@oar-sh/oar 0.9.12 → 0.9.14

package/server/public/index.html

@@ -2984,6 +2984,15 @@
   }
   .pending-action-text { overflow-wrap: anywhere; }
   .pending-action-cancel { margin-left: 0; }
+  /* The queued relay restart's row (relay-restart-ui.js): the headline, the
+     sessions it waits for (links), held messages, background tasks, buttons. */
+  .relay-restart-row { flex-direction: column; gap: 3px; }
+  .relay-restart-head { display: flex; flex-wrap: wrap; justify-content: center; gap: 6px; }
+  .relay-restart-waited { opacity: 0.85; }
+  .relay-restart-detail { color: var(--text); overflow-wrap: anywhere; max-height: 4.5em; overflow-y: auto; }
+  .relay-restart-session-link { color: inherit; text-decoration: underline; }
+  .relay-restart-actions { display: flex; flex-wrap: wrap; justify-content: center; gap: 6px; }
+  .relay-restart-row[data-asking="1"] .relay-restart-head { font-weight: 600; }
   .suspend-host-blockers {
     margin: 6px 0 10px;
     padding-left: 20px;
@@ -3438,6 +3447,26 @@
     font-size: var(--fs-meta-sm); text-decoration: underline; text-underline-offset: 3px;
   }
   #task-console-stop:hover:not(:disabled) { border-color: #f85149; color: #f85149; }
+  /* "Load earlier" within reach while following the end; the one at the top
+     of the output stays. */
+  #task-console-earlier-top {
+    background: none; border: 0; padding: 0; color: var(--accent); cursor: pointer;
+    font-size: var(--fs-meta-sm); text-decoration: underline; text-underline-offset: 3px;
+  }
+  #task-console-earlier-top:disabled { color: var(--muted); text-decoration: none; cursor: default; }
+  #task-console-earlier-top[hidden] { display: none; }
+  /* Where the output of a command piped into tail stops until it ends. */
+  #task-console-hold {
+    margin: 8px 0 0; padding: 6px 10px; border-left: 3px solid var(--warn); border-radius: 4px;
+    background: var(--bg2); color: var(--text); font-size: var(--fs-meta-sm);
+  }
+  #task-console-hold[hidden] { display: none; }
+  .tc-hold-text { font-weight: 600; }
+  .tc-hold-hint { color: var(--muted); margin-top: 2px; }
+  /* Wider screens: the console ends above the composer's open task row, so
+     the row's chip, clock and Stop stay in view (task-console.mjs sets the
+     bottom). Phones keep the full-screen console. */
+  #task-console-modal.tc-above-panel .task-console-dialog { height: 100%; }
   #task-console-scroll {
     flex: 1; overflow: auto; overscroll-behavior: contain; padding: 8px 14px 28px;
     background: var(--bg);
@@ -3496,6 +3525,9 @@
   .tc-bg-13 { background: var(--tc-ansi-13); }
   .tc-bg-14 { background: var(--tc-ansi-14); }
   .tc-bg-15 { background: var(--tc-ansi-15); }
+  /* Inverse text (SGR 7) with a side left unset: the console's own colours, swapped. */
+  .tc-fg-inverse { color: var(--bg); }
+  .tc-bg-inverse { background: var(--text); }
   #task-console-status { color: var(--muted); padding: 10px 0; font-size: var(--fs-meta-sm); }
   #task-console-status[hidden] { display: none; }
   #task-console-jump {
@@ -3712,6 +3744,8 @@
   .relay-event-time { flex: 0 0 auto; }
   .relay-event-lines { margin: 2px 0 4px; padding-left: 18px; }
   .relay-event-line { margin: 2px 0; overflow-wrap: anywhere; white-space: pre-wrap; }
+  /* The relay's note to carry on after a restart (relay-restart-note-view.mjs). */
+  .relay-restart-note-text { padding-left: 0; overflow-wrap: anywhere; white-space: pre-wrap; }
   .relay-event-line.relay-event-question-asked,
   .relay-event-line.relay-event-error,
   .relay-event-line.relay-event-task-failed,
@@ -5871,6 +5905,10 @@
     color: var(--muted);
     font-size: var(--fs-meta-xs);
   }
+  .relay-question-header {
+    font-weight: 600;
+    color: var(--text);
+  }
   .relay-question-body {
     line-height: 1.5;
     color: var(--text);
@@ -7156,7 +7194,7 @@
             checked
           >
         </div>
-        <div class="settings-help" style="margin-top: 6px;">Hide the menu action when host suspend is unsupported or not needed on this device.</div>
+        <div class="settings-help" style="margin-top: 6px;">Shows or hides the menu action in this browser only. Suspend works only when the relay runs on Windows; a queued suspend still shows its banner here either way.</div>
         <div class="settings-row" style="margin-top: 12px; margin-bottom: 0;">
           <label for="scroll-on-send-toggle">Jump to the end when I send a message</label>
           <input
@@ -7198,7 +7236,7 @@
             onchange="updateTurnCeilingSetting(this.value)"
           >
         </div>
-        <div class="settings-help" style="margin-top: 6px;">A hard cap on how long one turn may run before the relay requeues it. Turns are already kept alive by worker heartbeats, and a turn waiting on your answer to a question is never cut off — so this only catches a worker that has hung. Set to 0 for no limit.</div>
+        <div class="settings-help" style="margin-top: 6px;">A hard cap on how long one turn may run before the relay requeues it, counted from the start of the turn or from your last answer to one of its questions. Turns are already kept alive by worker heartbeats, and the relay never cuts off a turn waiting on your answer to a question — so this only catches a worker that has hung. Grok also enforces the limit itself, counted from the start of the prompt and without pausing for questions (remote relay approvals). Set to 0 for no limit.</div>
         <div class="settings-row settings-row-column" style="margin-top: 12px; margin-bottom: 0;">
           <label for="background-task-timeout-slider">Background task timeout <span id="background-task-timeout-value">4 h</span></label>
           <input
@@ -7229,6 +7267,30 @@
           >
         </div>
         <div class="settings-help" style="margin-top: 6px;">A shell or Monitor task that has written no output for this long gets an amber "no output for N min" note in the composer panel and its console.</div>
+        <div class="settings-row" style="margin-top: 12px; margin-bottom: 0;">
+          <label for="restart-resume-toggle">After a relay restart, tell interrupted sessions to carry on</label>
+          <input
+            id="restart-resume-toggle"
+            type="checkbox"
+            onchange="updateRestartResumeSettingFromToggle(this.checked)"
+            aria-label="After a relay restart, tell interrupted sessions to carry on"
+          >
+        </div>
+        <div class="settings-help" style="margin-top: 6px;">Most turns a restart interrupts run again by themselves. A turn that cannot (the agent had already taken the message, or had started on its own after a background task) just stops. With this on, such a session gets one relay note once the relay is back, saying when it restarted and asking the agent to check what it was doing and carry on. Your message is never sent again; idle, archived and usage-limit-paused sessions get nothing. Off by default; a setting of this relay.</div>
+        <div class="settings-row" style="margin-top: 12px; margin-bottom: 0;">
+          <label for="relay-restart-max-wait-select">Ask after a queued relay restart has waited</label>
+          <select id="relay-restart-max-wait-select" onchange="updateRelayRestartMaxWaitSetting(this.value)" aria-label="Ask after a queued relay restart has waited">
+            <option value="5">5 min</option>
+            <option value="10">10 min</option>
+            <option value="15">15 min</option>
+            <option value="30" selected>30 min</option>
+            <option value="60">1 h</option>
+            <option value="120">2 h</option>
+            <option value="240">4 h</option>
+            <option value="0">No limit</option>
+          </select>
+        </div>
+        <div class="settings-help" style="margin-top: 6px;">A queued relay restart waits for the running turns, and new messages wait for the restart. After this long the banner asks whether to restart now, keep waiting or cancel; it never restarts while the turns run, and still restarts as soon as they end. No limit waits until the turns end.</div>
         <div class="settings-row" style="margin-top: 12px; margin-bottom: 0;">
           <label for="subagent-record-retention-select">Keep sub-agent tool output</label>
           <select id="subagent-record-retention-select" onchange="updateSubagentRecordRetentionSetting(this.value)" aria-label="Keep sub-agent tool output">
@@ -7431,7 +7493,7 @@
             <div style="display: flex; gap: 8px; margin-top: 8px;">
               <button id="copilot-save-btn" type="button" class="summary-btn" onclick="saveCopilotSettings()">Save Copilot settings</button>
             </div>
-            <div class="settings-help">Chooses how GitHub Copilot conversations run. <strong>SDK</strong> is the default: a headless worker per conversation with mid-turn steering and background task cards — no CLI extension to install, but no tmux inspector for those sessions. <strong>Extension</strong> runs the Copilot CLI in a terminal session, which you can attach to with the tmux inspector. A relay that cannot run the SDK engine uses Extension. Applies to newly started conversations; sessions already running keep their engine until their worker restarts.</div>
+            <div class="settings-help">Chooses how GitHub Copilot conversations run. <strong>SDK</strong> is the default: a headless worker per conversation with mid-turn steering and background task cards — no CLI extension to install, but no tmux inspector for those sessions. <strong>Extension</strong> runs the Copilot CLI in a terminal session, which you can attach to with the tmux inspector. A relay where no engine was saved and that cannot run the SDK engine uses Extension. Applies whenever a conversation's worker starts; sessions already running keep their engine until their worker restarts.</div>
           </div>
         </div>
         <div
@@ -7825,7 +7887,7 @@
               <button id="cursor-dashboard-token-save-btn" type="button" class="summary-btn" onclick="saveCursorDashboardToken()">Save token</button>
               <button id="cursor-dashboard-token-remove-btn" type="button" class="summary-btn" onclick="removeCursorDashboardToken()">Remove</button>
             </div>
-            <div class="settings-help">Unlocks the live "Included in plan" percentage bars on Check Usage. Detected automatically from this machine's Cursor IDE login when one exists; paste the <code>WorkosCursorSessionToken</code> cookie from a logged-in cursor.com tab (DevTools → Application → Cookies) only for headless relay hosts or to use a different account. Headless hosts can also set <code>CURSOR_SESSION_TOKEN</code> in the relay environment. Tokens stay on the relay.</div>
+            <div class="settings-help">Unlocks the live percentage bars on Check Usage: "Plan usage (total)", "Auto + Composer" and "API". Detected automatically from this machine's Cursor IDE login when one exists; paste the <code>WorkosCursorSessionToken</code> cookie from a logged-in cursor.com tab (DevTools → Application → Cookies) only for headless relay hosts or to use a different account. Headless hosts can also set <code>CURSOR_SESSION_TOKEN</code> in the relay environment. Tokens stay on the relay.</div>
           </div>
         </div>
       </div>
@@ -7871,7 +7933,7 @@
             checked
           >
         </div>
-        <div class="settings-help" style="margin-top: 6px;">When off, agents on paired relays can still read sessions here, but cannot send prompts, start sessions, answer questions or stop turns. The relay token stays the real boundary: anyone holding it has full access.</div>
+        <div class="settings-help" style="margin-top: 6px;">When off, agents on paired relays can still list, read and wait on sessions here, but cannot send prompts, start sessions, answer questions, stop turns, cancel queued turns, archive or unarchive sessions, or watch sessions here for events. The relay token stays the real boundary: anyone holding it has full access.</div>
         <!-- Agent sessions (agent-sessions-settings-ui.js). Hidden until the relay
              answers with settings; a relay without the route never shows it. -->
         <div id="agent-sessions-section" hidden>
@@ -8073,6 +8135,10 @@
             <label for="push-event-host-suspend-toggle">Host suspend fired or was dropped</label>
             <input id="push-event-host-suspend-toggle" type="checkbox" onchange="updatePushPreferencesFromControls()" checked disabled>
           </div>
+          <div class="settings-row" style="width: 100%; margin-top: 6px; margin-bottom: 0;">
+            <label for="push-event-relay-restart-toggle">Queued relay restart waited its maximum time</label>
+            <input id="push-event-relay-restart-toggle" type="checkbox" onchange="updatePushPreferencesFromControls()" checked disabled>
+          </div>
           <label style="margin-top: 10px;">Devices</label>
           <div id="push-device-list" style="width: 100%;"></div>
           <div class="settings-help">Notifications are only sent while no device has the app in the foreground. Content defaults to generic text; message previews are opt-in per device.</div>
@@ -8251,11 +8317,16 @@
         <span id="task-console-stall" class="tc-stall" hidden></span>
         <button id="task-console-chip" class="bg-task-chip" type="button" hidden></button>
         <button id="task-console-failure" type="button" hidden>first failure</button>
+        <button id="task-console-earlier-top" type="button" hidden>Load earlier</button>
       </div>
     </div>
     <div id="task-console-scroll">
       <button id="task-console-earlier" type="button" hidden>Load earlier</button>
       <pre id="task-console-body"></pre>
+      <div id="task-console-hold" role="note" hidden>
+        <div class="tc-hold-text"></div>
+        <div class="tc-hold-hint"></div>
+      </div>
       <div id="task-console-status" hidden></div>
     </div>
     <button id="task-console-jump" type="button" hidden>Jump to end ↓</button>

package/server/relay-exit-codes.mjs

@@ -2,3 +2,9 @@
 
 // Intentional relay restart requested via authenticated localhost API.
 export const RELAY_RESTART_EXIT_CODE = 75;
+// The runtime stopped on purpose and starting it again at once cannot help:
+// its database needs a decision (adoptEarlierDatabase refused), or its data
+// folder cannot be made (ensureDataDirs). The supervisors do not retry it, so
+// its one line is said once; the code goes on to whatever started the relay.
+// 78 is sysexits' EX_CONFIG.
+export const RELAY_STOP_EXIT_CODE = 78;

package/server/relay-self-restart.mjs

@@ -1,6 +1,6 @@
 import { spawn } from 'child_process';
 import path from 'path';
-import { RELAY_RESTART_EXIT_CODE } from './relay-exit-codes.mjs';
+import { RELAY_RESTART_EXIT_CODE, RELAY_STOP_EXIT_CODE } from './relay-exit-codes.mjs';
 
 // Role selection travels on argv, never in the environment. The runtime's env is
 // inherited by tmux worker sessions and by the Copilot CLI it launches, and the
@@ -151,6 +151,11 @@ export async function runDirectRelaySupervisor({
         return await exitImpl(0);
       }
 
+      // Stopped on purpose, with its reason already said: not a crash.
+      if (exitCode === RELAY_STOP_EXIT_CODE) {
+        return await exitImpl(RELAY_STOP_EXIT_CODE);
+      }
+
       const attempt = crashCount + 1;
       logger?.error?.(`[relay] runtime crashed with exit code ${exitCode ?? 'null'} (crash ${attempt}/${maxCrashRestarts}).`);
       if (attempt >= maxCrashRestarts) {

package/server/relay-tools.md

@@ -2,46 +2,54 @@
 
 For any user-facing question or clarification, use the ask_user tool so the web relay can render question cards and buttons. Never ask questions in plain assistant text.
 
-When using ask_user, ALWAYS include a `choices` array with 2-6 answer options so the web relay can render clickable buttons. Example:
+When using ask_user, ALWAYS include a `choices` array with 2-8 answer options so the web relay can render clickable buttons. The relay keeps the first 8 choices and drops the rest. Example:
 ```json
 {
-  "question": "<QUIZ_QUESTION_TEXT>",
-  "choices": ["<CHOICE_A>", "<CHOICE_B>", "<CHOICE_C>", "<CHOICE_D>"]
+  "question": "The login test fails because the session cookie expires too early. How should I fix it?",
+  "choices": ["Fix the cookie lifetime in the code", "Update the test to match the code", "Leave it and only report it"]
 }
 ```
-At runtime, inject the question and choices from a random item in your quiz pool.
 Only omit choices when the question genuinely requires freeform text input (e.g., "What is your name?").
 
 When the user may pick several of the choices (they are not mutually exclusive), set `"multi_select": true` if your ask_user tool offers that field; otherwise begin the question with "Select all that apply:". Either way, expect an answer that lists several choices separated by ", ".
 
 In autopilot, still call ask_user when user input is truly blocking, because the relay bridge can surface the question even when the direct SDK question hook is bypassed.
 
-For relay restarts in extension-managed mode, require explicit user permission first, then use the authenticated localhost API `POST /api/relay/shutdown`. Do not restart by killing processes or using respawn scripts.
+For a relay restart or shutdown, require explicit user permission first, then use the authenticated localhost API `POST /api/relay/shutdown`. Do not restart by killing processes or using respawn scripts.
 
-Note: shutdown is queued and only completes when the current turn finishes, so it is pointless to wait for it to interrupt an active turn.
+Note: the request is queued. The relay only shuts down or restarts once no turn is running on it, your own included (after a maximum wait it asks the user), and it holds new messages until then, so end your turn instead of waiting for the restart. The answer names the sessions it waits for (`waitingFor`), the messages it holds (`held`) and the background tasks (`backgroundTasks`, each with whether it `survives`): tell the user.
 
 Use `restart: true` in the request body when the user wants a real relay restart rather than a plain shutdown. Example request body: `{ "reason": "manual-restart", "requestedBy": "localhost-api", "restart": true }`.
 
+Never pass `immediate` in that request body: it restarts without waiting for the running turns, which only the user may decide, with Restart now in the web UI.
+
+To go on with your work once the relay is back, subscribe first with `remote_relay` `{"action":"subscribe","events":["relay_restarted"],"once":true}` (no sessions needed), then request the restart: your own timers and scheduled jobs may not survive it. A restart requested while a turn that `relay_restarted` woke is still running does not wake that conversation (a `once` subscription ends with it).
+
 ## Preview servers
 
-Publish a local web server or a static directory on a public preview URL so the user can open it from any device, or list/close existing previews. Use this whenever the user wants to see, try, or share something with a web UI — never ask them to open localhost or forward a port. For a dev server: call this FIRST with {action:"create", port} to get the basePath, then start the server configured to serve under that basePath (Vite --base, Next basePath, Express mount prefix); the proxy forwards X-Forwarded-Prefix but does not rewrite bodies, so root-absolute asset paths will not work. For plain files or a build output: pass {action:"create", dir} instead and the relay serves the directory itself — no dev server needed. Always tell the user the returned URL and that the link is public: anyone who has it can reach the app without logging in. Publishing the same port or directory again in this conversation returns the same link. Previews never expire and survive a relay restart (a port preview until the machine reboots); close them with {action:"close"} when the user is done.
+Publish a local web server or a static directory on a public preview URL so the user can open it from any device, or list/close this conversation's previews. Use this whenever the user wants to see, try, or share something with a web UI — never ask them to open localhost or forward a port. For a dev server: call this FIRST with {action:"create", port} to get the basePath, then start the server configured to serve under that basePath (Vite --base, Next basePath, Express mount prefix); the proxy forwards X-Forwarded-Prefix but does not rewrite bodies, so root-absolute asset paths will not work. For plain files or a build output: pass {action:"create", dir} instead and the relay serves the directory itself — no dev server needed. Always tell the user the returned URL and that the link is public: anyone who has it can reach the app without logging in. Publishing the same port or directory again in this conversation returns the same link. Previews never expire and survive a relay restart (a port preview until the machine reboots); close them with {action:"close"} when the user is done.
 
-If you have a `preview` tool, use it. Otherwise use the authenticated localhost API (same auth as `POST /api/relay/shutdown`): `POST /api/previews` with `{ "conversationId": "<conv>", "port": 5173, "label": "web app" }` (or `"dir": "./dist"` instead of the port) publishes, `GET /api/previews` lists, `DELETE /api/previews/:token` closes the link without touching the dev server behind it. A 503 with `details` means the preview lane is disabled or misconfigured — surface those details, they are the operator's fix. See `docs/preview-servers.md`.
+If you have a `preview` tool, use it. Otherwise use the authenticated localhost API (same auth as `POST /api/relay/shutdown`): `POST /api/previews` with `{ "conversationId": "<conv>", "port": 5173, "label": "web app" }` (or `"dir": "./dist"` instead of the port) publishes, `GET /api/previews?conversationId=<conv>` lists this conversation's previews, `DELETE /api/previews/:token?conversationId=<conv>` closes one of them without touching the dev server behind it. Always pass the conversation: you may list and close only this conversation's previews, another conversation's is refused (403), and the relay-wide list is the user's (Settings → Previews). A 503 with `details` means the preview lane is disabled or misconfigured — surface those details, they are the operator's fix. See `docs/preview-servers.md`.
 
 ## Remote relays
 
 If you have a `remote_relay` tool, it works with sessions on OAR relays: the other relays this relay is paired with and, when its owner allows it, this relay itself. It lists and reads sessions, prompts a session, starts a new one and waits for its reply. Start with `{"action":"list_relays"}`.
 
-A paired relay stays locked until the user mentions it in this conversation (`@name` or its plain name); a locked relay refuses everything except `list_relays`, so ask the user to mention it rather than retrying. Use a paired relay only when the user asks for work there or mentions it.
+A paired relay stays locked until the user mentions it in this conversation (`@name` or its plain name) or an agent on that relay writes to this conversation; a locked relay refuses everything except `list_relays`, so ask the user to mention it rather than retrying. Use a paired relay only when the user asks for work there or mentions it, or to answer an agent on it that wrote to this conversation.
 
 This relay itself is listed with "self": true when its owner switched agent sessions on, and is addressed by its name or as "this"; it needs no mention. Use it to hand parts of your task to other sessions:
 
 - `create_session` starts a session with any provider that `relay_info` lists: a local one in a folder ("cwd"), or provider "claude-cloud" with "repo" (a GitHub URL or owner/repo) and an optional "branch". At most 4 sessions you started may work at the same time; a fifth is refused until one finishes.
 - The first `create_session` on this relay shows the user an approval card, once per conversation. A session that an agent created cannot create sessions itself (one level only).
 - Sessions you start here are grouped under this session in the user's sidebar. `list_sessions` lists in the sidebar's order (a group sorts by its newest session, head first) and shows the group as a "group" field (id, name, role); `read_session` adds the group's live members with their state. Agents only read groups, the user arranges them.
+- A "model" for `create_session` or `send` must be an id `relay_info` lists for the provider (Claude also takes "opus", "sonnet", "haiku"). An unknown id is refused with the close matches and the valid ids (`Unknown model 'gpt-5-4' for Copilot on relay "…"; did you mean 'gpt-5.4'? Valid ids: … Nothing was sent.`), and nothing is created or sent: pick from the list instead of guessing. If the answer has a "modelNote" saying the model could not be checked, the relay had no model list yet.
 - A new session knows nothing of this conversation: write a self-contained prompt. A Claude Cloud session works on a fresh clone in a sandbox at Anthropic, so name the branch it should work on and push.
 - Follow each session with `wait` (the message id comes back from `create_session` and `send`) and `read_session`; "wait_seconds" is limited to the maximum set on the relay (default 600).
 - Sessions run on the relay owner's accounts and cost their usage: start only what the task needs.
 - `read_task_output` ("session", "task_id" from `read_session`'s tasks, optional "lines") reads the end of a background shell or Monitor task's output, also for an hour after it ended: the last lines, minutes since its last output, and pass/fail counts for a test run. Credentials are scrubbed out.
 
+On this relay and on a paired one, `subscribe` ("sessions": ids, or ["all"]) wakes you when something happens in the sessions you watch, instead of polling them. Leave "events" out unless you need more: the default (question_asked, error, turn_end, subagent_finished, task_failed, stalled, all_idle) wakes you for questions, errors, replies, finished sub-agents, failed tasks (a non-zero exit included), stalls and all_idle, but not for each shell command that ended well. To get those too, pass that list plus "task_finished" (and "task_started" for the starts); each one costs you a turn, so do it only if you must follow every command. "relay_restarted" (this relay only, never in the default) wakes you when the relay runs again after a restart, with who requested it and why; named alone it needs no sessions.
+
+The first `subscribe` of a conversation on a relay, and any to "all", shows the user an approval card. `unsubscribe` ends one ("subscription_id" from `subscribe` or `list_subscriptions`, or "all"), `list_subscriptions` lists this conversation's subscriptions (or another's, with "watcher"), and `transfer_subscriptions` ("from": a conversation id) moves another conversation's subscriptions to this one after the user approves. `usage` shows what each provider plan of a relay has left and whether a Claude usage limit has paused turns there: check it before you start work that costs. `stop` stops a session's running turn and `archive` archives a session. The `remote_relay` tool's own description is the full reference for every action and field.
+
 Write actions may first wait for the user's approval. If a result lists `pendingQuestions`, the other agent is waiting for an answer: ask the user (unless they told you to decide), then pass it on with `answer_question`. Always tell the user which relay and session you worked on.

package/server/repositories/message-repository.mjs

@@ -18,6 +18,25 @@ export function createMessageRepository(db) {
     const notHeldForUsageLimit = (alias = '') => (queueHasUsageLimitPause
         ? `AND NOT (${alias}usage_limit_pause IS NOT NULL AND ${alias}status = 'pending' AND ${alias}next_attempt_at IS NOT NULL AND ${alias}next_attempt_at > strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))`
         : '');
+    // When a processing row is due for the stale sweep; one rule for the
+    // listings and the requeue, so the UPDATE can never take a row the
+    // listing did not. Inactivity is measured from the last heartbeat, the
+    // ceiling (@ceilingBefore, NULL = no limit) from the later of the turn's
+    // start and its last answered question, and a turn waiting on an
+    // unanswered question is never due. The comments at the statements say why.
+    const staleProcessingSql = `(
+              (
+                COALESCE(owner_last_claimed_at, processing_at, timestamp) < @inactiveBefore
+                OR (
+                  @ceilingBefore IS NOT NULL
+                  AND MAX(
+                    COALESCE(processing_at, timestamp),
+                    COALESCE((SELECT MAX(answered_at) FROM relay_questions WHERE queue_id = queue.id), '')
+                  ) < @ceilingBefore
+                )
+              )
+              AND id NOT IN (SELECT queue_id FROM relay_questions WHERE status = 'pending')
+            )`;
     const messageColumns = new Set(db.prepare(`PRAGMA table_info(messages)`).all().map((column) => column.name));
     const messagesHaveSourceId = messageColumns.has('source_message_id');
     const messagesHaveResendOf = messageColumns.has('resend_of_message_id');
@@ -37,6 +56,9 @@ export function createMessageRepository(db) {
         listPinnedMessages: messagePins.listPinnedMessages,
         countPinnedMessages: messagePins.countPinnedMessages,
         getLatestConversationModel: db.prepare(`SELECT model FROM messages WHERE conversation_id = ? AND model IS NOT NULL AND model != '' ORDER BY timestamp DESC LIMIT 1`),
+        // The model of the conversation's latest user turn: one of the
+        // fallbacks for a send that names no model.
+        getLatestUserMessageModel: db.prepare(`SELECT model FROM messages WHERE conversation_id = ? AND role = 'user' AND model IS NOT NULL AND model != '' ORDER BY timestamp DESC LIMIT 1`),
         getRecentMessagesDesc: db.prepare(`SELECT id, role, text, timestamp FROM messages WHERE conversation_id = ? ORDER BY timestamp DESC LIMIT ?`),
         insertMsg:      db.prepare(`INSERT INTO messages (id, conversation_id, role, text, model, mode, attachments, timestamp, model_requested, model_actual, model_origin) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`),
         // Provenance is derived from the authenticated responder identity at
@@ -366,18 +388,13 @@ export function createMessageRepository(db) {
           FROM queue
           WHERE status = 'processing'
             AND COALESCE(kind, '') != 'continuation'
-            AND (
-              COALESCE(owner_last_claimed_at, processing_at, timestamp) < @inactiveBefore
-              OR (
-                @ceilingBefore IS NOT NULL
-                AND MAX(
-                  COALESCE(processing_at, timestamp),
-                  COALESCE((SELECT MAX(answered_at) FROM relay_questions WHERE queue_id = queue.id), '')
-                ) < @ceilingBefore
-              )
-            )
-            AND id NOT IN (SELECT queue_id FROM relay_questions WHERE status = 'pending')
+            AND ${staleProcessingSql}
         `),
+        // Requeues one row listRecoverableProcessing returned, so the caller
+        // knows exactly which rows it requeued and announces only those. The
+        // sweep runs synchronously, so nothing changes between listing and
+        // requeue; re-checking the same rule here is a safeguard that keeps
+        // this statement from ever taking a row the listing would not.
         recoverProcessingBefore: db.prepare(`
           UPDATE queue
           SET status = 'pending',
@@ -387,14 +404,11 @@ export function createMessageRepository(db) {
               owner_lease_expires_at = NULL,
               owner_last_claimed_at = NULL,
               retry_count = retry_count + 1
-          WHERE status = 'processing'
+          WHERE id = @id
+            AND status = 'processing'
             AND COALESCE(kind, '') != 'continuation'
             AND consumed_at IS NULL
-            AND (
-              COALESCE(owner_last_claimed_at, processing_at, timestamp) < @inactiveBefore
-              OR (@ceilingBefore IS NOT NULL AND COALESCE(processing_at, timestamp) < @ceilingBefore)
-            )
-            AND id NOT IN (SELECT queue_id FROM relay_questions WHERE status = 'pending')
+            AND ${staleProcessingSql}
         `),
         // Dead-worker recovery: the owner's process is provably gone, so its
         // in-flight rows go back to pending — owner intact (the primer
@@ -464,17 +478,7 @@ export function createMessageRepository(db) {
           FROM queue
           WHERE status = 'processing'
             AND kind = 'continuation'
-            AND (
-              COALESCE(owner_last_claimed_at, processing_at, timestamp) < @inactiveBefore
-              OR (
-                @ceilingBefore IS NOT NULL
-                AND MAX(
-                  COALESCE(processing_at, timestamp),
-                  COALESCE((SELECT MAX(answered_at) FROM relay_questions WHERE queue_id = queue.id), '')
-                ) < @ceilingBefore
-              )
-            )
-            AND id NOT IN (SELECT queue_id FROM relay_questions WHERE status = 'pending')
+            AND ${staleProcessingSql}
         `),
         listQueueForPauseDrop: db.prepare(`SELECT id, conversation_id FROM queue WHERE status IN ('pending', 'processing', 'parked')`),
         // Authoritative "is a turn in flight" signal for the conversation list.

package/server/repositories/remote-relay-repository.mjs

@@ -27,7 +27,9 @@ function parseOrigin(json) {
 
 export function createRemoteRelayRepository(db) {
   const hasUnlock = db.prepare(`SELECT 1 FROM conversation_remote_relay_unlocks WHERE conversation_id = ? AND remote_relay_id = ?`);
-  const listUnlocks = db.prepare(`SELECT remote_relay_id, message_id, created_at FROM conversation_remote_relay_unlocks WHERE conversation_id = ? ORDER BY created_at ASC`);
+  // Two unlocks can share a millisecond (Windows' clock is coarse); the rowid
+  // keeps them in the order they were recorded rather than by relay id.
+  const listUnlocks = db.prepare(`SELECT remote_relay_id, message_id, created_at FROM conversation_remote_relay_unlocks WHERE conversation_id = ? ORDER BY created_at ASC, rowid ASC`);
   const insertUnlock = db.prepare(`INSERT OR IGNORE INTO conversation_remote_relay_unlocks (conversation_id, remote_relay_id, message_id, created_at) VALUES (?, ?, ?, ?)`);
   // The relay's unlocks and the approvals stored under its id (`<id>:watch`).
   const deleteUnlocksForRelay = db.prepare(`
@@ -64,7 +66,7 @@ export function createRemoteRelayRepository(db) {
     hasUnlock(conversationId, remoteRelayId) {
       return !!hasUnlock.get(String(conversationId || ''), String(remoteRelayId || ''));
     },
-    /** `[{ remoteRelayId, messageId, createdAt }]`, oldest first. */
+    /** `[{ remoteRelayId, messageId, createdAt }]`, oldest first, ties in the order recorded. */
     listUnlocks(conversationId) {
       return listUnlocks.all(String(conversationId || '')).map((row) => ({
         remoteRelayId: row.remote_relay_id,

package/server/repositories/subagent-timeline-statements.mjs

@@ -47,6 +47,8 @@ export function createSubagentTimelineStatements(db) {
     // The column list every run read uses, so the header travels with the
     // run wherever runs are listed (conversation payload, in-flight snapshot).
     subagentRunSelectColumns,
+    // A run that runs again (a resumed agent): no end time while it runs.
+    reopenSubagentRun: db.prepare(`UPDATE subagent_runs SET status = 'running', updated_at = ?, completed_at = NULL WHERE id = ?`),
     updateSubagentRunHeader: null,
     setSubagentRunTruncated: null,
     listChildSubagentRuns: null,

package/server/routes/ask-user-routes.mjs

@@ -3,6 +3,7 @@
 import { createAskUserRoutingService } from '../services/ask-user-routing-service.mjs';
 import { admitRemoteRelayRequest, readRemoteRelayRequest } from '../services/remote-relay-inbound.mjs';
 import { isRemoteRelayApprovalQuestion } from '../../shared/remote-relay-contract.mjs';
+import { closedQuestionAnswer, questionAcceptsFreeText } from '../../shared/question-answer-rule.mjs';
 import {
   extractRequestedSchema,
   normalizeSchema,
@@ -35,19 +36,39 @@ function firstKnownValue(source, keyPaths = []) {
   return null;
 }
 
+function parseRowJson(value) {
+  try {
+    return JSON.parse(String(value || ''));
+  } catch {
+    return null;
+  }
+}
+
 /**
  * A stored question row that is this relay's Allow / Deny card for one of its
  * own agent's calls to another relay (remote-relay-caller-context.mjs). The
  * context lives in the row's request envelope.
  */
 function isRemoteRelayApprovalRow(row) {
-  let envelope = null;
-  try {
-    envelope = JSON.parse(String(row?.request || ''));
-  } catch {
-    return false;
-  }
-  return isRemoteRelayApprovalQuestion(envelope);
+  const envelope = parseRowJson(row?.request);
+  return envelope ? isRemoteRelayApprovalQuestion(envelope) : false;
+}
+
+/**
+ * The choices of a stored card that takes no typed text (approval and
+ * permission cards, and a card with choices that stored no flag, as the
+ * runtime's formatQuestionRow reads it for the card view), or null for a
+ * card that takes any reply.
+ */
+function closedQuestionOfRow(row) {
+  const envelope = parseRowJson(row?.request);
+  const parsedChoices = parseRowJson(row?.choices);
+  const choices = Array.isArray(parsedChoices) ? parsedChoices.map((choice) => String(choice ?? '')) : [];
+  const allowFreeform = envelope && typeof envelope === 'object' && typeof envelope.allowFreeform === 'boolean'
+    ? envelope.allowFreeform
+    : null;
+  if (questionAcceptsFreeText({ allowFreeform, choices })) return null;
+  return { choices, multiSelect: envelope?.context?.multiSelect === true };
 }
 
 function extractContinuationOwnership(rawRequest) {
@@ -297,6 +318,19 @@ export function registerAskUserRoutes(app, deps) {
       flatText = summarizeStructuredAnswer(schema, structured) || flatText;
     } else if (!flatText) {
       return res.status(400).json({ error: 'Empty answer' });
+    } else {
+      // A card that takes no typed text is answered by its choices only.
+      // Anything else is refused and the card stays open: it must not pass
+      // for an answer (an approval reader would take it for a denial).
+      const closed = closedQuestionOfRow(row);
+      if (closed) {
+        const accepted = closedQuestionAnswer(closed, flatText);
+        if (!accepted) {
+          console.warn(`[${ts()}] QUESTION  reject id=${id.slice(0, 8)} reason=not-a-choice`);
+          return res.status(400).json({ error: 'This question takes one of its choices, not typed text', choices: closed.choices });
+        }
+        flatText = accepted;
+      }
     }
 
     const result = askUserRoutingService.routeAnswer({