@join-pantheon/cli 0.31.0 → 0.31.2-rc.1

package/dist/worker.js

@@ -1,6 +1,6 @@
 import { spawn as procSpawn } from "node:child_process";
 import { execFileSync } from "node:child_process";
-import { chmodSync, mkdirSync, writeFileSync, existsSync, readdirSync, readFileSync, realpathSync, rmSync } from "node:fs";
+import { chmodSync, lstatSync, mkdirSync, writeFileSync, existsSync, readdirSync, readFileSync, readlinkSync, realpathSync, rmSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { detectClaudeFeatures, describeFeatures, ensureRunTmp, NO_CLAUDE_FEATURES, runTmpDir } from "./claude-confine.js";
@@ -8,19 +8,22 @@ import { snapshotHome, restoreHome, describeChange, trustWrite, askedHere } from
 import { PantheonClient } from "./client.js";
 import { createHash, randomBytes } from "node:crypto";
 import { newKeypair, signDelegate } from "./identity.js";
-import { loadPins, pinScope, savePins, teamPinId } from "./pins.js";
+import { loadPins, pinScope, savePins, teamPinId, writeWhole } from "./pins.js";
 import { answeredIn, markAnswered, noteNonce } from "./nonces.js";
-import { brokenStateFiles, brokenStateFix } from "./file-lock.js";
+import { brokenStateFiles, brokenStateFix, pidAlive, readStateFile, withFileLock } from "./file-lock.js";
+import { mkdirInside, writeInside } from "./safe-write.js";
+import { adoptedCommon, adoptWorktree, gitCallEnv, lfsInUse, repoHooksArgs, safeGitArgs, WorktreeTampered } from "./git-safe.js";
 import { trusted } from "./verify-act.js";
-import { headlessSpawn, materializeSpawnFiles, chooseAgent, describeChoice, unattendedRefusal, SANDBOXED_FOR_UNATTENDED, NOT_FOR_UNATTENDED_RUNS, claudeSandboxable, quarantineRepoAgentConfig, AGENT_EDIT_SUFFIX, REPO_AGENT_CONFIG, COMMAND_GRANT_SCOPE, repoCommands, REPO_COMMANDS_FILE, claudeCommandRules, } from "./agents.js";
+import { headlessSpawn, materializeSpawnFiles, chooseAgent, agentById, describeChoice, unattendedRefusal, SANDBOXED_FOR_UNATTENDED, NOT_FOR_UNATTENDED_RUNS, claudeSandboxable, quarantineRepoAgentConfig, AGENT_EDIT_SUFFIX, REPO_AGENT_CONFIG, COMMAND_GRANT_SCOPE, repoCommands, REPO_COMMANDS_FILE, claudeCommandRules, } from "./agents.js";
+import { activeOutages, detectOutage, earliest, whenAgain } from "./agent-outage.js";
 import { agentSpawn, CmdLineUnsafe } from "./which.js";
 import { VERSION } from "./version.js";
-import { applyAnswer, CAPABILITY_ARGS, CARRY_REASON, carryOverWakers, dropLedgerGrants, hasWakeOnce, isApprovedWaker, mayAskWake, takeWakeOnce, OLD_RELAY_WAKE, relayKnowsAdmitters, loadPolicy, mayAsk, needsSelfUpgrade, parseGrantAnswer, recordAsk, savePolicy, useGrant, WOKEN_RUN_ENV, takeTeamFlagOnYes, unsandboxedAllowed, } from "./worker-policy.js";
+import { applyAnswer, CAPABILITY_ARGS, CARRY_REASON, carryOverWakers, dropLedgerGrants, hasWakeOnce, isApprovedWaker, mayAskWake, takeWakeOnce, OLD_RELAY_WAKE, relayKnowsAdmitters, loadPolicy, mayAsk, needsSelfUpgrade, parseGrantAnswer, recordAsk, savePolicy, useGrant, WOKEN_RUN_ENV, takeTeamFlagOnYes, unsandboxedAllowed, policyPath, } from "./worker-policy.js";
 import { agentHookStates, repairHook } from "./notify.js";
 import { fence, assess } from "./untrusted.js";
-import { allowed, recordRun } from "./spend.js";
+import { allowed, closeStartedRun, finishRun, recordRun, startRun } from "./spend.js";
 import { handledIn, loadContinued, markContinued, unmarkContinued } from "./continued.js";
-import { loadProfile, reservedDecisionsNote, saveProfile, wakeMode } from "./profile.js";
+import { loadProfile, profileForTeam, reservedDecisionsNote, saveProfile, wakeMode } from "./profile.js";
 import { clip } from "./brief.js";
 import { composeWorker } from "./notice.js";
 import { diagnoseRun, gitProbe, workNeedsCommands } from "./run-failure.js";
@@ -57,7 +60,7 @@ function configuredSshCommand(cwd) {
         return hit;
     let set = false;
     try {
-        set = execFileSync("git", ["-C", cwd, "config", "--get", "core.sshCommand"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 10_000 }).trim().length > 0;
+        set = execFileSync("git", safeGitArgs(cwd, ["-C", cwd, "config", "--get", "core.sshCommand"]), { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 10_000 }).trim().length > 0;
     }
     catch { }
     sshCommandSeen.set(cwd, set);
@@ -74,7 +77,7 @@ export function agentBaseEnv(base, proxy) {
 const GIT_TIMEOUT_MS = 60_000;
 export const WORKTREE_ADD_TIMEOUT_MS = 15 * 60_000;
 export const FETCH_TIMEOUT_MS = 90_000;
-const git = (cwd, ...args) => execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: gitEnv(process.env, proxyEnvFor(), cwd), timeout: GIT_TIMEOUT_MS, killSignal: "SIGKILL" }).trim();
+const git = (cwd, ...args) => execFileSync("git", safeGitArgs(cwd, args), { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: gitCallEnv(args, gitEnv(process.env, proxyEnvFor(), cwd)), timeout: GIT_TIMEOUT_MS, killSignal: "SIGKILL" }).trim();
 const gitVersions = new Map();
 export function gitVersion() {
     const key = process.env.PATH ?? "";
@@ -97,7 +100,7 @@ export function fetchOrigin(project, timeoutMs = FETCH_TIMEOUT_MS) {
     return new Promise((res) => {
         let child;
         try {
-            child = procSpawn("git", ["fetch", "--quiet", "origin"], { cwd: project, env: gitEnv(process.env, proxyEnvFor(), project), stdio: ["ignore", "ignore", "pipe"] });
+            child = procSpawn("git", safeGitArgs(project, ["fetch", "--quiet", "origin"]), { cwd: project, env: gitEnv(process.env, proxyEnvFor(), project), stdio: ["ignore", "ignore", "pipe"] });
         }
         catch (e) {
             res({ ok: false, why: e.message });
@@ -113,7 +116,7 @@ export function fetchOrigin(project, timeoutMs = FETCH_TIMEOUT_MS) {
 }
 function fetchOriginSync(project) {
     try {
-        execFileSync("git", ["fetch", "--quiet", "origin"], { cwd: project, stdio: ["ignore", "ignore", "pipe"], env: gitEnv(process.env, proxyEnvFor(), project), timeout: FETCH_TIMEOUT_MS, killSignal: "SIGKILL" });
+        execFileSync("git", safeGitArgs(project, ["fetch", "--quiet", "origin"]), { cwd: project, stdio: ["ignore", "ignore", "pipe"], env: gitEnv(process.env, proxyEnvFor(), project), timeout: FETCH_TIMEOUT_MS, killSignal: "SIGKILL" });
         return { ok: true };
     }
     catch (e) {
@@ -133,7 +136,157 @@ const isRepo = (cwd) => {
         return false;
     }
 };
+export const worktreeLabel = (wt) => `${basename(dirname(wt))}/${basename(wt)}`;
+const LINK_SCAN_BUDGET = 1_000_000;
+const GIT_SCAN_MAXBUFFER = 1 << 28;
+const gitScan = (cwd, args) => execFileSync("git", safeGitArgs(cwd, args), { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: gitCallEnv(args, gitEnv(process.env, proxyEnvFor(), cwd)), timeout: GIT_TIMEOUT_MS, killSignal: "SIGKILL", maxBuffer: GIT_SCAN_MAXBUFFER });
+const ENV_DIRS = new Set([".venv", "venv", "env", ".tox", "__pypackages__", ".direnv"]);
+const AGENT_FILE = /^(CLAUDE.*\.md|AGENTS?.*\.md|GEMINI\.md|CONVENTIONS\.md|\.mcp\.json|\.cursorrules|\.windsurfrules|\.clinerules)$/i;
+const AGENT_DIRS = new Set([".claude", ".cursor", ".github", ".kiro", ".codex", ".vscode", ".agents", ".gemini", ".junie", ".amazonq", ".continue", ".clinerules", ".windsurf"]);
+function inEnvDir(rel) {
+    const parts = rel.split("/");
+    const base = parts[parts.length - 1];
+    if (AGENT_FILE.test(base) || parts.some((x) => AGENT_DIRS.has(x)))
+        return false;
+    const dirs = parts.slice(0, -1);
+    if (dirs.some((x) => ENV_DIRS.has(x)))
+        return true;
+    const nm = dirs.indexOf("node_modules");
+    return nm >= 0 && dirs.slice(nm + 1).includes(".bin");
+}
+function executableFile(abs) {
+    try {
+        const st = statSync(abs);
+        return st.isFile() && (st.mode & 0o111) !== 0;
+    }
+    catch {
+        return false;
+    }
+}
+export function outsideLinks(worktree, budgetMax = LINK_SCAN_BUDGET) {
+    const root = (() => { try {
+        return realpathSync.native(worktree);
+    }
+    catch {
+        return null;
+    } })();
+    if (!root)
+        return { links: [], unreadable: null };
+    const inside = (p) => p === root || p.startsWith(root + sep);
+    const candidates = new Map();
+    let repo = false;
+    try {
+        repo = git(worktree, "rev-parse", "--is-inside-work-tree") === "true";
+    }
+    catch {
+        repo = false;
+    }
+    if (repo) {
+        let tracked;
+        try {
+            tracked = gitScan(worktree, ["ls-files", "-s", "-z"]);
+        }
+        catch (e) {
+            return { links: [], unreadable: `the repo's tracked files could not be listed (${e.message.split("\n")[0]})` };
+        }
+        for (const e of tracked.split("\0")) {
+            const m = /^120000 ([0-9a-f]+) \d+\t([\s\S]+)$/.exec(e);
+            if (m)
+                candidates.set(m[2], m[1]);
+        }
+    }
+    let budget = budgetMax;
+    const walk = (rel) => {
+        let ents;
+        try {
+            ents = readdirSync(join(root, rel), { withFileTypes: true });
+        }
+        catch {
+            return null;
+        }
+        for (const d of ents) {
+            if (--budget < 0)
+                return `the checkout has more files than can be checked for links (over ${budgetMax})`;
+            if (d.name === ".git")
+                continue;
+            const r = rel ? `${rel}/${d.name}` : d.name;
+            if (d.isSymbolicLink()) {
+                if (!candidates.has(r))
+                    candidates.set(r, null);
+            }
+            else if (d.isDirectory()) {
+                const why = walk(r);
+                if (why)
+                    return why;
+            }
+        }
+        return null;
+    };
+    const why = walk("");
+    if (why)
+        return { links: [], unreadable: why };
+    const out = [];
+    for (const [rel, sha] of candidates) {
+        const p = join(root, rel);
+        let target = null;
+        try {
+            target = realpathSync.native(p);
+        }
+        catch {
+            try {
+                const dir = realpathSync.native(dirname(p));
+                target = resolve(dir, readlinkSync(p));
+            }
+            catch {
+                if (sha) {
+                    try {
+                        target = resolve(dirname(p), gitScan(worktree, ["cat-file", "blob", sha]).replace(/\n$/, ""));
+                    }
+                    catch { }
+                }
+            }
+        }
+        if (target === null || inside(target))
+            continue;
+        if (inEnvDir(rel) && executableFile(target))
+            continue;
+        out.push(rel);
+    }
+    return { links: out.sort(), unreadable: null };
+}
+export function outsideLinksDiagnosis(member, worktree, scan) {
+    const names = scan.links.slice(0, 8).join(", ") + (scan.links.length > 8 ? `, and ${scan.links.length - 8} more` : "");
+    const where = worktreeLabel(worktree);
+    const says = scan.unreadable
+        ? `the checkout for this could not be fully checked for links leading out of it (${scan.unreadable}) — a run could read a file outside it as the repo's own, so none was started`
+        : `the checkout holds links that lead outside it (${names}) — a run would read whatever they point at as the repo's own, and could send it on, so none was started`;
+    return {
+        cause: "outside_links",
+        says,
+        fix: scan.unreadable
+            ? `Look at this machine's worktree ${where}: a very large or unreadable checkout cannot be vouched for. Take this request in a live session, or clear it out (pantheon stops at that worktree; its branch and commits are kept in the repo).`
+            : `On this machine, delete these links from the worktree ${where} — not from the repo's branch, where they are not: ${scan.links.map((l) => `${where}/${l}`).join(", ")}. Or take this request in a live session. Unattended runs start again once nothing in the checkout leads out of it.`,
+        peer: {
+            summary: `${member}'s worker did not start a run: its checkout for this could not be vouched for`,
+            body: `${member}'s machine could not confirm its checkout for this holds no link leading outside it, so its worker did not start an unattended run: a run would read whatever such a link points at. It is still owed and waits for ${member}. Nothing was run.`,
+        },
+    };
+}
+export function tamperedDiagnosis(member, e) {
+    return {
+        cause: "worktree_tampered",
+        says: `the worktree's .git was changed after Pantheon made it (${e.why}) — git would obey that gitdir's config outside any sandbox, so git is not run in it`,
+        fix: /hooks folder/.test(e.why)
+            ? `Look at the repo's own git hooks folder (.git/hooks in your checkout) and remove anything you did not put there; the next request checks out a fresh worktree.`
+            : `Look at what is in that worktree, then remove its folder and run  git worktree prune  in the repo; the next request checks out a fresh one.`,
+        peer: {
+            summary: `${member}'s worker stopped: its checkout for this was changed underneath it`,
+            body: `The checkout ${member}'s worker uses for this was changed in a way it does not run git in, so it stopped. It is still owed and waits for ${member}.`,
+        },
+    };
+}
 const CHECKOUT_MARK = "pantheon-checkout-complete";
+function writeMark(mark) { writeInside(dirname(mark), mark, `${new Date().toISOString()}\n`, 0o644); }
 function checkoutMark(worktree) {
     try {
         return join(git(worktree, "rev-parse", "--absolute-git-dir"), CHECKOUT_MARK);
@@ -142,9 +295,23 @@ function checkoutMark(worktree) {
         return null;
     }
 }
+const isLinkAt = (p) => { try {
+    return lstatSync(p).isSymbolicLink();
+}
+catch {
+    return false;
+} };
 export function settleWorktree(project, worktree, log) {
-    if (!existsSync(join(worktree, ".git")))
+    if (!existsSync(join(worktree, ".git")) && !isLinkAt(join(worktree, ".git")))
         return false;
+    const adopt = adoptWorktree(project, worktree);
+    if (adopt?.kind === "tampered")
+        throw new WorktreeTampered(worktree, adopt.why);
+    if (adopt?.kind === "stale") {
+        log(`  ! the worktree ${worktree} no longer points at this repo (${adopt.why}) — removing it and checking out again`);
+        removeWorktree(project, worktree);
+        return false;
+    }
     const mark = checkoutMark(worktree);
     if (mark && existsSync(mark))
         return true;
@@ -159,7 +326,7 @@ export function settleWorktree(project, worktree, log) {
     }
     if (whole && mark) {
         try {
-            writeFileSync(mark, `${new Date().toISOString()}\n`);
+            writeMark(mark);
         }
         catch { }
         return true;
@@ -242,11 +409,14 @@ function planWorktree(project, scratch, goal, log, branch, base, fetch) {
 export function worktreeAddArgs(add, os = process.platform) {
     return os === "win32" ? ["-c", "core.longpaths=true", ...add] : add;
 }
-function finishWorktree(r, log) {
+function finishWorktree(project, r, log) {
+    const adopt = adoptWorktree(project, r.worktree);
+    if (adopt)
+        throw new WorktreeTampered(r.worktree, adopt.why);
     const mark = checkoutMark(r.worktree);
     if (mark)
-        writeFileSync(mark, `${new Date().toISOString()}\n`);
-    excludeRunFiles(r.worktree);
+        writeMark(mark);
+    excludeRunFiles(r.worktree, log);
     log(`  worktree ${r.worktree} on ${r.branch} (from ${r.baseRef} ${r.baseSha.slice(0, 7)})`);
     return r;
 }
@@ -259,13 +429,13 @@ export function prepareWorktree(project, scratch, goal, log, branch = `pantheon/
     if ("done" in p)
         return p.done;
     try {
-        execFileSync("git", p.add, { cwd: project, stdio: ["ignore", "ignore", "pipe"], env: gitEnv(process.env, proxyEnvFor(), project), timeout: opts.addTimeoutMs ?? WORKTREE_ADD_TIMEOUT_MS, killSignal: "SIGKILL" });
+        execFileSync("git", safeGitArgs(project, p.add), { cwd: project, stdio: ["ignore", "ignore", "pipe"], env: gitCallEnv(p.add, gitEnv(process.env, proxyEnvFor(), project)), timeout: opts.addTimeoutMs ?? WORKTREE_ADD_TIMEOUT_MS, killSignal: "SIGKILL" });
     }
     catch (e) {
         const err = e;
         throw addFailed(project, p.result.worktree, err.killed || err.signal ? `stopped after ${Math.round((opts.addTimeoutMs ?? WORKTREE_ADD_TIMEOUT_MS) / 1000)}s` : (String(err.stderr ?? "").trim().split("\n")[0] || ((err.message ?? "failed").split("\n")[0] ?? "failed")));
     }
-    return finishWorktree(p.result, log);
+    return finishWorktree(project, p.result, log);
 }
 export async function prepareWorktreeAsync(project, scratch, goal, log, branch = `pantheon/${goal}`, base = null, opts = {}) {
     const inRepo = isRepo(project) && safeSegment(goal) !== null;
@@ -280,7 +450,7 @@ export async function prepareWorktreeAsync(project, scratch, goal, log, branch =
     const why = await new Promise((res) => {
         let child;
         try {
-            child = procSpawn("git", p.add, { cwd: project, env: gitEnv(process.env, proxyEnvFor(), project), stdio: ["ignore", "ignore", "pipe"] });
+            child = procSpawn("git", safeGitArgs(project, p.add), { cwd: project, env: gitCallEnv(p.add, gitEnv(process.env, proxyEnvFor(), project)), stdio: ["ignore", "ignore", "pipe"] });
         }
         catch (e) {
             res(e.message);
@@ -295,7 +465,7 @@ export async function prepareWorktreeAsync(project, scratch, goal, log, branch =
     });
     if (why !== null)
         throw addFailed(project, p.result.worktree, why);
-    return finishWorktree(p.result, log);
+    return finishWorktree(project, p.result, log);
 }
 export function branchName(space, goalId, title) {
     const slug = (title ?? "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40).replace(/-+$/, "");
@@ -327,17 +497,47 @@ YOUR BRANCH STARTS AT ${baseSha.slice(0, 12)} (${baseRef}, ${fresh}).
 const RUN_DROPPINGS = [".pantheon-task.md", ".pantheon-run.log", ".pantheon-mcp.json", ".pantheon/*", "!.pantheon/commands", "!.pantheon/personas/",
     `*${AGENT_EDIT_SUFFIX}`, `*${AGENT_EDIT_SUFFIX}-*`];
 const RUN_DROPPINGS_OLD = [".pantheon/"];
-export function excludeRunFiles(worktree) {
+const plainFile = (p) => { try {
+    const st = lstatSync(p);
+    return st.isFile() && st.nlink === 1;
+}
+catch {
+    return false;
+} };
+const excludeSaid = new Set();
+export function excludeRunFiles(worktree, log) {
     try {
         const common = git(worktree, "rev-parse", "--git-common-dir");
-        const file = resolve(worktree, common, "info", "exclude");
-        const had = existsSync(file) ? readFileSync(file, "utf8") : "";
+        const root = resolve(worktree, common);
+        const info = join(root, "info");
+        const file = join(info, "exclude");
+        const infoOk = (() => { try {
+            const st = lstatSync(info);
+            return st.isDirectory();
+        }
+        catch {
+            return !existsSync(info);
+        } })();
+        const fileOk = (() => { try {
+            lstatSync(file);
+            return plainFile(file);
+        }
+        catch {
+            return true;
+        } })();
+        if (!infoOk || !fileOk) {
+            if (log && !excludeSaid.has(file)) {
+                excludeSaid.add(file);
+                log(`  exclude ${file} is not a plain file in a plain folder (a link, or a hard link) — left as it is; the run's own files may show as untracked in this repo`);
+            }
+            return;
+        }
+        const had = plainFile(file) ? readFileSync(file, "utf8") : "";
         const cur = had.split("\n").filter((l) => !RUN_DROPPINGS_OLD.includes(l)).join("\n");
         const missing = RUN_DROPPINGS.filter((l) => !cur.split("\n").includes(l));
         if (!missing.length && cur === had)
             return;
-        mkdirSync(resolve(worktree, common, "info"), { recursive: true });
-        writeFileSync(file, missing.length ? `${cur.replace(/\n?$/, "\n")}${missing.join("\n")}\n` : cur);
+        writeInside(root, file, missing.length ? `${cur.replace(/\n?$/, "\n")}${missing.join("\n")}\n` : cur, 0o644);
     }
     catch { }
 }
@@ -384,10 +584,11 @@ export function workspaceNote(route, attached, sha, outbox) {
     return lines.join("\n");
 }
 export function gitOut(cwd, args, timeoutMs = GIT_TIMEOUT_MS) {
+    const argv = safeGitArgs(cwd, args);
     return new Promise((res) => {
         let child;
         try {
-            child = procSpawn("git", args, { cwd, env: gitEnv(process.env, proxyEnvFor(), cwd), stdio: ["ignore", "pipe", "ignore"] });
+            child = procSpawn("git", argv, { cwd, env: gitCallEnv(args, gitEnv(process.env, proxyEnvFor(), cwd)), stdio: ["ignore", "pipe", "ignore"] });
         }
         catch {
             res(null);
@@ -413,6 +614,7 @@ export async function onRemote(cwd, branch, commit) {
     return (await gitOut(cwd, ["merge-base", "--is-ancestor", commit, tip])) !== null;
 }
 export const MASS_DELETE_SHARE = 0.5;
+const ONCE_GIVE_BACK_MS = 120_000;
 export const asksForMassDelete = (text) => /\b(?:delete|remove|wipe|drop|rm)\b[^\n]{0,40}\b(?:all|every|entire|whole|most)\b/i.test(text);
 const GIT_HOOK_NAMES = [
     "applypatch-msg", "pre-applypatch", "post-applypatch", "prepare-commit-msg", "commit-msg", "post-commit",
@@ -466,10 +668,10 @@ exit 0
 `;
 export function massDeleteGuardEnv(runHome, worktree, allow, env = process.env) {
     const dir = join(runHome, "git-hooks");
-    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    mkdirInside(runHome, dir);
     for (const [name, body] of [["pre-commit", PRE_COMMIT], ["pre-push", PRE_PUSH], ...GIT_HOOK_NAMES.map((n) => [n, passThrough(n)])]) {
         const f = join(dir, name);
-        writeFileSync(f, body);
+        writeInside(runHome, f, body, 0o755);
         try {
             chmodSync(f, 0o755);
         }
@@ -477,9 +679,13 @@ export function massDeleteGuardEnv(runHome, worktree, allow, env = process.env)
     }
     let orig = "";
     try {
-        orig = resolve(worktree, git(worktree, "rev-parse", "--git-path", "hooks"));
+        const out = execFileSync("git", repoHooksArgs(worktree), { cwd: worktree, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: gitCallEnv(["rev-parse"], gitEnv(process.env, proxyEnvFor(), worktree)), timeout: GIT_TIMEOUT_MS }).trim();
+        orig = resolve(worktree, out);
+    }
+    catch (e) {
+        if (e instanceof WorktreeTampered)
+            throw e;
     }
-    catch { }
     const n = Number.parseInt(env.GIT_CONFIG_COUNT ?? "0", 10) || 0;
     return {
         GIT_CONFIG_COUNT: String(n + 1),
@@ -491,12 +697,14 @@ export function massDeleteGuardEnv(runHome, worktree, allow, env = process.env)
 }
 export function deletedSinceBase(worktree, baseSha) {
     try {
-        const total = git(worktree, "ls-tree", "-r", "--name-only", baseSha).split("\n").filter(Boolean).length;
-        const gone = git(worktree, "diff", "--name-only", "--diff-filter=D", baseSha).split("\n").filter(Boolean).length;
-        return { gone, total };
+        const total = gitScan(worktree, ["ls-tree", "-r", "--name-only", baseSha]).split("\n").filter(Boolean).length;
+        const gone = gitScan(worktree, ["diff", "--name-only", "--diff-filter=D", baseSha]).split("\n").filter(Boolean).length;
+        return { gone, total, unreadable: null };
     }
-    catch {
-        return null;
+    catch (e) {
+        if (e instanceof WorktreeTampered)
+            throw e;
+        return { gone: 0, total: 0, unreadable: e.message.split("\n")[0] || "git failed" };
     }
 }
 export const printable = (s) => typeof s === "string" && /^[A-Za-z0-9_][A-Za-z0-9_:.\-]{0,119}$/.test(s) ? s : "(an id this worker will not print)";
@@ -597,6 +805,70 @@ Act, reply if a reply is owed, then finish.`;
 export const TASK_POINTER = "Your task for this run is in the file .pantheon-task.md in the current directory. Read that file first and follow it: it is the whole brief.";
 let fleetLock = null;
 export const RUN_TIMEOUT_MS = 20 * 60_000;
+export const RUN_SLOT = "run-slot.json";
+export const RUN_LEASE_RENEW_MS = 60_000;
+const RUN_LEASE_FRESH_MS = 10 * 60_000;
+function readRunLease(f) {
+    let text;
+    try {
+        text = readStateFile(f);
+    }
+    catch {
+        rmSync(f, { recursive: true, force: true });
+        return null;
+    }
+    if (text === null)
+        return null;
+    try {
+        const v = JSON.parse(text);
+        if (v && typeof v === "object")
+            return v;
+    }
+    catch { }
+    rmSync(f, { recursive: true, force: true });
+    return null;
+}
+export function takeRunLease(dir, space, now = Date.now()) {
+    const f = join(dir, RUN_SLOT);
+    return withFileLock(f, () => {
+        const cur = readRunLease(f);
+        if (cur && Number.isInteger(cur.pid) && cur.pid !== process.pid && typeof cur.at === "number" && Number.isFinite(cur.at)
+            && Math.abs(now - cur.at) <= RUN_LEASE_FRESH_MS && pidAlive(cur.pid)) {
+            return { held: typeof cur.space === "string" ? cur.space : "another team" };
+        }
+        const token = randomBytes(12).toString("hex");
+        writeWhole(f, JSON.stringify({ pid: process.pid, token, space, at: now }) + "\n");
+        return { token };
+    });
+}
+export function renewRunLease(dir, token, now = Date.now()) {
+    const f = join(dir, RUN_SLOT);
+    try {
+        withFileLock(f, () => {
+            const cur = readRunLease(f);
+            if (cur?.token === token)
+                writeWhole(f, JSON.stringify({ ...cur, at: now }) + "\n");
+        });
+    }
+    catch { }
+}
+export function releaseRunLease(dir, token) {
+    const f = join(dir, RUN_SLOT);
+    try {
+        withFileLock(f, () => { if (readRunLease(f)?.token === token)
+            rmSync(f, { force: true }); });
+    }
+    catch { }
+}
+export function repairRunLease(dir) {
+    const f = join(dir, RUN_SLOT);
+    if (!existsSync(f))
+        return;
+    try {
+        withFileLock(f, () => { readRunLease(f); });
+    }
+    catch { }
+}
 export function killRunTree(pid, os = process.platform) {
     if (!Number.isInteger(pid) || pid <= 1)
         return;
@@ -782,6 +1054,10 @@ export class Worker {
     }
     parkedNotHere = new Set();
     parkedNoSandbox = new Map();
+    outages = new Map();
+    outageHold = new Map();
+    outageHeldUntil = new Map();
+    outageRetries = new Map();
     parkedNoSandboxConts = new Map();
     ranNoSandboxCheckedAt = 0;
     noSandboxDiagnosis(choice) {
@@ -809,14 +1085,16 @@ export class Worker {
         if (this.opts.agentCmd)
             return null;
         const ok = this.unsandboxedOk();
-        const key = `${agent ?? "auto"}|${ok}`;
+        const key = `${agent ?? "auto"}|${ok}|${Object.entries(activeOutages(this.outages)).map(([k, v]) => `${k}@${v.until}`).join(",")}`;
         const hit = this.sandboxHold.get(key);
         if (hit && Date.now() - hit.at < 60_000)
             return hit.d;
         let d = null;
         try {
-            const c = (this.opts.choose ?? chooseAgent)(agent, { prefer: loadProfile(this.cfg).agent.primary_surface, unsandboxedOk: ok });
-            if (NOT_FOR_UNATTENDED_RUNS.has(c.backend.id))
+            const c = (this.opts.choose ?? chooseAgent)(agent, { prefer: loadProfile(this.cfg).agent.primary_surface, unsandboxedOk: ok, outages: activeOutages(this.outages) });
+            if (c.outage)
+                d = this.outageDiagnosis(c.backend.label, c.outage, []);
+            else if (NOT_FOR_UNATTENDED_RUNS.has(c.backend.id))
                 d = this.noUnattendedAgentDiagnosis(unattendedRefusal(c, { unsandboxedOk: ok }) ?? c.backend.label);
             else if (!SANDBOXED_FOR_UNATTENDED.has(c.backend.id) && !ok)
                 d = this.noSandboxDiagnosis(c);
@@ -842,6 +1120,45 @@ export class Worker {
             return false;
         }
     }
+    outageDiagnosis(label, out, others, meanwhile) {
+        const at = whenAgain(out.until);
+        const rest = meanwhile ? `; the agent standing in for it cannot take this one (${meanwhile.replace(/\.$/, "")})`
+            : others.length ? `; ${others.join("; ")}` : "; no other agent is installed for runs while you are away";
+        return {
+            cause: "agent_unavailable",
+            says: `${label} is unavailable here until about ${at} — ${out.why}${rest}.`,
+            fix: `It runs by itself after ${at}. Sooner: sign in to another agent (cursor-agent, codex or copilot) — and for an agent without a sandbox, pantheon policy grant unsandboxed-runs — or answer it in a live session.`,
+            peer: {
+                summary: `${this.cfg.member}'s agent is unavailable until about ${at} — this waits`,
+                body: `${this.cfg.member}'s worker could not start a run: ${label} ${out.why}, and no other agent on that machine could take it. It is still owed; the worker tries again after ${at}.`,
+            },
+        };
+    }
+    outagesPassed(c) {
+        const now = activeOutages(this.outages);
+        return c.skipped.flatMap((x) => { const out = now[x.backend.id]; return out ? [{ label: x.backend.label, out }] : []; });
+    }
+    fallbackSaid = new Set();
+    sayFallbackUnsandboxed(c) {
+        if (SANDBOXED_FOR_UNATTENDED.has(c.backend.id) || !this.opts.notify)
+            return;
+        const passed = this.outagesPassed(c).filter((p) => p.label === "Claude Code");
+        const first = passed[0];
+        if (!first)
+            return;
+        const key = `${c.backend.id}|${first.out.until}`;
+        if (this.fallbackSaid.has(key))
+            return;
+        this.fallbackSaid.add(key);
+        try {
+            this.opts.notify({
+                kind: "worker", who: "Your worker", heading: `${c.backend.label} is answering for Claude Code`, context: this.cfg.space,
+                body: `Claude Code is unavailable until about ${whenAgain(first.out.until)} — ${first.out.why}. Until then ${c.backend.label} takes teammates' requests on this machine, without Claude Code's sandbox, as your settings allow. To have them wait instead: pantheon policy revoke unsandboxed-runs`,
+                ttl: 0, sound: false,
+            });
+        }
+        catch { }
+    }
     claudeSandboxableNow() {
         if (this.opts.agentCmd)
             return false;
@@ -983,6 +1300,12 @@ export class Worker {
             }
             if (!ok && now - h.at < every)
                 continue;
+            const ou = this.outageHeldUntil.get(id);
+            if (ou !== undefined) {
+                if (ou > now)
+                    continue;
+                this.outageHeldUntil.delete(id);
+            }
             if (this.heldForSandbox(h.agent)) {
                 h.at = now;
                 continue;
@@ -1208,13 +1531,18 @@ export class Worker {
         const seen = noteNonce(this.pinTeam, act.from, sig.nonce, act.id, this.opts.home, sig.s);
         if (this.opts.home !== undefined) {
             const also = noteNonce(this.pinTeam, act.from, sig.nonce, act.id, undefined, sig.s);
+            const forged = [seen, also].some((x) => x.replayOf === act.id && !x.unvouched);
+            const unvouched = !forged && [seen, also].some((x) => x.replayOf === act.id && x.unvouched);
             seen.replayOf ??= also.replayOf;
             seen.answered ||= also.answered;
+            seen.unvouched = unvouched || undefined;
         }
+        if (seen.replayOf === act.id && seen.answered && seen.unvouched)
+            return { why: "this machine already answered that request", trust: "answered", from: act.from };
         if (seen.replayOf)
             return { why: `a copy of ${seen.replayOf}, which this machine already had — the same signed request under a new id`, trust: "replayed", from: act.from };
         if (seen.answered)
-            return { why: "this machine already answered that signed request", trust: "replayed", from: act.from };
+            return { why: "this machine already answered that signed request", trust: "answered", from: act.from };
         if (sig.role === "run" && sig.cert && seen.firstSeen > sig.cert.expires + 6 * 3600_000) {
             return { why: "a run's request that first reached this machine hours after that run ended", trust: "stale", from: act.from };
         }
@@ -1262,8 +1590,11 @@ export class Worker {
         const pol = loadPolicy(this.opts.home);
         if (isApprovedWaker(pol, [this.cfg.spaceId, this.cfg.space], from))
             return;
+        const before = { ...(pol.wakeOnce ?? {}) };
         if (takeWakeOnce(pol, [this.cfg.spaceId, this.cfg.space], from)) {
             savePolicy(pol, this.opts.home);
+            const keys = Object.keys(before).filter((k) => (pol.wakeOnce?.[k] ?? 0) < before[k]);
+            this.spentOnce = { ...this.spentOnce, wake: keys, file: this.policyBytes() };
             this.opts.log(`  wake    ${from} may start this one run (you said "just this once")`);
         }
     }
@@ -1378,6 +1709,11 @@ export class Worker {
     }
     openRunHome(cfg = this.cfg, features = []) {
         const dir = this.runHomePath();
+        try {
+            if (!lstatSync(dir).isDirectory())
+                rmSync(dir, { recursive: true, force: true });
+        }
+        catch { }
         mkdirSync(dir, { recursive: true, mode: 0o700 });
         const file = join(dir, "config.json");
         let written = cfg;
@@ -1396,11 +1732,7 @@ export class Worker {
             this.opts.log(`  sign    this relay cannot check a run's own key yet, so woken runs sign as ${cfg.member} (upgrade the relay to 0.31)`);
         }
         written = { ...written, pinTeam: this.pinTeam };
-        writeFileSync(file, JSON.stringify(written, null, 2) + "\n", { mode: 0o600 });
-        try {
-            chmodSync(file, 0o600);
-        }
-        catch { }
+        writeInside(dir, file, JSON.stringify(written, null, 2) + "\n", 0o600);
         try {
             const p = loadPins(this.opts.home);
             savePins(p, dir);
@@ -1408,6 +1740,14 @@ export class Worker {
         catch { }
         return dir;
     }
+    cleanupStep(what, step) {
+        try {
+            step();
+        }
+        catch (e) {
+            this.opts.log(`! ${what} failed: ${e.message.split("\n")[0]}`);
+        }
+    }
     sealRunHome(dir) {
         try {
             for (const a of answeredIn(dir))
@@ -1421,7 +1761,7 @@ export class Worker {
         catch { }
         const { token: _t, privateKey: _k, pendingAuth: _p, delegate: _d, ...stub } = this.cfg;
         try {
-            writeFileSync(join(dir, "config.json"), JSON.stringify({ ...stub, sealed: "the token and key are written here only while a woken run holds them" }, null, 2) + "\n", { mode: 0o600 });
+            writeInside(dir, join(dir, "config.json"), JSON.stringify({ ...stub, sealed: "the token and key are written here only while a woken run holds them" }, null, 2) + "\n", 0o600);
         }
         catch {
             try {
@@ -1477,10 +1817,18 @@ export class Worker {
         });
         await client.connect();
         this.client = client;
+        try {
+            await this.serve(client);
+        }
+        finally {
+            client.close();
+        }
+    }
+    async serve(client) {
         const agentLabel = this.opts.agentCmd
             ? this.opts.agentCmd
             : (() => { try {
-                return describeChoice((this.opts.choose ?? chooseAgent)(this.opts.agent, { prefer: loadProfile(this.cfg).agent.primary_surface }));
+                return describeChoice((this.opts.choose ?? chooseAgent)(this.opts.agent, { prefer: loadProfile(this.cfg).agent.primary_surface, unsandboxedOk: this.unsandboxedOk() }));
             }
             catch {
                 return "auto";
@@ -1512,6 +1860,7 @@ export class Worker {
                 for (const w of p.warnings)
                     this.opts.log(`    ! ${p.name}: ${w}`);
         }
+        this.recoverInterruptedRun();
         if (this.opts.continuations !== false)
             await this.restoreHeldContinuations(client);
         this.writeState("watching", "waiting for work");
@@ -1566,8 +1915,11 @@ export class Worker {
             this.sayKeyChanges(client);
             const aged = client
                 .myWork()
-                .filter((o) => o.kind !== "HUMAN" && !o.claimed_by)
+                .filter((o) => o.kind !== "HUMAN" && o.kind !== "DELIVER" && !o.claimed_by)
                 .filter((o) => Date.now() - o.created_at >= grace)
+                .filter((o) => { const t = this.outageHold.get(o.id); if (t === undefined)
+                return true; if (t > Date.now())
+                return false; this.outageHold.delete(o.id); return true; })
                 .filter((o) => {
                 if (this.failuresOf(o.id) < 2)
                     return true;
@@ -1719,111 +2071,251 @@ export class Worker {
                 maxRunsPerHour: this.opts.maxRunsPerHour,
                 maxRunsPerDay: this.opts.maxRunsPerDay,
             });
-            const gate = allowed({ perHour: policy.maxRunsPerHour, perDay: policy.maxRunsPerDay }, this.opts.home);
-            if (!gate.ok) {
-                if (!this.skipLogged.has(`cap:${candidate?.id ?? continuation.id}`)) {
-                    this.skipLogged.add(`cap:${candidate?.id ?? continuation.id}`);
-                    this.opts.log(`! not spawning: ${gate.why}. Raise it with --max-runs / --max-runs-day${persona ? ` (persona "${persona.name}" may cap it lower)` : ""}, or leave it.`);
-                }
-                this.writeState("capped", gate.why);
+            const slot = this.takeSlot();
+            if ("held" in slot) {
+                this.writeState("watching", `waiting: ${slot.held}`);
                 if (continuation)
-                    this.requeueContinuation(continuation, 60_000);
+                    this.requeueContinuation(continuation, 5_000);
                 continue;
             }
-            if (continuation) {
+            try {
+                const gate = allowed({ perHour: policy.maxRunsPerHour, perDay: policy.maxRunsPerDay }, this.opts.home);
+                if (!gate.ok) {
+                    if (!this.skipLogged.has(`cap:${candidate?.id ?? continuation.id}`)) {
+                        this.skipLogged.add(`cap:${candidate?.id ?? continuation.id}`);
+                        this.opts.log(gate.broken ? `! not spawning: ${gate.why}`
+                            : `! not spawning: ${gate.why}. Raise it with --max-runs / --max-runs-day${persona ? ` (persona "${persona.name}" may cap it lower)` : ""}, or leave it.`);
+                    }
+                    this.writeState("capped", gate.why);
+                    if (continuation)
+                        this.requeueContinuation(continuation, 60_000);
+                    continue;
+                }
+                if (this.stopped)
+                    break;
+                if (continuation) {
+                    try {
+                        await client.claim(`cont:${continuation.id}`);
+                    }
+                    catch (e) {
+                        const msg = e.message;
+                        if (/^DEFER/.test(msg)) {
+                            this.requeueContinuation(continuation, 10_000);
+                        }
+                        else {
+                            this.markDone(continuation.id);
+                            if (!this.skipLogged.has(`cont:${continuation.id}`)) {
+                                this.skipLogged.add(`cont:${continuation.id}`);
+                                this.opts.log(`- not continuing from ${continuation.id}: ${msg.split("\n")[0]}`);
+                            }
+                        }
+                        continue;
+                    }
+                    if (this.stopped) {
+                        this.opts.log(`- not continuing from ${continuation.id}: the worker is stopping`);
+                        break;
+                    }
+                }
+                this.running = true;
+                this.writeState("running", candidate ? `${candidate.kind} ${candidate.id}` : `CONTINUE ${continuation.id}`);
+                let job;
                 try {
-                    await client.claim(`cont:${continuation.id}`);
+                    job = candidate
+                        ? await this.handle(client, candidate, persona, policy, candidateAct)
+                        : await this.handleContinuation(client, continuation, persona, policy);
                 }
                 catch (e) {
-                    const msg = e.message;
-                    if (/^DEFER/.test(msg)) {
-                        this.requeueContinuation(continuation, 10_000);
+                    const msg = e?.message?.split("\n")[0] ?? String(e);
+                    const ob = candidate ?? {
+                        id: `cont:${continuation.id}`, kind: "CONTINUE", owner: this.cfg.member, ref: continuation.id,
+                        goal: continuation.goal, created_at: continuation.ts, body: `${continuation.act} from ${continuation.from}`,
+                    };
+                    if (e instanceof WorktreeTampered) {
+                        this.opts.log(`! ${ob.id}: ${msg}`);
+                        job = { obligation: ob, branch: "", worktree: e.worktree, ok: false, refused: true, detail: msg, diagnosis: tamperedDiagnosis(this.cfg.member, e) };
                     }
                     else {
-                        this.markDone(continuation.id);
-                        if (!this.skipLogged.has(`cont:${continuation.id}`)) {
-                            this.skipLogged.add(`cont:${continuation.id}`);
-                            this.opts.log(`- not continuing from ${continuation.id}: ${msg.split("\n")[0]}`);
-                        }
+                        this.opts.log(`! ${ob.id}: the run failed with an error — ${msg}`);
+                        job = { obligation: ob, branch: "", worktree: "", ok: false, detail: `the run failed with an error: ${msg}` };
+                    }
+                }
+                this.runProject = null;
+                this.done.push(job);
+                this.client?.reportWorkerState("idle");
+                if (candidate && job.ok)
+                    this.markDone(`handled:${candidate.ref}`);
+                const ran = candidate ? candidateAct : continuation;
+                if (job.ok && ran?.sig) {
+                    try {
+                        markAnswered(this.pinTeam, ran.from, ran.sig.nonce, ran.id, this.opts.home, ran.sig.s);
+                        if (this.opts.home !== undefined)
+                            markAnswered(this.pinTeam, ran.from, ran.sig.nonce, ran.id, undefined, ran.sig.s);
+                    }
+                    catch { }
+                }
+                {
+                    const soon = earliest(activeOutages(this.outages));
+                    if (soon && job.refused && job.forOutage && job.diagnosis && !job.waitUntil) {
+                        const label = [...this.outages.entries()].find(([, v]) => v === soon)?.[0];
+                        Object.assign(job, { waitUntil: soon.until, diagnosis: this.outageDiagnosis(label ? agentById(label)?.label ?? label : "The agent", soon, [], job.diagnosis.says) });
+                    }
+                }
+                if (job.agentOut) {
+                    if (continuation) {
+                        this.contDone.delete(continuation.id);
+                        for (const k of this.contKeys())
+                            unmarkContinued(k, continuation.id, this.opts.home);
+                        this.requeueContinuation(continuation, 0);
                     }
                     continue;
                 }
-            }
-            this.running = true;
-            fleetLock = this;
-            this.writeState("running", candidate ? `${candidate.kind} ${candidate.id}` : `CONTINUE ${continuation.id}`);
-            const job = candidate
-                ? await this.handle(client, candidate, persona, policy, candidateAct)
-                : await this.handleContinuation(client, continuation, persona, policy);
-            this.runProject = null;
-            this.done.push(job);
-            this.client?.reportWorkerState("idle");
-            if (candidate && job.ok)
-                this.markDone(`handled:${candidate.ref}`);
-            const ran = candidate ? candidateAct : continuation;
-            if (job.ok && ran?.sig) {
-                try {
-                    markAnswered(this.pinTeam, ran.from, ran.sig.nonce, ran.id, this.opts.home, ran.sig.s);
-                    if (this.opts.home !== undefined)
-                        markAnswered(this.pinTeam, ran.from, ran.sig.nonce, ran.id, undefined, ran.sig.s);
+                if (job.refused && job.diagnosis?.cause === "agent_unavailable" && job.waitUntil) {
+                    if (candidate)
+                        this.outageHold.set(candidate.id, job.waitUntil);
+                    if (this.outageHold.size > 500)
+                        this.outageHold.delete(this.outageHold.keys().next().value);
+                    if (continuation) {
+                        this.holdContinuation(continuation, policy.agent);
+                        this.outageHeldUntil.set(`cont:${continuation.id}`, job.waitUntil);
+                    }
+                    if (!this.skipLogged.has(`out-told:${job.obligation.id}`)) {
+                        this.skipLogged.add(`out-told:${job.obligation.id}`);
+                        await this.reportRefused(client, job.obligation, job.diagnosis, !!candidate);
+                    }
                 }
-                catch { }
-            }
-            if (job.refused && job.diagnosis) {
-                if (candidate) {
-                    this.failedRuns.set(candidate.id, 2);
-                    this.skipLogged.add(`parked:${candidate.id}`);
-                    if (job.diagnosis.cause === "repo_not_here")
-                        this.parkedNotHere.add(candidate.id);
+                else if (job.refused && job.diagnosis) {
+                    if (candidate) {
+                        this.failedRuns.set(candidate.id, 2);
+                        this.skipLogged.add(`parked:${candidate.id}`);
+                        if (job.diagnosis.cause === "repo_not_here")
+                            this.parkedNotHere.add(candidate.id);
+                    }
+                    if (!candidate && continuation && this.parkedNoSandbox.has(job.obligation.id))
+                        this.holdContinuation(continuation, policy.agent);
+                    await this.reportRefused(client, job.obligation, job.diagnosis, !!candidate);
+                    if (job.diagnosis.cause === "outside_links" || job.diagnosis.cause === "worktree_tampered")
+                        await this.reportStuck(client, job.obligation, job.diagnosis, 0);
                 }
-                if (!candidate && continuation && this.parkedNoSandbox.has(job.obligation.id))
-                    this.holdContinuation(continuation, policy.agent);
-                await this.reportRefused(client, job.obligation, job.diagnosis, !!candidate);
-            }
-            else if (candidate && !job.ok) {
-                const attempts = this.failuresOf(candidate.id) + 1;
-                const failures = job.diagnosis?.cause === "no_commands" || job.diagnosis?.cause === "no_sandbox_commands" ? 2 : attempts;
-                if (job.diagnosis?.cause === "no_sandbox_commands")
-                    this.markDone(`parked-ns:${candidate.id}`);
-                if (this.contDone.has(`unparked-ns:${candidate.id}`))
-                    this.markDone(`parked2-ns:${candidate.id}`);
-                this.failedRuns.set(candidate.id, failures);
-                this.markDone(failures >= 2 ? `parked:${candidate.id}` : `failed1:${candidate.id}`);
-                if (this.contDone.has(`unparked:${candidate.id}`))
-                    this.markDone(`parked2:${candidate.id}`);
-                else if (job.diagnosis?.cause === "no_commands")
-                    this.markDone(`parked-nc:${candidate.id}`);
-                if (this.failedRuns.size > 200) {
-                    this.failedRuns.delete(this.failedRuns.keys().next().value);
+                else if (candidate && !job.ok) {
+                    const attempts = this.failuresOf(candidate.id) + 1;
+                    const failures = job.diagnosis?.cause === "no_commands" || job.diagnosis?.cause === "no_sandbox_commands" ? 2 : attempts;
+                    if (job.diagnosis?.cause === "no_sandbox_commands")
+                        this.markDone(`parked-ns:${candidate.id}`);
+                    if (this.contDone.has(`unparked-ns:${candidate.id}`))
+                        this.markDone(`parked2-ns:${candidate.id}`);
+                    this.failedRuns.set(candidate.id, failures);
+                    this.markDone(failures >= 2 ? `parked:${candidate.id}` : `failed1:${candidate.id}`);
+                    if (this.contDone.has(`unparked:${candidate.id}`))
+                        this.markDone(`parked2:${candidate.id}`);
+                    else if (job.diagnosis?.cause === "no_commands")
+                        this.markDone(`parked-nc:${candidate.id}`);
+                    if (this.failedRuns.size > 200) {
+                        this.failedRuns.delete(this.failedRuns.keys().next().value);
+                    }
+                    if (failures >= 2 && job.diagnosis)
+                        await this.reportStuck(client, candidate, job.diagnosis, attempts);
                 }
-                if (failures >= 2 && job.diagnosis)
-                    await this.reportStuck(client, candidate, job.diagnosis, attempts);
             }
-            this.running = false;
-            if (fleetLock === this)
-                fleetLock = null;
+            finally {
+                this.running = false;
+                this.endAttempt();
+                this.giveSlot(slot.token);
+            }
             this.writeState("watching", "waiting for work");
             if (this.opts.once)
                 break;
         }
-        client.close();
     }
     stop() {
         this.stopped = true;
         for (const pid of this.runPids)
             killRunTree(pid);
     }
+    takeSlot() {
+        if (fleetLock && fleetLock !== this)
+            return { held: `a run for "${fleetLock.cfg.space}" is in progress` };
+        let lease;
+        try {
+            lease = takeRunLease(this.stateDir(), this.cfg.space);
+        }
+        catch (e) {
+            const why = `${RUN_SLOT} cannot be read and written (${e.message.split("\n")[0]}) — repair or delete it`;
+            if (!this.skipLogged.has(`slot:${why}`)) {
+                this.skipLogged.add(`slot:${why}`);
+                this.opts.log(`! holding unattended runs: ${why}`);
+            }
+            return { held: why };
+        }
+        if ("held" in lease)
+            return { held: `a run for "${lease.held}" is in progress in another pantheon worker on this machine` };
+        fleetLock = this;
+        const dir = this.stateDir(), token = lease.token;
+        this.leaseTimer = setInterval(() => renewRunLease(dir, token), this.opts.runLeaseRenewMs ?? RUN_LEASE_RENEW_MS);
+        this.leaseTimer.unref?.();
+        return lease;
+    }
+    leaseTimer = null;
+    giveSlot(token) {
+        if (this.leaseTimer) {
+            clearInterval(this.leaseTimer);
+            this.leaseTimer = null;
+        }
+        releaseRunLease(this.stateDir(), token);
+        if (fleetLock === this)
+            fleetLock = null;
+    }
     runPids = new Set();
-    trackRun(pid) {
+    trackRun(pid, attempt) {
         this.runPids.add(pid);
         liveRuns.add(pid);
         installRunReaper();
-        writeRunRecord(this.stateDir(), { pid, member: this.cfg.member, space: this.cfg.space, at: Date.now() });
+        this.attemptPid = pid;
+        writeRunRecord(this.stateDir(), { pid, member: this.cfg.member, space: this.cfg.space, at: Date.now(), worker: process.pid, obligation: attempt.obligation, ...(attempt.spend ? { spend: attempt.spend } : {}) });
     }
     untrackRun(pid) {
         this.runPids.delete(pid);
         liveRuns.delete(pid);
-        clearRunRecord(this.stateDir(), pid);
+    }
+    attemptPid = null;
+    endAttempt() {
+        if (this.attemptPid === null)
+            return;
+        clearRunRecord(this.stateDir(), this.attemptPid);
+        this.attemptPid = null;
+    }
+    recoverInterruptedRun() {
+        const dir = this.stateDir(), f = join(dir, RUN_RECORD);
+        let r;
+        try {
+            r = JSON.parse(readFileSync(f, "utf8"));
+        }
+        catch {
+            return;
+        }
+        if (!r || r.space !== this.cfg.space || r.member !== this.cfg.member || typeof r.obligation !== "string")
+            return;
+        if (!Number.isInteger(r.worker) || r.worker === process.pid || pidAlive(r.worker))
+            return;
+        if (Number.isInteger(r.pid) && typeof r.at === "number" && Date.now() - r.at <= RUN_TIMEOUT_MS + 5 * 60_000 && recordedRunAlive(r.pid))
+            killRunTree(r.pid);
+        try {
+            rmSync(f, { force: true });
+        }
+        catch { }
+        if (typeof r.spend === "string") {
+            try {
+                closeStartedRun(r.spend, "the worker went before the run ended", { at: r.at, goal: null, obligation: r.obligation, ok: false, triggeredBy: "unknown", summary: "the worker went before the run ended", space: this.spaceKey(), member: r.member }, this.opts.home);
+            }
+            catch { }
+        }
+        if (r.obligation.startsWith("cont:")) {
+            this.opts.log(`! the last run (${r.obligation}) ended with its worker — counted, not run again`);
+            return;
+        }
+        const failures = this.failuresOf(r.obligation) + 1;
+        this.failedRuns.set(r.obligation, failures);
+        this.markDone(failures >= 2 ? `parked:${r.obligation}` : `failed1:${r.obligation}`);
+        this.opts.log(`! the last run for ${r.obligation} ended with its worker (stopped, restarted or killed mid-run) — counted as a failed attempt${failures >= 2 ? "; parked: it is not run again" : ""}`);
     }
     stateDir() {
         return this.opts.home ?? process.env.PANTHEON_HOME ?? join(homedir(), ".pantheon");
@@ -1841,7 +2333,10 @@ export class Worker {
         }
         catch { }
     }
-    brokenStateFiles() { return brokenStateFiles(this.stateDir()); }
+    brokenStateFiles() {
+        repairRunLease(this.stateDir());
+        return brokenStateFiles(this.stateDir());
+    }
     hooksInstalledHere() {
         try {
             return agentHookStates(this.opts.project).some((s) => s.installed);
@@ -1877,13 +2372,45 @@ export class Worker {
         const needs = workNeedsCommands("CONTINUE", trigger, act.act);
         return this.runJob(client, o, persona, policy, (branch, canPush) => buildContinuationBrief(act, trigger, branch, persona, canPush), false, needs, trigger, act);
     }
+    spentOnce = {};
+    policyBytes() { try {
+        return readFileSync(policyPath(this.opts.home), "utf8");
+    }
+    catch {
+        return null;
+    } }
+    restoreOnces() {
+        const spent = this.spentOnce;
+        this.spentOnce = {};
+        if (!spent.cmd && !spent.wake?.length)
+            return;
+        try {
+            if (this.policyBytes() !== spent.file) {
+                this.opts.log(`  grants  not giving back the "just this once": your grants changed during the run`);
+                return;
+            }
+            const p = loadPolicy(this.opts.home);
+            if (spent.cmd && !p.grants.run_commands)
+                p.grants.run_commands = spent.cmd;
+            for (const k of spent.wake ?? [])
+                (p.wakeOnce ??= {})[k] = Math.min(99, (p.wakeOnce[k] ?? 0) + 1);
+            savePolicy(p, this.opts.home);
+            this.opts.log(`  grants  the "just this once" spent on that run is given back for the next agent`);
+        }
+        catch (e) {
+            this.opts.log(`! could not give back a "just this once" grant: ${e.message.split("\n")[0]}`);
+        }
+    }
     commandGrant(persona) {
         if (persona?.allowBash === false)
             return false;
         const policy = loadPolicy(this.opts.home);
+        const was = policy.grants.run_commands;
         if (!useGrant(policy, "run_commands"))
             return false;
         savePolicy(policy, this.opts.home);
+        if (was?.mode === "once")
+            this.spentOnce = { ...this.spentOnce, cmd: was, file: this.policyBytes() };
         this.opts.log(`  bash    on for this run — your human granted run_commands`);
         return true;
     }
@@ -1928,7 +2455,7 @@ export class Worker {
         let choice;
         if (!this.opts.agentCmd) {
             try {
-                choice = (this.opts.choose ?? chooseAgent)(policy.agent ?? this.opts.agent, { prefer: loadProfile(this.cfg).agent.primary_surface, unsandboxedOk: this.unsandboxedOk() });
+                choice = (this.opts.choose ?? chooseAgent)(policy.agent ?? this.opts.agent, { prefer: loadProfile(this.cfg).agent.primary_surface, unsandboxedOk: this.unsandboxedOk(), outages: activeOutages(this.outages) });
             }
             catch (e) {
                 const detail = `could not plan the run: ${e.message}`;
@@ -1941,6 +2468,14 @@ export class Worker {
                 this.opts.log(`  agent   ${said}`);
                 this.lastAgentSaid = said;
             }
+            if (choice.outage) {
+                const diagnosis = this.outageDiagnosis(choice.backend.label, choice.outage, choice.skipped.filter((x) => x.backend.id !== choice.backend.id).map((x) => `${x.backend.label}: ${x.why}`));
+                if (!this.skipLogged.has(`out:${o.id}:${choice.outage.until}`)) {
+                    this.skipLogged.add(`out:${o.id}:${choice.outage.until}`);
+                    this.opts.log(`! not starting a run for ${o.kind} ${o.id}: ${diagnosis.says} — it waits (not counted as a run)`);
+                }
+                return { obligation: o, branch, worktree, ok: false, refused: true, detail: diagnosis.says, diagnosis, waitUntil: choice.outage.until };
+            }
             const refused = unattendedRefusal(choice, { unsandboxedOk: this.unsandboxedOk() });
             if (refused) {
                 const noSandbox = !SANDBOXED_FOR_UNATTENDED.has(choice.backend.id) && !NOT_FOR_UNATTENDED_RUNS.has(choice.backend.id);
@@ -1957,7 +2492,7 @@ export class Worker {
                     this.skipLogged.add(`refused:${o.id}`);
                     this.opts.log(`! not starting a run for ${o.kind} ${o.id}: ${refused} — it waits for a live session (not counted as a run)`);
                 }
-                return { obligation: o, branch, worktree, ok: false, refused: true, detail: refused, diagnosis };
+                return { obligation: o, branch, worktree, ok: false, refused: true, detail: refused, diagnosis, ...(this.outagesPassed(choice).length ? { forOutage: true } : {}) };
             }
         }
         if (this.opts.allowBash && !policy.allowBash && persona) {
@@ -1989,13 +2524,14 @@ export class Worker {
                 this.skipLogged.add(`refused:${o.id}`);
                 this.opts.log(`! not starting a run for ${o.kind} ${o.id}: ${says}`);
             }
-            return { obligation: o, branch, worktree, ok: false, refused: true, detail: says, diagnosis };
+            return { obligation: o, branch, worktree, ok: false, refused: true, detail: says, diagnosis, ...(choice && this.outagesPassed(choice).length ? { forOutage: true } : {}) };
         }
         const byCli = !!this.opts.agentCmd && !!this.opts.agentCmdFromCli;
         const noCommandsHere = features?.unknown ? "unknown"
             : features && ((choice?.backend.id === "claude-code" && !this.opts.agentCmd) || byCli) && !claudeSandboxable(features) && !this.unsandboxedOk() ? "unsandboxed"
                 : null;
         const wantedBash = policy.allowBash || (persona?.allowBash !== false && !!loadPolicy(this.opts.home).grants.run_commands);
+        this.spentOnce = {};
         let allowBash = noCommandsHere ? false : policy.allowBash || this.commandGrant(persona);
         const bashDroppedForSandbox = noCommandsHere === "unsandboxed" && wantedBash;
         let baseRef = "", baseSha = "", tipSha = "";
@@ -2004,11 +2540,21 @@ export class Worker {
             ({ branch, worktree, baseRef, baseSha, tipSha, fetched } = await prepareWorktreeAsync(project, scratch, goal, this.opts.log, branch, this.repoBase(place.fp)));
         }
         catch (e) {
+            if (e instanceof WorktreeTampered)
+                throw e;
             const detail = `could not prepare a worktree: ${e.message}`;
             this.opts.log(`! ${detail}`);
             return { obligation: o, branch, worktree, ok: false, detail };
         }
+        const scan = outsideLinks(worktree);
+        if (scan.links.length || scan.unreadable) {
+            const diagnosis = outsideLinksDiagnosis(this.cfg.member, worktree, scan);
+            this.opts.log(`! not starting a run for ${o.kind} ${o.id}: ${diagnosis.says}`);
+            return { obligation: o, branch, worktree, ok: false, refused: true, detail: diagnosis.says, diagnosis };
+        }
         await this.spendWakeOnce(client, o);
+        if (choice)
+            this.sayFallbackUnsandboxed(choice);
         if (noCommandsHere === "unknown" && wantedBash) {
             this.opts.log(`  bash    off for this run — \`${binary} --help\` did not answer, so its sandbox and deny rules cannot be confirmed`);
         }
@@ -2040,12 +2586,12 @@ export class Worker {
         }
         const multi = this.workspaceList().length > 1 || place.kind === "folder" || route.notHere.length > 0;
         const whereNote = multi ? workspaceNote(route, attached, tipSha || baseSha, place.kind === "folder" ? worktree : null) : "";
-        const reserved = reservedDecisionsNote(loadProfile(this.cfg));
+        const reserved = reservedDecisionsNote(profileForTeam(this.cfg));
         const brief = makeBrief(branch, canPush) + whereNote + baseNote(baseRef, baseSha, fetched) +
             (allowBash ? (agentId === "claude-code" ? commandNote(worktree, tipSha || baseSha, (m) => this.opts.log(m)) : "") : holdRepoConfig ? heldNote() : "") +
             (reserved ? `\n\n${reserved}` : "");
         const startedAt = Date.now();
-        writeFileSync(join(worktree, ".pantheon-task.md"), brief);
+        writeInside(worktree, join(worktree, ".pantheon-task.md"), brief, 0o644);
         let command;
         let args;
         let env = agentBaseEnv(process.env, proxyEnvFor());
@@ -2087,14 +2633,14 @@ export class Worker {
                 backend, binary, prompt: brief, worktree, cfg: runCfg, branch, allowBash, runHome,
                 ...(attached.length ? { readOnlyDirs: attached.map((a) => a.path) } : {}),
                 ...(baseSha ? { base: baseSha } : {}), ...(tipSha ? { commandsRev: tipSha } : {}), goal,
-                ...(features ? { claude: { features, pantheonHome: this.stateDir(), home: personHome, userSettings: join(personHome, ".claude", "settings.json") } } : {}),
+                ...(features ? { claude: { features, pantheonHome: this.stateDir(), home: personHome, userSettings: join(personHome, ".claude", "settings.json"), ...(() => { const c = adoptedCommon(worktree); return c ? { gitCommon: c } : {}; })() } } : {}),
             });
             for (const n of plan.notes ?? [])
                 if (!this.notesSaid.has(n)) {
                     this.notesSaid.add(n);
                     this.opts.log(`  confine ${n}`);
                 }
-            materializeSpawnFiles(worktree, plan);
+            materializeSpawnFiles(worktree, plan, runHome);
             for (const f of plan.writeFiles ?? []) {
                 const rel = isAbsolute(f.path) ? relative(worktree, f.path) : f.path;
                 if (!rel.startsWith("..") && !isAbsolute(rel))
@@ -2118,10 +2664,10 @@ export class Worker {
             }
         }
         catch (e) {
-            if (fenced)
+            this.cleanupStep("putting the repo's agent config back", () => { if (fenced)
                 for (const l of fenced.restore().lines)
-                    this.opts.log(`  config  ${l}`);
-            this.sealRunHome(runHome);
+                    this.opts.log(`  config  ${l}`); });
+            this.cleanupStep("sealing the run home", () => this.sealRunHome(runHome));
             const detail = `could not plan the run: ${e.message}`;
             this.opts.log(`! ${detail}`);
             recordRun({ at: Date.now(), goal: o.goal, obligation: o.id, ok: false, triggeredBy: (await this.actOf(client, o.ref))?.from ?? "unknown", summary: clip(o.body), space: this.spaceKey(), member: this.cfg.member }, this.opts.home);
@@ -2130,137 +2676,190 @@ export class Worker {
         let detail;
         let transcript = "";
         const homeBefore = snapshotHome(this.stateDir());
+        let spendId = null;
         try {
-            detail = await new Promise((res) => {
-                let child;
-                try {
-                    child = procSpawn(sp.command, sp.args, { cwd: worktree, stdio: ["ignore", "pipe", "pipe"], env, ...sp.options, detached: process.platform !== "win32" });
-                }
-                catch (e) {
-                    res(`could not start "${command}": ${e.message}`);
-                    return;
-                }
-                const pid = child.pid;
-                if (pid)
-                    this.trackRun(pid);
-                let head = "", tail = "";
-                const take = (b) => {
-                    const s = b.toString();
-                    if (head.length < 16_000)
-                        head += s.slice(0, 16_000 - head.length);
-                    tail = (tail + s).slice(-16_000);
-                };
-                child.stdout.on("data", take);
-                child.stderr.on("data", take);
-                let timedOut = false;
-                let dead = false;
-                const markDead = () => { if (dead)
-                    return; dead = true; if (pid)
-                    this.untrackRun(pid); };
-                let settled = false;
-                let exitGrace = null;
-                let exitCode = null;
-                const limit = this.opts.runTimeoutMs ?? RUN_TIMEOUT_MS;
-                const finish = (code, signal) => {
-                    if (settled)
+            spendId = startRun({ at: Date.now(), goal: o.goal, obligation: o.id, ok: false, triggeredBy: client.recentFrom(o.ref) ?? "unknown", summary: clip(o.body), space: this.spaceKey(), member: this.cfg.member }, this.opts.home);
+        }
+        catch (e) {
+            this.opts.log(`! could not record the run as started: ${e.message.split("\n")[0]}`);
+        }
+        let recorded = false;
+        try {
+            try {
+                detail = await new Promise((res) => {
+                    let child;
+                    try {
+                        child = procSpawn(sp.command, sp.args, { cwd: worktree, stdio: ["ignore", "pipe", "pipe"], env, ...sp.options, detached: process.platform !== "win32" });
+                    }
+                    catch (e) {
+                        res(`could not start "${command}": ${e.message}`);
                         return;
-                    settled = true;
-                    clearTimeout(kill);
-                    if (exitGrace)
-                        clearTimeout(exitGrace);
-                    markDead();
-                    transcript = `${head}\n${tail}`;
-                    res(`exit ${code ?? signal}${timedOut ? ` (stopped after ${Math.round(limit / 1000)}s)` : ""}\n${tail.slice(-4000)}`);
-                };
-                const kill = setTimeout(() => { if (dead)
-                    return; timedOut = true; if (pid)
-                    killRunTree(pid); }, limit);
-                child.on("exit", (code, signal) => {
-                    clearTimeout(kill);
-                    if (pid && !dead && killTreeOnExit())
-                        killRunTree(pid);
-                    markDead();
-                    const c = child;
-                    exitCode = { code, signal };
-                    exitGrace = setTimeout(() => { try {
-                        c.stdout.destroy();
-                        c.stderr.destroy();
                     }
-                    catch { } finish(code, signal); }, this.opts.exitGraceMs ?? EXIT_GRACE_MS);
+                    const pid = child.pid;
+                    if (pid)
+                        this.trackRun(pid, { obligation: o.id, spend: spendId });
+                    let head = "", tail = "";
+                    const take = (b) => {
+                        const s = b.toString();
+                        if (head.length < 16_000)
+                            head += s.slice(0, 16_000 - head.length);
+                        tail = (tail + s).slice(-16_000);
+                    };
+                    child.stdout.on("data", take);
+                    child.stderr.on("data", take);
+                    let timedOut = false;
+                    let dead = false;
+                    const markDead = () => { if (dead)
+                        return; dead = true; if (pid)
+                        this.untrackRun(pid); };
+                    let settled = false;
+                    let exitGrace = null;
+                    let exitCode = null;
+                    const limit = this.opts.runTimeoutMs ?? RUN_TIMEOUT_MS;
+                    const finish = (code, signal) => {
+                        if (settled)
+                            return;
+                        settled = true;
+                        clearTimeout(kill);
+                        if (exitGrace)
+                            clearTimeout(exitGrace);
+                        markDead();
+                        transcript = `${head}\n${tail}`;
+                        res(`exit ${code ?? signal}${timedOut ? ` (stopped after ${Math.round(limit / 1000)}s)` : ""}\n${tail.slice(-4000)}`);
+                    };
+                    const kill = setTimeout(() => { if (dead)
+                        return; timedOut = true; if (pid)
+                        killRunTree(pid); }, limit);
+                    child.on("exit", (code, signal) => {
+                        clearTimeout(kill);
+                        if (pid && !dead && killTreeOnExit())
+                            killRunTree(pid);
+                        markDead();
+                        const c = child;
+                        exitCode = { code, signal };
+                        exitGrace = setTimeout(() => { try {
+                            c.stdout.destroy();
+                            c.stderr.destroy();
+                        }
+                        catch { } finish(code, signal); }, this.opts.exitGraceMs ?? EXIT_GRACE_MS);
+                    });
+                    child.on("close", (code, signal) => finish(exitCode?.code ?? code, exitCode?.signal ?? signal));
+                    child.on("error", (e) => { if (settled)
+                        return; settled = true; clearTimeout(kill); if (exitGrace)
+                        clearTimeout(exitGrace); markDead(); res(`could not start "${command}": ${e.message}`); });
                 });
-                child.on("close", (code, signal) => finish(exitCode?.code ?? code, exitCode?.signal ?? signal));
-                child.on("error", (e) => { if (settled)
-                    return; settled = true; clearTimeout(kill); if (exitGrace)
-                    clearTimeout(exitGrace); markDead(); res(`could not start "${command}": ${e.message}`); });
-            });
-        }
-        finally {
-            if (fenced) {
-                const r = fenced.restore();
-                for (const l of r.lines)
-                    this.opts.log(`  config  ${l}`);
             }
-            this.sealRunHome(runHome);
-            this.restoreHomeAfterRun(homeBefore, o);
-        }
-        const runLog = join(worktree, ".pantheon-run.log");
-        let extra = "";
-        let massDelete = false;
-        if (allowBash && baseSha) {
-            const d = deletedSinceBase(worktree, baseSha);
-            if (d && d.total >= 4 && d.gone > d.total * MASS_DELETE_SHARE) {
-                massDelete = true;
-                extra = `\n! this branch deletes ${d.gone} of the ${d.total} files tracked at its base — do not merge it without looking`;
-                this.opts.log(`! ${o.id}: the branch ${branch} deletes ${d.gone} of the ${d.total} files tracked at ${baseSha.slice(0, 7)} — do not merge it without looking`);
-            }
-        }
-        writeFileSync(runLog, `obligation ${o.id}\nbranch ${branch}\n\n${detail}\n${extra}`);
-        const exited = /^exit 0/.test(detail);
-        const sent = client.mineSince(startedAt, o.goal);
-        const repliedWith = sent.find((a) => ["DELIVERED", "ANSWER", "ESCALATE", "ACCEPT", "OBJECT", "PROPOSE", "CONTRACT", "CLOSE", "WITHDRAW"].includes(a.act) || (a.act === "NOTE" && !!a.ref));
-        const replied = requireReply ? client.repliedTo(o) || !!repliedWith : true;
-        if (requireReply && replied && !client.repliedTo(o) && repliedWith) {
-            this.opts.log(`  reply   ${repliedWith.act} ${repliedWith.id} answers ${o.id}, though the relay still lists it as owed${repliedWith.ref ? "" : " (the act named no ref)"}`);
-        }
-        const ok = exited && replied;
-        await this.checkDeliveries(client, sent, { branch, worktree, canPush: canPush && !massDelete, goal: o.goal ?? null });
-        this.runProject = null;
-        if (place.kind === "folder") {
-            let drafts = [];
-            try {
-                drafts = readdirSync(worktree).filter((f) => !f.startsWith(".") && f !== "AGENTS.md" && f !== "CLAUDE.md");
+            finally {
+                this.cleanupStep("putting the repo's agent config back", () => { if (fenced)
+                    for (const l of fenced.restore().lines)
+                        this.opts.log(`  config  ${l}`); });
+                this.cleanupStep("sealing the run home", () => this.sealRunHome(runHome));
+                this.cleanupStep("checking Pantheon's own files", () => this.restoreHomeAfterRun(homeBefore, o));
+            }
+            const runLog = join(worktree, ".pantheon-run.log");
+            let extra = "";
+            let massDelete = false;
+            if (allowBash && baseSha) {
+                const d = deletedSinceBase(worktree, baseSha);
+                if (d.unreadable) {
+                    massDelete = true;
+                    extra = `\n! could not check how many files this branch deletes (${d.unreadable}) — it is not pushed from here; look before merging`;
+                    this.opts.log(`! ${o.id}: could not check the branch ${branch} for a mass deletion (${d.unreadable}) — not pushing it`);
+                }
+                else if (d.total >= 4 && d.gone > d.total * MASS_DELETE_SHARE) {
+                    massDelete = true;
+                    extra = `\n! this branch deletes ${d.gone} of the ${d.total} files tracked at its base — do not merge it without looking`;
+                    this.opts.log(`! ${o.id}: the branch ${branch} deletes ${d.gone} of the ${d.total} files tracked at ${baseSha.slice(0, 7)} — do not merge it without looking`);
+                }
             }
-            catch { }
-            if (drafts.length) {
-                this.opts.log(`  drafts  ${drafts.length} file${drafts.length === 1 ? "" : "s"} for ${place.name} in ${worktree}: ${drafts.slice(0, 5).join(", ")}${drafts.length > 5 ? ", …" : ""}`);
-                if (this.opts.notify) {
-                    try {
-                        this.opts.notify({ kind: "worker", who: "Your worker", heading: `Drafts for ${place.name}`, context: this.cfg.space, body: `A request from ${(await this.actOf(client, o.ref))?.from ?? "a teammate"} left ${drafts.length} draft file${drafts.length === 1 ? "" : "s"} for you to review in ${worktree}. Nothing in ${place.path} was changed.`, ttl: 0, sound: false });
+            this.writeRunLog(worktree, runLog, `obligation ${o.id}\nbranch ${branch}\n\n${detail}\n${extra}`);
+            const exited = /^exit 0/.test(detail);
+            const sent = client.mineSince(startedAt, o.goal);
+            const repliedWith = sent.find((a) => ["DELIVERED", "ANSWER", "ESCALATE", "ACCEPT", "OBJECT", "PROPOSE", "CONTRACT", "CLOSE", "WITHDRAW"].includes(a.act) || (a.act === "NOTE" && !!a.ref));
+            const replied = requireReply ? client.repliedTo(o) || !!repliedWith : true;
+            if (requireReply && replied && !client.repliedTo(o) && repliedWith) {
+                this.opts.log(`  reply   ${repliedWith.act} ${repliedWith.id} answers ${o.id}, though the relay still lists it as owed${repliedWith.ref ? "" : " (the act named no ref)"}`);
+            }
+            const ok = exited && replied;
+            await this.checkDeliveries(client, sent, { branch, worktree, canPush: canPush && !massDelete, goal: o.goal ?? null });
+            this.runProject = null;
+            if (place.kind === "folder") {
+                let drafts = [];
+                try {
+                    drafts = readdirSync(worktree).filter((f) => !f.startsWith(".") && f !== "AGENTS.md" && f !== "CLAUDE.md");
+                }
+                catch { }
+                if (drafts.length) {
+                    this.opts.log(`  drafts  ${drafts.length} file${drafts.length === 1 ? "" : "s"} for ${place.name} in ${worktree}: ${drafts.slice(0, 5).join(", ")}${drafts.length > 5 ? ", …" : ""}`);
+                    if (this.opts.notify) {
+                        try {
+                            this.opts.notify({ kind: "worker", who: "Your worker", heading: `Drafts for ${place.name}`, context: this.cfg.space, body: `A request from ${(await this.actOf(client, o.ref))?.from ?? "a teammate"} left ${drafts.length} draft file${drafts.length === 1 ? "" : "s"} for you to review in ${worktree}. Nothing in ${place.path} was changed.`, ttl: 0, sound: false });
+                        }
+                        catch { }
                     }
-                    catch { }
                 }
             }
+            const triggeredBy = (await this.actOf(client, o.ref))?.from ?? "unknown";
+            const summary = clip(o.body);
+            const end = { at: Date.now(), goal: o.goal, obligation: o.id, ok, triggeredBy, summary, space: this.spaceKey(), member: this.cfg.member };
+            if (spendId)
+                finishRun(spendId, end, this.opts.home);
+            else
+                recordRun(end, this.opts.home);
+            recorded = true;
+            const runKeys = client.features.includes("delegate");
+            const sentAnywhere = client.mineSince(startedAt).some((a) => !runKeys || !a.sig || a.sig.role === "run");
+            const outage = !ok && !exited && !sentAnywhere && choice && !/\(stopped after \d+s\)/.test(detail.split("\n")[0] ?? "") ? detectOutage(choice.backend.id, detail) : null;
+            if (outage) {
+                this.outages.set(choice.backend.id, outage);
+                const refusedLog = join(worktree, `.pantheon-run.${choice.backend.id}-refused.log`);
+                this.writeRunLog(worktree, refusedLog, `obligation ${o.id}\nbranch ${branch}\nagent ${choice.backend.label}\n\n${detail}\n`);
+                if (Date.now() - startedAt < ONCE_GIVE_BACK_MS)
+                    this.restoreOnces();
+            }
+            if (outage && (this.outageRetries.get(o.id) ?? 0) < 3) {
+                this.outageRetries.set(o.id, (this.outageRetries.get(o.id) ?? 0) + 1);
+                if (this.outageRetries.size > 200)
+                    this.outageRetries.delete(this.outageRetries.keys().next().value);
+                this.opts.log(`! ${choice.backend.label} refused the run for ${o.id}: ${outage.why} — passed over until about ${whenAgain(outage.until)}; the request goes to the next agent here (transcript: ${join(worktree, `.pantheon-run.${choice.backend.id}-refused.log`)})`);
+                return { obligation: o, branch, worktree, ok: false, detail, agentOut: true };
+            }
+            const quiet = ok && !requireReply && sent.length === 0;
+            const diagnosis = ok ? undefined : outage ? this.outageDiagnosis(choice.backend.label, outage, [], "it was handed to another agent three times already") : diagnoseRun({ exited, replied, allowBash, branch, project, worktree, detail, transcript, runLog, needsCommands, ...(bashDroppedForSandbox ? { commandsNeedSandbox: byCli ? "agent-cmd" : "claude" } : {}), ...(agentId ? { agent: agentId } : {}), ...(place.kind === "folder" ? { folder: true } : {}),
+                ...(agentId === "claude-code" && allowBash ? { allowedRules: bashRules } : {}), ...(baseRef ? { baseRef } : {}) }, this.opts.probe ?? gitProbe);
+            if (this.opts.notify && !quiet && (!ok || loadProfile(this.cfg).notifications?.worker_done)) {
+                try {
+                    const reply = sent[sent.length - 1] ?? null;
+                    this.opts.notify(composeWorker({ ok, triggeredBy, obligationBody: o.body, goal: o.goal ? client.goals.get(o.goal) : undefined, reply, obligationRef: o.ref, ...(diagnosis ? { diagnosis } : {}) }, (() => { const tools = installedTools(); return { tools, preferred: preferredTool(loadProfile(this.cfg), tools, this.opts.home) }; })()));
+                }
+                catch { }
+            }
+            this.opts.log(quiet ? `< read ${o.id} on ${branch} — the thread was already settled, nothing sent`
+                : ok ? `< handled ${o.id} on ${branch}`
+                    : `! ${o.id} stopped [${diagnosis.cause}]: ${diagnosis.says} (transcript: ${runLog})`);
+            return { obligation: o, branch, worktree, ok, detail, ...(diagnosis ? { diagnosis } : {}) };
         }
-        const triggeredBy = (await this.actOf(client, o.ref))?.from ?? "unknown";
-        const summary = clip(o.body);
-        recordRun({
-            at: Date.now(), goal: o.goal, obligation: o.id, ok,
-            triggeredBy, summary, space: this.spaceKey(), member: this.cfg.member,
-        }, this.opts.home);
-        const quiet = ok && !requireReply && sent.length === 0;
-        const diagnosis = ok ? undefined : diagnoseRun({ exited, replied, allowBash, branch, project, worktree, detail, transcript, runLog, needsCommands, ...(bashDroppedForSandbox ? { commandsNeedSandbox: byCli ? "agent-cmd" : "claude" } : {}), ...(agentId ? { agent: agentId } : {}), ...(place.kind === "folder" ? { folder: true } : {}),
-            ...(agentId === "claude-code" && allowBash ? { allowedRules: bashRules } : {}), ...(baseRef ? { baseRef } : {}) }, this.opts.probe ?? gitProbe);
-        if (this.opts.notify && !quiet && (!ok || loadProfile(this.cfg).notifications?.worker_done)) {
-            try {
-                const reply = sent[sent.length - 1] ?? null;
-                this.opts.notify(composeWorker({ ok, triggeredBy, obligationBody: o.body, goal: o.goal ? client.goals.get(o.goal) : undefined, reply, obligationRef: o.ref, ...(diagnosis ? { diagnosis } : {}) }, (() => { const tools = installedTools(); return { tools, preferred: preferredTool(loadProfile(this.cfg), tools, this.opts.home) }; })()));
+        catch (e) {
+            if (!recorded) {
+                try {
+                    const end = { at: Date.now(), goal: o.goal, obligation: o.id, ok: false, triggeredBy: client.recentFrom(o.ref) ?? "unknown", summary: clip(o.body), space: this.spaceKey(), member: this.cfg.member };
+                    if (spendId)
+                        finishRun(spendId, end, this.opts.home);
+                    else
+                        recordRun(end, this.opts.home);
+                }
+                catch { }
             }
-            catch { }
+            throw e;
+        }
+    }
+    writeRunLog(worktree, f, text) {
+        try {
+            writeInside(worktree, f, text, 0o644);
+        }
+        catch (e) {
+            this.opts.log(`! could not write the run log ${f}: ${e.message.split("\n")[0]}`);
         }
-        this.opts.log(quiet ? `< read ${o.id} on ${branch} — the thread was already settled, nothing sent`
-            : ok ? `< handled ${o.id} on ${branch}`
-                : `! ${o.id} stopped [${diagnosis.cause}]: ${diagnosis.says} (transcript: ${runLog})`);
-        return { obligation: o, branch, worktree, ok, detail, ...(diagnosis ? { diagnosis } : {}) };
     }
     lastFeaturesSaid = "";
     notesSaid = new Set();
@@ -2312,7 +2911,7 @@ export class Worker {
                 const r = await gitOut(run.worktree, ["push", "--quiet", "origin", `refs/heads/${br}:refs/heads/${br}`], FETCH_TIMEOUT_MS);
                 pushed = r !== null && await onRemote(run.worktree, br, commit);
                 if (pushed)
-                    this.opts.log(`* pushed ${br} for the run: its DELIVERED ${d.id} named ${commit.slice(0, 7)}, which origin did not have`);
+                    this.opts.log(`* pushed ${br} for the run: its DELIVERED ${d.id} named ${commit.slice(0, 7)}, which origin did not have — repo hooks not run on Pantheon's push${lfsInUse(run.worktree) ? "; LFS objects uploaded" : ""}`);
             }
             if (pushed)
                 continue;
@@ -2375,7 +2974,8 @@ export class Worker {
                 ].join("\n"),
             });
             markContinued(space, key, this.opts.home);
-            this.opts.log(`* told ${peer ?? "the teammate"} that ${o.id} waits for a live session: ${d.cause === "repo_not_here" ? d.says : "no agent here can take unattended work"}`);
+            this.opts.log(d.cause === "agent_unavailable" ? `* told ${peer ?? "the teammate"} that ${o.id} waits: ${d.says}`
+                : `* told ${peer ?? "the teammate"} that ${o.id} waits for a live session: ${d.cause === "repo_not_here" ? d.says : "no agent here can take unattended work"}`);
         }
         catch (e) {
             this.opts.log(`! could not tell the teammate that ${o.id} is waiting: ${e.message}`);
@@ -2390,7 +2990,8 @@ export class Worker {
         const asking = !!d.capability && mayAsk(policy, d.capability);
         const what = clip(o.body, 120);
         const lines = [
-            `${attempts === 1 ? "A run" : `${attempts === 2 ? "Two" : attempts} runs`} on this machine could not finish ${o.kind === "CONTINUE" ? "a follow-up" : `the ${o.kind}`} it owes: ${what}`,
+            attempts === 0 ? `No run was started on this machine for ${o.kind === "CONTINUE" ? "a follow-up" : `the ${o.kind}`} it owes: ${what}`
+                : `${attempts === 1 ? "A run" : `${attempts === 2 ? "Two" : attempts} runs`} on this machine could not finish ${o.kind === "CONTINUE" ? "a follow-up" : `the ${o.kind}`} it owes: ${what}`,
             ``,
             `WHY IT STOPPED. ${d.says}`,
             `WHAT UNBLOCKS IT. ${d.fix}`,
@@ -2542,39 +3143,48 @@ export class Worker {
         const lastAttempt = policy.attempts.self_upgrade ?? null;
         if (!needsSelfUpgrade(VERSION, relayPkg, lastAttempt))
             return;
-        if (useGrant(policy, "self_upgrade")) {
-            policy.attempts.self_upgrade = Date.now();
-            savePolicy(policy, home);
-            this.writeState("upgrading", `pantheon ${VERSION} -> ${relayPkg} (relay is ahead)`);
-            this.opts.log(`* self-upgrade: relay runs ${relayPkg}, this machine runs ${VERSION} — upgrading (granted by this machine's human)`);
-            let result;
+        if (policy.grants.self_upgrade) {
+            const slot = this.takeSlot();
+            if ("held" in slot)
+                return;
             try {
-                result = this.opts.selfUpgrade?.run ? this.opts.selfUpgrade.run() : await this.runRealUpgrade(relayPkg ?? undefined);
-            }
-            catch (e) {
-                result = { ok: false, alreadyCurrent: false, from: VERSION, to: relayPkg ?? "?" };
-                this.opts.log(`! self-upgrade failed: ${e.message}`);
-            }
-            if (result.ok && result.to === result.from) {
-                delete policy.attempts.self_upgrade;
+                useGrant(policy, "self_upgrade");
+                policy.attempts.self_upgrade = Date.now();
                 savePolicy(policy, home);
-                this.opts.log(`* self-upgrade: nothing newer than ${result.to} to install yet (the relay runs ${relayPkg}); will check again`);
+                this.writeState("upgrading", `pantheon ${VERSION} -> ${relayPkg} (relay is ahead)`);
+                this.opts.log(`* self-upgrade: relay runs ${relayPkg}, this machine runs ${VERSION} — upgrading (granted by this machine's human)`);
+                let result;
+                try {
+                    result = this.opts.selfUpgrade?.run ? this.opts.selfUpgrade.run() : await this.runRealUpgrade(relayPkg ?? undefined);
+                }
+                catch (e) {
+                    result = { ok: false, alreadyCurrent: false, from: VERSION, to: relayPkg ?? "?" };
+                    this.opts.log(`! self-upgrade failed: ${e.message}`);
+                }
+                if (result.ok && result.to === result.from) {
+                    delete policy.attempts.self_upgrade;
+                    savePolicy(policy, home);
+                    this.opts.log(`* self-upgrade: nothing newer than ${result.to} to install yet (the relay runs ${relayPkg}); will check again`);
+                    return;
+                }
+                if (result.ok && !result.alreadyCurrent) {
+                    await client.send({
+                        act: "NOTE", goal: null, after_seq: Math.max(client.readSeq, client.seq),
+                        summary: `self-upgraded pantheon ${result.from} -> ${result.to}; worker restarting on the new build`,
+                        body: `This machine's worker upgraded pantheon ${result.from} -> ${result.to} (fast-forward pull + rebuild, granted by its human) and is restarting on the new build. Agent windows on this machine opened on 0.24 or later switch to the new version by themselves; a window opened on an older pantheon needs one reconnect (/mcp → pantheon → Reconnect, or reopen it).`,
+                    }).catch((e) => this.opts.log(`! could not report the upgrade on the ledger: ${e.message}`));
+                    await this.bringMachineAlong();
+                    this.opts.log(`* self-upgrade done: ${result.from} -> ${result.to}; restarting worker to load it`);
+                    (this.opts.selfUpgrade?.restart ?? (() => process.exit(0)))();
+                }
+                else if (!result.ok) {
+                    this.opts.log("! self-upgrade did not complete — will not retry for an hour; run `pantheon upgrade` by hand to see why");
+                }
                 return;
             }
-            if (result.ok && !result.alreadyCurrent) {
-                await client.send({
-                    act: "NOTE", goal: null, after_seq: Math.max(client.readSeq, client.seq),
-                    summary: `self-upgraded pantheon ${result.from} -> ${result.to}; worker restarting on the new build`,
-                    body: `This machine's worker upgraded pantheon ${result.from} -> ${result.to} (fast-forward pull + rebuild, granted by its human) and is restarting on the new build. Agent windows on this machine opened on 0.24 or later switch to the new version by themselves; a window opened on an older pantheon needs one reconnect (/mcp → pantheon → Reconnect, or reopen it).`,
-                }).catch((e) => this.opts.log(`! could not report the upgrade on the ledger: ${e.message}`));
-                await this.bringMachineAlong();
-                this.opts.log(`* self-upgrade done: ${result.from} -> ${result.to}; restarting worker to load it`);
-                (this.opts.selfUpgrade?.restart ?? (() => process.exit(0)))();
-            }
-            else if (!result.ok) {
-                this.opts.log("! self-upgrade did not complete — will not retry for an hour; run `pantheon upgrade` by hand to see why");
+            finally {
+                this.giveSlot(slot.token);
             }
-            return;
         }
         if (mayAsk(policy, "self_upgrade")) {
             try {