cron safety net: ${err.message}`,
+          conversation_id: conv.id,
+          message_id: inFlight.evidentMessageId
+        });
+        this.removeInFlight(watcher, inFlight.evidentMessageId);
+        return;
+      }
+      if (this.now() >= inFlight.deadline) {
+        this.log({
+          level: "warn",
+          message: `Failed to report abandoned no-answer message ${inFlight.evidentMessageId.slice(0, 8)} as failed within the delivery window \u2014 leaving it for the cron safety net: ${err instanceof Error ? err.message : String(err)}`,
+          conversation_id: conv.id,
+          message_id: inFlight.evidentMessageId
+        });
+        this.removeInFlight(watcher, inFlight.evidentMessageId);
+        return;
+      }
+      this.log({
+        level: "warn",
+        message: `Failed to report abandoned no-answer message ${inFlight.evidentMessageId.slice(0, 8)} as failed (will retry next tick): ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conv.id,
+        message_id: inFlight.evidentMessageId
+      });
+      return;
+    }
+    inFlight.done = true;
+    await this.reportSubagentAuthFailures(
+      watcher.conv.id,
+      inFlight.opencodeMessageId,
+      inFlight.evidentMessageId,
+      messages
+    );
+    this.removeInFlight(watcher, inFlight.evidentMessageId);
+  }
   /**
    * Report a queued message as failed after the never-started bound. The accepted
    * OpenCode copy is not cancelled, so the local fence remains on unsuccessful
@@ -9547,6 +10448,66 @@ var ChannelDriver = class _ChannelDriver {
     this.neverStartedAttempts.delete(inFlight.evidentMessageId);
     this.removeInFlight(watcher, inFlight.evidentMessageId);
   }
+  /**
+   * Report a turn as failed when the session database was observed unwritable.
+   * The queue row is retained as failed, while the OpenCode copy stays fenced so
+   * a later drain cannot blindly prompt the same turn again.
+   */
+  async settleMessageSessionStoreUnwritable(sessionId, watcher, inFlight) {
+    const conv = watcher.conv;
+    const error2 = SESSION_STORE_UNWRITABLE_ERROR;
+    this.log({
+      level: "error",
+      message: `Message ${inFlight.evidentMessageId.slice(0, 8)} was not resolved as done: ${error2}`,
+      conversation_id: conv.id,
+      message_id: inFlight.evidentMessageId
+    });
+    this.anchorDeliveryDeadline(inFlight);
+    try {
+      await this.markFailed(conv.id, inFlight.evidentMessageId, sessionId, error2);
+    } catch (err) {
+      if (err instanceof ChannelAuthError) throw err;
+      if (err instanceof ChannelTerminalError) {
+        this.log({
+          level: "warn",
+          message: `Failed to report session-store failure for message ${inFlight.evidentMessageId.slice(0, 8)} as failed (terminal HTTP ${err.status}) \u2014 keeping its OpenCode copy fenced: ${err.message}`,
+          conversation_id: conv.id,
+          message_id: inFlight.evidentMessageId
+        });
+        this.recordReleasedOpencodeId(
+          inFlight.evidentMessageId,
+          sessionId,
+          inFlight.opencodeMessageId
+        );
+        this.removeInFlight(watcher, inFlight.evidentMessageId);
+        return;
+      }
+      if (this.now() >= inFlight.deadline) {
+        this.log({
+          level: "warn",
+          message: `Failed to report session-store failure for message ${inFlight.evidentMessageId.slice(0, 8)} as failed within the delivery window \u2014 keeping its OpenCode copy fenced: ${err instanceof Error ? err.message : String(err)}`,
+          conversation_id: conv.id,
+          message_id: inFlight.evidentMessageId
+        });
+        this.recordReleasedOpencodeId(
+          inFlight.evidentMessageId,
+          sessionId,
+          inFlight.opencodeMessageId
+        );
+        this.removeInFlight(watcher, inFlight.evidentMessageId);
+        return;
+      }
+      this.log({
+        level: "warn",
+        message: `Failed to report session-store failure for message ${inFlight.evidentMessageId.slice(0, 8)} as failed (will retry next tick): ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conv.id,
+        message_id: inFlight.evidentMessageId
+      });
+      return;
+    }
+    inFlight.done = true;
+    this.removeInFlight(watcher, inFlight.evidentMessageId);
+  }
   // Restart recovery: re-adopt `processing` messages (ADR-0046, WI-3/4/5)
   /**
    * Re-adopt this agent's `processing` messages on drain (ADR-0046 Decision §1).
@@ -9585,11 +10546,22 @@ var ChannelDriver = class _ChannelDriver {
         }
       }
     }
-    if (this.untrackableAck.size > 0 || this.neverStartedAttempts.size > 0) {
+    if (this.untrackableAck.size > 0 || this.neverStartedAttempts.size > 0 || this.awaitingCorrelation.size > 0) {
       const stillProcessing = new Set(rows.map((r) => r.id));
+      for (const id of this.awaitingCorrelation.keys()) {
+        if (!stillProcessing.has(id) && !this.pendingMessageIds.has(id)) {
+          this.awaitingCorrelation.delete(id);
+          this.log({
+            level: "debug",
+            message: `Re-adopt: message ${id.slice(0, 8)} left processing and pending \u2014 cleared awaiting-correlation fence`,
+            message_id: id
+          });
+        }
+      }
       for (const id of [...this.untrackableAck.keys()]) {
         if (!stillProcessing.has(id) && !this.pendingMessageIds.has(id)) {
           this.untrackableAck.delete(id);
+          this.untrackableAckSessionIds.delete(id);
           this.untrackableAckSignalled.delete(id);
           this.untrackableAckWarned.delete(id);
           this.log({
@@ -9629,7 +10601,7 @@ var ChannelDriver = class _ChannelDriver {
       bySession.set(row.opencode_session_id, list);
     }
     for (const [sessionId, sessionRows] of bySession) {
-      let messages;
+      let messages = null;
       try {
         if (this.isV2) {
           const snapshot = await this.getSessionMessages(sessionId);
@@ -9638,9 +10610,9 @@ var ChannelDriver = class _ChannelDriver {
               level: "warn",
               message: `Re-adopt: polling session ${sessionId.slice(0, 8)} returned an unreadable message snapshot \u2014 skipping this session this tick`
             });
-            continue;
+          } else {
+            messages = snapshot;
           }
-          messages = snapshot;
         } else {
           const polled = await pollSessionMessagesForRedrive(
             this.port,
@@ -9653,15 +10625,22 @@ var ChannelDriver = class _ChannelDriver {
               level: "warn",
               message: `Re-adopt: polling session ${sessionId.slice(0, 8)} returned ${polled.malformed ? "a non-array message body" : `HTTP ${polled.status ?? "a network error"}${normalized ? `: ${normalized}` : ""}`} \u2014 skipping this session this tick`
             });
-            continue;
+          } else {
+            messages = polled.messages;
           }
-          messages = polled.messages;
         }
       } catch (err) {
         this.log({
           level: "warn",
           message: `Re-adopt: failed to poll session ${sessionId.slice(0, 8)} (will retry next drain): ${err instanceof Error ? err.message : String(err)}`
         });
+      }
+      if (messages === null) {
+        for (const row of sessionRows) {
+          if (this.awaitingCorrelation.has(row.id)) {
+            await this.advanceReadoptCorrelation(sessionId, row, null);
+          }
+        }
         continue;
       }
       const anyUntracked = sessionRows.some((row) => !this.isTracked(sessionId, row.id));
@@ -9671,6 +10650,59 @@ var ChannelDriver = class _ChannelDriver {
       }
     }
   }
+  /** Advance a re-adopted accepted prompt through the shared correlation fence. */
+  async advanceReadoptCorrelation(sessionId, row, messages) {
+    const correlation = this.awaitingCorrelation.get(row.id);
+    if (!correlation) return false;
+    correlation.attempts += 1;
+    const correlatedId = messages === null ? null : this.findAwaitingCorrelationId(correlation, sessionId, messages);
+    if (correlatedId !== null) {
+      this.awaitingCorrelation.delete(row.id);
+      const conv = this.convForRow(sessionId, row);
+      const message = this.queuedMessageForRow(row);
+      const processedAtMs = this.processedAtMs(row);
+      this.registerReadopted(conv, sessionId, message, correlatedId, processedAtMs, processedAtMs);
+      this.dispatched.add(row.id);
+      this.readopted.add(row.id);
+      this.ensureWatcherRunning(sessionId);
+      this.log({
+        level: "info",
+        message: `Re-adopt: matched accepted message ${row.id.slice(0, 8)} to OpenCode turn ${correlatedId.slice(0, 8)} without sending it again`,
+        conversation_id: row.conversation_id,
+        message_id: row.id
+      });
+      void this.postSignal(row.conversation_id, row.id, "readopt_redispatched");
+      void this.postSignal(row.conversation_id, row.id, "ack_correlated", {
+        opencode_message_id: correlatedId
+      });
+      return true;
+    }
+    if (correlation.knownUserIds === null) {
+      this.log({
+        level: "debug",
+        message: `Re-adopt: message ${row.id.slice(0, 8)} cannot be correlated because its pre-dispatch session list was unreadable`,
+        conversation_id: row.conversation_id,
+        message_id: row.id
+      });
+    } else if (correlation.sessionId !== sessionId) {
+      this.log({
+        level: "warn",
+        message: `Re-adopt: message ${row.id.slice(0, 8)} moved from original session ${correlation.sessionId.slice(0, 8)} to ${sessionId.slice(0, 8)} while awaiting correlation \u2014 refusing to adopt a turn from the rebound session`,
+        conversation_id: row.conversation_id,
+        message_id: row.id
+      });
+    }
+    if (correlation.attempts >= MAX_IDENTICAL_REDRIVE_POLL_FAILURES) {
+      await this.handoffUntrackableCorrelation(
+        row.conversation_id,
+        row.id,
+        correlation.sessionId,
+        correlation.attempts,
+        "readopt"
+      );
+    }
+    return true;
+  }
   /**
    * Re-adopt ONE `processing` row against the tick's session message snapshot
    * (ADR-0046 Decision §1/§2). Idempotent: skips a row already being driven.
@@ -9678,8 +10710,10 @@ var ChannelDriver = class _ChannelDriver {
    * Branches on `messageRunState(messages, row.opencode_message_id)` — the
    * opencode-assigned user-message id persisted on the first `processing` PATCH
    * (#218). A row with a NULL stored id (dispatched but the read-back never landed
-   * before the restart) has no id to correlate → treated as an orphan and
-   * re-dispatched (at most once, see `forceReadoptRun`):
+   * before the restart) is first offered to an awaiting-correlation fence recorded
+   * by this process; without that fence, it has no id to correlate after restart
+   * and is treated as an orphan and re-dispatched (at most once, see
+   * `forceReadoptRun`):
    *   - `done`             → `markDone` now (guarded like the watcher's done branch);
    *   - `failed`           → `markFailed` with the surfaced error (issue #182), so an
    *                          errored turn is reported failed on restart, NOT re-dispatched —
@@ -9688,7 +10722,8 @@ var ChannelDriver = class _ChannelDriver {
    *                          re-dispatched instead (issue #1310, see the branch below);
    *   - `running`/`queued` → re-attach a watcher via `registerReadopted` (no re-dispatch),
    *                          tracking the stored id so the reply correlates by it;
-   *   - `unknown`/null id  → re-dispatch (opencode assigns a fresh id) + attach a watcher.
+   *   - `unknown`/null id  → correlate through an awaiting fence when present;
+   *                          otherwise re-dispatch (opencode assigns a fresh id) + attach a watcher.
    *
    * Only `ChannelAuthError` propagates.
    */
@@ -9702,6 +10737,7 @@ var ChannelDriver = class _ChannelDriver {
       });
       return;
     }
+    if (await this.advanceReadoptCorrelation(sessionId, row, messages)) return;
     const ocId = row.opencode_message_id;
     const state = messageRunState(messages, ocId ?? "");
     if (state === "done") {
@@ -9768,12 +10804,48 @@ var ChannelDriver = class _ChannelDriver {
       await this.reportSubagentAuthFailures(row.conversation_id, ocId ?? "", row.id, messages);
       this.dontRedispatch.delete(row.id);
       this.untrackableAck.delete(row.id);
+      this.untrackableAckSessionIds.delete(row.id);
       this.untrackableAckSignalled.delete(row.id);
       this.untrackableAckWarned.delete(row.id);
       void this.postSignal(row.conversation_id, row.id, "readopt_failed");
       return;
     }
-    if (this.dontRedispatch.has(row.id) || this.untrackableAck.has(row.id)) {
+    if (this.untrackableAck.has(row.id)) {
+      if (this.untrackableAckSignalled.has(row.id)) {
+        const firstFenceWarning = !this.untrackableAckWarned.has(row.id);
+        this.untrackableAckWarned.add(row.id);
+        this.log({
+          level: firstFenceWarning ? "warn" : "debug",
+          message: `Re-adopt: message ${row.id.slice(0, 8)} is fenced after an untrackable OpenCode turn \u2014 skipping re-dispatch and retrying the terminal report`,
+          conversation_id: row.conversation_id,
+          message_id: row.id
+        });
+        const errorMessage3 = this.untrackableAck.get(row.id);
+        const reportError = await this.reportUntrackableAck(
+          row.conversation_id,
+          row.id,
+          this.untrackableAckSessionIds.get(row.id) ?? null,
+          errorMessage3
+        );
+        if (reportError !== null) {
+          this.log({
+            level: "warn",
+            message: `Re-adopt: failed to report untrackable message ${row.id.slice(0, 8)} (will retry next drain): ${reportError.message}`,
+            conversation_id: row.conversation_id,
+            message_id: row.id
+          });
+        }
+      } else {
+        this.log({
+          level: "debug",
+          message: `Re-adopt: message ${row.id.slice(0, 8)} already gave up \u2014 left to the cron; skipping until it leaves processing`,
+          conversation_id: row.conversation_id,
+          message_id: row.id
+        });
+      }
+      return;
+    }
+    if (this.dontRedispatch.has(row.id)) {
       this.log({
         level: "debug",
         message: `Re-adopt: message ${row.id.slice(0, 8)} already gave up \u2014 left to the cron; skipping until it leaves processing`,
@@ -9951,6 +11023,7 @@ var ChannelDriver = class _ChannelDriver {
     }
     this.dontRedispatch.delete(row.id);
     this.untrackableAck.delete(row.id);
+    this.untrackableAckSessionIds.delete(row.id);
     this.untrackableAckSignalled.delete(row.id);
     this.untrackableAckWarned.delete(row.id);
     void this.postSignal(row.conversation_id, row.id, "readopt_done");
@@ -9970,8 +11043,9 @@ var ChannelDriver = class _ChannelDriver {
    * latch makes a null-id row re-dispatched AT MOST ONCE per outstanding read-back:
    * short-circuit while the row is latched; clear it on a successful dispatch (the
    * row is then tracked in `dispatched`, so `readoptOne`'s early skip prevents
-   * re-entry) OR on a failed/unresolved dispatch (genuinely un-sent → the next tick
-   * may retry exactly once more).
+   * re-entry) or when the dispatch itself failed before acceptance. An accepted V1
+   * dispatch whose id is not readable enters the bounded correlation fence instead
+   * of retrying; exhaustion hands it to `untrackableAck`.
    *
    * `evidentMessageId = row.id` addresses the SERVER row. Deadline anchored to
    * `processed_at` (Invariant 1).
@@ -10034,6 +11108,7 @@ var ChannelDriver = class _ChannelDriver {
       );
     }
     let ocId;
+    let preDispatchUserIds = null;
     try {
       ocId = this.isV2 ? await sendV2Prompt(this.openCodeClient, sessionId, row.content) : await this.dispatchLocked(
         sessionId,
@@ -10043,7 +11118,20 @@ var ChannelDriver = class _ChannelDriver {
           row.content,
           options,
           sendAttachments,
-          this.openCodeClient
+          this.openCodeClient,
+          {
+            onKnownUserIds: (ids) => {
+              preDispatchUserIds = ids;
+            },
+            onKnownUserIdsError: (error2) => {
+              this.log({
+                level: "warn",
+                message: `Pre-dispatch snapshot callback failed for message ${row.id.slice(0, 8)}: ${error2 instanceof Error ? error2.message : String(error2)}`,
+                conversation_id: row.conversation_id,
+                message_id: row.id
+              });
+            }
+          }
         )
       );
     } catch (err) {
@@ -10076,6 +11164,7 @@ var ChannelDriver = class _ChannelDriver {
           }
         } else {
           this.untrackableAck.set(row.id, errorMessage3);
+          this.untrackableAckSessionIds.set(row.id, sessionId);
         }
         this.log({
           level: "error",
@@ -10124,39 +11213,20 @@ var ChannelDriver = class _ChannelDriver {
     }
     if (ocId === null) {
       this.awaitingReadopt.delete(row.id);
-      const streak = this.recordUnconfirmedDispatch(row.id, sessionId);
-      if (streak >= MAX_IDENTICAL_REDRIVE_POLL_FAILURES) {
-        this.unconfirmedDispatchFailures.delete(row.id);
-        this.sessions.delete(readoptConv.id);
-        this.supersede(readoptConv.id, sessionId);
-        const errorMessage3 = `OpenCode accepted this re-dispatched message ${streak} times in a row but never confirmed its assigned id (session ${sessionId.slice(0, 8)}'s message list could not be read back) \u2014 the session was abandoned; a fresh one is used for further messages.`;
-        this.log({
-          level: "error",
-          message: errorMessage3,
-          conversation_id: row.conversation_id,
-          message_id: row.id
-        });
-        await this.markFailed(row.conversation_id, row.id, null, errorMessage3).catch((markErr) => {
-          this.log({
-            level: "warn",
-            message: `markFailed PATCH for message ${row.id.slice(0, 8)} (conversation ${row.conversation_id.slice(0, 8)}) failed (best-effort, not retried): ${markErr instanceof Error ? markErr.message : String(markErr)}`,
-            conversation_id: row.conversation_id,
-            message_id: row.id
-          });
-        });
-        void this.postSignal(row.conversation_id, row.id, "readopt_orphan_unsent");
-        return;
-      }
+      this.awaitingCorrelation.set(row.id, {
+        sessionId,
+        content: row.content,
+        attempts: 0,
+        knownUserIds: preDispatchUserIds
+      });
       this.log({
         level: "warn",
-        message: `Re-adopt: message ${row.id.slice(0, 8)} re-dispatched but its opencode id could not be read back (${streak}/${MAX_IDENTICAL_REDRIVE_POLL_FAILURES}) \u2014 leaving un-tracked to retry next drain`,
+        message: `Re-adopt: OpenCode accepted message ${row.id.slice(0, 8)}, but its assigned id could not be read back \u2014 the message will not be sent again while the runner matches it to the turn already running`,
         conversation_id: row.conversation_id,
         message_id: row.id
       });
-      void this.postSignal(row.conversation_id, row.id, "readopt_orphan_unsent");
       return;
     }
-    this.unconfirmedDispatchFailures.delete(row.id);
     const processedAtMs = this.processedAtMs(row);
     this.registerReadopted(
       readoptConv,
@@ -11062,7 +12132,7 @@ var ChannelDriver = class _ChannelDriver {
    *                                    watcher retries next tick within the
    *                                    deadline, Finding 4).
    */
-  async markDone(conversationId, messageId, sessionId, opencodeMessageId, title, usage, usageAgentName, subagentInvocations) {
+  async markDone(conversationId, messageId, sessionId, opencodeMessageId, title, usage, usageAgentName, subagentInvocations, error2) {
     const res = await this.fetchImpl(
       `${this.apiUrl}/runners/${this.agentId}/threads/${conversationId}/messages/${messageId}`,
       {
@@ -11080,7 +12150,8 @@ var ChannelDriver = class _ChannelDriver {
           ...title ? { title } : {},
           ...usage ? usage : {},
           ...usageAgentName ? { usage_agent_name: usageAgentName } : {},
-          ...subagentInvocations && subagentInvocations.length > 0 ? { subagent_invocations: subagentInvocations } : {}
+          ...subagentInvocations && subagentInvocations.length > 0 ? { subagent_invocations: subagentInvocations } : {},
+          ...error2 ? { error: error2 } : {}
         })
       }
     );
@@ -11808,7 +12879,9 @@ async function installRunnerSecret({
 }) {
   const arn = env.RUNNER_SECRET_ARN?.trim();
   if (!arn) {
-    log3("runner secret is not configured; continuing without GitHub and MCP credentials");
+    if (!env.GH_TOKEN) {
+      log3("runner secret is not configured; continuing without GitHub and MCP credentials");
+    }
     return false;
   }
   const result = await (commandRunner ?? runCommand2)(
@@ -12751,9 +13824,12 @@ async function driveChannels(state, driver) {
   }
 }
 var SESSION_CLEANUP_FIRST_SWEEP_MS = 1e4;
-var SESSION_DB_RECLAIM_MAX_PAGES = 2e4;
+var SESSION_CLEANUP_MAX_DELETES_PER_SWEEP = 100;
+var SESSION_CLEANUP_MAX_ISOLATED_DELETE_FAILURES = 2;
+var SESSION_CLEANUP_GIVE_UP_AFTER_FAILURES = 2;
+var MAX_SESSION_DELETE_BODY_LENGTH = 200;
 function shouldWarnForReclaimSkip(reason) {
-  if (reason !== "sqlite-unavailable") return false;
+  if (reason !== "sqlite-unavailable" && reason !== "disk-exhaustion") return false;
   const version2 = /^v(\d+)\.(\d+)\.(\d+)$/.exec(process.version);
   if (!version2) return false;
   const major = Number(version2[1]);
@@ -12810,61 +13886,146 @@ function logSessionDbProvenanceMismatch(state, provenance, currentVersion, preBo
 async function runSweep(state, driver, config) {
   const mode = `age=${config.maxAgeMs ?? "\u2014"} count=${config.maxCount ?? "\u2014"}`;
   try {
-    const sessions = await listSessions(state.port, state.opencodeClient ?? void 0);
-    if (sessions === null) {
-      logSessionCleanupActivity(state, "sweep", {
+    const enumeration = await listAllSessions(state.port, state.opencodeClient ?? void 0);
+    const sessions = enumeration.sessions;
+    const enumerationReason = sessions === null ? enumeration.reason : null;
+    if (enumerationReason !== null) {
+      logActivity(state, {
         type: "info",
-        message: `Session cleanup: could not list sessions (opencode unreachable); skipping this sweep (${mode})`,
-        metadata: {
-          outcome: "sweep-skipped",
-          reason: "opencode-unreachable"
-        }
+        level: "warn",
+        message: `Session cleanup: could not enumerate sessions (${enumerationReason}); skipping deletes and continuing with space reclaim (${mode})`
       });
-      return;
     }
-    const toDelete = selectSessionsToDelete(
-      sessions.map((s) => ({ id: s.id, lastActivityMs: sessionLastActivityMs(s) })),
-      {
-        maxAgeMs: config.maxAgeMs,
-        maxCount: config.maxCount,
-        nowMs: Date.now(),
-        protectedIds: driver.protectedSessionIds()
-      }
-    );
-    const protectedNow = driver.protectedSessionIds();
     let deleted = 0;
     let failed = 0;
+    let failed4xx = 0;
+    let failed5xx = 0;
+    let failedOtherStatus = 0;
+    let failedThrew = 0;
     let skippedNewlyActive = 0;
-    for (const id of toDelete) {
-      if (protectedNow.has(id)) {
-        skippedNewlyActive++;
-        logActivity(state, {
+    let remaining = 0;
+    let protectedNow = driver.protectedSessionIds();
+    if (sessions !== null) {
+      const toDelete = selectSessionsToDelete(
+        sessions.map((s) => ({ id: s.id, lastActivityMs: sessionLastActivityMs(s) })),
+        {
+          maxAgeMs: config.maxAgeMs,
+          maxCount: config.maxCount,
+          nowMs: Date.now(),
+          protectedIds: protectedNow
+        }
+      );
+      const eligibleToDelete = toDelete.filter(
+        (id) => (state.sessionDeleteFailures.get(id)?.isolatedFailures ?? 0) < SESSION_CLEANUP_GIVE_UP_AFTER_FAILURES
+      );
+      const deleteCandidates = eligibleToDelete.slice(0, SESSION_CLEANUP_MAX_DELETES_PER_SWEEP);
+      remaining = eligibleToDelete.length - deleteCandidates.length;
+      const answeredFailures = [];
+      protectedNow = driver.protectedSessionIds();
+      for (const id of deleteCandidates) {
+        if (protectedNow.has(id)) {
+          skippedNewlyActive++;
+          logActivity(state, {
+            type: "info",
+            message: `Session cleanup: skipping ${id} \u2014 became active/bound after selection (${mode})`
+          });
+          continue;
+        }
+        const outcome = await deleteSession(state.port, id, state.opencodeClient ?? void 0);
+        if (outcome.ok) {
+          deleted++;
+        } else if (outcome.status === "threw") {
+          failed++;
+          failedThrew++;
+        } else {
+          failed++;
+          const statusClass = Math.floor(outcome.status / 100);
+          if (statusClass === 4) failed4xx++;
+          else if (statusClass === 5) failed5xx++;
+          else failedOtherStatus++;
+          answeredFailures.push({
+            id,
+            status: outcome.status,
+            ...outcome.body !== void 0 ? { body: outcome.body } : {}
+          });
+        }
+      }
+      const givenUpFailures = [];
+      if (failed > SESSION_CLEANUP_MAX_ISOLATED_DELETE_FAILURES) {
+        for (const { id } of answeredFailures) state.sessionDeleteFailures.delete(id);
+      } else {
+        for (const failure of answeredFailures) {
+          const previous = state.sessionDeleteFailures.get(failure.id);
+          const record = previous?.status === failure.status ? { status: failure.status, isolatedFailures: previous.isolatedFailures + 1 } : { status: failure.status, isolatedFailures: 1 };
+          state.sessionDeleteFailures.set(failure.id, record);
+          if (record.isolatedFailures >= SESSION_CLEANUP_GIVE_UP_AFTER_FAILURES) {
+            givenUpFailures.push(failure);
+          }
+        }
+      }
+      for (const failure of givenUpFailures) {
+        const excerpt = redactDiagnosticText(failure.body ?? "(no response body)").slice(
+          0,
+          MAX_SESSION_DELETE_BODY_LENGTH
+        );
+        logSessionCleanupActivity(state, "sweep", {
           type: "info",
-          message: `Session cleanup: skipping ${id} \u2014 became active/bound after selection (${mode})`
+          level: "warn",
+          message: `Session cleanup: gave up on session ${failure.id} after ${SESSION_CLEANUP_GIVE_UP_AFTER_FAILURES} isolated delete failures (status ${failure.status}): ${excerpt}`,
+          metadata: {
+            outcome: "session-delete-given-up",
+            session_id: failure.id,
+            status: failure.status,
+            body_excerpt: excerpt,
+            given_up_count: givenUpFailures.length
+          }
         });
-        continue;
       }
-      if (await deleteSession(state.port, id, state.opencodeClient ?? void 0)) deleted++;
-      else failed++;
+      const failedNote = failed > 0 ? `, failed ${failed}` : "";
+      const skippedNote = skippedNewlyActive > 0 ? `, skipped ${skippedNewlyActive} newly-active` : "";
+      const remainingNote = remaining > 0 ? `, remaining ${remaining}` : "";
+      logActivity(state, {
+        type: "info",
+        message: `Session cleanup: inspected ${sessions.length}, deleted ${deleted}${failedNote}${skippedNote}${remainingNote} (${mode})`
+      });
     }
-    const failedNote = failed > 0 ? `, failed ${failed}` : "";
-    const skippedNote = skippedNewlyActive > 0 ? `, skipped ${skippedNewlyActive} newly-active` : "";
-    logActivity(state, {
-      type: "info",
-      message: `Session cleanup: inspected ${sessions.length}, deleted ${deleted}${failedNote}${skippedNote} (${mode})`
-    });
+    const sessionMetadata = {
+      sessions_inspected: sessions?.length ?? null,
+      sessions_deleted: deleted,
+      sessions_failed: failed,
+      sessions_failed_4xx: failed4xx,
+      sessions_failed_5xx: failed5xx,
+      sessions_failed_other: failedOtherStatus,
+      sessions_failed_threw: failedThrew,
+      sessions_skipped_active: skippedNewlyActive,
+      sessions_remaining: remaining,
+      ...enumerationReason !== null ? { session_enumeration_reason: enumerationReason } : {}
+    };
+    const protectedForReclaim = driver.protectedSessionIds();
     const reclaimResult = await reclaimSessionDbSpace({
       dbPath: sessionDbPath(),
-      maxPages: SESSION_DB_RECLAIM_MAX_PAGES,
-      allowFullVacuum: protectedNow.size === 0 && !state.sessionDbProvenanceAnomaly
+      chunkPages: SESSION_DB_RECLAIM_CHUNK_PAGES,
+      pageCeiling: SESSION_DB_RECLAIM_PAGE_CEILING,
+      timeBudgetMs: SESSION_DB_RECLAIM_TIME_BUDGET_MS,
+      hasLiveTurn: protectedForReclaim.size > 0,
+      hasProvenanceAnomaly: state.sessionDbProvenanceAnomaly
     });
     if (reclaimResult.ok) {
+      state.sessionStoreHealth.observeWritable();
       const beforeMib = (reclaimResult.beforeBytes / 1024 / 1024).toFixed(1);
       const afterMib = (reclaimResult.afterBytes / 1024 / 1024).toFixed(1);
       const checkpointNote = reclaimResult.checkpoint.busy ? ` (on-disk file truncation deferred: checkpoint busy, ${reclaimResult.checkpoint.log} WAL frames pending)` : "";
+      const loopElapsedMs = Math.max(
+        0,
+        reclaimResult.elapsedMs - reclaimResult.checkpointElapsedMs
+      );
+      const reclaimIsSlow = reclaimResult.elapsedMs >= 4 * SESSION_DB_RECLAIM_TIME_BUDGET_MS;
+      const perPageNote = reclaimResult.pagesReclaimed > 0 ? `, per-page ${(loopElapsedMs / reclaimResult.pagesReclaimed).toFixed(2)} ms/page` : "";
+      const slowReclaimNote = reclaimIsSlow ? ` (slow reclaim: total elapsed ${reclaimResult.elapsedMs} ms, checkpoint ${reclaimResult.checkpointElapsedMs} ms, loop ${loopElapsedMs} ms, budget ${SESSION_DB_RECLAIM_TIME_BUDGET_MS} ms${perPageNote})` : "";
       logSessionCleanupActivity(state, "sweep", {
         type: "info",
-        message: `Session cleanup: reclaimed session-db space (${reclaimResult.mode}): ${beforeMib} MiB -> ${afterMib} MiB${checkpointNote}`,
+        level: reclaimIsSlow ? "warn" : "info",
+        message: `Session cleanup: reclaimed session-db space (${reclaimResult.mode}): ${beforeMib} MiB -> ${afterMib} MiB (stopped by ${reclaimResult.stoppedBy}; freelist ${reclaimResult.freelistBefore} -> ${reclaimResult.freelistAfter} pages)` + checkpointNote + slowReclaimNote,
         metadata: {
           outcome: "reclaimed",
           mode: reclaimResult.mode,
@@ -12872,25 +14033,28 @@ async function runSweep(state, driver, config) {
           after_bytes: reclaimResult.afterBytes,
           checkpoint_busy: reclaimResult.checkpoint.busy,
           wal_frames_pending: reclaimResult.checkpoint.log,
-          sessions_inspected: sessions.length,
-          sessions_deleted: deleted,
-          sessions_failed: failed,
-          sessions_skipped_active: skippedNewlyActive
+          stopped_by: reclaimResult.stoppedBy,
+          freelist_before: reclaimResult.freelistBefore,
+          freelist_after: reclaimResult.freelistAfter,
+          pages_reclaimed: reclaimResult.pagesReclaimed,
+          reclaim_elapsed_ms: reclaimResult.elapsedMs,
+          checkpoint_elapsed_ms: reclaimResult.checkpointElapsedMs,
+          ...sessionMetadata
         }
       });
     } else {
+      if (reclaimResult.skipped === "disk-exhaustion") {
+        state.sessionStoreHealth.observeUnwritable();
+      }
       logSessionCleanupActivity(state, "sweep", {
         type: "info",
-        level: reclaimResult.skipped === "reclaim-error" || reclaimResult.skipped === "insufficient-disk-space" ? "warn" : "info",
+        level: reclaimResult.skipped === "reclaim-error" || reclaimResult.skipped === "disk-exhaustion" || reclaimResult.skipped === "insufficient-disk-space" ? "warn" : "info",
         message: `Session cleanup: session-db space reclaim skipped (${reclaimResult.skipped})` + (reclaimResult.detail ? `: ${reclaimResult.detail}` : ""),
         metadata: {
           outcome: "reclaim-skipped",
           reason: reclaimResult.skipped,
           ...reclaimResult.detail !== void 0 ? { detail: reclaimResult.detail } : {},
-          sessions_inspected: sessions.length,
-          sessions_deleted: deleted,
-          sessions_failed: failed,
-          sessions_skipped_active: skippedNewlyActive
+          ...sessionMetadata
         }
       });
     }
@@ -13147,6 +14311,19 @@ function scheduleResourceUsageReporting(state, options) {
           message: `Resource usage collection: ${warning2}`
         });
       }
+      const lowDiskDecision = evaluateLowDiskWarning({
+        ...usage,
+        nowMs: Date.now(),
+        state: state.lowDiskWarningState
+      });
+      state.lowDiskWarningState = lowDiskDecision.state;
+      if (lowDiskDecision.warning !== null) {
+        logActivity(state, {
+          type: "info",
+          level: "warn",
+          message: lowDiskDecision.warning
+        });
+      }
       const result = await reportResourceUsage(state.agentId, state.authHeader, usage);
       if (result.ok) {
         if (consecutiveFailures > 0) {
@@ -13393,6 +14570,7 @@ async function run(options) {
     opencodeClient: null,
     opencodeV2CredentialImportGuard: { inFlight: false },
     sessionDbProvenanceAnomaly: false,
+    sessionStoreHealth: createSessionStoreHealth(),
     opencodeProcess: null,
     stopOpenCodeLogTail: null,
     litestreamProcess: null,
@@ -13404,12 +14582,14 @@ async function run(options) {
     messageCount: 0,
     lastProxiedActivityAt: null,
     sessionCleanupTimers: [],
+    sessionDeleteFailures: /* @__PURE__ */ new Map(),
     claudeUsageTimer: null,
     claudeUsageRearm: null,
     openaiUsageTimer: null,
     openaiUsageRearm: null,
     resourceUsageTimer: null,
     stopResourceUsageSampling: null,
+    lowDiskWarningState: { worstBand: null, warnedAtMs: null },
     credentialSync: null,
     authHeader: ""
   };
@@ -13583,27 +14763,62 @@ async function run(options) {
     } else {
       log2(state, "Not running in a MicroVM (MICROVM_ID unset) \u2014 nothing to report", "debug");
     }
-    if (options.restoreRunnerCredentials) {
-      log2(state, "Restoring runner credentials before starting OpenCode");
-      const credentialContext = {
-        env: process.env,
-        log: (message, level = "info") => {
-          if (level === "error") {
-            logActivity(state, { type: "error", error: message });
-          } else {
-            logActivity(state, { type: "info", level, message });
-          }
+    if (options.restoreRunnerCredentials || options.credentialSyncMarker) {
+      const logCredentialVaultResolution = (message, level) => {
+        log2(state, message, level);
+        if (state.interactive && !state.json) {
+          logActivity(state, { type: "info", level, message });
         }
       };
-      const githubTokenPopulated = await installRunnerSecret(credentialContext);
+      const vaultResolution = await getRunnerCredentialVault(state.agentId, state.authHeader);
+      if (vaultResolution.error) {
+        delete process.env.CREDENTIAL_VAULT_PREFIX;
+        logCredentialVaultResolution(
+          `CREDENTIAL-VAULT-LOOKUP-FAILED: ${vaultResolution.error}; credentials will be read from and written to this runner's own prefix this boot`,
+          "warn"
+        );
+      } else if (vaultResolution.prefix !== null && vaultResolution.vaultId !== null && vaultResolution.source !== null) {
+        process.env.CREDENTIAL_VAULT_PREFIX = vaultResolution.prefix;
+        logCredentialVaultResolution(
+          `CREDENTIAL-VAULT: source=${vaultResolution.source} vault=${vaultResolution.vaultId} prefix=${vaultResolution.prefix}`,
+          "info"
+        );
+      } else {
+        delete process.env.CREDENTIAL_VAULT_PREFIX;
+        logCredentialVaultResolution(
+          "CREDENTIAL-VAULT-NONE: this runner is not linked to a credential vault; using its own prefix",
+          "debug"
+        );
+      }
+    }
+    const credentialContext = {
+      env: process.env,
+      log: (message, level = "info") => {
+        if (level === "error") {
+          logActivity(state, { type: "error", error: message });
+        } else {
+          logActivity(state, { type: "info", level, message });
+        }
+      }
+    };
+    const githubTokenPopulated = await installRunnerSecret(credentialContext);
+    if (options.restoreRunnerCredentials) {
       await restoreCredentialStores(credentialContext);
-      if (githubTokenPopulated) await configureGitHubAccess(credentialContext);
     }
+    if (githubTokenPopulated) await configureGitHubAccess(credentialContext);
     state.credentialSync?.arm();
-    const openCodeActivityForwarder = createOpenCodeActivityForwarder(() => ({
-      agentId: state.agentId,
-      authHeader: state.authHeader
-    }));
+    const openCodeActivityForwarder = createOpenCodeActivityForwarder(
+      () => ({
+        agentId: state.agentId,
+        authHeader: state.authHeader
+      }),
+      ({ isDiskFailure, sessionId, cause }) => {
+        if (isDiskFailure) state.sessionStoreHealth.observeUnwritable();
+        if (cause !== null && sessionId !== null) {
+          state.sessionStoreHealth.observeCause(sessionId, cause);
+        }
+      }
+    );
     const openCodeLogTail = tailOpenCodeLogFile(
       resolveOpenCodeLogPath(homedir7(), process.env),
       openCodeActivityForwarder
@@ -13613,22 +14828,27 @@ async function run(options) {
       openCodeLogTail.stop();
     };
     let sessionDbVerifyFatal = false;
+    let sessionDbVerifyFatalReason;
     if (!options.restoreSessionDb) {
-      log2(state, "Skipping session-DB restore: --restore-session-db was not passed", "debug");
+      logActivity(state, {
+        type: "info",
+        level: "warn",
+        message: "SESSION-DB-VERIFY-SKIPPED: reason=flag-absent \u2014 Skipping session-DB restore: --restore-session-db was not passed"
+      });
     } else {
       const health = await checkOpenCodeHealth(state.port);
       if (health.healthy) {
-        log2(
-          state,
-          "Skipping session-DB restore: OpenCode is already serving this database",
-          "debug"
-        );
+        logActivity(state, {
+          type: "info",
+          level: "warn",
+          message: "SESSION-DB-VERIFY-SKIPPED: reason=opencode-serving \u2014 Skipping session-DB restore: OpenCode is already serving this database"
+        });
       } else if (health.authFailed) {
-        log2(
-          state,
-          "Skipping session-DB restore: OpenCode answered with an authentication challenge; assuming this database is in use",
-          "debug"
-        );
+        logActivity(state, {
+          type: "info",
+          level: "warn",
+          message: "SESSION-DB-VERIFY-SKIPPED: reason=opencode-auth-challenge \u2014 Skipping session-DB restore: OpenCode answered with an authentication challenge; assuming this database is in use"
+        });
       } else {
         const result = await restoreAndVerifySessionDb({
           dbPath: sessionDbPath(),
@@ -13645,12 +14865,13 @@ async function run(options) {
           reportRecovery: (record) => reportSessionDbRecoveryRecord(state, record)
         });
         sessionDbVerifyFatal = result.verifyFatal;
+        sessionDbVerifyFatalReason = result.verifyFatalReason;
       }
     }
     reportSessionDbRecovery(state);
     if (sessionDbVerifyFatal) {
       throw new Error(
-        "SESSION-DB-INTEGRITY-EXHAUSTED: the corrupt session DB could not be proven separated from the active backup prefix or removed from disk"
+        sessionDbVerifyFatalReason === void 0 ? "SESSION-DB-INTEGRITY-EXHAUSTED: the corrupt session DB could not be proven separated from the active backup prefix or removed from disk" : `SESSION-DB-VERIFY-TIMEOUT: session DB verification timed out (${sessionDbVerifyFatalReason}); refusing to start`
       );
     }
     applyRunnerOpenCodeConfig({
@@ -13895,6 +15116,7 @@ async function run(options) {
       getAuthHeader: () => state.authHeader,
       conversationFilter: state.conversationFilter,
       stuckQueuedMs: CHANNEL_STUCK_QUEUED_MS,
+      sessionStoreHealth: state.sessionStoreHealth,
       // #559: the `--enable-file-sync-to` allow-list. Empty ⇒ pending files are
       // REJECTED with `file_sync_disabled` on the ack, not silently ignored.
       fileSyncDirectories,
@@ -13976,14 +15198,14 @@ async function run(options) {
         },
         onDisconnected: (code, reason, transition) => {
           state.connected = false;
-          const safeReason = redactDiagnosticText(reason).slice(0, MAX_DISCONNECT_REASON_LENGTH);
+          const safeReason2 = redactDiagnosticText(reason).slice(0, MAX_DISCONNECT_REASON_LENGTH);
           logActivity(state, {
             type: "info",
-            message: `Tunnel disconnected (generation: ${transition.generation}, code: ${code}, reason: ${safeReason})`
+            message: `Tunnel disconnected (generation: ${transition.generation}, code: ${code}, reason: ${safeReason2})`
           });
           emitAgentDisconnected(state.agentId, {
             code,
-            reason: safeReason,
+            reason: safeReason2,
             connection_generation: transition.generation
           });
           if (state.interactive) displayStatus(state);
@@ -14146,6 +15368,7 @@ program.command("login").description("Authenticate with Evident").option("--toke
 program.command("logout").description("Remove stored credentials for the current endpoint").option("--all", "Remove stored credentials for all endpoints").action((options) => logout({ all: options.all }));
 program.command("whoami").description("Show the currently logged in user").action(whoami);
 program.command("status").description("Check whether the configured credentials can reach Evident").option("--json", "Output in JSON format").action((options) => status({ json: options.json }));
+program.command("credential-vault-env").description("Print the shell assignment a runner image evals before starting the synchroniser").action(credentialVaultEnv);
 program.command("claude-usage").description("[spike] Show Claude subscription usage (requires a local `claude login`)").action(claudeUsage);
 program.command("run").description("Connect to Evident and process messages").option("--runner [id]", "Runner ID to connect to (optional when EVIDENT_RUNNER_KEY is set)").option(
   "-a, --agent [id]",