@openrig/cli 0.6.10 → 0.6.12

package/daemon/dist/domain/seat-lifecycle-service.js

@@ -1,3 +1,4 @@
+import { shellQuote } from "../adapters/shell-quote.js";
 import { deriveCanonicalFromEntry, getNodeInventory } from "./node-inventory.js";
 import { deriveSessionName, parseSessionName } from "./session-name.js";
 import { resolveStartupProof } from "./startup-resolver.js";
@@ -7,6 +8,14 @@ import { observeSolePane } from "./pane-binding-observation.js";
 import { createHash } from "node:crypto";
 import { NativePermissionStore } from "./native-permission-store.js";
 import { validateNativePermissionSelection, unresolvedClaudePermissionModes } from "./native-permission-selection.js";
+import { resolvePermissionPolicyAttachment, validatePermissionPolicyRef } from "./permission-policy/policy-ref.js";
+import { effortPrecedence, emittedEffortFromArgv, readNativeEffort, resolveSeatEffort, unknownLevelWarning, } from "./seat-effort.js";
+import { claudeCommandSessionToken, codexCommandResumeToken, observeClaudePaneRuntime, observeCodexPaneProcess, processArgv, } from "./native-process-lineage.js";
+import { defaultInPlaceRestartIo } from "./seat-restart-in-place.js";
+import nodePath from "node:path";
+import { CodexInPlaceRestart, } from "./seat-restart-in-place.js";
+import { seatAdapter } from "../adapters/community-harness-runtime-adapter.js";
+import { sessionCommunityHarnessSelect } from "./session-registry.js";
 /**
  * S5 (OPR.0.5.4.7) — the seat-lifecycle verb surface: set-model, single-seat stop,
  * dead-session clean. One coherent design (KI-5.3-9):
@@ -36,6 +45,10 @@ export class SeatLifecycleService {
     runtimeAdapters;
     occupantInvalidator;
     activityOracle;
+    inPlaceRestartIo;
+    inPlaceRestartTiming;
+    inPlaceRestartDaemonStartedAt;
+    transcripts;
     constructor(deps) {
         if (deps.db !== deps.rigRepo.db)
             throw new Error("SeatLifecycleService: rigRepo must share the same db handle");
@@ -54,6 +67,10 @@ export class SeatLifecycleService {
         this.runtimeAdapters = deps.runtimeAdapters ?? {};
         this.occupantInvalidator = deps.occupantInvalidator ?? null;
         this.activityOracle = deps.activityOracle ?? null;
+        this.inPlaceRestartIo = deps.inPlaceRestartIo;
+        this.inPlaceRestartTiming = deps.inPlaceRestartTiming;
+        this.inPlaceRestartDaemonStartedAt = deps.inPlaceRestartDaemonStartedAt;
+        this.transcripts = deps.transcripts ?? null;
     }
     async setModel(input) {
         const required = this.requireReason(input.reason);
@@ -91,6 +108,193 @@ export class SeatLifecycleService {
             this.eventBus.notifySubscribers(persisted);
         return { ok: true, seat, from, to: model, changed: true };
     }
+    /** OPR.0.7.0.7 — save one seat's effort for its next managed continuation. Like set-model it
+     *  validates, writes, and persists an audited event in the same transaction; it never restarts
+     *  the seat or touches its peers, model or account. `effort: null` clears the explicit choice. */
+    async setEffort(input) {
+        const required = this.requireReason(input.reason);
+        if (required)
+            return required;
+        const requested = input.effort === null ? null : input.effort.trim();
+        if (requested !== null) {
+            if (!requested)
+                return { ok: false, code: "missing_effort", message: "An effort level is required (--effort <level>), or pass --clear." };
+            // Levels are the runtime's own (they differ by model and client), so only the shape is checked here.
+            if (!/^[A-Za-z][A-Za-z0-9_-]{0,31}$/.test(requested)) {
+                return { ok: false, code: "invalid_effort", message: `"${requested}" isn't an effort level: use the runtime's level name, such as low, medium or high.` };
+            }
+        }
+        const resolved = this.resolveSeat(input.seatRef);
+        if ("code" in resolved)
+            return resolved;
+        const seat = this.describe(resolved);
+        const runtime = resolved.entry.runtime ?? "unknown";
+        if (runtime !== "claude-code" && runtime !== "codex") {
+            return { ok: false, code: "effort_unsupported_runtime", message: `Seat "${input.seatRef}" runs ${runtime}; reasoning effort applies to claude-code and codex seats only.` };
+        }
+        const from = this.readEffort(seat.nodeId);
+        if (!from) {
+            return { ok: false, code: "effort_unavailable", message: "This daemon's database has no per-seat effort choice (checked: nodes.effort_choice column); nothing was saved." };
+        }
+        let changed = false;
+        if (from.choice !== requested) {
+            let persisted = null;
+            this.db.transaction(() => {
+                if (!this.rigRepo.setNodeEffortChoice(seat.nodeId, requested))
+                    return;
+                changed = true;
+                persisted = this.eventBus.persistWithinTransaction({
+                    type: "node.effort_changed",
+                    rigId: seat.rigId,
+                    nodeId: seat.nodeId,
+                    logicalId: seat.logicalId,
+                    from: from.choice,
+                    to: requested,
+                    reason: input.reason.trim(),
+                    operator: input.operator ?? null,
+                });
+            })();
+            if (persisted)
+                this.eventBus.notifySubscribers(persisted);
+            if (!changed) {
+                return { ok: false, code: "effort_unavailable", message: `The effort choice for seat "${input.seatRef}" was not saved (no node row was updated); nothing changed.` };
+            }
+        }
+        const saved = this.readEffort(seat.nodeId) ?? from;
+        const running = await this.runningState(seat.nodeId);
+        const effect = requested === null
+            ? `Cleared: the seat has no saved effort choice now, so it goes back to ${saved.source === "authored" ? `the spec's authored effort ${saved.authored}` : "no effort flag (the runtime's own default)"} at its next managed launch, resume, restore or spec refresh. An in-place restart keeps the running effort and refuses if it would change it. The running process is unchanged; nothing was restarted.`
+            : `Saved for the seat's next managed continuation. The running process is unchanged; nothing was restarted.`;
+        return {
+            ok: true, seat, runtime, requested, from, saved, changed,
+            running: running.state, ...(running.detail ? { runningDetail: running.detail } : {}),
+            emitted: "not_yet", observed: "not_observed", effect,
+            ...(unknownLevelWarning(runtime, requested) ? { warning: unknownLevelWarning(runtime, requested) } : {}),
+        };
+    }
+    /** OPR.0.7.0.7 — requested, saved, emitted at launch and observed in the native session, each from
+     *  its own source. Reads only. An unseen value is reported as unknown or NOT VERIFIED, never guessed. */
+    async effortReport(seatRef) {
+        const resolved = this.resolveSeat(seatRef);
+        if ("code" in resolved)
+            return resolved;
+        const seat = this.describe(resolved);
+        const runtime = resolved.entry.runtime ?? "unknown";
+        if (runtime !== "claude-code" && runtime !== "codex") {
+            return { ok: false, code: "effort_unsupported_runtime", message: `Seat "${seatRef}" runs ${runtime}; reasoning effort applies to claude-code and codex seats only.` };
+        }
+        const saved = this.readEffort(seat.nodeId);
+        if (!saved) {
+            return { ok: false, code: "effort_unavailable", message: "This daemon's database has no per-seat effort choice (checked: nodes.effort_choice column)." };
+        }
+        const requested = this.lastRequestedEffort(seat.nodeId);
+        const precedence = { decided: effortPrecedence.decided, detail: effortPrecedence.detail };
+        let emitted;
+        let observed;
+        const session = this.latestSession(seat.nodeId);
+        const binding = this.sessionRegistry.getBindingForNode(seat.nodeId);
+        const target = binding?.tmuxPane ?? binding?.tmuxSession ?? null;
+        if (!session || TERMINAL_SESSION_STATUSES.has(session.status) || !target) {
+            emitted = { state: "unknown", detail: "The seat has no running session, so no launch to read." };
+            observed = { state: "not_verified", detail: "The seat has no running session." };
+        }
+        else {
+            const observe = runtime === "claude-code" ? observeClaudePaneRuntime : observeCodexPaneProcess;
+            const process = (await observe({ target, tmux: this.tmuxAdapter, ...(this.listProcesses ? { listProcesses: this.listProcesses } : {}) }))?.process;
+            if (!process) {
+                emitted = { state: "unknown", detail: `No single ${runtime === "claude-code" ? "Claude" : "Codex"} process could be read in the seat's pane.` };
+                observed = { state: "not_verified", detail: "The running process could not be read, so no turn can be tied to its launch." };
+            }
+            else {
+                const flag = emittedEffortFromArgv(runtime, processArgv(process.command));
+                const value = flag.flag === "present" ? flag.value : null;
+                emitted = { state: "observed", value, pid: process.pid, startedAt: process.startedAt ?? null, matchesSaved: value === saved.effective };
+                // Native effort is attributed only from the transcript of the conversation this process is on.
+                const joined = await this.joinedTranscript(runtime, session, process);
+                const native = "detail" in joined ? { state: "not_verified", detail: joined.detail }
+                    : readNativeEffort(runtime, joined.path, process.startedAt ?? null);
+                observed = native.state === "observed" ? { ...native, matchesEmitted: native.value === value } : native;
+            }
+        }
+        return { ok: true, seat, runtime, requested, saved, emitted, observed, precedence, summary: effortSummary(saved, emitted, observed) };
+    }
+    lastRequestedEffort(nodeId) {
+        const row = this.db.prepare("SELECT payload, created_at FROM events WHERE node_id = ? AND type = 'node.effort_changed' ORDER BY seq DESC LIMIT 1")
+            .get(nodeId);
+        if (!row)
+            return null;
+        try {
+            const payload = JSON.parse(row.payload);
+            return { value: payload.to ?? null, at: row.created_at, reason: payload.reason ?? "", operator: payload.operator ?? null };
+        }
+        catch {
+            return null;
+        }
+    }
+    /** The transcript of the conversation the observed process is on, or why that join can't be made.
+     *  The recorded conversation (Codex: the session's resume token; Claude: the status sidecar's session)
+     *  must be the one the process itself names, by argv or, for a Codex that names none, by its own logs. */
+    async joinedTranscript(runtime, session, process) {
+        if (!this.transcripts)
+            return { detail: "The native transcript for this session isn't known to OpenRig." };
+        const mismatch = "The process in the pane isn't on the conversation recorded for this seat (or its conversation couldn't be read), so no native turn can be attributed to it.";
+        try {
+            if (runtime === "codex") {
+                const recorded = this.sessionResumeToken(session.id);
+                if (!recorded)
+                    return { detail: "No Codex conversation is recorded for this session yet." };
+                let own = codexCommandResumeToken(process.command) ?? undefined;
+                if (own === undefined && process.startedAt) {
+                    const io = { ...defaultInPlaceRestartIo(), ...this.inPlaceRestartIo };
+                    const facts = await io.readProcess(process.pid);
+                    const home = facts?.env.CODEX_HOME ?? (facts?.env.HOME ? nodePath.join(facts.env.HOME, ".codex") : undefined);
+                    own = home ? await io.readThreadId(process.pid, process.startedAt, home) : undefined;
+                }
+                if (own !== recorded)
+                    return { detail: mismatch };
+                return { path: this.transcripts.readCodexTranscriptPath(recorded) };
+            }
+            const sidecar = this.transcripts.readSidecar(session.session_name);
+            if (!sidecar.ok)
+                return { detail: "Claude's status sidecar for this session isn't available, so its transcript isn't known." };
+            const recorded = sidecar.data.session_id ?? null;
+            const own = claudeCommandSessionToken(process.command);
+            // A resumed Claude can rotate to a new session id; the registry's recorded rotation from the
+            // launched id to the sidecar's joins them too.
+            const rotated = this.db.prepare("SELECT 1 FROM sessions WHERE id = ? AND resume_token = ? AND resume_rotated_from = ?")
+                .get(session.id, recorded, own);
+            if (!recorded || !own || (own !== recorded && !rotated))
+                return { detail: mismatch };
+            return { path: sidecar.data.transcript_path ?? null };
+        }
+        catch {
+            return { detail: mismatch };
+        }
+    }
+    readEffort(nodeId) {
+        let row;
+        try {
+            row = this.db.prepare("SELECT effort, effort_choice FROM nodes WHERE id = ?").get(nodeId);
+        }
+        catch {
+            return null; // an older database without the columns
+        }
+        if (!row)
+            return null;
+        return resolveSeatEffort({ effort: row.effort, effortChoice: row.effort_choice });
+    }
+    /** Whether the seat's latest session is live now. Never a guess: an indeterminate probe is unknown. */
+    async runningState(nodeId) {
+        const session = this.latestSession(nodeId);
+        if (!session)
+            return { state: "no", detail: "no session recorded" };
+        if (TERMINAL_SESSION_STATUSES.has(session.status))
+            return { state: "no", detail: `latest session ${session.status}` };
+        const probe = await this.probeLiveness(session.session_name, "running is reported as unknown");
+        if ("code" in probe)
+            return { state: "unknown", detail: probe.message };
+        return probe.state === "present" ? { state: "yes" } : { state: "no", detail: "tmux session absent" };
+    }
     async setPermissions(input) {
         input = { ...input };
         const required = this.requireReason(input.reason);
@@ -136,6 +340,71 @@ export class SeatLifecycleService {
             return { ok: false, code: "permission_selection_refused", message: error.message };
         }
     }
+    /** `rig policy apply <name> --seat`: re-point an existing seat's own permission_policy. This writes
+     *  the raw ref and the provenance the instantiator would persist for the same member ref; restore,
+     *  resume and launches that read the seat's stored state use that provenance, while a launch from a
+     *  spec that declares a policy re-applies the spec's. The ref is validated exactly as a spec
+     *  member's is; the running process is untouched. */
+    async setPolicy(input) {
+        const required = this.requireReason(input.reason);
+        if (required)
+            return required;
+        const invalid = validatePermissionPolicyRef(input.ref, "permission_policy");
+        if (invalid)
+            return { ok: false, code: "invalid_policy", message: invalid };
+        const ref = input.ref;
+        // Built-ins and `none` resolve from the ref alone; only a custom file reads its declaring directory.
+        const attachment = resolvePermissionPolicyAttachment(ref, "", { readFile: () => { throw new Error("no declaring spec"); } });
+        if (attachment.origin === "custom") {
+            return {
+                ok: false, code: "invalid_policy",
+                message: `permission_policy: '${ref}' is a custom policy file, which resolves relative to the rig spec that declares it; a seat has no spec directory of its own.`,
+                guidance: "Use builtin:<name> or none here, or declare the custom ref in the rig spec.",
+            };
+        }
+        const resolved = this.resolveSeat(input.seatRef);
+        if ("code" in resolved)
+            return resolved;
+        const seat = this.describe(resolved);
+        if (resolved.entry.runtime === "terminal") {
+            return { ok: false, code: "invalid_policy", message: "permission_policy: not valid on terminal members (a terminal node is not an agent seat)" };
+        }
+        const row = this.db.prepare("SELECT permission_policy FROM nodes WHERE id = ?").get(seat.nodeId);
+        const from = row?.permission_policy ?? null;
+        const provenance = {
+            origin: attachment.origin,
+            resolvedTarget: attachment.resolvedTarget ?? null,
+            declaringDir: attachment.declaringDir ?? null,
+            launchPosture: attachment.launchPosture,
+        };
+        const before = this.rigRepo.getNodePolicyProvenance(seat.nodeId);
+        const changed = from !== ref || !before || before.origin !== provenance.origin || before.resolvedTarget !== provenance.resolvedTarget
+            || before.declaringDir !== provenance.declaringDir || before.launchPosture !== provenance.launchPosture;
+        if (changed) {
+            let persisted = null;
+            this.db.transaction(() => {
+                this.rigRepo.setNodePermissionPolicy(seat.nodeId, ref);
+                this.rigRepo.setNodePolicyProvenance(seat.nodeId, provenance);
+                persisted = this.eventBus.persistWithinTransaction({
+                    type: "node.policy_changed", rigId: seat.rigId, nodeId: seat.nodeId, logicalId: seat.logicalId,
+                    from, to: ref, launchPosture: attachment.launchPosture, reason: input.reason.trim(), operator: input.actor.trim(),
+                });
+            })();
+            if (persisted)
+                this.eventBus.notifySubscribers(persisted);
+        }
+        let selection = false;
+        // An unreadable selection refuses the launch by itself (NativePermissionStore.read); nothing to add here.
+        try {
+            selection = new NativePermissionStore(this.db).read(seat.nodeId) !== null;
+        }
+        catch { /* see above */ }
+        const effect = "Restore, resume and launches that read this seat's stored state use this policy, unless an explicit native selection (rig seat set-permissions) takes precedence. "
+            + "`rig up <rig name>` uses it; a launch from a spec that declares a policy replaces it with the spec's policy, which later restores then use. "
+            + "The running process and the rig spec file are unchanged; nothing was restarted."
+            + (selection ? " This seat has an explicit native permission selection, so that selection takes precedence at launch." : "");
+        return { ok: true, seat, from, to: ref, launchPosture: attachment.launchPosture, changed, effect };
+    }
     async stopSeat(input) {
         const required = this.requireReason(input.reason);
         if (required)
@@ -174,7 +443,7 @@ export class SeatLifecycleService {
                 guidance: "A dead seat with stale records is returned to launchable with: rig seat clean",
             };
         }
-        return this.stopManagedTmuxSeat(resolved, session, input.reason, input.operator);
+        return this.stopManagedTmuxSeat(resolved, session, input.reason, input.operator, true);
     }
     async cleanSeat(input) {
         const required = this.requireReason(input.reason);
@@ -217,11 +486,14 @@ export class SeatLifecycleService {
             if ("code" in probed)
                 return probed;
             if (probed.state === "present") {
+                const latest = this.latestSession(resolved.nodeId);
                 return {
                     ok: false,
                     code: "session_live",
                     message: `Session "${name}" is alive in tmux (checked: tmux has-session, against EVERY session row clean would mutate) — clean only operates on dead seats.`,
-                    guidance: "Stop a live seat first with: rig seat stop",
+                    guidance: latest?.session_name === name && latest.origin !== "claimed"
+                        ? "Stop a live seat first with: rig seat stop"
+                        : `Check that session (rig capture -- ${shellQuote(name)}) and end it yourself if it is no longer needed, then retry; rig seat stop targets the seat's latest session, not a selected historical session.`,
                 };
             }
         }
@@ -257,19 +529,19 @@ export class SeatLifecycleService {
             this.eventBus.notifySubscribers(persisted);
         return { ok: true, seat, actions: { sessionsExited, bindingCleared: binding !== null } };
     }
-    /** Finish context delivery to the same fresh occupant after its native gate.
+    /** Finish context delivery to the same fresh or forked occupant after its native gate.
      * This never launches a process or replays an uncertain/finished delivery.
      */
-    async continueFreshStartup(seatRef) {
+    async continueStartup(seatRef) {
         const resolved = this.resolveSeat(seatRef);
         if ("code" in resolved)
             return resolved;
         const guard = this.tmuxAdapter.deliveryGuard;
         return guard
-            ? guard.lifecycle([resolved.nodeId], () => this.continueFreshStartupUnchecked(seatRef))
-            : this.continueFreshStartupUnchecked(seatRef);
+            ? guard.lifecycle([resolved.nodeId], () => this.continueStartupUnchecked(seatRef))
+            : this.continueStartupUnchecked(seatRef);
     }
-    async continueFreshStartupUnchecked(seatRef) {
+    async continueStartupUnchecked(seatRef) {
         const resolved = this.resolveSeat(seatRef);
         if ("code" in resolved)
             return resolved;
@@ -277,14 +549,15 @@ export class SeatLifecycleService {
         const node = this.rigRepo.getRig(seat.rigId)?.nodes.find((n) => n.id === seat.nodeId);
         const session = this.latestSession(seat.nodeId);
         const binding = this.sessionRegistry.getBindingForNode(seat.nodeId);
+        const pending = session && this.startupOrchestrator?.pendingStartupContext(seat.nodeId, session.id);
         if (!node || !session || !binding?.tmuxSession || !this.startupOrchestrator
-            || !this.startupOrchestrator.canContinueFresh(node.id, session.id)) {
-            return { ok: false, code: "continuation_unavailable", message: "No verified pending fresh-context delivery exists for this occupant. Refresh to inspect its actual state." };
+            || !pending) {
+            return { ok: false, code: "continuation_unavailable", message: "No verified pending startup-context delivery exists for this occupant. Refresh to inspect its actual state." };
         }
         const pane = await observeSolePane(this.tmuxAdapter, binding.tmuxSession);
         if (!pane.ok || pane.pane !== binding.tmuxPane)
             return { ok: false, code: "binding_changed", message: "The managed terminal binding changed; context was not delivered." };
-        const adapter = node.runtime ? this.runtimeAdapters[node.runtime] : undefined;
+        const adapter = seatAdapter(this.runtimeAdapters, node.runtime, session.community_harness);
         if (!adapter)
             return { ok: false, code: "runtime_adapter_missing", message: "The configured runtime adapter is unavailable." };
         const ready = await adapter.checkReady({ ...binding, cwd: node.cwd ?? "." });
@@ -298,41 +571,30 @@ export class SeatLifecycleService {
         // Recheck after the asynchronous native observation; startNode immediately
         // records pending before its first await, consuming the retained permission.
         if (this.latestSession(node.id)?.id !== session.id || this.sessionRegistry.getBindingForNode(node.id)?.tmuxPane !== pane.pane
-            || !this.startupOrchestrator.canContinueFresh(node.id, session.id))
+            || !this.stillPending(node.id, session.id, pending))
             return { ok: false, code: "continuation_unavailable", message: "Startup changed during the readiness check. Refresh." };
         const result = await this.startupOrchestrator.startNode({
             rigId: seat.rigId, nodeId: node.id, sessionId: session.id,
-            binding: { ...binding, cwd: node.cwd ?? ".", model: node.model ?? undefined, effort: node.effort ?? undefined, codexConfigProfile: node.codexConfigProfile ?? undefined },
+            binding: { ...binding, cwd: node.cwd ?? ".", model: node.model ?? undefined, effort: resolveSeatEffort(node).effective ?? undefined, codexConfigProfile: node.codexConfigProfile ?? undefined },
             adapter, plan: startup.context.plan, resolvedStartupFiles: startup.context.resolvedStartupFiles,
-            startupActions: startup.context.startupActions, isRestore: false,
-            sessionName: session.session_name, skipHarnessLaunch: true, continueFreshStartup: true, includeDurableObligations: true, allowFreshFallback: false,
+            startupActions: startup.context.startupActions, isRestore: pending.mode === "fork" && pending.isRestore,
+            sessionName: session.session_name, skipHarnessLaunch: true, continueFreshStartup: pending.mode === "fresh", includeDurableObligations: true, allowFreshFallback: false,
+            ...(pending.mode === "fork" ? { forkSource: { kind: "native_id", value: pending.parentToken } } : {}),
         });
-        return { ...result, message: result.ok ? "Configured context delivered to the existing fresh conversation." : result.errors.join("; ") };
+        return { ...result, message: result.ok ? "Configured context delivered to the existing conversation." : result.errors.join("; ") };
     }
-    /** Deliberately replace exactly one managed seat with a blank native occupant. */
-    async launchFresh(input) {
-        const required = this.requireReason(input.reason);
-        if (required)
-            return required;
-        if (input.fresh !== true) {
-            return {
-                ok: false,
-                code: "fresh_required",
-                message: "Explicit fresh launch requires fresh=true (--fresh); no continuity mode is inferred.",
-            };
-        }
-        const resolved = this.resolveSeat(input.seatRef);
-        if ("code" in resolved)
-            return resolved;
-        const guard = this.tmuxAdapter.deliveryGuard;
-        if (guard && !guard.ownsLifecycle(resolved.nodeId)) {
-            return guard.lifecycle([resolved.nodeId], () => this.launchFresh(input));
-        }
+    /**
+     * Resolve a seat snapshot into current launch settings and persisted startup context.
+     * Return a refusal for stale seats, unavailable services, or runtime/context mismatch.
+     * Reads only: callers receive no reservation or launch guarantee. Execution repeats
+     * this resolution under its lifecycle lock rather than trusting an earlier plan.
+     */
+    resolveFreshLaunch(resolved, seatRef) {
         const seat = this.describe(resolved);
         const rig = this.rigRepo.getRig(seat.rigId);
         const node = rig?.nodes.find((candidate) => candidate.id === seat.nodeId);
         if (!rig || !node) {
-            return { ok: false, code: "seat_not_found", message: `Seat "${input.seatRef}" no longer exists.`, guidance: SEAT_LOOKUP_GUIDANCE };
+            return { ok: false, code: "seat_not_found", message: `Seat "${seatRef}" no longer exists.`, guidance: SEAT_LOOKUP_GUIDANCE };
         }
         if (!this.nodeLauncher || !this.startupOrchestrator) {
             return { ok: false, code: "launch_unavailable", message: "Fresh-launch services are unavailable in this daemon." };
@@ -347,7 +609,7 @@ export class SeatLifecycleService {
                 message: `Persisted startup context runtime '${startup.context.runtime}' does not match current node runtime '${node.runtime ?? "missing"}'.`,
             };
         }
-        const adapter = this.runtimeAdapters[node.runtime];
+        const adapter = seatAdapter(this.runtimeAdapters, node.runtime, this.latestSession(node.id)?.community_harness);
         if (!adapter) {
             return {
                 ok: false,
@@ -357,15 +619,204 @@ export class SeatLifecycleService {
         }
         const canonicalSessionName = deriveCanonicalFromEntry(resolved.entry)
             ?? deriveSessionName(seat.rigName, seat.logicalId);
-        const retiringRows = this.nonTerminalSessions(node.id);
-        if (retiringRows.some((row) => row.origin === "claimed")) {
+        return { ok: true, resolved, seat, rig, node, adapter, startup: startup.context, canonicalSessionName, nodeLauncher: this.nodeLauncher, startupOrchestrator: this.startupOrchestrator };
+    }
+    /**
+     * Validate an observed canonical collision against current managed rows and binding.
+     * `stop` authorizes only this matching occupant; it cannot authorize adopted or
+     * mismatched sessions. Return its session row or a refusal, including unknown pane
+     * observations, without stopping, repairing, or starting a tmux server.
+     */
+    /** Whether the context found before the native check is still owed. A fork continuation needs the exact
+     *  same pending event: its child is verified against that attempt. A fresh continuation keeps main's
+     *  check (fresh context still pending for this occupant), so another pending event doesn't refuse it. */
+    stillPending(nodeId, sessionId, pending) {
+        const now = this.startupOrchestrator?.pendingStartupContext(nodeId, sessionId);
+        return pending.mode === "fork" ? now?.eventSeq === pending.eventSeq : now?.mode === "fresh";
+    }
+    async validateFreshCollision(resolved, canonicalSessionName, stop) {
+        const currentSession = this.latestSession(resolved.nodeId);
+        const currentBinding = this.sessionRegistry.getBindingForNode(resolved.nodeId);
+        const currentManaged = currentSession !== null
+            && !TERMINAL_SESSION_STATUSES.has(currentSession.status)
+            && currentSession.origin !== "claimed"
+            && currentSession.session_name === canonicalSessionName
+            && currentBinding?.tmuxSession === canonicalSessionName;
+        if (!currentManaged) {
             return {
                 ok: false,
-                code: "claimed_session",
-                message: `Seat "${input.seatRef}" has an adopted/operator-owned occupant; fresh launch refuses even with --stop.`,
+                code: "unmanaged_session_collision",
+                message: `Canonical tmux session "${canonicalSessionName}" exists but is not owned by this seat's current managed rows; refusing to overwrite it.`,
+            };
+        }
+        if (!stop) {
+            return {
+                ok: false,
+                code: "session_live",
+                message: `Seat "${canonicalSessionName}" is live; fresh launch refuses without --stop.`,
+                guidance: "Re-run with --stop to end exactly this managed occupant, or use rig handover to carry context.",
+            };
+        }
+        const observedPane = await observeSolePane(this.tmuxAdapter, canonicalSessionName);
+        if (!observedPane.ok && observedPane.code === "tmux_unavailable") {
+            return {
+                ok: false,
+                code: "tmux_probe_failed",
+                message: `${observedPane.detail}; fresh launch refuses rather than kill without live occupant identity.`,
+            };
+        }
+        if (!observedPane.ok || observedPane.pane !== currentBinding?.tmuxPane) {
+            return {
+                ok: false,
+                code: "unmanaged_session_collision",
+                message: `Canonical tmux session "${canonicalSessionName}" is live, but its pane does not match this seat's current managed binding; refusing to stop it.`,
+            };
+        }
+        return currentSession;
+    }
+    /**
+     * Check historical rows/bindings that clean would touch, excluding the canonical name.
+     * Read-only tmux probes reject adopted, live, or unreadable historical occupants
+     * before any stop. Null means no historical blocker was observed; the caller must
+     * still validate the canonical occupant and recheck absence before launching.
+     */
+    async validateFreshHistory(nodeId, canonicalSessionName, seatRef) {
+        const rows = this.nonTerminalSessions(nodeId);
+        if (rows.some(row => row.origin === "claimed")) {
+            return {
+                ok: false, code: "claimed_session",
+                message: `Seat "${seatRef}" has an adopted/operator-owned occupant; fresh launch refuses even with --stop.`,
                 guidance: "Stop the adopted process yourself, then run rig seat clean before launching fresh.",
             };
         }
+        const binding = this.sessionRegistry.getBindingForNode(nodeId);
+        const names = new Set([...rows.map(row => row.session_name), ...(binding?.tmuxSession ? [binding.tmuxSession] : [])]);
+        for (const name of names) {
+            if (name === canonicalSessionName)
+                continue;
+            const probe = await this.probeLiveness(name, "fresh launch refuses while historical occupant state is unknown");
+            if ("code" in probe)
+                return probe;
+            if (probe.state === "present")
+                return {
+                    ok: false, code: "session_live",
+                    message: `Historical session "${name}" is still live; fresh launch refuses to change this seat.`,
+                    guidance: "rig seat stop targets the seat's latest session, not a selected historical session; it may stop the current occupant instead.",
+                };
+        }
+        return null;
+    }
+    /**
+     * Snapshot one seat's proposed fresh launch; `fresh` is mandatory and `stop` is intent.
+     * No lifecycle lock, repair, material projection, native launch or persistent write
+     * is entered. Siblings are listed as unchanged; no seat is reserved by the result.
+     * Known blockers set launchable=false; otherwise incomplete observations yield null.
+     * Unreadable tmux remains incomplete, never readiness. No launch command is built.
+     * Errors are reduced to safe codes;
+     * startup text, credentials and process output are not included in the response.
+     */
+    async planFresh(input) {
+        const refusal = (error) => ({
+            ...error, planOnly: true, complete: error.code !== "tmux_probe_failed", launchable: false,
+            // Parser/probe errors can embed persisted startup content or process output.
+            message: `Fresh launch preview refused: ${error.code}.`,
+        });
+        if (!input.fresh)
+            return refusal({ ok: false, code: "fresh_required", message: "--plan requires --fresh." });
+        const resolved = this.resolveSeat(input.seatRef);
+        if ("code" in resolved)
+            return refusal(resolved);
+        const prepared = this.resolveFreshLaunch(resolved, input.seatRef);
+        if ("code" in prepared)
+            return refusal(prepared);
+        const { seat, rig, node, startup, canonicalSessionName } = prepared;
+        const blockers = [];
+        const warnings = ["Snapshot only; execution resolves and validates again. Native readiness is not checked."];
+        let complete = true;
+        let tmuxUnknown = false;
+        const guard = this.tmuxAdapter.deliveryGuard?.preference(node.id);
+        if (guard?.effective || guard?.desired)
+            blockers.push({ code: "typing_guard_enabled", message: "Typing protection blocks lifecycle operations for this seat." });
+        const record = (error) => {
+            if (error.code === "tmux_probe_failed") {
+                complete = false;
+                tmuxUnknown = true;
+                warnings.push("tmux state is unknown; no server was started and no occupant was changed.");
+            }
+            else if (error.code === "claimed_session" || error.code === "session_live") {
+                blockers.push({ code: error.code, message: error.message, guidance: error.guidance });
+            }
+            else
+                blockers.push({ code: error.code, message: `Fresh launch would be refused: ${error.code}.` });
+        };
+        const history = await this.validateFreshHistory(node.id, canonicalSessionName, input.seatRef);
+        if (history)
+            record(history);
+        const probe = await this.probeLiveness(canonicalSessionName, "preview does not repair tmux");
+        const currentOccupant = "code" in probe ? "unknown" : probe.state;
+        let stopRequired = currentOccupant === "absent" ? false : null;
+        let owned = false;
+        if ("code" in probe)
+            record(probe);
+        else if (probe.state === "present") {
+            // Check ownership even without --stop; presence alone is not permission to stop.
+            const collision = await this.validateFreshCollision(resolved, canonicalSessionName, true);
+            if ("code" in collision)
+                record(collision);
+            else {
+                owned = true;
+                stopRequired = true;
+                if (!input.stop)
+                    blockers.push({ code: "session_live", message: "A live managed occupant requires --stop." });
+            }
+        }
+        const launchable = blockers.length > 0 ? false : complete ? true : null;
+        const siblings = rig.nodes.filter(n => n.id !== node.id).map(n => ({
+            logicalId: n.logicalId, sessionName: n.binding?.tmuxSession ?? null, effect: "unchanged",
+        }));
+        return {
+            ok: true, planOnly: true, complete, launchable, seat,
+            sessionName: canonicalSessionName, currentOccupant,
+            stopRequired, wouldStop: blockers.length > 0 ? false : tmuxUnknown ? null : owned && input.stop === true,
+            blockers, warnings, siblings,
+            startup: { projectionCount: startup.plan.entries.length,
+                fileCount: startup.resolvedStartupFiles.filter(f => f.appliesOn.includes("fresh_start")).length,
+                actionCount: startup.startupActions.filter(a => a.appliesOn.includes("fresh_start")).length },
+        };
+    }
+    /**
+     * Execute a fresh replacement of exactly one seat, requiring fresh intent and reason.
+     * Resolve configuration again under the lifecycle lock, reject unsafe historical or
+     * canonical occupants, and require positive absence before creating a new occupant.
+     * Unlike planFresh this mutates lifecycle/startup state; an earlier preview grants
+     * no authority to skip validation. Sibling seats are never included in the operation.
+     */
+    async launchFresh(input) {
+        const required = this.requireReason(input.reason);
+        if (required)
+            return required;
+        if (input.fresh !== true) {
+            return {
+                ok: false,
+                code: "fresh_required",
+                message: "Explicit fresh launch requires fresh=true (--fresh); no continuity mode is inferred.",
+            };
+        }
+        const resolved = this.resolveSeat(input.seatRef);
+        if ("code" in resolved)
+            return resolved;
+        const guard = this.tmuxAdapter.deliveryGuard;
+        if (guard && !guard.ownsLifecycle(resolved.nodeId)) {
+            return guard.lifecycle([resolved.nodeId], () => this.launchFresh(input));
+        }
+        const prepared = this.resolveFreshLaunch(resolved, input.seatRef);
+        if ("code" in prepared)
+            return prepared;
+        const { seat, node, adapter, startup, canonicalSessionName, nodeLauncher, startupOrchestrator } = prepared;
+        const historyRefusal = await this.validateFreshHistory(resolved.nodeId, canonicalSessionName, input.seatRef);
+        if (historyRefusal)
+            return historyRefusal;
+        const retiringRows = this.nonTerminalSessions(node.id);
         // Detached is terminal for process cleanup, but remains a reboot candidate.
         // A deliberate fresh launch must retire that prior history as well.
         const supersededSessionIds = this.db.prepare("SELECT id FROM sessions WHERE node_id = ? AND status NOT IN ('superseded', 'exited')").all(node.id).map((row) => row.id);
@@ -403,44 +854,10 @@ export class SeatLifecycleService {
         if ("code" in canonicalProbe)
             return canonicalProbe;
         if (canonicalProbe.state === "present") {
-            const currentSession = this.latestSession(node.id);
-            const currentBinding = this.sessionRegistry.getBindingForNode(node.id);
-            const currentManaged = currentSession !== null
-                && !TERMINAL_SESSION_STATUSES.has(currentSession.status)
-                && currentSession.origin !== "claimed"
-                && currentSession.session_name === canonicalSessionName
-                && currentBinding?.tmuxSession === canonicalSessionName;
-            if (!currentManaged) {
-                return {
-                    ok: false,
-                    code: "unmanaged_session_collision",
-                    message: `Canonical tmux session "${canonicalSessionName}" exists but is not owned by this seat's current managed rows; refusing to overwrite it.`,
-                };
-            }
-            if (!input.stop) {
-                return {
-                    ok: false,
-                    code: "session_live",
-                    message: `Seat "${input.seatRef}" is live; fresh launch refuses without --stop.`,
-                    guidance: "Re-run with --stop to end exactly this managed occupant, or use rig handover to carry context.",
-                };
-            }
-            const observedPane = await observeSolePane(this.tmuxAdapter, canonicalSessionName);
-            if (!observedPane.ok && observedPane.code === "tmux_unavailable") {
-                return {
-                    ok: false,
-                    code: "tmux_probe_failed",
-                    message: `${observedPane.detail}; fresh launch refuses rather than kill without live occupant identity.`,
-                };
-            }
-            if (!observedPane.ok || observedPane.pane !== currentBinding?.tmuxPane) {
-                return {
-                    ok: false,
-                    code: "unmanaged_session_collision",
-                    message: `Canonical tmux session "${canonicalSessionName}" is live, but its pane does not match this seat's current managed binding; refusing to stop it.`,
-                };
-            }
-            const stopped = await this.stopManagedTmuxSeat(resolved, currentSession, input.reason, input.operator);
+            const currentSession = await this.validateFreshCollision(resolved, canonicalSessionName, input.stop === true);
+            if ("code" in currentSession)
+                return currentSession;
+            const stopped = await this.stopManagedTmuxSeat(resolved, currentSession, input.reason, input.operator, false);
             if (!stopped.ok)
                 return stopped;
             // Stopping the server's last session ends tmux's server, and every probe
@@ -481,7 +898,7 @@ export class SeatLifecycleService {
             successorSessionName: canonicalSessionName,
             ...(retiringGeneration ? { retiringGeneration } : {}),
         });
-        const launch = await this.nodeLauncher.launchNode(seat.rigId, seat.logicalId, {
+        const launch = await nodeLauncher.launchNode(seat.rigId, seat.logicalId, {
             sessionName: canonicalSessionName,
             cwd: node.cwd ?? undefined,
             occupantKind: "fresh",
@@ -500,9 +917,9 @@ export class SeatLifecycleService {
                 supersededSessionIds,
                 retiringGeneration,
                 newGeneration: null,
-                startupPolicyHash: startup.context.hash,
+                startupPolicyHash: startup.hash,
                 model: node.model,
-                effort: node.effort ?? null,
+                effort: resolveSeatEffort(node).effective,
                 reason: input.reason,
                 operator: input.operator,
                 errors: ["new occupant generation was not persisted"],
@@ -515,7 +932,7 @@ export class SeatLifecycleService {
         const launchPosture = this.rigRepo.getNodePolicyProvenance(node.id)?.launchPosture
             ?? this.rigRepo.getRigPolicyProvenance(seat.rigId)?.launchPosture
             ?? "floor";
-        const startupResult = await this.startupOrchestrator.startNode({
+        const startupResult = await startupOrchestrator.startNode({
             rigId: seat.rigId,
             nodeId: node.id,
             sessionId: launch.session.id,
@@ -523,14 +940,14 @@ export class SeatLifecycleService {
                 ...launch.binding,
                 cwd: node.cwd ?? ".",
                 model: node.model ?? undefined,
-                effort: node.effort ?? undefined,
+                effort: resolveSeatEffort(node).effective ?? undefined,
                 codexConfigProfile: node.codexConfigProfile ?? undefined,
                 launchPosture,
             },
             adapter,
-            plan: startup.context.plan,
-            resolvedStartupFiles: startup.context.resolvedStartupFiles,
-            startupActions: startup.context.startupActions,
+            plan: startup.plan,
+            resolvedStartupFiles: startup.resolvedStartupFiles,
+            startupActions: startup.startupActions,
             isRestore: false,
             includeDurableObligations: true,
             sessionName: canonicalSessionName,
@@ -543,9 +960,9 @@ export class SeatLifecycleService {
                 supersededSessionIds,
                 retiringGeneration,
                 newGeneration: generation,
-                startupPolicyHash: startup.context.hash,
+                startupPolicyHash: startup.hash,
                 model: node.model,
-                effort: node.effort ?? null,
+                effort: resolveSeatEffort(node).effective,
                 reason: input.reason,
                 operator: input.operator,
                 errors: startupResult.errors,
@@ -607,8 +1024,8 @@ export class SeatLifecycleService {
                 nativeSessionId,
                 ...(nativeSessionId ? {} : { nativeSessionIdReason: "scrape_miss" }),
                 model: node.model,
-                effort: node.effort ?? null,
-                startupPolicyHash: startup.context.hash,
+                effort: resolveSeatEffort(node).effective,
+                startupPolicyHash: startup.hash,
                 reason: input.reason.trim(),
                 operator: input.operator ?? null,
                 status: attentionRequired ? "attention_required" : "ready",
@@ -639,14 +1056,128 @@ export class SeatLifecycleService {
             sessionId: launch.session.id,
             generation,
             model: node.model,
-            effort: node.effort ?? undefined,
-            startupPolicyHash: startup.context.hash,
+            effort: resolveSeatEffort(node).effective ?? undefined,
+            startupPolicyHash: startup.hash,
             supersededSessionIds,
             warnings: startupResult.warnings,
         };
     }
+    /**
+     * OPR.0.7.0.5 — restart one Codex seat in place so it reads its home's current account: same conversation,
+     * same pane, the settings it is running with now. `plan` runs every gate read-only. Activity (mid-turn,
+     * needs input) and child processes are reported for the operator to judge, not refused. Identity, typing
+     * guard, adopted sessions, unreadable tmux and settings drift are named refusals before any signal.
+     */
+    async restartInPlace(input) {
+        if (!input.plan) {
+            const required = this.requireReason(input.reason ?? "");
+            if (required)
+                return required;
+        }
+        const resolved = this.resolveSeat(input.seatRef);
+        if ("code" in resolved)
+            return resolved;
+        const prepared = this.inPlaceRestarter();
+        if ("code" in prepared)
+            return prepared;
+        if (input.plan) {
+            const target = await this.inPlaceTarget(resolved, input.seatRef);
+            return "code" in target ? target : prepared.plan(target);
+        }
+        // Recorded before waiting for the lease: a restart that ran meanwhile refuses this one (no repeat
+        // on a slow reply).
+        const seenStartedSeq = prepared.latestStartedSeq(resolved.nodeId);
+        const run = async () => {
+            const target = await this.inPlaceTarget(resolved, input.seatRef);
+            if ("code" in target)
+                return target;
+            return prepared.execute(target, { reason: input.reason ?? "", operator: input.operator ?? null, seenStartedSeq });
+        };
+        const guard = this.tmuxAdapter.deliveryGuard;
+        return guard && !guard.ownsLifecycle(resolved.nodeId) ? guard.lifecycle([resolved.nodeId], run) : run();
+    }
+    /** `--verify`: report `moved` only with a completed tool turn since the restart and account-specific evidence. */
+    async verifyRestartInPlace(input) {
+        const resolved = this.resolveSeat(input.seatRef);
+        if ("code" in resolved)
+            return resolved;
+        const prepared = this.inPlaceRestarter();
+        if ("code" in prepared)
+            return prepared;
+        const target = await this.inPlaceTarget(resolved, input.seatRef);
+        return "code" in target ? target : prepared.verify(target, { expectAccount: input.expectAccount ?? null });
+    }
+    inPlaceRestarter() {
+        const adapter = this.runtimeAdapters["codex"];
+        if (!adapter?.buildResumeCommand || !adapter.verifyResumeInPane || !adapter.sendResumeCommand) {
+            return { ok: false, code: "runtime_adapter_missing", message: "The Codex runtime adapter with in-place resume is unavailable in this daemon." };
+        }
+        const activity = this.activityOracle?.getSeatState ? this.activityOracle : null;
+        return new CodexInPlaceRestart({
+            db: this.db, sessionRegistry: this.sessionRegistry, eventBus: this.eventBus, tmux: this.tmuxAdapter,
+            codex: adapter, activity, listProcesses: this.listProcesses,
+            io: this.inPlaceRestartIo, timing: this.inPlaceRestartTiming, daemonStartedAt: this.inPlaceRestartDaemonStartedAt,
+        });
+    }
+    /** The shared seat refusals, then the binding the relaunch is built from (the handover's posture rules). */
+    async inPlaceTarget(resolved, seatRef) {
+        const seat = this.describe(resolved);
+        const node = this.rigRepo.getRig(seat.rigId)?.nodes.find((candidate) => candidate.id === seat.nodeId);
+        if (!node)
+            return { ok: false, code: "seat_not_found", message: `Seat "${seatRef}" no longer exists.`, guidance: SEAT_LOOKUP_GUIDANCE };
+        if (node.runtime !== "codex") {
+            return { ok: false, code: "not_codex", message: `Seat "${seatRef}" runs ${node.runtime ?? "an unknown runtime"}; in-place restart supports Codex seats only.` };
+        }
+        const preference = this.tmuxAdapter.deliveryGuard?.preference(node.id);
+        if (preference?.effective || preference?.desired) {
+            return { ok: false, code: "typing_guard_enabled", message: "Typing protection blocks lifecycle operations for this seat; nothing was restarted." };
+        }
+        const session = this.latestSession(node.id);
+        if (!session || TERMINAL_SESSION_STATUSES.has(session.status)) {
+            return { ok: false, code: "no_session", message: `Seat "${seatRef}" has no live managed session to restart (checked: latest sessions row).` };
+        }
+        if (session.origin === "claimed") {
+            return { ok: false, code: "claimed_session", message: `Session "${session.session_name}" was adopted (origin=claimed), not launched by OpenRig; in-place restart refuses it.`,
+                guidance: "Release an adopted session with: rig unclaim" };
+        }
+        const probed = await this.probeLiveness(session.session_name, "in-place restart refuses rather than act on an unknown session");
+        if ("code" in probed)
+            return probed;
+        if (probed.state === "absent") {
+            return { ok: false, code: "session_not_live", message: `Session "${session.session_name}" is absent in tmux; there is nothing to restart in place.` };
+        }
+        const binding = this.sessionRegistry.getBindingForNode(node.id);
+        if (!binding?.tmuxSession || binding.tmuxSession !== session.session_name || !binding.tmuxPane) {
+            return { ok: false, code: "session_not_live", message: `Seat "${seatRef}" has no bound tmux pane for session "${session.session_name}".` };
+        }
+        let permissionOverride;
+        try {
+            permissionOverride = new NativePermissionStore(this.db).launchOverride(node.id, "codex");
+        }
+        catch (error) {
+            return { ok: false, code: "permission_selection_refused", message: `Permission selection: ${error.message}` };
+        }
+        const launchPosture = permissionOverride.launchPosture
+            ?? this.rigRepo.getNodePolicyProvenance(node.id)?.launchPosture
+            ?? this.rigRepo.getRigPolicyProvenance(seat.rigId)?.launchPosture
+            ?? "floor";
+        // OPR.0.7.0.7: an in-place restart is a managed continuation, so it relaunches with the seat's saved effort.
+        const savedEffort = resolveSeatEffort(node);
+        return {
+            seat, sessionId: session.id, sessionName: session.session_name,
+            saved: { model: node.model ?? null, effort: savedEffort.effective, codexConfigProfile: node.codexConfigProfile ?? null, effortSource: savedEffort.source },
+            binding: {
+                ...binding, cwd: node.cwd ?? ".",
+                ...(node.model ? { model: node.model } : {}),
+                ...(savedEffort.effective ? { effort: savedEffort.effective } : {}),
+                ...(node.codexConfigProfile ? { codexConfigProfile: node.codexConfigProfile } : {}),
+                launchPosture, kernelAuthority: permissionOverride.kernelAuthority, teamPermissionDefault: permissionOverride.teamPermissionDefault,
+                nonInterruptive: this.rigRepo.getRigNonInterruptive(seat.rigId),
+            },
+        };
+    }
     // -- shared internals --
-    async stopManagedTmuxSeat(resolved, session, reason, operator) {
+    async stopManagedTmuxSeat(resolved, session, reason, operator, recordStopIntent) {
         const seat = this.describe(resolved);
         const kill = await this.tmuxAdapter.killSession(session.session_name);
         if (kill && !kill.ok && kill.code !== "session_not_found") {
@@ -658,7 +1189,13 @@ export class SeatLifecycleService {
         }
         let persisted = null;
         const tx = this.db.transaction(() => {
-            this.sessionRegistry.updateStatus(session.id, "exited");
+            if (recordStopIntent && kill?.ok) {
+                this.sessionRegistry.markIntentionallyStopped(session.id);
+            }
+            else {
+                // An internal replacement stop or an unconfirmed kill must still affect health.
+                this.sessionRegistry.updateStatus(session.id, "exited");
+            }
             this.sessionRegistry.clearBinding(resolved.nodeId);
             persisted = this.eventBus.persistWithinTransaction({
                 type: "session.stopped",
@@ -903,7 +1440,7 @@ export class SeatLifecycleService {
         };
     }
     latestSession(nodeId) {
-        const row = this.db.prepare("SELECT id, session_name, status, origin FROM sessions WHERE node_id = ? ORDER BY id DESC LIMIT 1").get(nodeId);
+        const row = this.db.prepare(`SELECT id, session_name, status, origin, ${sessionCommunityHarnessSelect(this.db, "sessions")} AS community_harness FROM sessions WHERE node_id = ? ORDER BY id DESC LIMIT 1`).get(nodeId);
         return row ?? null;
     }
     /** The ONE resolution path, mirroring SeatStatusService.findMatches semantics
@@ -978,4 +1515,23 @@ function isOptionalOneOf(value, allowed) {
 function isStringArrayOf(value, allowed) {
     return Array.isArray(value) && value.every((entry) => isOneOf(entry, allowed));
 }
+/** One line naming where the four values agree, and where they can't be seen. */
+function effortSummary(saved, emitted, observed) {
+    const savedText = saved.effective ? `${saved.effective} (${saved.source === "seat_choice" ? "seat choice" : "authored"})` : "no flag (the runtime's own default)";
+    if (emitted.state !== "observed")
+        return `Saved: ${savedText}. Launch: unknown (${emitted.detail}) Native effort: NOT VERIFIED.`;
+    const launch = emitted.value ?? "no flag";
+    const launchNote = emitted.matchesSaved ? "" : " This differs from the saved value: it applies at the seat's next managed continuation.";
+    if (observed.state !== "observed")
+        return `Saved: ${savedText}. Launch sent: ${launch}.${launchNote} Native effort: NOT VERIFIED (${observed.detail})`;
+    const sent = observed.matchesEmitted === false
+        ? `${observed.value}, not the ${launch} the launch sent (changed or overridden inside the session)`
+        : observed.value;
+    const verdict = observed.outcome === "accepted" ? "accepted by the service for that turn"
+        : observed.outcome === "rejected" ? `REJECTED (${observed.detail})`
+            : observed.outcome === "failed" || observed.outcome === "interrupted" ? (observed.detail ?? "not judged").replace(/\.$/, "")
+                : observed.outcome === "pending" ? "its turn hasn't finished, so not yet known whether it was taken"
+                    : "applied level NOT VERIFIED (whether this is after any model fallback isn't shown)";
+    return `Saved: ${savedText}. Launch sent: ${launch}.${launchNote} The session sent ${sent} with its latest turn (${observed.source}, ${observed.at}): ${verdict}.`;
+}
 //# sourceMappingURL=seat-lifecycle-service.js.map