@oar-sh/oar 0.9.20 → 0.9.21

package/server/claude-cloud-worker/claude-cloud-session-process.mjs

@@ -178,6 +178,18 @@ export function createClaudeCloudSessionRunner({
   // Background work is over and nothing has moved for this long: ask the
   // session whether the agent is still going to say something.
   backgroundQuietMs = 45_000,
+  // Between turns, while the cloud may still be working on something no
+  // relay turn owns (its last known status was not idle, or a turn ended here
+  // without its `result`), the session is read again this often: the relay
+  // waits on that answer before it replaces this worker (releaseHold).
+  statusRecheckMs = 20_000,
+  // A session that stays not idle this long is no longer read (one warning
+  // line); the next delivery starts the reads again. The hold stays: the
+  // relay does not replace a worker whose session it last saw working.
+  statusRecheckGiveUpMs = 2 * 60 * 60_000,
+  // How often the stored binding is asked for again at start when the relay
+  // does not answer (attachOnStart); three tries in all.
+  bindingRetryMs = 5_000,
 } = {}) {
   const publisher = createClaudeTurnPublisher({ api, dbg });
   // The account's usage limit as the sandbox's Claude Code reports it: the
@@ -211,10 +223,23 @@ export function createClaudeCloudSessionRunner({
   // - `attributionRequestId`: the request whose answer is still to come.
   // - `model`: the model this process last gave the sandbox (the create's,
   //   or a later set_model); undefined while it does not know.
+  // - `workerStatus`: the session's `worker_status` at the last read of it
+  //   ('idle' when the cloud has nothing running), null while unknown.
   let session = null;
   let turn = null;
   let stream = null;
   let idleTimer = null;
+  let statusTimer = null;
+  // A read of the session between turns that may attach it (syncSession):
+  // a delivery waits for it, so the two never read the log at once.
+  let pendingSync = null;
+  // When the current run of status rechecks began (null: none runs), and
+  // whether it was given up (statusRecheckGiveUpMs).
+  let recheckSince = null;
+  let recheckGivenUp = false;
+  // A turn the session started by itself is being registered with the relay.
+  let openingStrayTurn = false;
+  let disposed = false;
   // Events are handled one at a time and in order; posting a user message
   // takes a place in the same line, so no event of the turn it starts is
   // looked at before the turn's start is known.
@@ -249,6 +274,7 @@ export function createClaudeCloudSessionRunner({
       attribution: undefined,
       attributionRequestId: null,
       model: undefined,
+      workerStatus: null,
     };
   }
 
@@ -275,6 +301,33 @@ export function createClaudeCloudSessionRunner({
     return Boolean(turn);
   }
 
+  /**
+   * Why the relay may not stop this worker and launch a fresh one now, or ''
+   * when it may (the hold names of the relay's STEERING_RELEASE_HOLDS):
+   * - 'turn': a turn runs here, delivered or one the session started itself
+   *   (from the moment the relay is asked for its row).
+   * - 'background': no turn runs here, but the cloud may still be working on
+   *   one: a turn that ended here without its `result` (a Stop the cloud did
+   *   not confirm, the background-hold ceiling, a turn the relay would not
+   *   register), or a session whose last known status is not idle. A worker
+   *   replaced then would lose what that work still writes: the count lives
+   *   only in this process, and a fresh one reads on from the stored cursor
+   *   as if nothing were running.
+   * A session this process has not read yet holds nothing.
+   */
+  function releaseHold() {
+    if (turn || openingStrayTurn) return 'turn';
+    if (!session) return '';
+    if (session.unfinishedTurns > 0) return 'background';
+    if (session.workerStatus && session.workerStatus !== 'idle') return 'background';
+    return '';
+  }
+
+  /** Remember what a read of the session said about the cloud's work. */
+  function noteSessionRead(workerStatus) {
+    if (session) session.workerStatus = workerStatus || null;
+  }
+
   // ---------------------------------------------------------------------------
   // Relay-facing publishing
 
@@ -456,6 +509,7 @@ export function createClaudeCloudSessionRunner({
         let workerStatus = '';
         try {
           ({ workerStatus } = readCloudSessionUsage(await withTimeout(cloud.getSession(session.id), sessionReadTimeoutMs)));
+          noteSessionRead(workerStatus);
         } catch (error) {
           dbg('cloud session read failed', error?.message || String(error));
         }
@@ -532,6 +586,9 @@ export function createClaudeCloudSessionRunner({
     if (!response?.messageId) {
       dbg('stray cloud turn not registered; skipping it until its result');
       session.unfinishedTurns += 1;
+      // No turn here will end the wait on its `result`; the session's
+      // status will.
+      scheduleStatusRecheck();
       return null;
     }
     const message = {
@@ -569,6 +626,7 @@ export function createClaudeCloudSessionRunner({
         endTurn(t);
         if (turn === t) turn = null;
         scheduleIdleClose();
+        scheduleStatusRecheck();
       }
     })();
     return t;
@@ -592,7 +650,14 @@ export function createClaudeCloudSessionRunner({
     // continuation of its own, so the chat shows it.
     if (!t && session.attached && sequence !== null && session.unfinishedTurns === 0
       && sequence > session.cursorSeq && startsStrayTurn(event, payload, type)) {
-      t = await openStrayTurn(sequence, payload, type);
+      // The relay is asked for a row first: the turn runs already, and the
+      // release holds meanwhile as it will once the row is there.
+      openingStrayTurn = true;
+      try {
+        t = await openStrayTurn(sequence, payload, type);
+      } finally {
+        openingStrayTurn = false;
+      }
       if (!t) return;
     }
 
@@ -963,12 +1028,159 @@ export function createClaudeCloudSessionRunner({
   async function confirmUnfinishedTurns() {
     try {
       const { workerStatus } = readCloudSessionUsage(await withTimeout(cloud.getSession(session.id), sessionReadTimeoutMs));
+      noteSessionRead(workerStatus);
       if (workerStatus === 'idle') session.unfinishedTurns = 0;
     } catch (error) {
       dbg('cloud session read failed', error?.message || String(error));
     }
   }
 
+  // ---------------------------------------------------------------------------
+  // Between turns: the session's status, and the attach at start
+
+  /**
+   * The session's status, read once (bounded); null when the read failed, in
+   * which case what was known before stays.
+   */
+  async function readWorkerStatus() {
+    try {
+      const { workerStatus } = readCloudSessionUsage(await withTimeout(cloud.getSession(session.id), sessionReadTimeoutMs));
+      noteSessionRead(workerStatus);
+      return workerStatus || null;
+    } catch (error) {
+      dbg('cloud session read failed', error?.message || String(error));
+      return null;
+    }
+  }
+
+  /**
+   * Read the session again later while it holds the release with no turn
+   * here to end the wait (a turn's end schedules this itself), or while the
+   * session bound at start is not attached yet.
+   */
+  function scheduleStatusRecheck() {
+    if (statusTimer || disposed || !session || turn) return;
+    if (session.attached && !releaseHold()) {
+      recheckSince = null;
+      return;
+    }
+    if (recheckGivenUp) return;
+    if (recheckSince === null) {
+      recheckSince = now();
+    } else if (now() - recheckSince >= statusRecheckGiveUpMs) {
+      // Not forever: a session stuck in a working state would be read every
+      // statusRecheckMs for the life of the worker.
+      recheckGivenUp = true;
+      dbg(
+        `warning: the cloud session has not been idle for ${Math.round(statusRecheckGiveUpMs / 60_000)} min;`,
+        'no more status reads until the next delivery, and the relay does not replace this worker meanwhile',
+      );
+      return;
+    }
+    statusTimer = setTimeoutImpl(() => {
+      statusTimer = null;
+      void syncSession();
+    }, statusRecheckMs);
+    statusTimer?.unref?.();
+  }
+
+  function clearStatusRecheck() {
+    if (statusTimer) clearTimeoutImpl(statusTimer);
+    statusTimer = null;
+  }
+
+  /**
+   * Between turns: read the session, and act on an idle one. An idle cloud
+   * has no `result` left to send, so the turns that ended here without one
+   * are done with (as confirmUnfinishedTurns does before a send). An idle
+   * session bound at start but not attached yet is read on from the stored
+   * cursor up to now and its stream opened, so a turn the session starts by
+   * itself from here on is followed as a continuation, as the worker before
+   * this one did. A session that is working is not attached: the turn it
+   * runs may be a delivered one a dead worker left behind, which the relay
+   * delivers again and the delivery follows from the log (catchUp); taken
+   * for a turn of the session's own, it would be published twice.
+   * A delivery waits for this (pendingSync).
+   */
+  function syncSession() {
+    if (pendingSync) return pendingSync;
+    if (disposed || !session || turn || openingStrayTurn) return Promise.resolve(false);
+    const run = (async () => {
+      let attachedNow = false;
+      const status = await readWorkerStatus();
+      if (!disposed && session && !turn && status === 'idle') {
+        session.unfinishedTurns = 0;
+        if (!session.attached) {
+          await catchUp();
+          if (!disposed && session && !session.attached) {
+            session.attached = true;
+            ensureStream();
+            attachedNow = true;
+            dbg('cloud event stream opened between turns', `after=${session.lastSeq}`);
+          }
+        }
+      }
+      return attachedNow;
+    })();
+    pendingSync = run
+      .catch((error) => {
+        dbg('cloud session sync failed', error?.message || String(error));
+        return false;
+      })
+      .finally(() => {
+        pendingSync = null;
+        scheduleStatusRecheck();
+      });
+    return pendingSync;
+  }
+
+  /** The binding the relay stores for this conversation, or null. */
+  async function readStoredBinding() {
+    const routePath = `/api/claude-cloud-session?conversationId=${encodeURIComponent(sdkSessionId)}`;
+    for (let attempt = 1; ; attempt += 1) {
+      try {
+        return await api('GET', routePath);
+      } catch (error) {
+        // A relay without the route answers 404 for good: the first delivery
+        // binds the session, as before.
+        if (Number(error?.status) === 404 || attempt >= 3 || disposed) {
+          dbg('stored cloud session not read', error?.message || String(error));
+          return null;
+        }
+        await sleep(bindingRetryMs);
+      }
+    }
+  }
+
+  /**
+   * At worker start: bind the cloud session the relay stores for this
+   * conversation and open its event stream from the stored cursor, before
+   * any delivery. The worker this one replaces kept its stream open for its
+   * whole life (idleCloseMs = 0) and so mirrored the turns the session
+   * starts by itself (a message sent on claude.ai, the agent's closing turn
+   * after background work); without this a fresh worker would see none of
+   * them until its first delivery. A conversation with no cloud session yet
+   * has nothing to attach: its first delivery creates one. A session that is
+   * working at start is read again every statusRecheckMs and attached once
+   * idle (syncSession says why not before).
+   *
+   * Resolves true when the stream was opened.
+   */
+  async function attachOnStart() {
+    if (session || turn || disposed || pendingSync) return false;
+    const run = (async () => {
+      const binding = await readStoredBinding();
+      const id = String(binding?.sessionId || '').trim();
+      if (!id || session || disposed) return false;
+      session = newSession(id, { cursor: toCloudSequence(binding.lastSequence) ?? 0 });
+      return true;
+    })();
+    // A delivery that arrives meanwhile waits until the binding is known.
+    pendingSync = run.catch(() => false).finally(() => { pendingSync = null; });
+    if (!await pendingSync) return false;
+    return syncSession();
+  }
+
   /**
    * Before a message goes into a session that exists: hand the sandbox the
    * commit attribution the relay delivered, unless this process already did.
@@ -1173,6 +1385,7 @@ export function createClaudeCloudSessionRunner({
       dbg('cloud session read failed', error?.message || String(error));
     }
     if (usage.sessionUrl) session.url = usage.sessionUrl;
+    if (usage.workerStatus !== undefined) noteSessionRead(usage.workerStatus);
     const costUsd = usage.costUsd ?? state.result?.totalCostUsd ?? null;
     await reportSession(message, {
       ...(costUsd !== null ? { costUsd } : {}),
@@ -1318,7 +1531,19 @@ export function createClaudeCloudSessionRunner({
       dbg('turn already active; rejecting concurrent deliver', message.id);
       return false;
     }
+    // The session is being read between turns (the attach at start, or a
+    // status check): this delivery binds and reads it after that, never
+    // beside it. A turn the session started meanwhile takes precedence.
+    while (pendingSync) await pendingSync;
+    if (turn) {
+      dbg('turn already active; rejecting concurrent deliver', message.id);
+      return false;
+    }
     clearIdleClose();
+    clearStatusRecheck();
+    // A delivery starts the status reads afresh, also after they were given up.
+    recheckSince = null;
+    recheckGivenUp = false;
     const t = openTurn(message);
     const relayHoldMs = Number(pending?.settings?.backgroundTaskTimeoutMs);
     if (Number.isFinite(relayHoldMs) && relayHoldMs > 0) t.holdMs = relayHoldMs;
@@ -1337,11 +1562,14 @@ export function createClaudeCloudSessionRunner({
       endTurn(t);
       turn = null;
       scheduleIdleClose();
+      scheduleStatusRecheck();
     }
   }
 
   async function dispose() {
+    disposed = true;
     clearIdleClose();
+    clearStatusRecheck();
     if (turn) endTurn(turn);
     const entry = stream;
     stream = null;
@@ -1353,6 +1581,8 @@ export function createClaudeCloudSessionRunner({
     getActiveQueueMessageId,
     getActiveQueueAttempt,
     isTurnActive,
+    releaseHold,
+    attachOnStart,
     dispose,
   };
 }

package/server/claude-cloud-worker/claude-cloud-session-worker.mjs

@@ -14,6 +14,7 @@ import {
 import { createApiClient } from '../../shared/worker-runtime/api-client.mjs';
 import { createWorkerWebSocketLink } from '../../shared/worker-runtime/worker-websocket-link.mjs';
 import { createHeartbeatController } from '../../shared/worker-runtime/heartbeat.mjs';
+import { resolveBuildId } from '../../shared/build-id.mjs';
 import { installWorkerLogFile } from '../../shared/worker-runtime/worker-log-file.mjs';
 import { createControlPoller } from '../../shared/control-poller.mjs';
 import { installWorkerCrashGuard } from '../../shared/worker-crash-guard.mjs';
@@ -21,6 +22,7 @@ import { createClaudeCloudCredentials } from '../../shared/claude-cloud/credenti
 import { createClaudeCloudClient } from '../../shared/claude-cloud/api-client.mjs';
 import { resolveClaudeCloudBaseUrl } from '../../shared/claude-cloud/base-url.mjs';
 import { createClaudeCloudSessionRunner } from './claude-cloud-session-process.mjs';
+import { buildClaudeCloudSteeringState } from './claude-cloud-worker-steering.mjs';
 
 // Windows console launch: the launcher names the worker log, this copies
 // stdout/stderr into it. A no-op wherever the launcher redirects instead.
@@ -51,6 +53,10 @@ async function main() {
 
   const configPath = String(process.env.COPILOT_WEB_RELAY_CONFIG || '').trim()
     || path.resolve(__dirname, '..', 'config.json');
+  // The code this process started on, read once from the repo root and kept
+  // for its whole life: the relay recycles a worker whose build differs from
+  // its own, and a tree that moves on under us must not change our answer.
+  const buildId = resolveBuildId(path.resolve(__dirname, '..', '..')).id;
   const serverUrl = resolveRelayServerUrl({ configPath });
   const token = loadTokenFromConfig(configPath);
   const defaultModel = String(process.env.CLAUDE_CLOUD_RELAY_MODEL || '').trim();
@@ -101,17 +107,28 @@ async function main() {
   let heartbeatTimer = null;
   const heartbeat = createHeartbeatController({
     api,
+    buildId,
     pollMs: HEARTBEAT_MS,
     getSessionReady: () => true,
     getHeartbeatTimer: () => heartbeatTimer,
     setHeartbeatTimer: (timer) => { heartbeatTimer = timer; },
     getActiveQueueMessageId: () => runner.getActiveQueueMessageId(),
+    // No steering here; the snapshot tells the relay when it may replace
+    // this worker: between turns, with no turn that ended here without its
+    // result, and with the cloud session idle at its last read. Anything else
+    // is cloud work whose output only this process would still publish. The
+    // cloud session lives on in the cloud; the fresh worker binds it at start
+    // and re-opens its event stream from the cursor the relay stores
+    // (runner.attachOnStart below), so the turns the session starts by
+    // itself are still followed.
+    getSteeringState: () => buildClaudeCloudSteeringState(runner),
   });
 
   const wsLink = createWorkerWebSocketLink({
     serverUrl,
     token,
     dbg,
+    buildId,
     getSessionReady: () => true,
     getSessionId: () => sdkSessionId,
     getPid: () => process.pid,
@@ -144,9 +161,13 @@ async function main() {
     getActiveQueueMessageIds: () => [runner.getActiveQueueAttempt()],
   });
 
-  dbg(`starting session=${sdkSessionId.slice(0, 8)} server=${serverUrl} model=${defaultModel || 'default'}`);
+  dbg(`starting session=${sdkSessionId.slice(0, 8)} server=${serverUrl} model=${defaultModel || 'default'} build=${buildId || 'unknown'}`);
   heartbeat.startHeartbeat();
   wsLink.start();
+  // Not awaited: deliveries wait for it inside the runner, and a relay that
+  // cannot say which cloud session this is leaves the binding to the first
+  // delivery, as before.
+  runner.attachOnStart().catch((error) => dbg('cloud session attach at start failed', error?.message || String(error)));
 }
 
 main().catch((error) => {

package/server/claude-cloud-worker/claude-cloud-worker-steering.mjs

@@ -0,0 +1,34 @@
+/**
+ * The heartbeat steering snapshot of the Claude Cloud worker. It steers
+ * nothing (`supported: false`, so the composer offers no mid-turn steering and
+ * reads neither the hold nor the cancellable ids); it is sent for the release
+ * fields, which tell the relay whether it may stop this worker and launch a
+ * fresh one now (its recycle after a deploy).
+ *
+ * The rule is the runner's (`releaseHold()` in claude-cloud-session-process.mjs):
+ * not while a turn runs here, not while a turn that ended here without its
+ * `result` may still run in the cloud, and not while the cloud session's last
+ * known status is not idle. The generic snapshot of the other small mains
+ * (shared/worker-runtime/simple-steering-state.mjs) knows only the turn; the
+ * cloud session can be busy with no relay turn at all.
+ *
+ * `runner` is the object createClaudeCloudSessionRunner returns.
+ */
+export function buildClaudeCloudSteeringState(runner) {
+  const attempt = runner?.getActiveQueueAttempt?.() || null;
+  const messageId = String(attempt?.id || '').trim() || null;
+  const turnActive = runner?.isTurnActive?.() === true || Boolean(messageId);
+  // A runner without the hold function still never says yes mid-turn.
+  const hold = String(runner?.releaseHold?.() || '').trim() || (turnActive ? 'turn' : '');
+  return {
+    turnActive,
+    canSteer: false,
+    holdReason: null,
+    messageId,
+    supported: false,
+    cancellableIds: [],
+    releasable: !hold,
+    releaseHold: hold || null,
+    backgroundTaskCount: 0,
+  };
+}

package/server/claude-worker/claude-session-process.mjs

@@ -4250,11 +4250,17 @@ export function createClaudeSessionRunner({
     // `releasable`: the relay may replace this worker now (a billing swap):
     // no CLI process and no delivery on its way in, or a process
     // canReleaseForRespawn would let go of.
+    // `cliAlive`: the CLI child is still up. The relay's recycle replaces a
+    // stale worker only once it is releasable AND its CLI is gone; a
+    // releasable worker whose CLI is up sits in the idle window, where a
+    // scheduled job may still wake it, and is left to its own idle-out. A
+    // closing process is not gone yet, so it still counts as alive.
     if (!proc || proc.closing || proc.aborted) {
       const admitting = admittingDeliveries > 0;
       return {
         turnActive: false, canSteer: false, holdReason: null, messageId: null, supported: true, autoCompactWindow: null,
         releasable: !admitting, releaseHold: admitting ? 'turn' : null, backgroundTaskCount: 0,
+        cliAlive: Boolean(proc),
       };
     }
     const ctx = proc.activeCtx || null;
@@ -4293,6 +4299,7 @@ export function createClaudeSessionRunner({
       releasable: !hold,
       releaseHold: hold || null,
       backgroundTaskCount: proc.liveTasks.size,
+      cliAlive: true,
     };
   }
 

package/server/claude-worker/claude-session-worker-main.mjs

@@ -14,6 +14,7 @@ import {
 import { createApiClient } from '../../shared/worker-runtime/api-client.mjs';
 import { createWorkerWebSocketLink } from '../../shared/worker-runtime/worker-websocket-link.mjs';
 import { createHeartbeatController } from '../../shared/worker-runtime/heartbeat.mjs';
+import { resolveBuildId } from '../../shared/build-id.mjs';
 import { createControlPoller } from '../../shared/control-poller.mjs';
 import { resolveDeliveredAutoCompactWindow } from '../../shared/auto-compact-window.mjs';
 import { resolveDeliveredThinking } from '../../shared/claude-thinking.mjs';
@@ -59,6 +60,10 @@ export async function runClaudeSessionWorker({
 
   const configPath = String(process.env.COPILOT_WEB_RELAY_CONFIG || '').trim()
     || path.resolve(__dirname, '..', 'config.json');
+  // The code this process started on, read once from the repo root and kept
+  // for its whole life: the relay recycles a worker whose build differs from
+  // its own, and a tree that moves on under us must not change our answer.
+  const buildId = resolveBuildId(path.resolve(__dirname, '..', '..')).id;
   const serverUrl = resolveRelayServerUrl({ configPath });
   const token = loadTokenFromConfig(configPath);
   const cwd = String(process.env.COPILOT_WORKSPACE_ROOT || '').trim() || process.cwd();
@@ -143,6 +148,7 @@ export async function runClaudeSessionWorker({
   let heartbeatTimer = null;
   heartbeat = createHeartbeatController({
     api,
+    buildId,
     // What this worker runs on: the relay hands it only rows of that billing.
     workerKind: turnRunner.workerKind,
     pollMs: HEARTBEAT_MS,
@@ -191,6 +197,7 @@ export async function runClaudeSessionWorker({
     getSessionId: () => sdkSessionId,
     getPid: () => process.pid,
     workerKind: turnRunner.workerKind,
+    buildId,
     onDeliver: async (pending, reason) => {
       dbg('queue.deliver received', `reason=${reason}`, `msgId=${pending?.message?.id || 'none'}`);
       const deliveredTimeout = Number(pending?.settings?.backgroundTaskTimeoutMs);
@@ -263,7 +270,7 @@ export async function runClaudeSessionWorker({
     onBeforeExit: () => { try { turnRunner.shutdown({ graceful: false }); } catch {} },
   });
 
-  dbg(`starting session=${sdkSessionId.slice(0, 8)} server=${serverUrl} cwd=${cwd} model=${defaultModel || 'default'}${backend ? ` backend=${backend.id}` : ''}`);
+  dbg(`starting session=${sdkSessionId.slice(0, 8)} server=${serverUrl} cwd=${cwd} model=${defaultModel || 'default'}${backend ? ` backend=${backend.id}` : ''} build=${buildId || 'unknown'}`);
   heartbeat.startHeartbeat();
   wsLink.start();
 }

package/server/copilot-worker/copilot-sdk-session-process.mjs

@@ -709,6 +709,12 @@ export function createCopilotSdkSessionRunner({
   // card), so they hold the stall watchdog and the idle shutdown too — but
   // not steering: nobody is answering a card here.
   let pendingRelayToolCalls = 0;
+  // Deliveries `handlePendingPayload` is still working on. Most become (or
+  // steer into) `activeTurn` at once, but a steer that waits on the turn's
+  // send, its row or the relay context can find the turn gone and open its
+  // own afterwards: in that gap no turn exists, and the worker must still
+  // not read as replaceable (`releaseHold`).
+  let admittingDeliveries = 0;
   // `relay_tool` is registered only while this relay has paired remotes.
   // Asked once when the worker starts; a session build waits for that first
   // answer (it is async anyway), and every runtime stop asks again so the
@@ -4739,7 +4745,62 @@ export function createCopilotSdkSessionRunner({
     const canSteer = canAcceptSteering();
     const holdReason = turnActive && !canSteer ? steeringHoldReason(turn) : null;
     const messageId = String(turn?.currentOwner?.message?.id || turn?.message?.id || '').trim() || null;
-    return { turnActive, canSteer, holdReason, messageId, supported: true, cancellableIds: cancellableIds() };
+    // `releasable`: the relay may stop this worker and launch a fresh one now
+    // (its recycle after a deploy), the same fields the Claude worker sends.
+    const hold = releaseHold();
+    return {
+      turnActive,
+      canSteer,
+      holdReason,
+      messageId,
+      supported: true,
+      cancellableIds: cancellableIds(),
+      releasable: !hold,
+      releaseHold: hold || null,
+      // As the task panel counts them: with the registry it is the truth, and
+      // the event-scraped shell set would count its shells a second time.
+      backgroundTaskCount: sessionRpc.tasks ? backgroundTasks.size : backgroundShells.size(),
+      // The runtime process (the CLI child) is up: a client or a session
+      // handle exists until `stopRuntime` clears both. The relay's recycle
+      // replaces a stale worker only once it is releasable AND this is false;
+      // releasable with the runtime up is the idle window, left to the idle
+      // shutdown.
+      cliAlive: Boolean(client || session),
+    };
+  }
+
+  /**
+   * What keeps this worker from being replaced now ('' when nothing does):
+   * the idle shutdown's gates (`evaluateLifecycle`) and the runtime tree's
+   * busy check, named with the relay's hold words. Stopping the worker ends
+   * the runtime, and with it the turn, the card a human is answering, a
+   * compaction, and every background shell and agent.
+   *
+   *  - 'question': a question card or an ask-mode approval is open;
+   *  - 'compaction': the runtime is compacting the session;
+   *  - 'turn': a turn is running or still publishing its rows, a `relay_tool`
+   *    call is out, an image row is on the relay's image routes, or a
+   *    delivery is on its way in;
+   *  - 'background': a background shell or agent is live, a settled shell's
+   *    continuation is due (`continuationGraceMs`), a registry read is due
+   *    or under way, or the task registry has failed to answer: in the last
+   *    two "nothing is running" is not known (`backgroundWorkHoldsRuntime`
+   *    holds the runtime on the same grounds).
+   */
+  function releaseHold() {
+    if (pendingHumanRequests > 0) return 'question';
+    if (isCompacting()) return 'compaction';
+    if (
+      activeTurn || publishingTurns.size > 0 || pendingRelayToolCalls > 0
+      || directImageMessages.size > 0 || admittingDeliveries > 0
+    ) return 'turn';
+    if (backgroundShells.size() > 0 || backgroundTasks.size > 0) return 'background';
+    if (continuationDueSince && Date.now() - continuationDueSince < continuationGraceMs) return 'background';
+    // A read of the registry that is debounced, queued or on its way may
+    // still find a live agent or shell the last answer did not have.
+    if (sessionRpc.tasks && (taskRefreshTimer || taskRefreshQueued > 0 || taskRefreshInFlight)) return 'background';
+    if (sessionRpc.tasks && taskRefreshFailures > 0 && taskRefreshFailures < MAX_TASK_REFRESH_FAILURES) return 'background';
+    return '';
   }
 
   /**
@@ -4883,6 +4944,18 @@ export function createCopilotSdkSessionRunner({
   }
 
   async function handlePendingPayload(pending) {
+    // A payload without a message is refused at once, as it always was: it
+    // admits nothing.
+    if (!pending?.message) return false;
+    admittingDeliveries += 1;
+    try {
+      return await admitPendingPayload(pending);
+    } finally {
+      admittingDeliveries -= 1;
+    }
+  }
+
+  async function admitPendingPayload(pending) {
     const message = pending?.message || null;
     if (!message) return false;
     // An image model is no chat model: its row goes to the relay's image

package/server/copilot-worker/copilot-sdk-session-worker.mjs

@@ -20,6 +20,7 @@ import {
 import { createApiClient } from '../../shared/worker-runtime/api-client.mjs';
 import { createWorkerWebSocketLink } from '../../shared/worker-runtime/worker-websocket-link.mjs';
 import { createHeartbeatController } from '../../shared/worker-runtime/heartbeat.mjs';
+import { resolveBuildId } from '../../shared/build-id.mjs';
 import { installWorkerLogFile } from '../../shared/worker-runtime/worker-log-file.mjs';
 import {
   createRunnerLinkBridge,
@@ -52,6 +53,10 @@ async function main() {
 
   const configPath = String(process.env.COPILOT_WEB_RELAY_CONFIG || '').trim()
     || path.resolve(__dirname, '..', 'config.json');
+  // The code this process started on, read once from the repo root and kept
+  // for its whole life: the relay recycles a worker whose build differs from
+  // its own, and a tree that moves on under us must not change our answer.
+  const buildId = resolveBuildId(path.resolve(__dirname, '..', '..')).id;
   // Two reads of the same small file. Collapsing them to one would mean
   // re-implementing `resolveRelayServerUrl`'s env override, host
   // normalisation and port defaulting inside this worker — a live contract
@@ -129,6 +134,7 @@ async function main() {
   let heartbeatTimer = null;
   heartbeat = createHeartbeatController({
     api,
+    buildId,
     pollMs: HEARTBEAT_MS,
     getSessionReady: () => true,
     getHeartbeatTimer: () => heartbeatTimer,
@@ -158,6 +164,7 @@ async function main() {
     serverUrl,
     token,
     dbg,
+    buildId,
     getSessionReady: () => true,
     getSessionId: () => sdkSessionId,
     getPid: () => process.pid,
@@ -238,7 +245,7 @@ async function main() {
     getActiveQueueMessageIds: () => turnRunner.getActiveQueueMessageIds(),
   });
 
-  dbg(`starting session=${sdkSessionId.slice(0, 8)} server=${serverUrl} cwd=${cwd} model=${defaultModel || 'default'}`);
+  dbg(`starting session=${sdkSessionId.slice(0, 8)} server=${serverUrl} cwd=${cwd} model=${defaultModel || 'default'} build=${buildId || 'unknown'}`);
   heartbeat.startHeartbeat();
   wsLink.start();
 }